Merge branch 'release/1.16.0'

* feat(stack-details): add stack deploy prune option

* fix go fmt issues

* add changes proposed by reviewer

* refactor deployStack as suggested by codeclimate

.codeclimate.yml

@@ -12,7 +12,8 @@ engines:
     enabled: true
     config:
       languages:
-      - javascript
+        javascript:
+          mass_threshold: 80
   eslint:
     enabled: true
     config:

CODE_OF_CONDUCT.md

@@ -0,0 +1,46 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at anthony.lapenna@portainer.io. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [http://contributor-covenant.org/version/1/4][version]
+
+[homepage]: http://contributor-covenant.org
+[version]: http://contributor-covenant.org/version/1/4/

README.md

@@ -1,30 +1,39 @@
 
 <p align="center">
-  <img title="portainer" src='http://portainer.io/images/logo_alt.png' />
+  <img title="portainer" src='https://portainer.io/images/logo_alt.png' />
 </p>
 
 [![Docker Pulls](https://img.shields.io/docker/pulls/portainer/portainer.svg)](https://hub.docker.com/r/portainer/portainer/)
 [![Microbadger](https://images.microbadger.com/badges/image/portainer/portainer.svg)](http://microbadger.com/images/portainer/portainer "Image size")
 [![Documentation Status](https://readthedocs.org/projects/portainer/badge/?version=stable)](http://portainer.readthedocs.io/en/stable/?badge=stable)
 [![Codefresh build status]( https://g.codefresh.io/api/badges/build?repoOwner=portainer&repoName=portainer&branch=develop&pipelineName=portainer-ci&accountName=deviantony&type=cf-1)]( https://g.codefresh.io/repositories/portainer/portainer/builds?filter=trigger:build;branch:develop;service:5922a08a3a1aab000116fcc6~portainer-ci)
-[![Slack](http://portainer.io/slack/badge.svg)](http://portainer.io/slack/)
+[![Code Climate](https://codeclimate.com/github/portainer/portainer/badges/gpa.svg)](https://codeclimate.com/github/portainer/portainer)
+[![Slack](https://portainer.io/slack/badge.svg)](https://portainer.io/slack/)
 [![Gitter](https://badges.gitter.im/portainer/Lobby.svg)](https://gitter.im/portainer/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge)
 [![Donate](https://img.shields.io/badge/Donate-PayPal-green.svg)](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=YHXZJQNJQ36H6)
 
-**_Portainer_** is a lightweight management UI which allows you to **easily** manage your Docker host or Swarm cluster.
+**_Portainer_** is a lightweight management UI which allows you to **easily** manage your different Docker environments (Docker hosts or Swarm clusters).
 
-**_Portainer_** is meant to be as **simple** to deploy as it is to use. It consists of a single container that can run on any Docker engine (Docker for Linux and Docker for Windows are supported).
+**_Portainer_** is meant to be as **simple** to deploy as it is to use. It consists of a single container that can run on any Docker engine (can be deployed as Linux container or a Windows native container).
 
-**_Portainer_** allows you to manage your Docker containers, images, volumes, networks and more ! It is compatible with the *standalone Docker* engine and with *Docker Swarm*.
+**_Portainer_** allows you to manage your Docker containers, images, volumes, networks and more ! It is compatible with the *standalone Docker* engine and with *Docker Swarm mode*.
 
 ## Demo
 
-<img src="http://portainer.io/images/screenshots/portainer.gif" width="77%"/>
+<img src="https://portainer.io/images/screenshots/portainer.gif" width="77%"/>
 
 You can try out the public demo instance: http://demo.portainer.io/ (login with the username **admin** and the password **tryportainer**).
 
 Please note that the public demo cluster is **reset every 15min**.
 
+Alternatively, you can deploy a copy of the demo stack inside a [play-with-docker (PWD)](https://labs.play-with-docker.com) playground:
+
+- Browse [PWD/?stack=portainer-demo/play-with-docker/docker-stack.yml](http://play-with-docker.com/?stack=https://raw.githubusercontent.com/portainer/portainer-demo/master/play-with-docker/docker-stack.yml)
+- Sign in with your [Docker ID](https://docs.docker.com/docker-id)
+- Follow [these](https://github.com/portainer/portainer-demo/blob/master/play-with-docker/docker-stack.yml#L5-L8) steps.
+
+Unlike the public demo, the playground sessions are deleted after 4 hours. Apart from that, all the settings are same, including default credentials.
+
 ## Getting started
 
 * [Deploy Portainer](https://portainer.readthedocs.io/en/latest/deployment.html)
@@ -34,8 +43,8 @@ Please note that the public demo cluster is **reset every 15min**.
 
 * Issues: https://github.com/portainer/portainer/issues
 * FAQ: https://portainer.readthedocs.io/en/latest/faq.html
+* Slack (chat): https://portainer.io/slack/
 * Gitter (chat): https://gitter.im/portainer/Lobby
-* Slack: http://portainer.io/slack/
 
 ## Reporting bugs and contributing
 

api/bolt/datastore.go

@@ -23,6 +23,9 @@ type Store struct {
 	ResourceControlService *ResourceControlService
 	VersionService         *VersionService
 	SettingsService        *SettingsService
+	RegistryService        *RegistryService
+	DockerHubService       *DockerHubService
+	StackService           *StackService
 
 	db                    *bolt.DB
 	checkForDataMigration bool
@@ -37,6 +40,9 @@ const (
 	endpointBucketName        = "endpoints"
 	resourceControlBucketName = "resource_control"
 	settingsBucketName        = "settings"
+	registryBucketName        = "registries"
+	dockerhubBucketName       = "dockerhub"
+	stackBucketName           = "stacks"
 )
 
 // NewStore initializes a new Store and the associated services
@@ -50,6 +56,9 @@ func NewStore(storePath string) (*Store, error) {
 		ResourceControlService: &ResourceControlService{},
 		VersionService:         &VersionService{},
 		SettingsService:        &SettingsService{},
+		RegistryService:        &RegistryService{},
+		DockerHubService:       &DockerHubService{},
+		StackService:           &StackService{},
 	}
 	store.UserService.store = store
 	store.TeamService.store = store
@@ -58,6 +67,9 @@ func NewStore(storePath string) (*Store, error) {
 	store.ResourceControlService.store = store
 	store.VersionService.store = store
 	store.SettingsService.store = store
+	store.RegistryService.store = store
+	store.DockerHubService.store = store
+	store.StackService.store = store
 
 	_, err := os.Stat(storePath + "/" + databaseFileName)
 	if err != nil && os.IsNotExist(err) {
@@ -74,40 +86,26 @@ func NewStore(storePath string) (*Store, error) {
 // Open opens and initializes the BoltDB database.
 func (store *Store) Open() error {
 	path := store.Path + "/" + databaseFileName
+
 	db, err := bolt.Open(path, 0600, &bolt.Options{Timeout: 1 * time.Second})
 	if err != nil {
 		return err
 	}
 	store.db = db
+
+	bucketsToCreate := []string{versionBucketName, userBucketName, teamBucketName, endpointBucketName,
+		resourceControlBucketName, teamMembershipBucketName, settingsBucketName,
+		registryBucketName, dockerhubBucketName, stackBucketName}
+
 	return db.Update(func(tx *bolt.Tx) error {
-		_, err := tx.CreateBucketIfNotExists([]byte(versionBucketName))
-		if err != nil {
-			return err
-		}
-		_, err = tx.CreateBucketIfNotExists([]byte(userBucketName))
-		if err != nil {
-			return err
-		}
-		_, err = tx.CreateBucketIfNotExists([]byte(teamBucketName))
-		if err != nil {
-			return err
-		}
-		_, err = tx.CreateBucketIfNotExists([]byte(endpointBucketName))
-		if err != nil {
-			return err
-		}
-		_, err = tx.CreateBucketIfNotExists([]byte(resourceControlBucketName))
-		if err != nil {
-			return err
-		}
-		_, err = tx.CreateBucketIfNotExists([]byte(teamMembershipBucketName))
-		if err != nil {
-			return err
-		}
-		_, err = tx.CreateBucketIfNotExists([]byte(settingsBucketName))
-		if err != nil {
-			return err
+
+		for _, bucket := range bucketsToCreate {
+			_, err := tx.CreateBucketIfNotExists([]byte(bucket))
+			if err != nil {
+				return err
+			}
 		}
+
 		return nil
 	})
 }

api/bolt/dockerhub_service.go

@@ -0,0 +1,61 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// DockerHubService represents a service for managing registries.
+type DockerHubService struct {
+	store *Store
+}
+
+const (
+	dbDockerHubKey = "DOCKERHUB"
+)
+
+// DockerHub returns the DockerHub object.
+func (service *DockerHubService) DockerHub() (*portainer.DockerHub, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(dockerhubBucketName))
+		value := bucket.Get([]byte(dbDockerHubKey))
+		if value == nil {
+			return portainer.ErrDockerHubNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var dockerhub portainer.DockerHub
+	err = internal.UnmarshalDockerHub(data, &dockerhub)
+	if err != nil {
+		return nil, err
+	}
+	return &dockerhub, nil
+}
+
+// StoreDockerHub persists a DockerHub object.
+func (service *DockerHubService) StoreDockerHub(dockerhub *portainer.DockerHub) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(dockerhubBucketName))
+
+		data, err := internal.MarshalDockerHub(dockerhub)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put([]byte(dbDockerHubKey), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}

api/bolt/endpoint_service.go

@@ -7,7 +7,7 @@ import (
 	"github.com/boltdb/bolt"
 )
 
-// EndpointService represents a service for managing users.
+// EndpointService represents a service for managing endpoints.
 type EndpointService struct {
 	store *Store
 }

api/bolt/internal/internal.go

@@ -47,6 +47,26 @@ func UnmarshalEndpoint(data []byte, endpoint *portainer.Endpoint) error {
 	return json.Unmarshal(data, endpoint)
 }
 
+// MarshalStack encodes a stack to binary format.
+func MarshalStack(stack *portainer.Stack) ([]byte, error) {
+	return json.Marshal(stack)
+}
+
+// UnmarshalStack decodes a stack from a binary data.
+func UnmarshalStack(data []byte, stack *portainer.Stack) error {
+	return json.Unmarshal(data, stack)
+}
+
+// MarshalRegistry encodes a registry to binary format.
+func MarshalRegistry(registry *portainer.Registry) ([]byte, error) {
+	return json.Marshal(registry)
+}
+
+// UnmarshalRegistry decodes a registry from a binary data.
+func UnmarshalRegistry(data []byte, registry *portainer.Registry) error {
+	return json.Unmarshal(data, registry)
+}
+
 // MarshalResourceControl encodes a resource control object to binary format.
 func MarshalResourceControl(rc *portainer.ResourceControl) ([]byte, error) {
 	return json.Marshal(rc)
@@ -67,6 +87,16 @@ func UnmarshalSettings(data []byte, settings *portainer.Settings) error {
 	return json.Unmarshal(data, settings)
 }
 
+// MarshalDockerHub encodes a Dockerhub object to binary format.
+func MarshalDockerHub(settings *portainer.DockerHub) ([]byte, error) {
+	return json.Marshal(settings)
+}
+
+// UnmarshalDockerHub decodes a Dockerhub object from a binary data.
+func UnmarshalDockerHub(data []byte, settings *portainer.DockerHub) error {
+	return json.Unmarshal(data, settings)
+}
+
 // Itob returns an 8-byte big endian representation of v.
 // This function is typically used for encoding integer IDs to byte slices
 // so that they can be used as BoltDB keys.

api/bolt/migrate_dbversion2.go

@@ -0,0 +1,25 @@
+package bolt
+
+import "github.com/portainer/portainer"
+
+func (m *Migrator) updateSettingsToDBVersion3() error {
+	legacySettings, err := m.SettingsService.Settings()
+	if err != nil {
+		return err
+	}
+
+	legacySettings.AuthenticationMethod = portainer.AuthenticationInternal
+	legacySettings.LDAPSettings = portainer.LDAPSettings{
+		TLSConfig: portainer.TLSConfiguration{},
+		SearchSettings: []portainer.LDAPSearchSettings{
+			portainer.LDAPSearchSettings{},
+		},
+	}
+
+	err = m.SettingsService.StoreSettings(legacySettings)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

api/bolt/migrate_dbversion3.go

@@ -0,0 +1,27 @@
+package bolt
+
+import "github.com/portainer/portainer"
+
+func (m *Migrator) updateEndpointsToDBVersion4() error {
+	legacyEndpoints, err := m.EndpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, endpoint := range legacyEndpoints {
+		endpoint.TLSConfig = portainer.TLSConfiguration{}
+		if endpoint.TLS {
+			endpoint.TLSConfig.TLS = true
+			endpoint.TLSConfig.TLSSkipVerify = false
+			endpoint.TLSConfig.TLSCACertPath = endpoint.TLSCACertPath
+			endpoint.TLSConfig.TLSCertPath = endpoint.TLSCertPath
+			endpoint.TLSConfig.TLSKeyPath = endpoint.TLSKeyPath
+		}
+		err = m.EndpointService.UpdateEndpoint(endpoint.ID, &endpoint)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}

api/bolt/migrate_dbversion4.go

@@ -0,0 +1,16 @@
+package bolt
+
+func (m *Migrator) updateSettingsToVersion5() error {
+	legacySettings, err := m.SettingsService.Settings()
+	if err != nil {
+		return err
+	}
+	legacySettings.AllowBindMountsForRegularUsers = true
+
+	err = m.SettingsService.StoreSettings(legacySettings)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

api/bolt/migrate_dbversion5.go

@@ -0,0 +1,16 @@
+package bolt
+
+func (m *Migrator) updateSettingsToVersion6() error {
+	legacySettings, err := m.SettingsService.Settings()
+	if err != nil {
+		return err
+	}
+	legacySettings.AllowPrivilegedModeForRegularUsers = true
+
+	err = m.SettingsService.StoreSettings(legacySettings)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

api/bolt/migrate_dbversion6.go

@@ -0,0 +1,16 @@
+package bolt
+
+func (m *Migrator) updateSettingsToVersion7() error {
+	legacySettings, err := m.SettingsService.Settings()
+	if err != nil {
+		return err
+	}
+	legacySettings.DisplayDonationHeader = true
+
+	err = m.SettingsService.StoreSettings(legacySettings)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

api/bolt/migrator.go

@@ -7,6 +7,7 @@ type Migrator struct {
 	UserService            *UserService
 	EndpointService        *EndpointService
 	ResourceControlService *ResourceControlService
+	SettingsService        *SettingsService
 	VersionService         *VersionService
 	CurrentDBVersion       int
 	store                  *Store
@@ -18,6 +19,7 @@ func NewMigrator(store *Store, version int) *Migrator {
 		UserService:            store.UserService,
 		EndpointService:        store.EndpointService,
 		ResourceControlService: store.ResourceControlService,
+		SettingsService:        store.SettingsService,
 		VersionService:         store.VersionService,
 		CurrentDBVersion:       version,
 		store:                  store,
@@ -28,7 +30,7 @@ func NewMigrator(store *Store, version int) *Migrator {
 func (m *Migrator) Migrate() error {
 
 	// Portainer < 1.12
-	if m.CurrentDBVersion == 0 {
+	if m.CurrentDBVersion < 1 {
 		err := m.updateAdminUserToDBVersion1()
 		if err != nil {
 			return err
@@ -36,7 +38,7 @@ func (m *Migrator) Migrate() error {
 	}
 
 	// Portainer 1.12.x
-	if m.CurrentDBVersion == 1 {
+	if m.CurrentDBVersion < 2 {
 		err := m.updateResourceControlsToDBVersion2()
 		if err != nil {
 			return err
@@ -47,6 +49,46 @@ func (m *Migrator) Migrate() error {
 		}
 	}
 
+	// Portainer 1.13.x
+	if m.CurrentDBVersion < 3 {
+		err := m.updateSettingsToDBVersion3()
+		if err != nil {
+			return err
+		}
+	}
+
+	// Portainer 1.14.0
+	if m.CurrentDBVersion < 4 {
+		err := m.updateEndpointsToDBVersion4()
+		if err != nil {
+			return err
+		}
+	}
+
+	// https://github.com/portainer/portainer/issues/1235
+	if m.CurrentDBVersion < 5 {
+		err := m.updateSettingsToVersion5()
+		if err != nil {
+			return err
+		}
+	}
+
+	// https://github.com/portainer/portainer/issues/1236
+	if m.CurrentDBVersion < 6 {
+		err := m.updateSettingsToVersion6()
+		if err != nil {
+			return err
+		}
+	}
+
+	// https://github.com/portainer/portainer/issues/1449
+	if m.CurrentDBVersion < 7 {
+		err := m.updateSettingsToVersion7()
+		if err != nil {
+			return err
+		}
+	}
+
 	err := m.VersionService.StoreDBVersion(portainer.DBVersion)
 	if err != nil {
 		return err

api/bolt/registry_service.go

@@ -0,0 +1,114 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// RegistryService represents a service for managing registries.
+type RegistryService struct {
+	store *Store
+}
+
+// Registry returns an registry by ID.
+func (service *RegistryService) Registry(ID portainer.RegistryID) (*portainer.Registry, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(registryBucketName))
+		value := bucket.Get(internal.Itob(int(ID)))
+		if value == nil {
+			return portainer.ErrRegistryNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var registry portainer.Registry
+	err = internal.UnmarshalRegistry(data, &registry)
+	if err != nil {
+		return nil, err
+	}
+	return &registry, nil
+}
+
+// Registries returns an array containing all the registries.
+func (service *RegistryService) Registries() ([]portainer.Registry, error) {
+	var registries = make([]portainer.Registry, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(registryBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var registry portainer.Registry
+			err := internal.UnmarshalRegistry(v, &registry)
+			if err != nil {
+				return err
+			}
+			registries = append(registries, registry)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return registries, nil
+}
+
+// CreateRegistry creates a new registry.
+func (service *RegistryService) CreateRegistry(registry *portainer.Registry) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(registryBucketName))
+
+		id, _ := bucket.NextSequence()
+		registry.ID = portainer.RegistryID(id)
+
+		data, err := internal.MarshalRegistry(registry)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put(internal.Itob(int(registry.ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// UpdateRegistry updates an registry.
+func (service *RegistryService) UpdateRegistry(ID portainer.RegistryID, registry *portainer.Registry) error {
+	data, err := internal.MarshalRegistry(registry)
+	if err != nil {
+		return err
+	}
+
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(registryBucketName))
+		err = bucket.Put(internal.Itob(int(ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteRegistry deletes an registry.
+func (service *RegistryService) DeleteRegistry(ID portainer.RegistryID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(registryBucketName))
+		err := bucket.Delete(internal.Itob(int(ID)))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}

api/bolt/stack_service.go

@@ -0,0 +1,138 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// StackService represents a service for managing stacks.
+type StackService struct {
+	store *Store
+}
+
+// Stack returns a stack object by ID.
+func (service *StackService) Stack(ID portainer.StackID) (*portainer.Stack, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(stackBucketName))
+		value := bucket.Get([]byte(ID))
+		if value == nil {
+			return portainer.ErrStackNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var stack portainer.Stack
+	err = internal.UnmarshalStack(data, &stack)
+	if err != nil {
+		return nil, err
+	}
+	return &stack, nil
+}
+
+// Stacks returns an array containing all the stacks.
+func (service *StackService) Stacks() ([]portainer.Stack, error) {
+	var stacks = make([]portainer.Stack, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(stackBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var stack portainer.Stack
+			err := internal.UnmarshalStack(v, &stack)
+			if err != nil {
+				return err
+			}
+			stacks = append(stacks, stack)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return stacks, nil
+}
+
+// StacksBySwarmID return an array containing all the stacks related to the specified Swarm ID.
+func (service *StackService) StacksBySwarmID(id string) ([]portainer.Stack, error) {
+	var stacks = make([]portainer.Stack, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(stackBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var stack portainer.Stack
+			err := internal.UnmarshalStack(v, &stack)
+			if err != nil {
+				return err
+			}
+			if stack.SwarmID == id {
+				stacks = append(stacks, stack)
+			}
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return stacks, nil
+}
+
+// CreateStack creates a new stack.
+func (service *StackService) CreateStack(stack *portainer.Stack) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(stackBucketName))
+
+		data, err := internal.MarshalStack(stack)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put([]byte(stack.ID), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// UpdateStack updates an stack.
+func (service *StackService) UpdateStack(ID portainer.StackID, stack *portainer.Stack) error {
+	data, err := internal.MarshalStack(stack)
+	if err != nil {
+		return err
+	}
+
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(stackBucketName))
+		err = bucket.Put([]byte(ID), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteStack deletes an stack.
+func (service *StackService) DeleteStack(ID portainer.StackID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(stackBucketName))
+		err := bucket.Delete([]byte(ID))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}

api/cli/cli.go

@@ -7,6 +7,7 @@ import (
 	"github.com/portainer/portainer"
 
 	"os"
+	"path/filepath"
 	"strings"
 
 	"gopkg.in/alecthomas/kingpin.v2"
@@ -16,12 +17,13 @@ import (
 type Service struct{}
 
 const (
-	errInvalidEndpointProtocol    = portainer.Error("Invalid endpoint protocol: Portainer only supports unix:// or tcp://")
-	errSocketNotFound             = portainer.Error("Unable to locate Unix socket")
-	errEndpointsFileNotFound      = portainer.Error("Unable to locate external endpoints file")
-	errInvalidSyncInterval        = portainer.Error("Invalid synchronization interval")
-	errEndpointExcludeExternal    = portainer.Error("Cannot use the -H flag mutually with --external-endpoints")
-	errNoAuthExcludeAdminPassword = portainer.Error("Cannot use --no-auth with --admin-password")
+	errInvalidEndpointProtocol       = portainer.Error("Invalid endpoint protocol: Portainer only supports unix:// or tcp://")
+	errSocketNotFound                = portainer.Error("Unable to locate Unix socket")
+	errEndpointsFileNotFound         = portainer.Error("Unable to locate external endpoints file")
+	errInvalidSyncInterval           = portainer.Error("Invalid synchronization interval")
+	errEndpointExcludeExternal       = portainer.Error("Cannot use the -H flag mutually with --external-endpoints")
+	errNoAuthExcludeAdminPassword    = portainer.Error("Cannot use --no-auth with --admin-password or --admin-password-file")
+	errAdminPassExcludeAdminPassFile = portainer.Error("Cannot use --admin-password with --admin-password-file")
 )
 
 // ParseFlags parse the CLI flags and return a portainer.Flags struct
@@ -29,14 +31,14 @@ func (*Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
 	kingpin.Version(version)
 
 	flags := &portainer.CLIFlags{
-		Endpoint:          kingpin.Flag("host", "Dockerd endpoint").Short('H').String(),
-		ExternalEndpoints: kingpin.Flag("external-endpoints", "Path to a file defining available endpoints").String(),
-		SyncInterval:      kingpin.Flag("sync-interval", "Duration between each synchronization via the external endpoints source").Default(defaultSyncInterval).String(),
 		Addr:              kingpin.Flag("bind", "Address and port to serve Portainer").Default(defaultBindAddress).Short('p').String(),
 		Assets:            kingpin.Flag("assets", "Path to the assets").Default(defaultAssetsDirectory).Short('a').String(),
+		CheckHealth:       kingpin.Flag("check-health", "GET http://localhost:<port>/api/health endpoint").Default(defaultCheckHealth).Short('c').Bool(),
 		Data:              kingpin.Flag("data", "Path to the folder where the data is stored").Default(defaultDataDirectory).Short('d').String(),
+		Endpoint:          kingpin.Flag("host", "Dockerd endpoint").Short('H').String(),
+		ExternalEndpoints: kingpin.Flag("external-endpoints", "Path to a file defining available endpoints").String(),
 		NoAuth:            kingpin.Flag("no-auth", "Disable authentication").Default(defaultNoAuth).Bool(),
-		NoAnalytics:       kingpin.Flag("no-analytics", "Disable Analytics in app").Default(defaultNoAuth).Bool(),
+		NoAnalytics:       kingpin.Flag("no-analytics", "Disable Analytics in app").Default(defaultNoAnalytics).Bool(),
 		TLSVerify:         kingpin.Flag("tlsverify", "TLS support").Default(defaultTLSVerify).Bool(),
 		TLSCacert:         kingpin.Flag("tlscacert", "Path to the CA").Default(defaultTLSCACertPath).String(),
 		TLSCert:           kingpin.Flag("tlscert", "Path to the TLS certificate file").Default(defaultTLSCertPath).String(),
@@ -44,7 +46,9 @@ func (*Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
 		SSL:               kingpin.Flag("ssl", "Secure Portainer instance using SSL").Default(defaultSSL).Bool(),
 		SSLCert:           kingpin.Flag("sslcert", "Path to the SSL certificate used to secure the Portainer instance").Default(defaultSSLCertPath).String(),
 		SSLKey:            kingpin.Flag("sslkey", "Path to the SSL key used to secure the Portainer instance").Default(defaultSSLKeyPath).String(),
+		SyncInterval:      kingpin.Flag("sync-interval", "Duration between each synchronization via the external endpoints source").Default(defaultSyncInterval).String(),
 		AdminPassword:     kingpin.Flag("admin-password", "Hashed admin password").String(),
+		AdminPasswordFile: kingpin.Flag("admin-password-file", "Path to the file containing the password for the admin user").String(),
 		// Deprecated flags
 		Labels:    pairs(kingpin.Flag("hide-label", "Hide containers with a specific label in the UI").Short('l')),
 		Logo:      kingpin.Flag("logo", "URL for the logo displayed in the UI").String(),
@@ -52,6 +56,15 @@ func (*Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
 	}
 
 	kingpin.Parse()
+
+	if !filepath.IsAbs(*flags.Assets) {
+		ex, err := os.Executable()
+		if err != nil {
+			panic(err)
+		}
+		*flags.Assets = filepath.Join(filepath.Dir(ex), *flags.Assets)
+	}
+
 	return flags, nil
 }
 
@@ -77,10 +90,14 @@ func (*Service) ValidateFlags(flags *portainer.CLIFlags) error {
 		return err
 	}
 
-	if *flags.NoAuth && (*flags.AdminPassword != "") {
+	if *flags.NoAuth && (*flags.AdminPassword != "" || *flags.AdminPasswordFile != "") {
 		return errNoAuthExcludeAdminPassword
 	}
 
+	if *flags.AdminPassword != "" && *flags.AdminPasswordFile != "" {
+		return errAdminPassExcludeAdminPassFile
+	}
+
 	displayDeprecationWarnings(*flags.Templates, *flags.Logo, *flags.Labels)
 
 	return nil

api/cli/defaults.go

@@ -5,7 +5,8 @@ package cli
 const (
 	defaultBindAddress     = ":9000"
 	defaultDataDirectory   = "/data"
-	defaultAssetsDirectory = "."
+	defaultAssetsDirectory = "./"
+	defaultCheckHealth     = "false"
 	defaultNoAuth          = "false"
 	defaultNoAnalytics     = "false"
 	defaultTLSVerify       = "false"

api/cli/defaults_windows.go

@@ -3,7 +3,8 @@ package cli
 const (
 	defaultBindAddress     = ":9000"
 	defaultDataDirectory   = "C:\\data"
-	defaultAssetsDirectory = "."
+	defaultAssetsDirectory = "./"
+	defaultCheckHealth     = "false"
 	defaultNoAuth          = "false"
 	defaultNoAnalytics     = "false"
 	defaultTLSVerify       = "false"

api/cmd/portainer/main.go

@@ -6,11 +6,15 @@ import (
 	"github.com/portainer/portainer/cli"
 	"github.com/portainer/portainer/cron"
 	"github.com/portainer/portainer/crypto"
-	"github.com/portainer/portainer/file"
+	"github.com/portainer/portainer/exec"
+	"github.com/portainer/portainer/filesystem"
+	"github.com/portainer/portainer/git"
 	"github.com/portainer/portainer/http"
 	"github.com/portainer/portainer/jwt"
+	"github.com/portainer/portainer/ldap"
 
 	"log"
+	"os"
 )
 
 func initCLI() *portainer.CLIFlags {
@@ -28,7 +32,7 @@ func initCLI() *portainer.CLIFlags {
 }
 
 func initFileService(dataStorePath string) portainer.FileService {
-	fileService, err := file.NewService(dataStorePath, "")
+	fileService, err := filesystem.NewService(dataStorePath, "")
 	if err != nil {
 		log.Fatal(err)
 	}
@@ -53,6 +57,10 @@ func initStore(dataStorePath string) *bolt.Store {
 	return store
 }
 
+func initStackManager(assetsPath string) portainer.StackManager {
+	return exec.NewStackManager(assetsPath)
+}
+
 func initJWTService(authenticationEnabled bool) portainer.JWTService {
 	if authenticationEnabled {
 		jwtService, err := jwt.NewService()
@@ -68,6 +76,14 @@ func initCryptoService() portainer.CryptoService {
 	return &crypto.Service{}
 }
 
+func initLDAPService() portainer.LDAPService {
+	return &ldap.Service{}
+}
+
+func initGitService() portainer.GitService {
+	return &git.Service{}
+}
+
 func initEndpointWatcher(endpointService portainer.EndpointService, externalEnpointFile string, syncInterval string) bool {
 	authorizeEndpointMgmt := true
 	if externalEnpointFile != "" {
@@ -91,12 +107,38 @@ func initStatus(authorizeEndpointMgmt bool, flags *portainer.CLIFlags) *portaine
 	}
 }
 
+func initDockerHub(dockerHubService portainer.DockerHubService) error {
+	_, err := dockerHubService.DockerHub()
+	if err == portainer.ErrDockerHubNotFound {
+		dockerhub := &portainer.DockerHub{
+			Authentication: false,
+			Username:       "",
+			Password:       "",
+		}
+		return dockerHubService.StoreDockerHub(dockerhub)
+	} else if err != nil {
+		return err
+	}
+
+	return nil
+}
+
 func initSettings(settingsService portainer.SettingsService, flags *portainer.CLIFlags) error {
 	_, err := settingsService.Settings()
 	if err == portainer.ErrSettingsNotFound {
 		settings := &portainer.Settings{
 			LogoURL:                     *flags.Logo,
-			DisplayExternalContributors: true,
+			DisplayDonationHeader:       true,
+			DisplayExternalContributors: false,
+			AuthenticationMethod:        portainer.AuthenticationInternal,
+			LDAPSettings: portainer.LDAPSettings{
+				TLSConfig: portainer.TLSConfiguration{},
+				SearchSettings: []portainer.LDAPSearchSettings{
+					portainer.LDAPSearchSettings{},
+				},
+			},
+			AllowBindMountsForRegularUsers:     true,
+			AllowPrivilegedModeForRegularUsers: true,
 		}
 
 		if *flags.Templates != "" {
@@ -130,15 +172,34 @@ func retrieveFirstEndpointFromDatabase(endpointService portainer.EndpointService
 func main() {
 	flags := initCLI()
 
+	if *flags.CheckHealth {
+		statuscode, err := http.HealthCheck(*flags.Addr)
+		if err == nil {
+			if statuscode == 200 {
+				log.Println(*flags.Addr, ": Online - response:", statuscode)
+				os.Exit(0)
+			} else {
+				log.Fatal(*flags.Addr, ": Error - response:", statuscode)
+			}
+		}
+		log.Fatal("Connection error:", err.Error())
+	}
+
 	fileService := initFileService(*flags.Data)
 
 	store := initStore(*flags.Data)
 	defer store.Close()
 
+	stackManager := initStackManager(*flags.Assets)
+
 	jwtService := initJWTService(!*flags.NoAuth)
 
 	cryptoService := initCryptoService()
 
+	ldapService := initLDAPService()
+
+	gitService := initGitService()
+
 	authorizeEndpointMgmt := initEndpointWatcher(store.EndpointService, *flags.ExternalEndpoints, *flags.SyncInterval)
 
 	err := initSettings(store.SettingsService, flags)
@@ -146,22 +207,29 @@ func main() {
 		log.Fatal(err)
 	}
 
+	err = initDockerHub(store.DockerHubService)
+	if err != nil {
+		log.Fatal(err)
+	}
+
 	applicationStatus := initStatus(authorizeEndpointMgmt, flags)
 
 	if *flags.Endpoint != "" {
-		var endpoints []portainer.Endpoint
 		endpoints, err := store.EndpointService.Endpoints()
 		if err != nil {
 			log.Fatal(err)
 		}
 		if len(endpoints) == 0 {
 			endpoint := &portainer.Endpoint{
-				Name:            "primary",
-				URL:             *flags.Endpoint,
-				TLS:             *flags.TLSVerify,
-				TLSCACertPath:   *flags.TLSCacert,
-				TLSCertPath:     *flags.TLSCert,
-				TLSKeyPath:      *flags.TLSKey,
+				Name: "primary",
+				URL:  *flags.Endpoint,
+				TLSConfig: portainer.TLSConfiguration{
+					TLS:           *flags.TLSVerify,
+					TLSSkipVerify: false,
+					TLSCACertPath: *flags.TLSCacert,
+					TLSCertPath:   *flags.TLSCert,
+					TLSKeyPath:    *flags.TLSKey,
+				},
 				AuthorizedUsers: []portainer.UserID{},
 				AuthorizedTeams: []portainer.TeamID{},
 			}
@@ -174,17 +242,40 @@ func main() {
 		}
 	}
 
-	if *flags.AdminPassword != "" {
-		log.Printf("Creating admin user with password hash %s", *flags.AdminPassword)
-		user := &portainer.User{
-			Username: "admin",
-			Role:     portainer.AdministratorRole,
-			Password: *flags.AdminPassword,
-		}
-		err := store.UserService.CreateUser(user)
+	adminPasswordHash := ""
+	if *flags.AdminPasswordFile != "" {
+		content, err := fileService.GetFileContent(*flags.AdminPasswordFile)
 		if err != nil {
 			log.Fatal(err)
 		}
+		adminPasswordHash, err = cryptoService.Hash(content)
+		if err != nil {
+			log.Fatal(err)
+		}
+	} else if *flags.AdminPassword != "" {
+		adminPasswordHash = *flags.AdminPassword
+	}
+
+	if adminPasswordHash != "" {
+		users, err := store.UserService.UsersByRole(portainer.AdministratorRole)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		if len(users) == 0 {
+			log.Printf("Creating admin user with password hash %s", adminPasswordHash)
+			user := &portainer.User{
+				Username: "admin",
+				Role:     portainer.AdministratorRole,
+				Password: adminPasswordHash,
+			}
+			err := store.UserService.CreateUser(user)
+			if err != nil {
+				log.Fatal(err)
+			}
+		} else {
+			log.Println("Instance already has an administrator user defined. Skipping admin password related flags.")
+		}
 	}
 
 	var server portainer.Server = &http.Server{
@@ -199,15 +290,21 @@ func main() {
 		EndpointService:        store.EndpointService,
 		ResourceControlService: store.ResourceControlService,
 		SettingsService:        store.SettingsService,
+		RegistryService:        store.RegistryService,
+		DockerHubService:       store.DockerHubService,
+		StackService:           store.StackService,
+		StackManager:           stackManager,
 		CryptoService:          cryptoService,
 		JWTService:             jwtService,
 		FileService:            fileService,
+		LDAPService:            ldapService,
+		GitService:             gitService,
 		SSL:                    *flags.SSL,
 		SSLCert:                *flags.SSLCert,
 		SSLKey:                 *flags.SSLKey,
 	}
 
-	log.Printf("Starting Portainer on %s", *flags.Addr)
+	log.Printf("Starting Portainer %s on %s", portainer.APIVersion, *flags.Addr)
 	err = server.Start()
 	if err != nil {
 		log.Fatal(err)

api/cron/endpoint_sync.go

@@ -22,6 +22,16 @@ type (
 		endpointsToUpdate []*portainer.Endpoint
 		endpointsToDelete []*portainer.Endpoint
 	}
+
+	fileEndpoint struct {
+		Name          string `json:"Name"`
+		URL           string `json:"URL"`
+		TLS           bool   `json:"TLS,omitempty"`
+		TLSSkipVerify bool   `json:"TLSSkipVerify,omitempty"`
+		TLSCACert     string `json:"TLSCACert,omitempty"`
+		TLSCert       string `json:"TLSCert,omitempty"`
+		TLSKey        string `json:"TLSKey,omitempty"`
+	}
 )
 
 const (
@@ -55,6 +65,28 @@ func isValidEndpoint(endpoint *portainer.Endpoint) bool {
 	return false
 }
 
+func convertFileEndpoints(fileEndpoints []fileEndpoint) []portainer.Endpoint {
+	convertedEndpoints := make([]portainer.Endpoint, 0)
+
+	for _, e := range fileEndpoints {
+		endpoint := portainer.Endpoint{
+			Name:      e.Name,
+			URL:       e.URL,
+			TLSConfig: portainer.TLSConfiguration{},
+		}
+		if e.TLS {
+			endpoint.TLSConfig.TLS = true
+			endpoint.TLSConfig.TLSSkipVerify = e.TLSSkipVerify
+			endpoint.TLSConfig.TLSCACertPath = e.TLSCACert
+			endpoint.TLSConfig.TLSCertPath = e.TLSCert
+			endpoint.TLSConfig.TLSKeyPath = e.TLSKey
+		}
+		convertedEndpoints = append(convertedEndpoints, endpoint)
+	}
+
+	return convertedEndpoints
+}
+
 func endpointExists(endpoint *portainer.Endpoint, endpoints []portainer.Endpoint) int {
 	for idx, v := range endpoints {
 		if endpoint.Name == v.Name && isValidEndpoint(&v) {
@@ -66,22 +98,25 @@ func endpointExists(endpoint *portainer.Endpoint, endpoints []portainer.Endpoint
 
 func mergeEndpointIfRequired(original, updated *portainer.Endpoint) *portainer.Endpoint {
 	var endpoint *portainer.Endpoint
-	if original.URL != updated.URL || original.TLS != updated.TLS ||
-		(updated.TLS && original.TLSCACertPath != updated.TLSCACertPath) ||
-		(updated.TLS && original.TLSCertPath != updated.TLSCertPath) ||
-		(updated.TLS && original.TLSKeyPath != updated.TLSKeyPath) {
+	if original.URL != updated.URL || original.TLSConfig.TLS != updated.TLSConfig.TLS ||
+		(updated.TLSConfig.TLS && original.TLSConfig.TLSSkipVerify != updated.TLSConfig.TLSSkipVerify) ||
+		(updated.TLSConfig.TLS && original.TLSConfig.TLSCACertPath != updated.TLSConfig.TLSCACertPath) ||
+		(updated.TLSConfig.TLS && original.TLSConfig.TLSCertPath != updated.TLSConfig.TLSCertPath) ||
+		(updated.TLSConfig.TLS && original.TLSConfig.TLSKeyPath != updated.TLSConfig.TLSKeyPath) {
 		endpoint = original
 		endpoint.URL = updated.URL
-		if updated.TLS {
-			endpoint.TLS = true
-			endpoint.TLSCACertPath = updated.TLSCACertPath
-			endpoint.TLSCertPath = updated.TLSCertPath
-			endpoint.TLSKeyPath = updated.TLSKeyPath
+		if updated.TLSConfig.TLS {
+			endpoint.TLSConfig.TLS = true
+			endpoint.TLSConfig.TLSSkipVerify = updated.TLSConfig.TLSSkipVerify
+			endpoint.TLSConfig.TLSCACertPath = updated.TLSConfig.TLSCACertPath
+			endpoint.TLSConfig.TLSCertPath = updated.TLSConfig.TLSCertPath
+			endpoint.TLSConfig.TLSKeyPath = updated.TLSConfig.TLSKeyPath
 		} else {
-			endpoint.TLS = false
-			endpoint.TLSCACertPath = ""
-			endpoint.TLSCertPath = ""
-			endpoint.TLSKeyPath = ""
+			endpoint.TLSConfig.TLS = false
+			endpoint.TLSConfig.TLSSkipVerify = false
+			endpoint.TLSConfig.TLSCACertPath = ""
+			endpoint.TLSConfig.TLSCertPath = ""
+			endpoint.TLSConfig.TLSKeyPath = ""
 		}
 	}
 	return endpoint
@@ -117,7 +152,7 @@ func (job endpointSyncJob) prepareSyncData(storedEndpoints, fileEndpoints []port
 	}
 
 	for idx, endpoint := range fileEndpoints {
-		if endpoint.Name == "" || endpoint.URL == "" {
+		if !isValidEndpoint(&endpoint) {
 			job.logger.Printf("Invalid file endpoint definition, skipping. [name: %v] [url: %v]", endpoint.Name, endpoint.URL)
 			continue
 		}
@@ -141,7 +176,7 @@ func (job endpointSyncJob) Sync() error {
 		return err
 	}
 
-	var fileEndpoints []portainer.Endpoint
+	var fileEndpoints []fileEndpoint
 	err = json.Unmarshal(data, &fileEndpoints)
 	if endpointSyncError(err, job.logger) {
 		return err
@@ -156,7 +191,9 @@ func (job endpointSyncJob) Sync() error {
 		return err
 	}
 
-	sync := job.prepareSyncData(storedEndpoints, fileEndpoints)
+	convertedFileEndpoints := convertFileEndpoints(fileEndpoints)
+
+	sync := job.prepareSyncData(storedEndpoints, convertedFileEndpoints)
 	if sync.requireSync() {
 		err = job.endpointService.Synchronize(sync.endpointsToCreate, sync.endpointsToUpdate, sync.endpointsToDelete)
 		if endpointSyncError(err, job.logger) {

api/crypto/tls.go

@@ -4,23 +4,36 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"io/ioutil"
+
+	"github.com/portainer/portainer"
 )
 
 // CreateTLSConfiguration initializes a tls.Config using a CA certificate, a certificate and a key
-func CreateTLSConfiguration(caCertPath, certPath, keyPath string) (*tls.Config, error) {
-	cert, err := tls.LoadX509KeyPair(certPath, keyPath)
-	if err != nil {
-		return nil, err
+func CreateTLSConfiguration(config *portainer.TLSConfiguration) (*tls.Config, error) {
+	TLSConfig := &tls.Config{}
+
+	if config.TLSCertPath != "" && config.TLSKeyPath != "" {
+		cert, err := tls.LoadX509KeyPair(config.TLSCertPath, config.TLSKeyPath)
+		if err != nil {
+			return nil, err
+		}
+
+		TLSConfig.Certificates = []tls.Certificate{cert}
 	}
-	caCert, err := ioutil.ReadFile(caCertPath)
-	if err != nil {
-		return nil, err
+
+	if !config.TLSSkipVerify {
+		caCert, err := ioutil.ReadFile(config.TLSCACertPath)
+		if err != nil {
+			return nil, err
+		}
+
+		caCertPool := x509.NewCertPool()
+		caCertPool.AppendCertsFromPEM(caCert)
+
+		TLSConfig.RootCAs = caCertPool
 	}
-	caCertPool := x509.NewCertPool()
-	caCertPool.AppendCertsFromPEM(caCert)
-	config := &tls.Config{
-		Certificates: []tls.Certificate{cert},
-		RootCAs:      caCertPool,
-	}
-	return config, nil
+
+	TLSConfig.InsecureSkipVerify = config.TLSSkipVerify
+
+	return TLSConfig, nil
 }

api/errors.go

@@ -13,8 +13,10 @@ const (
 const (
 	ErrUserNotFound            = Error("User not found")
 	ErrUserAlreadyExists       = Error("User already exists")
-	ErrInvalidUsername         = Error("Invalid username. White spaces are not allowed.")
-	ErrAdminAlreadyInitialized = Error("Admin user already initialized")
+	ErrInvalidUsername         = Error("Invalid username. White spaces are not allowed")
+	ErrAdminAlreadyInitialized = Error("An administrator user already exists")
+	ErrCannotRemoveAdmin       = Error("Cannot remove the default administrator account")
+	ErrAdminCannotRemoveSelf   = Error("Cannot remove your own user account. Contact another administrator")
 )
 
 // Team errors.
@@ -42,6 +44,19 @@ const (
 	ErrEndpointAccessDenied = Error("Access denied to endpoint")
 )
 
+// Registry errors.
+const (
+	ErrRegistryNotFound      = Error("Registry not found")
+	ErrRegistryAlreadyExists = Error("A registry is already defined for this URL")
+)
+
+// Stack errors
+const (
+	ErrStackNotFound                   = Error("Stack not found")
+	ErrStackAlreadyExists              = Error("A stack already exists with this name")
+	ErrComposeFileNotFoundInRepository = Error("Unable to find a Compose file in the repository")
+)
+
 // Version errors.
 const (
 	ErrDBVersionNotFound = Error("DB version not found")
@@ -52,6 +67,11 @@ const (
 	ErrSettingsNotFound = Error("Settings not found")
 )
 
+// DockerHub errors.
+const (
+	ErrDockerHubNotFound = Error("Dockerhub not found")
+)
+
 // Crypto errors.
 const (
 	ErrCryptoHashFailure = Error("Unable to hash data")

api/exec/stack_manager.go

@@ -0,0 +1,124 @@
+package exec
+
+import (
+	"bytes"
+	"os"
+	"os/exec"
+	"path"
+	"runtime"
+
+	"github.com/portainer/portainer"
+)
+
+// StackManager represents a service for managing stacks.
+type StackManager struct {
+	binaryPath string
+}
+
+// NewStackManager initializes a new StackManager service.
+func NewStackManager(binaryPath string) *StackManager {
+	return &StackManager{
+		binaryPath: binaryPath,
+	}
+}
+
+// Login executes the docker login command against a list of registries (including DockerHub).
+func (manager *StackManager) Login(dockerhub *portainer.DockerHub, registries []portainer.Registry, endpoint *portainer.Endpoint) error {
+	command, args := prepareDockerCommandAndArgs(manager.binaryPath, endpoint)
+	for _, registry := range registries {
+		if registry.Authentication {
+			registryArgs := append(args, "login", "--username", registry.Username, "--password", registry.Password, registry.URL)
+			err := runCommandAndCaptureStdErr(command, registryArgs, nil)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	if dockerhub.Authentication {
+		dockerhubArgs := append(args, "login", "--username", dockerhub.Username, "--password", dockerhub.Password)
+		err := runCommandAndCaptureStdErr(command, dockerhubArgs, nil)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// Logout executes the docker logout command.
+func (manager *StackManager) Logout(endpoint *portainer.Endpoint) error {
+	command, args := prepareDockerCommandAndArgs(manager.binaryPath, endpoint)
+	args = append(args, "logout")
+	return runCommandAndCaptureStdErr(command, args, nil)
+}
+
+// Deploy executes the docker stack deploy command.
+func (manager *StackManager) Deploy(stack *portainer.Stack, prune bool, endpoint *portainer.Endpoint) error {
+	stackFilePath := path.Join(stack.ProjectPath, stack.EntryPoint)
+	command, args := prepareDockerCommandAndArgs(manager.binaryPath, endpoint)
+
+	if prune {
+		args = append(args, "stack", "deploy", "--prune", "--with-registry-auth", "--compose-file", stackFilePath, stack.Name)
+	} else {
+		args = append(args, "stack", "deploy", "--with-registry-auth", "--compose-file", stackFilePath, stack.Name)
+	}
+
+	env := make([]string, 0)
+	for _, envvar := range stack.Env {
+		env = append(env, envvar.Name+"="+envvar.Value)
+	}
+
+	return runCommandAndCaptureStdErr(command, args, env)
+}
+
+// Remove executes the docker stack rm command.
+func (manager *StackManager) Remove(stack *portainer.Stack, endpoint *portainer.Endpoint) error {
+	command, args := prepareDockerCommandAndArgs(manager.binaryPath, endpoint)
+	args = append(args, "stack", "rm", stack.Name)
+	return runCommandAndCaptureStdErr(command, args, nil)
+}
+
+func runCommandAndCaptureStdErr(command string, args []string, env []string) error {
+	var stderr bytes.Buffer
+	cmd := exec.Command(command, args...)
+	cmd.Stderr = &stderr
+
+	if env != nil {
+		cmd.Env = os.Environ()
+		cmd.Env = append(cmd.Env, env...)
+	}
+
+	err := cmd.Run()
+	if err != nil {
+		return portainer.Error(stderr.String())
+	}
+
+	return nil
+}
+
+func prepareDockerCommandAndArgs(binaryPath string, endpoint *portainer.Endpoint) (string, []string) {
+	// Assume Linux as a default
+	command := path.Join(binaryPath, "docker")
+
+	if runtime.GOOS == "windows" {
+		command = path.Join(binaryPath, "docker.exe")
+	}
+
+	args := make([]string, 0)
+	args = append(args, "-H", endpoint.URL)
+
+	if endpoint.TLSConfig.TLS {
+		args = append(args, "--tls")
+
+		if !endpoint.TLSConfig.TLSSkipVerify {
+			args = append(args, "--tlsverify", "--tlscacert", endpoint.TLSConfig.TLSCACertPath)
+		}
+
+		if endpoint.TLSConfig.TLSCertPath != "" && endpoint.TLSConfig.TLSKeyPath != "" {
+			args = append(args, "--tlscert", endpoint.TLSConfig.TLSCertPath, "--tlskey", endpoint.TLSConfig.TLSKeyPath)
+		}
+	}
+
+	return command, args
+}

api/file/file.go

@@ -1,143 +0,0 @@
-package file
-
-import (
-	"github.com/portainer/portainer"
-
-	"io"
-	"os"
-	"path"
-	"strconv"
-)
-
-const (
-	// TLSStorePath represents the subfolder where TLS files are stored in the file store folder.
-	TLSStorePath = "tls"
-	// TLSCACertFile represents the name on disk for a TLS CA file.
-	TLSCACertFile = "ca.pem"
-	// TLSCertFile represents the name on disk for a TLS certificate file.
-	TLSCertFile = "cert.pem"
-	// TLSKeyFile represents the name on disk for a TLS key file.
-	TLSKeyFile = "key.pem"
-)
-
-// Service represents a service for managing files and directories.
-type Service struct {
-	dataStorePath string
-	fileStorePath string
-}
-
-// NewService initializes a new service. It creates a data directory and a directory to store files
-// inside this directory if they don't exist.
-func NewService(dataStorePath, fileStorePath string) (*Service, error) {
-	service := &Service{
-		dataStorePath: dataStorePath,
-		fileStorePath: path.Join(dataStorePath, fileStorePath),
-	}
-
-	// Checking if a mount directory exists is broken with Go on Windows.
-	// This will need to be reviewed after the issue has been fixed in Go.
-	// See: https://github.com/portainer/portainer/issues/474
-	// err := createDirectoryIfNotExist(dataStorePath, 0755)
-	// if err != nil {
-	// 	return nil, err
-	// }
-
-	err := service.createDirectoryInStoreIfNotExist(TLSStorePath)
-	if err != nil {
-		return nil, err
-	}
-
-	return service, nil
-}
-
-// StoreTLSFile creates a subfolder in the TLSStorePath and stores a new file with the content from r.
-func (service *Service) StoreTLSFile(endpointID portainer.EndpointID, fileType portainer.TLSFileType, r io.Reader) error {
-	ID := strconv.Itoa(int(endpointID))
-	endpointStorePath := path.Join(TLSStorePath, ID)
-	err := service.createDirectoryInStoreIfNotExist(endpointStorePath)
-	if err != nil {
-		return err
-	}
-
-	var fileName string
-	switch fileType {
-	case portainer.TLSFileCA:
-		fileName = TLSCACertFile
-	case portainer.TLSFileCert:
-		fileName = TLSCertFile
-	case portainer.TLSFileKey:
-		fileName = TLSKeyFile
-	default:
-		return portainer.ErrUndefinedTLSFileType
-	}
-
-	tlsFilePath := path.Join(endpointStorePath, fileName)
-	err = service.createFileInStore(tlsFilePath, r)
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-// GetPathForTLSFile returns the absolute path to a specific TLS file for an endpoint.
-func (service *Service) GetPathForTLSFile(endpointID portainer.EndpointID, fileType portainer.TLSFileType) (string, error) {
-	var fileName string
-	switch fileType {
-	case portainer.TLSFileCA:
-		fileName = TLSCACertFile
-	case portainer.TLSFileCert:
-		fileName = TLSCertFile
-	case portainer.TLSFileKey:
-		fileName = TLSKeyFile
-	default:
-		return "", portainer.ErrUndefinedTLSFileType
-	}
-	ID := strconv.Itoa(int(endpointID))
-	return path.Join(service.fileStorePath, TLSStorePath, ID, fileName), nil
-}
-
-// DeleteTLSFiles deletes a folder containing the TLS files for an endpoint.
-func (service *Service) DeleteTLSFiles(endpointID portainer.EndpointID) error {
-	ID := strconv.Itoa(int(endpointID))
-	endpointPath := path.Join(service.fileStorePath, TLSStorePath, ID)
-	err := os.RemoveAll(endpointPath)
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-// createDirectoryInStoreIfNotExist creates a new directory in the file store if it doesn't exists on the file system.
-func (service *Service) createDirectoryInStoreIfNotExist(name string) error {
-	path := path.Join(service.fileStorePath, name)
-	return createDirectoryIfNotExist(path, 0700)
-}
-
-// createDirectoryIfNotExist creates a directory if it doesn't exists on the file system.
-func createDirectoryIfNotExist(path string, mode uint32) error {
-	_, err := os.Stat(path)
-	if os.IsNotExist(err) {
-		err = os.Mkdir(path, os.FileMode(mode))
-		if err != nil {
-			return err
-		}
-	} else if err != nil {
-		return err
-	}
-	return nil
-}
-
-// createFile creates a new file in the file store with the content from r.
-func (service *Service) createFileInStore(filePath string, r io.Reader) error {
-	path := path.Join(service.fileStorePath, filePath)
-	out, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
-	if err != nil {
-		return err
-	}
-	defer out.Close()
-	_, err = io.Copy(out, r)
-	if err != nil {
-		return err
-	}
-	return nil
-}

api/filesystem/filesystem.go

@@ -0,0 +1,240 @@
+package filesystem
+
+import (
+	"bytes"
+	"io/ioutil"
+
+	"github.com/portainer/portainer"
+
+	"io"
+	"os"
+	"path"
+)
+
+const (
+	// TLSStorePath represents the subfolder where TLS files are stored in the file store folder.
+	TLSStorePath = "tls"
+	// LDAPStorePath represents the subfolder where LDAP TLS files are stored in the TLSStorePath.
+	LDAPStorePath = "ldap"
+	// TLSCACertFile represents the name on disk for a TLS CA file.
+	TLSCACertFile = "ca.pem"
+	// TLSCertFile represents the name on disk for a TLS certificate file.
+	TLSCertFile = "cert.pem"
+	// TLSKeyFile represents the name on disk for a TLS key file.
+	TLSKeyFile = "key.pem"
+	// ComposeStorePath represents the subfolder where compose files are stored in the file store folder.
+	ComposeStorePath = "compose"
+	// ComposeFileDefaultName represents the default name of a compose file.
+	ComposeFileDefaultName = "docker-compose.yml"
+)
+
+// Service represents a service for managing files and directories.
+type Service struct {
+	dataStorePath string
+	fileStorePath string
+}
+
+// NewService initializes a new service. It creates a data directory and a directory to store files
+// inside this directory if they don't exist.
+func NewService(dataStorePath, fileStorePath string) (*Service, error) {
+	service := &Service{
+		dataStorePath: dataStorePath,
+		fileStorePath: path.Join(dataStorePath, fileStorePath),
+	}
+
+	// Checking if a mount directory exists is broken with Go on Windows.
+	// This will need to be reviewed after the issue has been fixed in Go.
+	// See: https://github.com/portainer/portainer/issues/474
+	// err := createDirectoryIfNotExist(dataStorePath, 0755)
+	// if err != nil {
+	// 	return nil, err
+	// }
+
+	err := service.createDirectoryInStoreIfNotExist(TLSStorePath)
+	if err != nil {
+		return nil, err
+	}
+
+	err = service.createDirectoryInStoreIfNotExist(ComposeStorePath)
+	if err != nil {
+		return nil, err
+	}
+
+	return service, nil
+}
+
+// RemoveDirectory removes a directory on the filesystem.
+func (service *Service) RemoveDirectory(directoryPath string) error {
+	return os.RemoveAll(directoryPath)
+}
+
+// GetStackProjectPath returns the absolute path on the FS for a stack based
+// on its identifier.
+func (service *Service) GetStackProjectPath(stackIdentifier string) string {
+	return path.Join(service.fileStorePath, ComposeStorePath, stackIdentifier)
+}
+
+// StoreStackFileFromString creates a subfolder in the ComposeStorePath and stores a new file using the content from a string.
+// It returns the path to the folder where the file is stored.
+func (service *Service) StoreStackFileFromString(stackIdentifier, stackFileContent string) (string, error) {
+	stackStorePath := path.Join(ComposeStorePath, stackIdentifier)
+	err := service.createDirectoryInStoreIfNotExist(stackStorePath)
+	if err != nil {
+		return "", err
+	}
+
+	composeFilePath := path.Join(stackStorePath, ComposeFileDefaultName)
+	data := []byte(stackFileContent)
+	r := bytes.NewReader(data)
+
+	err = service.createFileInStore(composeFilePath, r)
+	if err != nil {
+		return "", err
+	}
+
+	return path.Join(service.fileStorePath, stackStorePath), nil
+}
+
+// StoreStackFileFromReader creates a subfolder in the ComposeStorePath and stores a new file using the content from an io.Reader.
+// It returns the path to the folder where the file is stored.
+func (service *Service) StoreStackFileFromReader(stackIdentifier string, r io.Reader) (string, error) {
+	stackStorePath := path.Join(ComposeStorePath, stackIdentifier)
+	err := service.createDirectoryInStoreIfNotExist(stackStorePath)
+	if err != nil {
+		return "", err
+	}
+
+	composeFilePath := path.Join(stackStorePath, ComposeFileDefaultName)
+
+	err = service.createFileInStore(composeFilePath, r)
+	if err != nil {
+		return "", err
+	}
+
+	return path.Join(service.fileStorePath, stackStorePath), nil
+}
+
+// StoreTLSFile creates a folder in the TLSStorePath and stores a new file with the content from r.
+func (service *Service) StoreTLSFile(folder string, fileType portainer.TLSFileType, r io.Reader) error {
+	storePath := path.Join(TLSStorePath, folder)
+	err := service.createDirectoryInStoreIfNotExist(storePath)
+	if err != nil {
+		return err
+	}
+
+	var fileName string
+	switch fileType {
+	case portainer.TLSFileCA:
+		fileName = TLSCACertFile
+	case portainer.TLSFileCert:
+		fileName = TLSCertFile
+	case portainer.TLSFileKey:
+		fileName = TLSKeyFile
+	default:
+		return portainer.ErrUndefinedTLSFileType
+	}
+
+	tlsFilePath := path.Join(storePath, fileName)
+	err = service.createFileInStore(tlsFilePath, r)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// GetPathForTLSFile returns the absolute path to a specific TLS file for an endpoint.
+func (service *Service) GetPathForTLSFile(folder string, fileType portainer.TLSFileType) (string, error) {
+	var fileName string
+	switch fileType {
+	case portainer.TLSFileCA:
+		fileName = TLSCACertFile
+	case portainer.TLSFileCert:
+		fileName = TLSCertFile
+	case portainer.TLSFileKey:
+		fileName = TLSKeyFile
+	default:
+		return "", portainer.ErrUndefinedTLSFileType
+	}
+	return path.Join(service.fileStorePath, TLSStorePath, folder, fileName), nil
+}
+
+// DeleteTLSFiles deletes a folder in the TLS store path.
+func (service *Service) DeleteTLSFiles(folder string) error {
+	storePath := path.Join(service.fileStorePath, TLSStorePath, folder)
+	err := os.RemoveAll(storePath)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// DeleteTLSFile deletes a specific TLS file from a folder.
+func (service *Service) DeleteTLSFile(folder string, fileType portainer.TLSFileType) error {
+	var fileName string
+	switch fileType {
+	case portainer.TLSFileCA:
+		fileName = TLSCACertFile
+	case portainer.TLSFileCert:
+		fileName = TLSCertFile
+	case portainer.TLSFileKey:
+		fileName = TLSKeyFile
+	default:
+		return portainer.ErrUndefinedTLSFileType
+	}
+
+	filePath := path.Join(service.fileStorePath, TLSStorePath, folder, fileName)
+
+	err := os.Remove(filePath)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// GetFileContent returns a string content from file.
+func (service *Service) GetFileContent(filePath string) (string, error) {
+	content, err := ioutil.ReadFile(filePath)
+	if err != nil {
+		return "", err
+	}
+
+	return string(content), nil
+}
+
+// createDirectoryInStoreIfNotExist creates a new directory in the file store if it doesn't exists on the file system.
+func (service *Service) createDirectoryInStoreIfNotExist(name string) error {
+	path := path.Join(service.fileStorePath, name)
+	return createDirectoryIfNotExist(path, 0700)
+}
+
+// createDirectoryIfNotExist creates a directory if it doesn't exists on the file system.
+func createDirectoryIfNotExist(path string, mode uint32) error {
+	_, err := os.Stat(path)
+	if os.IsNotExist(err) {
+		err = os.Mkdir(path, os.FileMode(mode))
+		if err != nil {
+			return err
+		}
+	} else if err != nil {
+		return err
+	}
+	return nil
+}
+
+// createFile creates a new file in the file store with the content from r.
+func (service *Service) createFileInStore(filePath string, r io.Reader) error {
+	path := path.Join(service.fileStorePath, filePath)
+
+	out, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
+	if err != nil {
+		return err
+	}
+	defer out.Close()
+
+	_, err = io.Copy(out, r)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

api/git/git.go

@@ -0,0 +1,25 @@
+package git
+
+import (
+	"gopkg.in/src-d/go-git.v4"
+)
+
+// Service represents a service for managing Git.
+type Service struct{}
+
+// NewService initializes a new service.
+func NewService(dataStorePath string) (*Service, error) {
+	service := &Service{}
+
+	return service, nil
+}
+
+// CloneRepository clones a git repository using the specified URL in the specified
+// destination folder.
+func (service *Service) CloneRepository(url, destination string) error {
+	_, err := git.PlainClone(destination, false, &git.CloneOptions{
+		URL: url,
+	})
+
+	return err
+}

api/http/error/error.go

@@ -4,7 +4,6 @@ import (
 	"encoding/json"
 	"log"
 	"net/http"
-	"strings"
 )
 
 // errorResponse is a generic response for sending a error.
@@ -21,10 +20,3 @@ func WriteErrorResponse(w http.ResponseWriter, err error, code int, logger *log.
 	w.WriteHeader(code)
 	json.NewEncoder(w).Encode(&errorResponse{Err: err.Error()})
 }
-
-// WriteMethodNotAllowedResponse writes an error message to the response and sets the Allow header.
-func WriteMethodNotAllowedResponse(w http.ResponseWriter, allowedMethods []string) {
-	w.Header().Set("Allow", strings.Join(allowedMethods, ", "))
-	w.WriteHeader(http.StatusMethodNotAllowed)
-	json.NewEncoder(w).Encode(&errorResponse{Err: http.StatusText(http.StatusMethodNotAllowed)})
-}

api/http/handler/auth.go

@@ -17,11 +17,13 @@ import (
 // AuthHandler represents an HTTP API handler for managing authentication.
 type AuthHandler struct {
 	*mux.Router
-	Logger        *log.Logger
-	authDisabled  bool
-	UserService   portainer.UserService
-	CryptoService portainer.CryptoService
-	JWTService    portainer.JWTService
+	Logger          *log.Logger
+	authDisabled    bool
+	UserService     portainer.UserService
+	CryptoService   portainer.CryptoService
+	JWTService      portainer.JWTService
+	LDAPService     portainer.LDAPService
+	SettingsService portainer.SettingsService
 }
 
 const (
@@ -42,17 +44,23 @@ func NewAuthHandler(bouncer *security.RequestBouncer, authDisabled bool) *AuthHa
 		authDisabled: authDisabled,
 	}
 	h.Handle("/auth",
-		bouncer.PublicAccess(http.HandlerFunc(h.handlePostAuth)))
+		bouncer.PublicAccess(http.HandlerFunc(h.handlePostAuth))).Methods(http.MethodPost)
 
 	return h
 }
 
-func (handler *AuthHandler) handlePostAuth(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodPost})
-		return
+type (
+	postAuthRequest struct {
+		Username string `valid:"required"`
+		Password string `valid:"required"`
 	}
 
+	postAuthResponse struct {
+		JWT string `json:"jwt"`
+	}
+)
+
+func (handler *AuthHandler) handlePostAuth(w http.ResponseWriter, r *http.Request) {
 	if handler.authDisabled {
 		httperror.WriteErrorResponse(w, ErrAuthDisabled, http.StatusServiceUnavailable, handler.Logger)
 		return
@@ -75,24 +83,39 @@ func (handler *AuthHandler) handlePostAuth(w http.ResponseWriter, r *http.Reques
 
 	u, err := handler.UserService.UserByUsername(username)
 	if err == portainer.ErrUserNotFound {
-		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		httperror.WriteErrorResponse(w, ErrInvalidCredentials, http.StatusBadRequest, handler.Logger)
 		return
 	} else if err != nil {
 		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
-	err = handler.CryptoService.CompareHashAndData(u.Password, password)
+	settings, err := handler.SettingsService.Settings()
 	if err != nil {
-		httperror.WriteErrorResponse(w, ErrInvalidCredentials, http.StatusUnprocessableEntity, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
+	if settings.AuthenticationMethod == portainer.AuthenticationLDAP && u.ID != 1 {
+		err = handler.LDAPService.AuthenticateUser(username, password, &settings.LDAPSettings)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+			return
+		}
+	} else {
+		err = handler.CryptoService.CompareHashAndData(u.Password, password)
+		if err != nil {
+			httperror.WriteErrorResponse(w, ErrInvalidCredentials, http.StatusUnprocessableEntity, handler.Logger)
+			return
+		}
+	}
+
 	tokenData := &portainer.TokenData{
 		ID:       u.ID,
 		Username: u.Username,
 		Role:     u.Role,
 	}
+
 	token, err := handler.JWTService.GenerateToken(tokenData)
 	if err != nil {
 		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
@@ -101,12 +124,3 @@ func (handler *AuthHandler) handlePostAuth(w http.ResponseWriter, r *http.Reques
 
 	encodeJSON(w, &postAuthResponse{JWT: token}, handler.Logger)
 }
-
-type postAuthRequest struct {
-	Username string `valid:"required"`
-	Password string `valid:"required"`
-}
-
-type postAuthResponse struct {
-	JWT string `json:"jwt"`
-}

api/http/handler/docker.go

@@ -30,7 +30,7 @@ func NewDockerHandler(bouncer *security.RequestBouncer) *DockerHandler {
 		Router: mux.NewRouter(),
 		Logger: log.New(os.Stderr, "", log.LstdFlags),
 	}
-	h.PathPrefix("/{id}/").Handler(
+	h.PathPrefix("/{id}/docker").Handler(
 		bouncer.AuthenticatedAccess(http.HandlerFunc(h.proxyRequestsToDockerAPI)))
 	return h
 }
@@ -90,5 +90,5 @@ func (handler *DockerHandler) proxyRequestsToDockerAPI(w http.ResponseWriter, r
 		}
 	}
 
-	http.StripPrefix("/"+id, proxy).ServeHTTP(w, r)
+	http.StripPrefix("/"+id+"/docker", proxy).ServeHTTP(w, r)
 }

api/http/handler/dockerhub.go

@@ -0,0 +1,89 @@
+package handler
+
+import (
+	"encoding/json"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+)
+
+// DockerHubHandler represents an HTTP API handler for managing DockerHub.
+type DockerHubHandler struct {
+	*mux.Router
+	Logger           *log.Logger
+	DockerHubService portainer.DockerHubService
+}
+
+// NewDockerHubHandler returns a new instance of DockerHubHandler.
+func NewDockerHubHandler(bouncer *security.RequestBouncer) *DockerHubHandler {
+	h := &DockerHubHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/dockerhub",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handleGetDockerHub))).Methods(http.MethodGet)
+	h.Handle("/dockerhub",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutDockerHub))).Methods(http.MethodPut)
+
+	return h
+}
+
+type (
+	putDockerHubRequest struct {
+		Authentication bool   `valid:""`
+		Username       string `valid:""`
+		Password       string `valid:""`
+	}
+)
+
+// handleGetDockerHub handles GET requests on /dockerhub
+func (handler *DockerHubHandler) handleGetDockerHub(w http.ResponseWriter, r *http.Request) {
+	dockerhub, err := handler.DockerHubService.DockerHub()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, dockerhub, handler.Logger)
+	return
+}
+
+// handlePutDockerHub handles PUT requests on /dockerhub
+func (handler *DockerHubHandler) handlePutDockerHub(w http.ResponseWriter, r *http.Request) {
+	var req putDockerHubRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	dockerhub := &portainer.DockerHub{
+		Authentication: false,
+		Username:       "",
+		Password:       "",
+	}
+
+	if req.Authentication {
+		dockerhub.Authentication = true
+		dockerhub.Username = req.Username
+		dockerhub.Password = req.Password
+	}
+
+	err = handler.DockerHubService.StoreDockerHub(dockerhub)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+	}
+}

api/http/handler/endpoint.go

@@ -55,6 +55,35 @@ func NewEndpointHandler(bouncer *security.RequestBouncer, authorizeEndpointManag
 	return h
 }
 
+type (
+	postEndpointsRequest struct {
+		Name                string `valid:"required"`
+		URL                 string `valid:"required"`
+		PublicURL           string `valid:"-"`
+		TLS                 bool
+		TLSSkipVerify       bool
+		TLSSkipClientVerify bool
+	}
+
+	postEndpointsResponse struct {
+		ID int `json:"Id"`
+	}
+
+	putEndpointAccessRequest struct {
+		AuthorizedUsers []int `valid:"-"`
+		AuthorizedTeams []int `valid:"-"`
+	}
+
+	putEndpointsRequest struct {
+		Name                string `valid:"-"`
+		URL                 string `valid:"-"`
+		PublicURL           string `valid:"-"`
+		TLS                 bool   `valid:"-"`
+		TLSSkipVerify       bool   `valid:"-"`
+		TLSSkipClientVerify bool   `valid:"-"`
+	}
+)
+
 // handleGetEndpoints handles GET requests on /endpoints
 func (handler *EndpointHandler) handleGetEndpoints(w http.ResponseWriter, r *http.Request) {
 	securityContext, err := security.RetrieveRestrictedRequestContext(r)
@@ -98,10 +127,13 @@ func (handler *EndpointHandler) handlePostEndpoints(w http.ResponseWriter, r *ht
 	}
 
 	endpoint := &portainer.Endpoint{
-		Name:            req.Name,
-		URL:             req.URL,
-		PublicURL:       req.PublicURL,
-		TLS:             req.TLS,
+		Name:      req.Name,
+		URL:       req.URL,
+		PublicURL: req.PublicURL,
+		TLSConfig: portainer.TLSConfiguration{
+			TLS:           req.TLS,
+			TLSSkipVerify: req.TLSSkipVerify,
+		},
 		AuthorizedUsers: []portainer.UserID{},
 		AuthorizedTeams: []portainer.TeamID{},
 	}
@@ -113,12 +145,20 @@ func (handler *EndpointHandler) handlePostEndpoints(w http.ResponseWriter, r *ht
 	}
 
 	if req.TLS {
-		caCertPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCA)
-		endpoint.TLSCACertPath = caCertPath
-		certPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCert)
-		endpoint.TLSCertPath = certPath
-		keyPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileKey)
-		endpoint.TLSKeyPath = keyPath
+		folder := strconv.Itoa(int(endpoint.ID))
+
+		if !req.TLSSkipVerify {
+			caCertPath, _ := handler.FileService.GetPathForTLSFile(folder, portainer.TLSFileCA)
+			endpoint.TLSConfig.TLSCACertPath = caCertPath
+		}
+
+		if !req.TLSSkipClientVerify {
+			certPath, _ := handler.FileService.GetPathForTLSFile(folder, portainer.TLSFileCert)
+			endpoint.TLSConfig.TLSCertPath = certPath
+			keyPath, _ := handler.FileService.GetPathForTLSFile(folder, portainer.TLSFileKey)
+			endpoint.TLSConfig.TLSKeyPath = keyPath
+		}
+
 		err = handler.EndpointService.UpdateEndpoint(endpoint.ID, endpoint)
 		if err != nil {
 			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
@@ -129,17 +169,6 @@ func (handler *EndpointHandler) handlePostEndpoints(w http.ResponseWriter, r *ht
 	encodeJSON(w, &postEndpointsResponse{ID: int(endpoint.ID)}, handler.Logger)
 }
 
-type postEndpointsRequest struct {
-	Name      string `valid:"required"`
-	URL       string `valid:"required"`
-	PublicURL string `valid:"-"`
-	TLS       bool
-}
-
-type postEndpointsResponse struct {
-	ID int `json:"Id"`
-}
-
 // handleGetEndpoint handles GET requests on /endpoints/:id
 func (handler *EndpointHandler) handleGetEndpoint(w http.ResponseWriter, r *http.Request) {
 	vars := mux.Vars(r)
@@ -218,11 +247,6 @@ func (handler *EndpointHandler) handlePutEndpointAccess(w http.ResponseWriter, r
 	}
 }
 
-type putEndpointAccessRequest struct {
-	AuthorizedUsers []int `valid:"-"`
-	AuthorizedTeams []int `valid:"-"`
-}
-
 // handlePutEndpoint handles PUT requests on /endpoints/:id
 func (handler *EndpointHandler) handlePutEndpoint(w http.ResponseWriter, r *http.Request) {
 	if !handler.authorizeEndpointManagement {
@@ -272,20 +296,36 @@ func (handler *EndpointHandler) handlePutEndpoint(w http.ResponseWriter, r *http
 		endpoint.PublicURL = req.PublicURL
 	}
 
+	folder := strconv.Itoa(int(endpoint.ID))
 	if req.TLS {
-		endpoint.TLS = true
-		caCertPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCA)
-		endpoint.TLSCACertPath = caCertPath
-		certPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCert)
-		endpoint.TLSCertPath = certPath
-		keyPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileKey)
-		endpoint.TLSKeyPath = keyPath
+		endpoint.TLSConfig.TLS = true
+		endpoint.TLSConfig.TLSSkipVerify = req.TLSSkipVerify
+		if !req.TLSSkipVerify {
+			caCertPath, _ := handler.FileService.GetPathForTLSFile(folder, portainer.TLSFileCA)
+			endpoint.TLSConfig.TLSCACertPath = caCertPath
+		} else {
+			endpoint.TLSConfig.TLSCACertPath = ""
+			handler.FileService.DeleteTLSFile(folder, portainer.TLSFileCA)
+		}
+
+		if !req.TLSSkipClientVerify {
+			certPath, _ := handler.FileService.GetPathForTLSFile(folder, portainer.TLSFileCert)
+			endpoint.TLSConfig.TLSCertPath = certPath
+			keyPath, _ := handler.FileService.GetPathForTLSFile(folder, portainer.TLSFileKey)
+			endpoint.TLSConfig.TLSKeyPath = keyPath
+		} else {
+			endpoint.TLSConfig.TLSCertPath = ""
+			handler.FileService.DeleteTLSFile(folder, portainer.TLSFileCert)
+			endpoint.TLSConfig.TLSKeyPath = ""
+			handler.FileService.DeleteTLSFile(folder, portainer.TLSFileKey)
+		}
 	} else {
-		endpoint.TLS = false
-		endpoint.TLSCACertPath = ""
-		endpoint.TLSCertPath = ""
-		endpoint.TLSKeyPath = ""
-		err = handler.FileService.DeleteTLSFiles(endpoint.ID)
+		endpoint.TLSConfig.TLS = false
+		endpoint.TLSConfig.TLSSkipVerify = true
+		endpoint.TLSConfig.TLSCACertPath = ""
+		endpoint.TLSConfig.TLSCertPath = ""
+		endpoint.TLSConfig.TLSKeyPath = ""
+		err = handler.FileService.DeleteTLSFiles(folder)
 		if err != nil {
 			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 			return
@@ -305,13 +345,6 @@ func (handler *EndpointHandler) handlePutEndpoint(w http.ResponseWriter, r *http
 	}
 }
 
-type putEndpointsRequest struct {
-	Name      string `valid:"-"`
-	URL       string `valid:"-"`
-	PublicURL string `valid:"-"`
-	TLS       bool   `valid:"-"`
-}
-
 // handleDeleteEndpoint handles DELETE requests on /endpoints/:id
 func (handler *EndpointHandler) handleDeleteEndpoint(w http.ResponseWriter, r *http.Request) {
 	if !handler.authorizeEndpointManagement {
@@ -346,8 +379,8 @@ func (handler *EndpointHandler) handleDeleteEndpoint(w http.ResponseWriter, r *h
 		return
 	}
 
-	if endpoint.TLS {
-		err = handler.FileService.DeleteTLSFiles(portainer.EndpointID(endpointID))
+	if endpoint.TLSConfig.TLS {
+		err = handler.FileService.DeleteTLSFiles(id)
 		if err != nil {
 			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 			return

api/http/handler/file.go

@@ -3,34 +3,22 @@ package handler
 import (
 	"os"
 
-	"github.com/portainer/portainer"
-	httperror "github.com/portainer/portainer/http/error"
-
 	"log"
 	"net/http"
-	"path"
 	"strings"
 )
 
 // FileHandler represents an HTTP API handler for managing static files.
 type FileHandler struct {
 	http.Handler
-	Logger             *log.Logger
-	allowedDirectories map[string]bool
+	Logger *log.Logger
 }
 
 // NewFileHandler returns a new instance of FileHandler.
-func NewFileHandler(assetPath string) *FileHandler {
+func NewFileHandler(assetPublicPath string) *FileHandler {
 	h := &FileHandler{
-		Handler: http.FileServer(http.Dir(assetPath)),
+		Handler: http.FileServer(http.Dir(assetPublicPath)),
 		Logger:  log.New(os.Stderr, "", log.LstdFlags),
-		allowedDirectories: map[string]bool{
-			"/":       true,
-			"/css":    true,
-			"/js":     true,
-			"/images": true,
-			"/fonts":  true,
-		},
 	}
 	return h
 }
@@ -45,17 +33,10 @@ func isHTML(acceptContent []string) bool {
 }
 
 func (handler *FileHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	requestDirectory := path.Dir(r.URL.Path)
-	if !handler.allowedDirectories[requestDirectory] {
-		httperror.WriteErrorResponse(w, portainer.ErrResourceNotFound, http.StatusNotFound, handler.Logger)
-		return
-	}
-
 	if !isHTML(r.Header["Accept"]) {
 		w.Header().Set("Cache-Control", "max-age=31536000")
 	} else {
 		w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
 	}
-
 	handler.Handler.ServeHTTP(w, r)
 }

api/http/handler/handler.go

@@ -17,7 +17,10 @@ type Handler struct {
 	TeamHandler           *TeamHandler
 	TeamMembershipHandler *TeamMembershipHandler
 	EndpointHandler       *EndpointHandler
+	RegistryHandler       *RegistryHandler
+	DockerHubHandler      *DockerHubHandler
 	ResourceHandler       *ResourceHandler
+	StackHandler          *StackHandler
 	StatusHandler         *StatusHandler
 	SettingsHandler       *SettingsHandler
 	TemplatesHandler      *TemplatesHandler
@@ -34,42 +37,50 @@ const (
 	ErrInvalidRequestFormat = portainer.Error("Invalid request data format")
 	// ErrInvalidQueryFormat defines an error raised when the data sent in the query or the URL is invalid
 	ErrInvalidQueryFormat = portainer.Error("Invalid query format")
-	// ErrEmptyResponseBody defines an error raised when portainer excepts to parse the body of a HTTP response and there is nothing to parse
-	// ErrEmptyResponseBody = portainer.Error("Empty response body")
 )
 
 // ServeHTTP delegates a request to the appropriate subhandler.
 func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	if strings.HasPrefix(r.URL.Path, "/api/auth") {
+
+	switch {
+	case strings.HasPrefix(r.URL.Path, "/api/auth"):
 		http.StripPrefix("/api", h.AuthHandler).ServeHTTP(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/api/users") {
-		http.StripPrefix("/api", h.UserHandler).ServeHTTP(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/api/teams") {
-		http.StripPrefix("/api", h.TeamHandler).ServeHTTP(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/api/team_memberships") {
-		http.StripPrefix("/api", h.TeamMembershipHandler).ServeHTTP(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/api/endpoints") {
-		http.StripPrefix("/api", h.EndpointHandler).ServeHTTP(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/api/resource_controls") {
+	case strings.HasPrefix(r.URL.Path, "/api/dockerhub"):
+		http.StripPrefix("/api", h.DockerHubHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/endpoints"):
+		if strings.Contains(r.URL.Path, "/docker/") {
+			http.StripPrefix("/api/endpoints", h.DockerHandler).ServeHTTP(w, r)
+		} else if strings.Contains(r.URL.Path, "/stacks") {
+			http.StripPrefix("/api/endpoints", h.StackHandler).ServeHTTP(w, r)
+		} else {
+			http.StripPrefix("/api", h.EndpointHandler).ServeHTTP(w, r)
+		}
+	case strings.HasPrefix(r.URL.Path, "/api/registries"):
+		http.StripPrefix("/api", h.RegistryHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/resource_controls"):
 		http.StripPrefix("/api", h.ResourceHandler).ServeHTTP(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/api/settings") {
+	case strings.HasPrefix(r.URL.Path, "/api/settings"):
 		http.StripPrefix("/api", h.SettingsHandler).ServeHTTP(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/api/status") {
+	case strings.HasPrefix(r.URL.Path, "/api/status"):
 		http.StripPrefix("/api", h.StatusHandler).ServeHTTP(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/api/templates") {
+	case strings.HasPrefix(r.URL.Path, "/api/templates"):
 		http.StripPrefix("/api", h.TemplatesHandler).ServeHTTP(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/api/upload") {
+	case strings.HasPrefix(r.URL.Path, "/api/upload"):
 		http.StripPrefix("/api", h.UploadHandler).ServeHTTP(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/api/websocket") {
+	case strings.HasPrefix(r.URL.Path, "/api/users"):
+		http.StripPrefix("/api", h.UserHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/teams"):
+		http.StripPrefix("/api", h.TeamHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/team_memberships"):
+		http.StripPrefix("/api", h.TeamMembershipHandler).ServeHTTP(w, r)
+	case strings.HasPrefix(r.URL.Path, "/api/websocket"):
 		http.StripPrefix("/api", h.WebSocketHandler).ServeHTTP(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/api/docker") {
-		http.StripPrefix("/api/docker", h.DockerHandler).ServeHTTP(w, r)
-	} else if strings.HasPrefix(r.URL.Path, "/") {
+	case strings.HasPrefix(r.URL.Path, "/"):
 		h.FileHandler.ServeHTTP(w, r)
 	}
 }
 
-// encodeJSON encodes v to w in JSON format. Error() is called if encoding fails.
+// encodeJSON encodes v to w in JSON format. WriteErrorResponse() is called if encoding fails.
 func encodeJSON(w http.ResponseWriter, v interface{}, logger *log.Logger) {
 	if err := json.NewEncoder(w).Encode(v); err != nil {
 		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, logger)

api/http/handler/registry.go

@@ -0,0 +1,314 @@
+package handler
+
+import (
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+	"strconv"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/mux"
+)
+
+// RegistryHandler represents an HTTP API handler for managing Docker registries.
+type RegistryHandler struct {
+	*mux.Router
+	Logger          *log.Logger
+	RegistryService portainer.RegistryService
+}
+
+// NewRegistryHandler returns a new instance of RegistryHandler.
+func NewRegistryHandler(bouncer *security.RequestBouncer) *RegistryHandler {
+	h := &RegistryHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/registries",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePostRegistries))).Methods(http.MethodPost)
+	h.Handle("/registries",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetRegistries))).Methods(http.MethodGet)
+	h.Handle("/registries/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleGetRegistry))).Methods(http.MethodGet)
+	h.Handle("/registries/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutRegistry))).Methods(http.MethodPut)
+	h.Handle("/registries/{id}/access",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutRegistryAccess))).Methods(http.MethodPut)
+	h.Handle("/registries/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleDeleteRegistry))).Methods(http.MethodDelete)
+
+	return h
+}
+
+type (
+	postRegistriesRequest struct {
+		Name           string `valid:"required"`
+		URL            string `valid:"required"`
+		Authentication bool   `valid:""`
+		Username       string `valid:""`
+		Password       string `valid:""`
+	}
+
+	postRegistriesResponse struct {
+		ID int `json:"Id"`
+	}
+
+	putRegistryAccessRequest struct {
+		AuthorizedUsers []int `valid:"-"`
+		AuthorizedTeams []int `valid:"-"`
+	}
+
+	putRegistriesRequest struct {
+		Name           string `valid:"required"`
+		URL            string `valid:"required"`
+		Authentication bool   `valid:""`
+		Username       string `valid:""`
+		Password       string `valid:""`
+	}
+)
+
+// handleGetRegistries handles GET requests on /registries
+func (handler *RegistryHandler) handleGetRegistries(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	registries, err := handler.RegistryService.Registries()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	filteredRegistries, err := security.FilterRegistries(registries, securityContext)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, filteredRegistries, handler.Logger)
+}
+
+// handlePostRegistries handles POST requests on /registries
+func (handler *RegistryHandler) handlePostRegistries(w http.ResponseWriter, r *http.Request) {
+	var req postRegistriesRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	registries, err := handler.RegistryService.Registries()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	for _, r := range registries {
+		if r.URL == req.URL {
+			httperror.WriteErrorResponse(w, portainer.ErrRegistryAlreadyExists, http.StatusConflict, handler.Logger)
+			return
+		}
+	}
+
+	registry := &portainer.Registry{
+		Name:            req.Name,
+		URL:             req.URL,
+		Authentication:  req.Authentication,
+		Username:        req.Username,
+		Password:        req.Password,
+		AuthorizedUsers: []portainer.UserID{},
+		AuthorizedTeams: []portainer.TeamID{},
+	}
+
+	err = handler.RegistryService.CreateRegistry(registry)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &postRegistriesResponse{ID: int(registry.ID)}, handler.Logger)
+}
+
+// handleGetRegistry handles GET requests on /registries/:id
+func (handler *RegistryHandler) handleGetRegistry(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	registryID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	registry, err := handler.RegistryService.Registry(portainer.RegistryID(registryID))
+	if err == portainer.ErrRegistryNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, registry, handler.Logger)
+}
+
+// handlePutRegistryAccess handles PUT requests on /registries/:id/access
+func (handler *RegistryHandler) handlePutRegistryAccess(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	registryID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putRegistryAccessRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	registry, err := handler.RegistryService.Registry(portainer.RegistryID(registryID))
+	if err == portainer.ErrRegistryNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if req.AuthorizedUsers != nil {
+		authorizedUserIDs := []portainer.UserID{}
+		for _, value := range req.AuthorizedUsers {
+			authorizedUserIDs = append(authorizedUserIDs, portainer.UserID(value))
+		}
+		registry.AuthorizedUsers = authorizedUserIDs
+	}
+
+	if req.AuthorizedTeams != nil {
+		authorizedTeamIDs := []portainer.TeamID{}
+		for _, value := range req.AuthorizedTeams {
+			authorizedTeamIDs = append(authorizedTeamIDs, portainer.TeamID(value))
+		}
+		registry.AuthorizedTeams = authorizedTeamIDs
+	}
+
+	err = handler.RegistryService.UpdateRegistry(registry.ID, registry)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+// handlePutRegistry handles PUT requests on /registries/:id
+func (handler *RegistryHandler) handlePutRegistry(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	registryID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putRegistriesRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	registry, err := handler.RegistryService.Registry(portainer.RegistryID(registryID))
+	if err == portainer.ErrRegistryNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	registries, err := handler.RegistryService.Registries()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	for _, r := range registries {
+		if r.URL == req.URL && r.ID != registry.ID {
+			httperror.WriteErrorResponse(w, portainer.ErrRegistryAlreadyExists, http.StatusConflict, handler.Logger)
+			return
+		}
+	}
+
+	if req.Name != "" {
+		registry.Name = req.Name
+	}
+
+	if req.URL != "" {
+		registry.URL = req.URL
+	}
+
+	if req.Authentication {
+		registry.Authentication = true
+		registry.Username = req.Username
+		registry.Password = req.Password
+	} else {
+		registry.Authentication = false
+		registry.Username = ""
+		registry.Password = ""
+	}
+
+	err = handler.RegistryService.UpdateRegistry(registry.ID, registry)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+// handleDeleteRegistry handles DELETE requests on /registries/:id
+func (handler *RegistryHandler) handleDeleteRegistry(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	registryID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = handler.RegistryService.Registry(portainer.RegistryID(registryID))
+	if err == portainer.ErrRegistryNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.RegistryService.DeleteRegistry(portainer.RegistryID(registryID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}

api/http/handler/resource_control.go

@@ -39,6 +39,23 @@ func NewResourceHandler(bouncer *security.RequestBouncer) *ResourceHandler {
 	return h
 }
 
+type (
+	postResourcesRequest struct {
+		ResourceID         string   `valid:"required"`
+		Type               string   `valid:"required"`
+		AdministratorsOnly bool     `valid:"-"`
+		Users              []int    `valid:"-"`
+		Teams              []int    `valid:"-"`
+		SubResourceIDs     []string `valid:"-"`
+	}
+
+	putResourcesRequest struct {
+		AdministratorsOnly bool  `valid:"-"`
+		Users              []int `valid:"-"`
+		Teams              []int `valid:"-"`
+	}
+)
+
 // handlePostResources handles POST requests on /resources
 func (handler *ResourceHandler) handlePostResources(w http.ResponseWriter, r *http.Request) {
 	var req postResourcesRequest
@@ -61,6 +78,14 @@ func (handler *ResourceHandler) handlePostResources(w http.ResponseWriter, r *ht
 		resourceControlType = portainer.ServiceResourceControl
 	case "volume":
 		resourceControlType = portainer.VolumeResourceControl
+	case "network":
+		resourceControlType = portainer.NetworkResourceControl
+	case "secret":
+		resourceControlType = portainer.SecretResourceControl
+	case "stack":
+		resourceControlType = portainer.StackResourceControl
+	case "config":
+		resourceControlType = portainer.ConfigResourceControl
 	default:
 		httperror.WriteErrorResponse(w, portainer.ErrInvalidResourceControlType, http.StatusBadRequest, handler.Logger)
 		return
@@ -121,22 +146,13 @@ func (handler *ResourceHandler) handlePostResources(w http.ResponseWriter, r *ht
 
 	err = handler.ResourceControlService.CreateResourceControl(&resourceControl)
 	if err != nil {
-		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
 	return
 }
 
-type postResourcesRequest struct {
-	ResourceID         string   `valid:"required"`
-	Type               string   `valid:"required"`
-	AdministratorsOnly bool     `valid:"-"`
-	Users              []int    `valid:"-"`
-	Teams              []int    `valid:"-"`
-	SubResourceIDs     []string `valid:"-"`
-}
-
 // handlePutResources handles PUT requests on /resources/:id
 func (handler *ResourceHandler) handlePutResources(w http.ResponseWriter, r *http.Request) {
 	vars := mux.Vars(r)
@@ -210,12 +226,6 @@ func (handler *ResourceHandler) handlePutResources(w http.ResponseWriter, r *htt
 	}
 }
 
-type putResourcesRequest struct {
-	AdministratorsOnly bool  `valid:"-"`
-	Users              []int `valid:"-"`
-	Teams              []int `valid:"-"`
-}
-
 // handleDeleteResources handles DELETE requests on /resources/:id
 func (handler *ResourceHandler) handleDeleteResources(w http.ResponseWriter, r *http.Request) {
 	vars := mux.Vars(r)

api/http/handler/settings.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/asaskevich/govalidator"
 	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/filesystem"
 	httperror "github.com/portainer/portainer/http/error"
 	"github.com/portainer/portainer/http/security"
 
@@ -20,6 +21,8 @@ type SettingsHandler struct {
 	*mux.Router
 	Logger          *log.Logger
 	SettingsService portainer.SettingsService
+	LDAPService     portainer.LDAPService
+	FileService     portainer.FileService
 }
 
 // NewSettingsHandler returns a new instance of OldSettingsHandler.
@@ -29,13 +32,44 @@ func NewSettingsHandler(bouncer *security.RequestBouncer) *SettingsHandler {
 		Logger: log.New(os.Stderr, "", log.LstdFlags),
 	}
 	h.Handle("/settings",
-		bouncer.PublicAccess(http.HandlerFunc(h.handleGetSettings))).Methods(http.MethodGet)
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleGetSettings))).Methods(http.MethodGet)
 	h.Handle("/settings",
 		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutSettings))).Methods(http.MethodPut)
+	h.Handle("/settings/public",
+		bouncer.PublicAccess(http.HandlerFunc(h.handleGetPublicSettings))).Methods(http.MethodGet)
+	h.Handle("/settings/authentication/checkLDAP",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutSettingsLDAPCheck))).Methods(http.MethodPut)
 
 	return h
 }
 
+type (
+	publicSettingsResponse struct {
+		LogoURL                            string                         `json:"LogoURL"`
+		DisplayDonationHeader              bool                           `json:"DisplayDonationHeader"`
+		DisplayExternalContributors        bool                           `json:"DisplayExternalContributors"`
+		AuthenticationMethod               portainer.AuthenticationMethod `json:"AuthenticationMethod"`
+		AllowBindMountsForRegularUsers     bool                           `json:"AllowBindMountsForRegularUsers"`
+		AllowPrivilegedModeForRegularUsers bool                           `json:"AllowPrivilegedModeForRegularUsers"`
+	}
+
+	putSettingsRequest struct {
+		TemplatesURL                       string                 `valid:"required"`
+		LogoURL                            string                 `valid:""`
+		BlackListedLabels                  []portainer.Pair       `valid:""`
+		DisplayDonationHeader              bool                   `valid:""`
+		DisplayExternalContributors        bool                   `valid:""`
+		AuthenticationMethod               int                    `valid:"required"`
+		LDAPSettings                       portainer.LDAPSettings `valid:""`
+		AllowBindMountsForRegularUsers     bool                   `valid:""`
+		AllowPrivilegedModeForRegularUsers bool                   `valid:""`
+	}
+
+	putSettingsLDAPCheckRequest struct {
+		LDAPSettings portainer.LDAPSettings `valid:""`
+	}
+)
+
 // handleGetSettings handles GET requests on /settings
 func (handler *SettingsHandler) handleGetSettings(w http.ResponseWriter, r *http.Request) {
 	settings, err := handler.SettingsService.Settings()
@@ -48,6 +82,27 @@ func (handler *SettingsHandler) handleGetSettings(w http.ResponseWriter, r *http
 	return
 }
 
+// handleGetPublicSettings handles GET requests on /settings/public
+func (handler *SettingsHandler) handleGetPublicSettings(w http.ResponseWriter, r *http.Request) {
+	settings, err := handler.SettingsService.Settings()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	publicSettings := &publicSettingsResponse{
+		LogoURL:                            settings.LogoURL,
+		DisplayDonationHeader:              settings.DisplayDonationHeader,
+		DisplayExternalContributors:        settings.DisplayExternalContributors,
+		AuthenticationMethod:               settings.AuthenticationMethod,
+		AllowBindMountsForRegularUsers:     settings.AllowBindMountsForRegularUsers,
+		AllowPrivilegedModeForRegularUsers: settings.AllowPrivilegedModeForRegularUsers,
+	}
+
+	encodeJSON(w, publicSettings, handler.Logger)
+	return
+}
+
 // handlePutSettings handles PUT requests on /settings
 func (handler *SettingsHandler) handlePutSettings(w http.ResponseWriter, r *http.Request) {
 	var req putSettingsRequest
@@ -63,10 +118,34 @@ func (handler *SettingsHandler) handlePutSettings(w http.ResponseWriter, r *http
 	}
 
 	settings := &portainer.Settings{
-		TemplatesURL:                req.TemplatesURL,
-		LogoURL:                     req.LogoURL,
-		BlackListedLabels:           req.BlackListedLabels,
-		DisplayExternalContributors: req.DisplayExternalContributors,
+		TemplatesURL:                       req.TemplatesURL,
+		LogoURL:                            req.LogoURL,
+		BlackListedLabels:                  req.BlackListedLabels,
+		DisplayDonationHeader:              req.DisplayDonationHeader,
+		DisplayExternalContributors:        req.DisplayExternalContributors,
+		LDAPSettings:                       req.LDAPSettings,
+		AllowBindMountsForRegularUsers:     req.AllowBindMountsForRegularUsers,
+		AllowPrivilegedModeForRegularUsers: req.AllowPrivilegedModeForRegularUsers,
+	}
+
+	if req.AuthenticationMethod == 1 {
+		settings.AuthenticationMethod = portainer.AuthenticationInternal
+	} else if req.AuthenticationMethod == 2 {
+		settings.AuthenticationMethod = portainer.AuthenticationLDAP
+	} else {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	if (settings.LDAPSettings.TLSConfig.TLS || settings.LDAPSettings.StartTLS) && !settings.LDAPSettings.TLSConfig.TLSSkipVerify {
+		caCertPath, _ := handler.FileService.GetPathForTLSFile(filesystem.LDAPStorePath, portainer.TLSFileCA)
+		settings.LDAPSettings.TLSConfig.TLSCACertPath = caCertPath
+	} else {
+		settings.LDAPSettings.TLSConfig.TLSCACertPath = ""
+		err := handler.FileService.DeleteTLSFiles(filesystem.LDAPStorePath)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		}
 	}
 
 	err = handler.SettingsService.StoreSettings(settings)
@@ -75,9 +154,28 @@ func (handler *SettingsHandler) handlePutSettings(w http.ResponseWriter, r *http
 	}
 }
 
-type putSettingsRequest struct {
-	TemplatesURL                string           `valid:"required"`
-	LogoURL                     string           `valid:""`
-	BlackListedLabels           []portainer.Pair `valid:""`
-	DisplayExternalContributors bool             `valid:""`
+// handlePutSettingsLDAPCheck handles PUT requests on /settings/ldap/check
+func (handler *SettingsHandler) handlePutSettingsLDAPCheck(w http.ResponseWriter, r *http.Request) {
+	var req putSettingsLDAPCheckRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	if (req.LDAPSettings.TLSConfig.TLS || req.LDAPSettings.StartTLS) && !req.LDAPSettings.TLSConfig.TLSSkipVerify {
+		caCertPath, _ := handler.FileService.GetPathForTLSFile(filesystem.LDAPStorePath, portainer.TLSFileCA)
+		req.LDAPSettings.TLSConfig.TLSCACertPath = caCertPath
+	}
+
+	err = handler.LDAPService.TestConnectivity(&req.LDAPSettings)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
 }

api/http/handler/stack.go

@@ -0,0 +1,795 @@
+package handler
+
+import (
+	"encoding/json"
+	"path"
+	"strconv"
+	"strings"
+	"sync"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/filesystem"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/proxy"
+	"github.com/portainer/portainer/http/security"
+
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+)
+
+// StackHandler represents an HTTP API handler for managing Stack.
+type StackHandler struct {
+	stackCreationMutex *sync.Mutex
+	stackDeletionMutex *sync.Mutex
+	*mux.Router
+	Logger                 *log.Logger
+	FileService            portainer.FileService
+	GitService             portainer.GitService
+	StackService           portainer.StackService
+	EndpointService        portainer.EndpointService
+	ResourceControlService portainer.ResourceControlService
+	RegistryService        portainer.RegistryService
+	DockerHubService       portainer.DockerHubService
+	StackManager           portainer.StackManager
+}
+
+type stackDeploymentConfig struct {
+	endpoint   *portainer.Endpoint
+	stack      *portainer.Stack
+	prune      bool
+	dockerhub  *portainer.DockerHub
+	registries []portainer.Registry
+}
+
+// NewStackHandler returns a new instance of StackHandler.
+func NewStackHandler(bouncer *security.RequestBouncer) *StackHandler {
+	h := &StackHandler{
+		Router:             mux.NewRouter(),
+		stackCreationMutex: &sync.Mutex{},
+		stackDeletionMutex: &sync.Mutex{},
+		Logger:             log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/{endpointId}/stacks",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePostStacks))).Methods(http.MethodPost)
+	h.Handle("/{endpointId}/stacks",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetStacks))).Methods(http.MethodGet)
+	h.Handle("/{endpointId}/stacks/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetStack))).Methods(http.MethodGet)
+	h.Handle("/{endpointId}/stacks/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleDeleteStack))).Methods(http.MethodDelete)
+	h.Handle("/{endpointId}/stacks/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePutStack))).Methods(http.MethodPut)
+	h.Handle("/{endpointId}/stacks/{id}/stackfile",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetStackFile))).Methods(http.MethodGet)
+	return h
+}
+
+type (
+	postStacksRequest struct {
+		Name             string           `valid:"required"`
+		SwarmID          string           `valid:"required"`
+		StackFileContent string           `valid:""`
+		GitRepository    string           `valid:""`
+		PathInRepository string           `valid:""`
+		Env              []portainer.Pair `valid:""`
+	}
+	postStacksResponse struct {
+		ID string `json:"Id"`
+	}
+	getStackFileResponse struct {
+		StackFileContent string `json:"StackFileContent"`
+	}
+	putStackRequest struct {
+		StackFileContent string           `valid:"required"`
+		Env              []portainer.Pair `valid:""`
+		Prune            bool             `valid:"-"`
+	}
+)
+
+// handlePostStacks handles POST requests on /:endpointId/stacks?method=<method>
+func (handler *StackHandler) handlePostStacks(w http.ResponseWriter, r *http.Request) {
+	method := r.FormValue("method")
+	if method == "" {
+		httperror.WriteErrorResponse(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	if method == "string" {
+		handler.handlePostStacksStringMethod(w, r)
+	} else if method == "repository" {
+		handler.handlePostStacksRepositoryMethod(w, r)
+	} else if method == "file" {
+		handler.handlePostStacksFileMethod(w, r)
+	} else {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+}
+
+func (handler *StackHandler) handlePostStacksStringMethod(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id, err := strconv.Atoi(vars["endpointId"])
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+	endpointID := portainer.EndpointID(id)
+
+	endpoint, err := handler.EndpointService.Endpoint(endpointID)
+	if err == portainer.ErrEndpointNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	var req postStacksRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	stackName := req.Name
+	if stackName == "" {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	stackFileContent := req.StackFileContent
+	if stackFileContent == "" {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	swarmID := req.SwarmID
+	if swarmID == "" {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	stacks, err := handler.StackService.Stacks()
+	if err != nil && err != portainer.ErrStackNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	for _, stack := range stacks {
+		if strings.EqualFold(stack.Name, stackName) {
+			httperror.WriteErrorResponse(w, portainer.ErrStackAlreadyExists, http.StatusConflict, handler.Logger)
+			return
+		}
+	}
+
+	stack := &portainer.Stack{
+		ID:         portainer.StackID(stackName + "_" + swarmID),
+		Name:       stackName,
+		SwarmID:    swarmID,
+		EntryPoint: filesystem.ComposeFileDefaultName,
+		Env:        req.Env,
+	}
+
+	projectPath, err := handler.FileService.StoreStackFileFromString(string(stack.ID), stackFileContent)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	stack.ProjectPath = projectPath
+
+	err = handler.StackService.CreateStack(stack)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	dockerhub, err := handler.DockerHubService.DockerHub()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	registries, err := handler.RegistryService.Registries()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	filteredRegistries, err := security.FilterRegistries(registries, securityContext)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	config := stackDeploymentConfig{
+		stack:      stack,
+		endpoint:   endpoint,
+		dockerhub:  dockerhub,
+		registries: filteredRegistries,
+		prune:      false,
+	}
+	err = handler.deployStack(&config)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &postStacksResponse{ID: string(stack.ID)}, handler.Logger)
+}
+
+func (handler *StackHandler) handlePostStacksRepositoryMethod(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id, err := strconv.Atoi(vars["endpointId"])
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+	endpointID := portainer.EndpointID(id)
+
+	endpoint, err := handler.EndpointService.Endpoint(endpointID)
+	if err == portainer.ErrEndpointNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	var req postStacksRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	stackName := req.Name
+	if stackName == "" {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	swarmID := req.SwarmID
+	if swarmID == "" {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	if req.GitRepository == "" {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	if req.PathInRepository == "" {
+		req.PathInRepository = filesystem.ComposeFileDefaultName
+	}
+
+	stacks, err := handler.StackService.Stacks()
+	if err != nil && err != portainer.ErrStackNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	for _, stack := range stacks {
+		if strings.EqualFold(stack.Name, stackName) {
+			httperror.WriteErrorResponse(w, portainer.ErrStackAlreadyExists, http.StatusConflict, handler.Logger)
+			return
+		}
+	}
+
+	stack := &portainer.Stack{
+		ID:         portainer.StackID(stackName + "_" + swarmID),
+		Name:       stackName,
+		SwarmID:    swarmID,
+		EntryPoint: req.PathInRepository,
+		Env:        req.Env,
+	}
+
+	projectPath := handler.FileService.GetStackProjectPath(string(stack.ID))
+	stack.ProjectPath = projectPath
+
+	// Ensure projectPath is empty
+	err = handler.FileService.RemoveDirectory(projectPath)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.GitService.CloneRepository(req.GitRepository, projectPath)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.StackService.CreateStack(stack)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	dockerhub, err := handler.DockerHubService.DockerHub()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	registries, err := handler.RegistryService.Registries()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	filteredRegistries, err := security.FilterRegistries(registries, securityContext)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	config := stackDeploymentConfig{
+		stack:      stack,
+		endpoint:   endpoint,
+		dockerhub:  dockerhub,
+		registries: filteredRegistries,
+		prune:      false,
+	}
+	err = handler.deployStack(&config)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &postStacksResponse{ID: string(stack.ID)}, handler.Logger)
+}
+
+func (handler *StackHandler) handlePostStacksFileMethod(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id, err := strconv.Atoi(vars["endpointId"])
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+	endpointID := portainer.EndpointID(id)
+
+	endpoint, err := handler.EndpointService.Endpoint(endpointID)
+	if err == portainer.ErrEndpointNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	stackName := r.FormValue("Name")
+	if stackName == "" {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	swarmID := r.FormValue("SwarmID")
+	if swarmID == "" {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	envParam := r.FormValue("Env")
+	var env []portainer.Pair
+	if err = json.Unmarshal([]byte(envParam), &env); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	stackFile, _, err := r.FormFile("file")
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	defer stackFile.Close()
+
+	stacks, err := handler.StackService.Stacks()
+	if err != nil && err != portainer.ErrStackNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	for _, stack := range stacks {
+		if strings.EqualFold(stack.Name, stackName) {
+			httperror.WriteErrorResponse(w, portainer.ErrStackAlreadyExists, http.StatusConflict, handler.Logger)
+			return
+		}
+	}
+
+	stack := &portainer.Stack{
+		ID:         portainer.StackID(stackName + "_" + swarmID),
+		Name:       stackName,
+		SwarmID:    swarmID,
+		EntryPoint: filesystem.ComposeFileDefaultName,
+		Env:        env,
+	}
+
+	projectPath, err := handler.FileService.StoreStackFileFromReader(string(stack.ID), stackFile)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	stack.ProjectPath = projectPath
+
+	err = handler.StackService.CreateStack(stack)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	dockerhub, err := handler.DockerHubService.DockerHub()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	registries, err := handler.RegistryService.Registries()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	filteredRegistries, err := security.FilterRegistries(registries, securityContext)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	config := stackDeploymentConfig{
+		stack:      stack,
+		endpoint:   endpoint,
+		dockerhub:  dockerhub,
+		registries: filteredRegistries,
+		prune:      false,
+	}
+	err = handler.deployStack(&config)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &postStacksResponse{ID: string(stack.ID)}, handler.Logger)
+}
+
+// handleGetStacks handles GET requests on /:endpointId/stacks?swarmId=<swarmId>
+func (handler *StackHandler) handleGetStacks(w http.ResponseWriter, r *http.Request) {
+	swarmID := r.FormValue("swarmId")
+
+	vars := mux.Vars(r)
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	id, err := strconv.Atoi(vars["endpointId"])
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+	endpointID := portainer.EndpointID(id)
+
+	_, err = handler.EndpointService.Endpoint(endpointID)
+	if err == portainer.ErrEndpointNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	var stacks []portainer.Stack
+	if swarmID == "" {
+		stacks, err = handler.StackService.Stacks()
+	} else {
+		stacks, err = handler.StackService.StacksBySwarmID(swarmID)
+	}
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	resourceControls, err := handler.ResourceControlService.ResourceControls()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	filteredStacks := proxy.FilterStacks(stacks, resourceControls, securityContext.IsAdmin,
+		securityContext.UserID, securityContext.UserMemberships)
+
+	encodeJSON(w, filteredStacks, handler.Logger)
+}
+
+// handleGetStack handles GET requests on /:endpointId/stacks/:id
+func (handler *StackHandler) handleGetStack(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	stackID := vars["id"]
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	endpointID, err := strconv.Atoi(vars["endpointId"])
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
+	if err == portainer.ErrEndpointNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	stack, err := handler.StackService.Stack(portainer.StackID(stackID))
+	if err == portainer.ErrStackNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	resourceControl, err := handler.ResourceControlService.ResourceControlByResourceID(stack.Name)
+	if err != nil && err != portainer.ErrResourceControlNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	extendedStack := proxy.ExtendedStack{*stack, portainer.ResourceControl{}}
+	if resourceControl != nil {
+		if securityContext.IsAdmin || proxy.CanAccessStack(stack, resourceControl, securityContext.UserID, securityContext.UserMemberships) {
+			extendedStack.ResourceControl = *resourceControl
+		} else {
+			httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+			return
+		}
+	}
+
+	encodeJSON(w, extendedStack, handler.Logger)
+}
+
+// handlePutStack handles PUT requests on /:endpointId/stacks/:id
+func (handler *StackHandler) handlePutStack(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	stackID := vars["id"]
+
+	endpointID, err := strconv.Atoi(vars["endpointId"])
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
+	if err == portainer.ErrEndpointNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	stack, err := handler.StackService.Stack(portainer.StackID(stackID))
+	if err == portainer.ErrStackNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	var req putStackRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+	stack.Env = req.Env
+
+	_, err = handler.FileService.StoreStackFileFromString(string(stack.ID), req.StackFileContent)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.StackService.UpdateStack(stack.ID, stack)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	dockerhub, err := handler.DockerHubService.DockerHub()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	registries, err := handler.RegistryService.Registries()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	filteredRegistries, err := security.FilterRegistries(registries, securityContext)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	config := stackDeploymentConfig{
+		stack:      stack,
+		endpoint:   endpoint,
+		dockerhub:  dockerhub,
+		registries: filteredRegistries,
+		prune:      req.Prune,
+	}
+	err = handler.deployStack(&config)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+// handleGetStackFile handles GET requests on /:endpointId/stacks/:id/stackfile
+func (handler *StackHandler) handleGetStackFile(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	stackID := vars["id"]
+
+	endpointID, err := strconv.Atoi(vars["endpointId"])
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
+	if err == portainer.ErrEndpointNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	stack, err := handler.StackService.Stack(portainer.StackID(stackID))
+	if err == portainer.ErrStackNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	stackFileContent, err := handler.FileService.GetFileContent(path.Join(stack.ProjectPath, stack.EntryPoint))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &getStackFileResponse{StackFileContent: stackFileContent}, handler.Logger)
+}
+
+// handleDeleteStack handles DELETE requests on /:endpointId/stacks/:id
+func (handler *StackHandler) handleDeleteStack(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	stackID := vars["id"]
+
+	endpointID, err := strconv.Atoi(vars["endpointId"])
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
+	if err == portainer.ErrEndpointNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	stack, err := handler.StackService.Stack(portainer.StackID(stackID))
+	if err == portainer.ErrStackNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	handler.stackDeletionMutex.Lock()
+	err = handler.StackManager.Remove(stack, endpoint)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	handler.stackDeletionMutex.Unlock()
+
+	err = handler.StackService.DeleteStack(portainer.StackID(stackID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.FileService.RemoveDirectory(stack.ProjectPath)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+func (handler *StackHandler) deployStack(config *stackDeploymentConfig) error {
+	handler.stackCreationMutex.Lock()
+
+	err := handler.StackManager.Login(config.dockerhub, config.registries, config.endpoint)
+	if err != nil {
+		handler.stackCreationMutex.Unlock()
+		return err
+	}
+
+	err = handler.StackManager.Deploy(config.stack, config.prune, config.endpoint)
+	if err != nil {
+		handler.stackCreationMutex.Unlock()
+		return err
+	}
+
+	err = handler.StackManager.Logout(config.endpoint)
+	if err != nil {
+		handler.stackCreationMutex.Unlock()
+		return err
+	}
+
+	handler.stackCreationMutex.Unlock()
+	return nil
+}

api/http/handler/team.go

@@ -34,7 +34,7 @@ func NewTeamHandler(bouncer *security.RequestBouncer) *TeamHandler {
 	h.Handle("/teams",
 		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePostTeams))).Methods(http.MethodPost)
 	h.Handle("/teams",
-		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handleGetTeams))).Methods(http.MethodGet)
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetTeams))).Methods(http.MethodGet)
 	h.Handle("/teams/{id}",
 		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetTeam))).Methods(http.MethodGet)
 	h.Handle("/teams/{id}",
@@ -47,6 +47,20 @@ func NewTeamHandler(bouncer *security.RequestBouncer) *TeamHandler {
 	return h
 }
 
+type (
+	postTeamsRequest struct {
+		Name string `valid:"required"`
+	}
+
+	postTeamsResponse struct {
+		ID int `json:"Id"`
+	}
+
+	putTeamRequest struct {
+		Name string `valid:"-"`
+	}
+)
+
 // handlePostTeams handles POST requests on /teams
 func (handler *TeamHandler) handlePostTeams(w http.ResponseWriter, r *http.Request) {
 	var req postTeamsRequest
@@ -84,23 +98,23 @@ func (handler *TeamHandler) handlePostTeams(w http.ResponseWriter, r *http.Reque
 	encodeJSON(w, &postTeamsResponse{ID: int(team.ID)}, handler.Logger)
 }
 
-type postTeamsResponse struct {
-	ID int `json:"Id"`
-}
-
-type postTeamsRequest struct {
-	Name string `valid:"required"`
-}
-
 // handleGetTeams handles GET requests on /teams
 func (handler *TeamHandler) handleGetTeams(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
 	teams, err := handler.TeamService.Teams()
 	if err != nil {
 		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
-	encodeJSON(w, teams, handler.Logger)
+	filteredTeams := security.FilterUserTeams(teams, securityContext)
+
+	encodeJSON(w, filteredTeams, handler.Logger)
 }
 
 // handleGetTeam handles GET requests on /teams/:id
@@ -181,10 +195,6 @@ func (handler *TeamHandler) handlePutTeam(w http.ResponseWriter, r *http.Request
 	}
 }
 
-type putTeamRequest struct {
-	Name string `valid:"-"`
-}
-
 // handleDeleteTeam handles DELETE requests on /teams/:id
 func (handler *TeamHandler) handleDeleteTeam(w http.ResponseWriter, r *http.Request) {
 	vars := mux.Vars(r)

api/http/handler/team_membership.go

@@ -42,6 +42,24 @@ func NewTeamMembershipHandler(bouncer *security.RequestBouncer) *TeamMembershipH
 	return h
 }
 
+type (
+	postTeamMembershipsRequest struct {
+		UserID int `valid:"required"`
+		TeamID int `valid:"required"`
+		Role   int `valid:"required"`
+	}
+
+	postTeamMembershipsResponse struct {
+		ID int `json:"Id"`
+	}
+
+	putTeamMembershipRequest struct {
+		UserID int `valid:"required"`
+		TeamID int `valid:"required"`
+		Role   int `valid:"required"`
+	}
+)
+
 // handlePostTeamMemberships handles POST requests on /team_memberships
 func (handler *TeamMembershipHandler) handlePostTeamMemberships(w http.ResponseWriter, r *http.Request) {
 	securityContext, err := security.RetrieveRestrictedRequestContext(r)
@@ -100,16 +118,6 @@ func (handler *TeamMembershipHandler) handlePostTeamMemberships(w http.ResponseW
 	encodeJSON(w, &postTeamMembershipsResponse{ID: int(membership.ID)}, handler.Logger)
 }
 
-type postTeamMembershipsResponse struct {
-	ID int `json:"Id"`
-}
-
-type postTeamMembershipsRequest struct {
-	UserID int `valid:"required"`
-	TeamID int `valid:"required"`
-	Role   int `valid:"required"`
-}
-
 // handleGetTeamsMemberships handles GET requests on /team_memberships
 func (handler *TeamMembershipHandler) handleGetTeamsMemberships(w http.ResponseWriter, r *http.Request) {
 	securityContext, err := security.RetrieveRestrictedRequestContext(r)
@@ -195,12 +203,6 @@ func (handler *TeamMembershipHandler) handlePutTeamMembership(w http.ResponseWri
 	}
 }
 
-type putTeamMembershipRequest struct {
-	UserID int `valid:"required"`
-	TeamID int `valid:"required"`
-	Role   int `valid:"required"`
-}
-
 // handleDeleteTeamMembership handles DELETE requests on /team_memberships/:id
 func (handler *TeamMembershipHandler) handleDeleteTeamMembership(w http.ResponseWriter, r *http.Request) {
 	vars := mux.Vars(r)

api/http/handler/templates.go

@@ -20,7 +20,7 @@ type TemplatesHandler struct {
 }
 
 const (
-	containerTemplatesURLLinuxServerIo = "http://tools.linuxserver.io/portainer.json"
+	containerTemplatesURLLinuxServerIo = "https://tools.linuxserver.io/portainer.json"
 )
 
 // NewTemplatesHandler returns a new instance of TemplatesHandler.
@@ -30,17 +30,12 @@ func NewTemplatesHandler(bouncer *security.RequestBouncer) *TemplatesHandler {
 		Logger: log.New(os.Stderr, "", log.LstdFlags),
 	}
 	h.Handle("/templates",
-		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handleGetTemplates)))
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handleGetTemplates))).Methods(http.MethodGet)
 	return h
 }
 
 // handleGetTemplates handles GET requests on /templates?key=<key>
 func (handler *TemplatesHandler) handleGetTemplates(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodGet})
-		return
-	}
-
 	key := r.FormValue("key")
 	if key == "" {
 		httperror.WriteErrorResponse(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
@@ -48,16 +43,17 @@ func (handler *TemplatesHandler) handleGetTemplates(w http.ResponseWriter, r *ht
 	}
 
 	var templatesURL string
-	if key == "containers" {
+	switch key {
+	case "containers":
 		settings, err := handler.SettingsService.Settings()
 		if err != nil {
 			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 			return
 		}
 		templatesURL = settings.TemplatesURL
-	} else if key == "linuxserver.io" {
+	case "linuxserver.io":
 		templatesURL = containerTemplatesURLLinuxServerIo
-	} else {
+	default:
 		httperror.WriteErrorResponse(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
 		return
 	}

api/http/handler/upload.go

@@ -8,7 +8,6 @@ import (
 	"log"
 	"net/http"
 	"os"
-	"strconv"
 
 	"github.com/gorilla/mux"
 )
@@ -26,23 +25,19 @@ func NewUploadHandler(bouncer *security.RequestBouncer) *UploadHandler {
 		Router: mux.NewRouter(),
 		Logger: log.New(os.Stderr, "", log.LstdFlags),
 	}
-	h.Handle("/upload/tls/{endpointID}/{certificate:(?:ca|cert|key)}",
-		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handlePostUploadTLS)))
+	h.Handle("/upload/tls/{certificate:(?:ca|cert|key)}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePostUploadTLS))).Methods(http.MethodPost)
 	return h
 }
 
+// handlePostUploadTLS handles POST requests on /upload/tls/{certificate:(?:ca|cert|key)}?folder=<folder>
 func (handler *UploadHandler) handlePostUploadTLS(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodPost})
-		return
-	}
-
 	vars := mux.Vars(r)
-	endpointID := vars["endpointID"]
 	certificate := vars["certificate"]
-	ID, err := strconv.Atoi(endpointID)
-	if err != nil {
-		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+
+	folder := r.FormValue("folder")
+	if folder == "" {
+		httperror.WriteErrorResponse(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
 		return
 	}
 
@@ -66,7 +61,7 @@ func (handler *UploadHandler) handlePostUploadTLS(w http.ResponseWriter, r *http
 		return
 	}
 
-	err = handler.FileService.StoreTLSFile(portainer.EndpointID(ID), fileType, file)
+	err = handler.FileService.StoreTLSFile(folder, fileType, file)
 	if err != nil {
 		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return

api/http/handler/user.go

@@ -26,6 +26,7 @@ type UserHandler struct {
 	TeamMembershipService  portainer.TeamMembershipService
 	ResourceControlService portainer.ResourceControlService
 	CryptoService          portainer.CryptoService
+	SettingsService        portainer.SettingsService
 }
 
 // NewUserHandler returns a new instance of UserHandler.
@@ -46,18 +47,46 @@ func NewUserHandler(bouncer *security.RequestBouncer) *UserHandler {
 		bouncer.AdministratorAccess(http.HandlerFunc(h.handleDeleteUser))).Methods(http.MethodDelete)
 	h.Handle("/users/{id}/memberships",
 		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handleGetMemberships))).Methods(http.MethodGet)
-	h.Handle("/users/{id}/teams",
-		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetTeams))).Methods(http.MethodGet)
 	h.Handle("/users/{id}/passwd",
-		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handlePostUserPasswd)))
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handlePostUserPasswd))).Methods(http.MethodPost)
 	h.Handle("/users/admin/check",
-		bouncer.PublicAccess(http.HandlerFunc(h.handleGetAdminCheck)))
+		bouncer.PublicAccess(http.HandlerFunc(h.handleGetAdminCheck))).Methods(http.MethodGet)
 	h.Handle("/users/admin/init",
-		bouncer.PublicAccess(http.HandlerFunc(h.handlePostAdminInit)))
+		bouncer.PublicAccess(http.HandlerFunc(h.handlePostAdminInit))).Methods(http.MethodPost)
 
 	return h
 }
 
+type (
+	postUsersRequest struct {
+		Username string `valid:"required"`
+		Password string `valid:""`
+		Role     int    `valid:"required"`
+	}
+
+	postUsersResponse struct {
+		ID int `json:"Id"`
+	}
+
+	postUserPasswdRequest struct {
+		Password string `valid:"required"`
+	}
+
+	postUserPasswdResponse struct {
+		Valid bool `json:"valid"`
+	}
+
+	putUserRequest struct {
+		Password string `valid:"-"`
+		Role     int    `valid:"-"`
+	}
+
+	postAdminInitRequest struct {
+		Username string `valid:"required"`
+		Password string `valid:"required"`
+	}
+)
+
 // handlePostUsers handles POST requests on /users
 func (handler *UserHandler) handlePostUsers(w http.ResponseWriter, r *http.Request) {
 	var req postUsersRequest
@@ -93,13 +122,6 @@ func (handler *UserHandler) handlePostUsers(w http.ResponseWriter, r *http.Reque
 		return
 	}
 
-	var role portainer.UserRole
-	if req.Role == 1 {
-		role = portainer.AdministratorRole
-	} else {
-		role = portainer.StandardUserRole
-	}
-
 	user, err := handler.UserService.UserByUsername(req.Username)
 	if err != nil && err != portainer.ErrUserNotFound {
 		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
@@ -110,16 +132,32 @@ func (handler *UserHandler) handlePostUsers(w http.ResponseWriter, r *http.Reque
 		return
 	}
 
+	var role portainer.UserRole
+	if req.Role == 1 {
+		role = portainer.AdministratorRole
+	} else {
+		role = portainer.StandardUserRole
+	}
+
 	user = &portainer.User{
 		Username: req.Username,
 		Role:     role,
 	}
-	user.Password, err = handler.CryptoService.Hash(req.Password)
+
+	settings, err := handler.SettingsService.Settings()
 	if err != nil {
-		httperror.WriteErrorResponse(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 		return
 	}
 
+	if settings.AuthenticationMethod == portainer.AuthenticationInternal {
+		user.Password, err = handler.CryptoService.Hash(req.Password)
+		if err != nil {
+			httperror.WriteErrorResponse(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
+			return
+		}
+	}
+
 	err = handler.UserService.CreateUser(user)
 	if err != nil {
 		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
@@ -129,16 +167,6 @@ func (handler *UserHandler) handlePostUsers(w http.ResponseWriter, r *http.Reque
 	encodeJSON(w, &postUsersResponse{ID: int(user.ID)}, handler.Logger)
 }
 
-type postUsersResponse struct {
-	ID int `json:"Id"`
-}
-
-type postUsersRequest struct {
-	Username string `valid:"required"`
-	Password string `valid:"required"`
-	Role     int    `valid:"required"`
-}
-
 // handleGetUsers handles GET requests on /users
 func (handler *UserHandler) handleGetUsers(w http.ResponseWriter, r *http.Request) {
 	securityContext, err := security.RetrieveRestrictedRequestContext(r)
@@ -164,11 +192,6 @@ func (handler *UserHandler) handleGetUsers(w http.ResponseWriter, r *http.Reques
 
 // handlePostUserPasswd handles POST requests on /users/:id/passwd
 func (handler *UserHandler) handlePostUserPasswd(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodPost})
-		return
-	}
-
 	vars := mux.Vars(r)
 	id := vars["id"]
 
@@ -210,14 +233,6 @@ func (handler *UserHandler) handlePostUserPasswd(w http.ResponseWriter, r *http.
 	encodeJSON(w, &postUserPasswdResponse{Valid: valid}, handler.Logger)
 }
 
-type postUserPasswdRequest struct {
-	Password string `valid:"required"`
-}
-
-type postUserPasswdResponse struct {
-	Valid bool `json:"valid"`
-}
-
 // handleGetUser handles GET requests on /users/:id
 func (handler *UserHandler) handleGetUser(w http.ResponseWriter, r *http.Request) {
 	vars := mux.Vars(r)
@@ -317,18 +332,8 @@ func (handler *UserHandler) handlePutUser(w http.ResponseWriter, r *http.Request
 	}
 }
 
-type putUserRequest struct {
-	Password string `valid:"-"`
-	Role     int    `valid:"-"`
-}
-
-// handlePostAdminInit handles GET requests on /users/admin/check
+// handleGetAdminCheck handles GET requests on /users/admin/check
 func (handler *UserHandler) handleGetAdminCheck(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodGet})
-		return
-	}
-
 	users, err := handler.UserService.UsersByRole(portainer.AdministratorRole)
 	if err != nil {
 		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
@@ -342,11 +347,6 @@ func (handler *UserHandler) handleGetAdminCheck(w http.ResponseWriter, r *http.R
 
 // handlePostAdminInit handles POST requests on /users/admin/init
 func (handler *UserHandler) handlePostAdminInit(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodPost})
-		return
-	}
-
 	var req postAdminInitRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
@@ -359,10 +359,14 @@ func (handler *UserHandler) handlePostAdminInit(w http.ResponseWriter, r *http.R
 		return
 	}
 
-	user, err := handler.UserService.UserByUsername("admin")
-	if err == portainer.ErrUserNotFound {
+	users, err := handler.UserService.UsersByRole(portainer.AdministratorRole)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if len(users) == 0 {
 		user := &portainer.User{
-			Username: "admin",
+			Username: req.Username,
 			Role:     portainer.AdministratorRole,
 		}
 		user.Password, err = handler.CryptoService.Hash(req.Password)
@@ -376,18 +380,10 @@ func (handler *UserHandler) handlePostAdminInit(w http.ResponseWriter, r *http.R
 			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
 			return
 		}
-	} else if err != nil {
-		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+	} else {
+		httperror.WriteErrorResponse(w, portainer.ErrAdminAlreadyInitialized, http.StatusConflict, handler.Logger)
 		return
 	}
-	if user != nil {
-		httperror.WriteErrorResponse(w, portainer.ErrAdminAlreadyInitialized, http.StatusForbidden, handler.Logger)
-		return
-	}
-}
-
-type postAdminInitRequest struct {
-	Password string `valid:"required"`
 }
 
 // handleDeleteUser handles DELETE requests on /users/:id
@@ -401,6 +397,22 @@ func (handler *UserHandler) handleDeleteUser(w http.ResponseWriter, r *http.Requ
 		return
 	}
 
+	if userID == 1 {
+		httperror.WriteErrorResponse(w, portainer.ErrCannotRemoveAdmin, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if tokenData.ID == portainer.UserID(userID) {
+		httperror.WriteErrorResponse(w, portainer.ErrAdminCannotRemoveSelf, http.StatusForbidden, handler.Logger)
+		return
+	}
+
 	_, err = handler.UserService.User(portainer.UserID(userID))
 
 	if err == portainer.ErrUserNotFound {
@@ -454,37 +466,3 @@ func (handler *UserHandler) handleGetMemberships(w http.ResponseWriter, r *http.
 
 	encodeJSON(w, memberships, handler.Logger)
 }
-
-// handleGetTeams handles GET requests on /users/:id/teams
-func (handler *UserHandler) handleGetTeams(w http.ResponseWriter, r *http.Request) {
-	vars := mux.Vars(r)
-	id := vars["id"]
-
-	uid, err := strconv.Atoi(id)
-	if err != nil {
-		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
-		return
-	}
-	userID := portainer.UserID(uid)
-
-	securityContext, err := security.RetrieveRestrictedRequestContext(r)
-	if err != nil {
-		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	if !security.AuthorizedUserManagement(userID, securityContext) {
-		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
-		return
-	}
-
-	teams, err := handler.TeamService.Teams()
-	if err != nil {
-		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
-		return
-	}
-
-	filteredTeams := security.FilterUserTeams(teams, securityContext)
-
-	encodeJSON(w, filteredTeams, handler.Logger)
-}

api/http/handler/websocket.go

@@ -69,12 +69,10 @@ func (handler *WebSocketHandler) webSocketDockerExec(ws *websocket.Conn) {
 		host = endpointURL.Path
 	}
 
-	// Should not be managed here
+	// TODO: Should not be managed here
 	var tlsConfig *tls.Config
-	if endpoint.TLS {
-		tlsConfig, err = crypto.CreateTLSConfiguration(endpoint.TLSCACertPath,
-			endpoint.TLSCertPath,
-			endpoint.TLSKeyPath)
+	if endpoint.TLSConfig.TLS {
+		tlsConfig, err = crypto.CreateTLSConfiguration(&endpoint.TLSConfig)
 		if err != nil {
 			log.Fatalf("Unable to create TLS configuration: %s", err)
 			return

api/http/health_check.go

@@ -0,0 +1,11 @@
+package http
+
+import (
+	"net/http"
+)
+
+// HealthCheck GETs /api/status
+func HealthCheck(addr string) (int, error) {
+	resp, err := http.Get("http://" + addr + "/api/status")
+	return resp.StatusCode, err
+}

api/http/proxy/access_control.go

@@ -2,6 +2,83 @@ package proxy
 
 import "github.com/portainer/portainer"
 
+type (
+	// ExtendedStack represents a stack combined with its associated access control
+	ExtendedStack struct {
+		portainer.Stack
+		ResourceControl portainer.ResourceControl `json:"ResourceControl"`
+	}
+)
+
+// applyResourceAccessControl returns an optionally decorated object as the first return value and the
+// access level for the user (granted or denied) as the second return value.
+// It will retrieve an identifier from the labels object. If an identifier exists, it will check for
+// an existing resource control associated to it.
+// Returns a decorated object and authorized access (true) when a resource control is found and the user can access the resource.
+// Returns the original object and authorized access (true) when no resource control is found.
+// Returns the original object and denied access (false) when a resource control is found and the user cannot access the resource.
+func applyResourceAccessControlFromLabel(labelsObject, resourceObject map[string]interface{}, labelIdentifier string,
+	context *restrictedOperationContext) (map[string]interface{}, bool) {
+
+	if labelsObject != nil && labelsObject[labelIdentifier] != nil {
+		resourceIdentifier := labelsObject[labelIdentifier].(string)
+		return applyResourceAccessControl(resourceObject, resourceIdentifier, context)
+	}
+	return resourceObject, true
+}
+
+// applyResourceAccessControl returns an optionally decorated object as the first return value and the
+// access level for the user (granted or denied) as the second return value.
+// Returns a decorated object and authorized access (true) when a resource control is found to the specified resource
+// identifier and the user can access the resource.
+// Returns the original object and authorized access (true) when no resource control is found for the specified
+// resource identifier.
+// Returns the original object and denied access (false) when a resource control is associated to the resource
+// and the user cannot access the resource.
+func applyResourceAccessControl(resourceObject map[string]interface{}, resourceIdentifier string,
+	context *restrictedOperationContext) (map[string]interface{}, bool) {
+
+	authorizedAccess := true
+
+	resourceControl := getResourceControlByResourceID(resourceIdentifier, context.resourceControls)
+	if resourceControl != nil {
+		if context.isAdmin || canUserAccessResource(context.userID, context.userTeamIDs, resourceControl) {
+			resourceObject = decorateObject(resourceObject, resourceControl)
+		} else {
+			authorizedAccess = false
+		}
+	}
+
+	return resourceObject, authorizedAccess
+}
+
+// decorateResourceWithAccessControlFromLabel will retrieve an identifier from the labels object. If an identifier exists,
+// it will check for an existing resource control associated to it. If a resource control is found, the resource object will be
+// decorated. If no identifier can be found in the labels or no resource control is associated to the identifier, the resource
+// object will not be changed.
+func decorateResourceWithAccessControlFromLabel(labelsObject, resourceObject map[string]interface{}, labelIdentifier string,
+	resourceControls []portainer.ResourceControl) map[string]interface{} {
+
+	if labelsObject != nil && labelsObject[labelIdentifier] != nil {
+		resourceIdentifier := labelsObject[labelIdentifier].(string)
+		resourceObject = decorateResourceWithAccessControl(resourceObject, resourceIdentifier, resourceControls)
+	}
+
+	return resourceObject
+}
+
+// decorateResourceWithAccessControl will check if a resource control is associated to the specified resource identifier.
+// If a resource control is found, the resource object will be decorated, otherwise it will not be changed.
+func decorateResourceWithAccessControl(resourceObject map[string]interface{}, resourceIdentifier string,
+	resourceControls []portainer.ResourceControl) map[string]interface{} {
+
+	resourceControl := getResourceControlByResourceID(resourceIdentifier, resourceControls)
+	if resourceControl != nil {
+		return decorateObject(resourceObject, resourceControl)
+	}
+	return resourceObject
+}
+
 func canUserAccessResource(userID portainer.UserID, userTeamIDs []portainer.TeamID, resourceControl *portainer.ResourceControl) bool {
 	for _, authorizedUserAccess := range resourceControl.UserAccesses {
 		if userID == authorizedUserAccess.UserID {
@@ -19,3 +96,63 @@ func canUserAccessResource(userID portainer.UserID, userTeamIDs []portainer.Team
 
 	return false
 }
+
+func decorateObject(object map[string]interface{}, resourceControl *portainer.ResourceControl) map[string]interface{} {
+	metadata := make(map[string]interface{})
+	metadata["ResourceControl"] = resourceControl
+	object["Portainer"] = metadata
+	return object
+}
+
+func getResourceControlByResourceID(resourceID string, resourceControls []portainer.ResourceControl) *portainer.ResourceControl {
+	for _, resourceControl := range resourceControls {
+		if resourceID == resourceControl.ResourceID {
+			return &resourceControl
+		}
+		for _, subResourceID := range resourceControl.SubResourceIDs {
+			if resourceID == subResourceID {
+				return &resourceControl
+			}
+		}
+	}
+	return nil
+}
+
+// CanAccessStack checks if a user can access a stack
+func CanAccessStack(stack *portainer.Stack, resourceControl *portainer.ResourceControl, userID portainer.UserID, memberships []portainer.TeamMembership) bool {
+	userTeamIDs := make([]portainer.TeamID, 0)
+	for _, membership := range memberships {
+		userTeamIDs = append(userTeamIDs, membership.TeamID)
+	}
+
+	if canUserAccessResource(userID, userTeamIDs, resourceControl) {
+		return true
+	}
+
+	return false
+}
+
+// FilterStacks filters stacks based on user role and resource controls.
+func FilterStacks(stacks []portainer.Stack, resourceControls []portainer.ResourceControl, isAdmin bool,
+	userID portainer.UserID, memberships []portainer.TeamMembership) []ExtendedStack {
+
+	filteredStacks := make([]ExtendedStack, 0)
+
+	userTeamIDs := make([]portainer.TeamID, 0)
+	for _, membership := range memberships {
+		userTeamIDs = append(userTeamIDs, membership.TeamID)
+	}
+
+	for _, stack := range stacks {
+		extendedStack := ExtendedStack{stack, portainer.ResourceControl{}}
+		resourceControl := getResourceControlByResourceID(stack.Name, resourceControls)
+		if resourceControl == nil {
+			filteredStacks = append(filteredStacks, extendedStack)
+		} else if resourceControl != nil && (isAdmin || canUserAccessResource(userID, userTeamIDs, resourceControl)) {
+			extendedStack.ResourceControl = *resourceControl
+			filteredStacks = append(filteredStacks, extendedStack)
+		}
+	}
+
+	return filteredStacks
+}

api/http/proxy/configs.go

@@ -0,0 +1,107 @@
+package proxy
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrDockerConfigIdentifierNotFound defines an error raised when Portainer is unable to find a config identifier
+	ErrDockerConfigIdentifierNotFound = portainer.Error("Docker config identifier not found")
+	configIdentifier                  = "ID"
+)
+
+// configListOperation extracts the response as a JSON object, loop through the configs array
+// decorate and/or filter the configs based on resource controls before rewriting the response
+func configListOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	var err error
+
+	// ConfigList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.30/#operation/ConfigList
+	responseArray, err := getResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	if executor.operationContext.isAdmin {
+		responseArray, err = decorateConfigList(responseArray, executor.operationContext.resourceControls)
+	} else {
+		responseArray, err = filterConfigList(responseArray, executor.operationContext)
+	}
+	if err != nil {
+		return err
+	}
+
+	return rewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// configInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the config based on resource control (check are done based on the configID and optional Swarm service ID)
+// and either rewrite an access denied response or a decorated config.
+func configInspectOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	// ConfigInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.30/#operation/ConfigInspect
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	if responseObject[configIdentifier] == nil {
+		return ErrDockerConfigIdentifierNotFound
+	}
+
+	configID := responseObject[configIdentifier].(string)
+	responseObject, access := applyResourceAccessControl(responseObject, configID, executor.operationContext)
+	if !access {
+		return rewriteAccessDeniedResponse(response)
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}
+
+// decorateConfigList loops through all configs and decorates any config with an existing resource control.
+// Resource controls checks are based on: resource identifier.
+// Config object schema reference: https://docs.docker.com/engine/api/v1.30/#operation/ConfigList
+func decorateConfigList(configData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
+	decoratedConfigData := make([]interface{}, 0)
+
+	for _, config := range configData {
+
+		configObject := config.(map[string]interface{})
+		if configObject[configIdentifier] == nil {
+			return nil, ErrDockerConfigIdentifierNotFound
+		}
+
+		configID := configObject[configIdentifier].(string)
+		configObject = decorateResourceWithAccessControl(configObject, configID, resourceControls)
+
+		decoratedConfigData = append(decoratedConfigData, configObject)
+	}
+
+	return decoratedConfigData, nil
+}
+
+// filterConfigList loops through all configs and filters public configs (no associated resource control)
+// as well as authorized configs (access granted to the user based on existing resource control).
+// Authorized configs are decorated during the process.
+// Resource controls checks are based on: resource identifier.
+// Config object schema reference: https://docs.docker.com/engine/api/v1.30/#operation/ConfigList
+func filterConfigList(configData []interface{}, context *restrictedOperationContext) ([]interface{}, error) {
+	filteredConfigData := make([]interface{}, 0)
+
+	for _, config := range configData {
+		configObject := config.(map[string]interface{})
+		if configObject[configIdentifier] == nil {
+			return nil, ErrDockerConfigIdentifierNotFound
+		}
+
+		configID := configObject[configIdentifier].(string)
+		configObject, access := applyResourceAccessControl(configObject, configID, context)
+		if access {
+			filteredConfigData = append(filteredConfigData, configObject)
+		}
+	}
+
+	return filteredConfigData, nil
+}

api/http/proxy/containers.go

@@ -11,6 +11,7 @@ const (
 	ErrDockerContainerIdentifierNotFound = portainer.Error("Docker container identifier not found")
 	containerIdentifier                  = "Id"
 	containerLabelForServiceIdentifier   = "com.docker.swarm.service.id"
+	containerLabelForStackIdentifier     = "com.docker.stack.namespace"
 )
 
 // containerListOperation extracts the response as a JSON object, loop through the containers array
@@ -27,8 +28,7 @@ func containerListOperation(request *http.Request, response *http.Response, exec
 	if executor.operationContext.isAdmin {
 		responseArray, err = decorateContainerList(responseArray, executor.operationContext.resourceControls)
 	} else {
-		responseArray, err = filterContainerList(responseArray, executor.operationContext.resourceControls,
-			executor.operationContext.userID, executor.operationContext.userTeamIDs)
+		responseArray, err = filterContainerList(responseArray, executor.operationContext)
 	}
 	if err != nil {
 		return err
@@ -58,30 +58,22 @@ func containerInspectOperation(request *http.Request, response *http.Response, e
 	if responseObject[containerIdentifier] == nil {
 		return ErrDockerContainerIdentifierNotFound
 	}
-	containerID := responseObject[containerIdentifier].(string)
 
-	resourceControl := getResourceControlByResourceID(containerID, executor.operationContext.resourceControls)
-	if resourceControl != nil {
-		if executor.operationContext.isAdmin || canUserAccessResource(executor.operationContext.userID,
-			executor.operationContext.userTeamIDs, resourceControl) {
-			responseObject = decorateObject(responseObject, resourceControl)
-		} else {
-			return rewriteAccessDeniedResponse(response)
-		}
+	containerID := responseObject[containerIdentifier].(string)
+	responseObject, access := applyResourceAccessControl(responseObject, containerID, executor.operationContext)
+	if !access {
+		return rewriteAccessDeniedResponse(response)
 	}
 
 	containerLabels := extractContainerLabelsFromContainerInspectObject(responseObject)
-	if containerLabels != nil && containerLabels[containerLabelForServiceIdentifier] != nil {
-		serviceID := containerLabels[containerLabelForServiceIdentifier].(string)
-		resourceControl := getResourceControlByResourceID(serviceID, executor.operationContext.resourceControls)
-		if resourceControl != nil {
-			if executor.operationContext.isAdmin || canUserAccessResource(executor.operationContext.userID,
-				executor.operationContext.userTeamIDs, resourceControl) {
-				responseObject = decorateObject(responseObject, resourceControl)
-			} else {
-				return rewriteAccessDeniedResponse(response)
-			}
-		}
+	responseObject, access = applyResourceAccessControlFromLabel(containerLabels, responseObject, containerLabelForServiceIdentifier, executor.operationContext)
+	if !access {
+		return rewriteAccessDeniedResponse(response)
+	}
+
+	responseObject, access = applyResourceAccessControlFromLabel(containerLabels, responseObject, containerLabelForStackIdentifier, executor.operationContext)
+	if !access {
+		return rewriteAccessDeniedResponse(response)
 	}
 
 	return rewriteResponse(response, responseObject, http.StatusOK)
@@ -106,3 +98,96 @@ func extractContainerLabelsFromContainerListObject(responseObject map[string]int
 	containerLabelsObject := extractJSONField(responseObject, "Labels")
 	return containerLabelsObject
 }
+
+// decorateContainerList loops through all containers and decorates any container with an existing resource control.
+// Resource controls checks are based on: resource identifier, service identifier (from label), stack identifier (from label).
+// Container object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
+func decorateContainerList(containerData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
+	decoratedContainerData := make([]interface{}, 0)
+
+	for _, container := range containerData {
+
+		containerObject := container.(map[string]interface{})
+		if containerObject[containerIdentifier] == nil {
+			return nil, ErrDockerContainerIdentifierNotFound
+		}
+
+		containerID := containerObject[containerIdentifier].(string)
+		containerObject = decorateResourceWithAccessControl(containerObject, containerID, resourceControls)
+
+		containerLabels := extractContainerLabelsFromContainerListObject(containerObject)
+		containerObject = decorateResourceWithAccessControlFromLabel(containerLabels, containerObject, containerLabelForServiceIdentifier, resourceControls)
+		containerObject = decorateResourceWithAccessControlFromLabel(containerLabels, containerObject, containerLabelForStackIdentifier, resourceControls)
+
+		decoratedContainerData = append(decoratedContainerData, containerObject)
+	}
+
+	return decoratedContainerData, nil
+}
+
+// filterContainerList loops through all containers and filters public containers (no associated resource control)
+// as well as authorized containers (access granted to the user based on existing resource control).
+// Authorized containers are decorated during the process.
+// Resource controls checks are based on: resource identifier, service identifier (from label), stack identifier (from label).
+// Container object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
+func filterContainerList(containerData []interface{}, context *restrictedOperationContext) ([]interface{}, error) {
+	filteredContainerData := make([]interface{}, 0)
+
+	for _, container := range containerData {
+		containerObject := container.(map[string]interface{})
+		if containerObject[containerIdentifier] == nil {
+			return nil, ErrDockerContainerIdentifierNotFound
+		}
+
+		containerID := containerObject[containerIdentifier].(string)
+		containerObject, access := applyResourceAccessControl(containerObject, containerID, context)
+		if access {
+			containerLabels := extractContainerLabelsFromContainerListObject(containerObject)
+			containerObject, access = applyResourceAccessControlFromLabel(containerLabels, containerObject, containerLabelForServiceIdentifier, context)
+			if access {
+				containerObject, access = applyResourceAccessControlFromLabel(containerLabels, containerObject, containerLabelForStackIdentifier, context)
+				if access {
+					filteredContainerData = append(filteredContainerData, containerObject)
+				}
+			}
+		}
+	}
+
+	return filteredContainerData, nil
+}
+
+// filterContainersWithLabels loops through a list of containers, and filters containers that do not contains
+// any labels in the labels black list.
+func filterContainersWithBlackListedLabels(containerData []interface{}, labelBlackList []portainer.Pair) ([]interface{}, error) {
+	filteredContainerData := make([]interface{}, 0)
+
+	for _, container := range containerData {
+		containerObject := container.(map[string]interface{})
+
+		containerLabels := extractContainerLabelsFromContainerListObject(containerObject)
+		if containerLabels != nil {
+			if !containerHasBlackListedLabel(containerLabels, labelBlackList) {
+				filteredContainerData = append(filteredContainerData, containerObject)
+			}
+		} else {
+			filteredContainerData = append(filteredContainerData, containerObject)
+		}
+	}
+
+	return filteredContainerData, nil
+}
+
+func containerHasBlackListedLabel(containerLabels map[string]interface{}, labelBlackList []portainer.Pair) bool {
+	for key, value := range containerLabels {
+		labelName := key
+		labelValue := value.(string)
+
+		for _, blackListedLabel := range labelBlackList {
+			if blackListedLabel.Name == labelName && blackListedLabel.Value == labelValue {
+				return true
+			}
+		}
+	}
+
+	return false
+}

api/http/proxy/decorator.go

@@ -1,90 +0,0 @@
-package proxy
-
-import "github.com/portainer/portainer"
-
-// decorateVolumeList loops through all volumes and will decorate any volume with an existing resource control.
-// Volume object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
-func decorateVolumeList(volumeData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
-	decoratedVolumeData := make([]interface{}, 0)
-
-	for _, volume := range volumeData {
-
-		volumeObject := volume.(map[string]interface{})
-		if volumeObject[volumeIdentifier] == nil {
-			return nil, ErrDockerVolumeIdentifierNotFound
-		}
-
-		volumeID := volumeObject[volumeIdentifier].(string)
-		resourceControl := getResourceControlByResourceID(volumeID, resourceControls)
-		if resourceControl != nil {
-			volumeObject = decorateObject(volumeObject, resourceControl)
-		}
-		decoratedVolumeData = append(decoratedVolumeData, volumeObject)
-	}
-
-	return decoratedVolumeData, nil
-}
-
-// decorateContainerList loops through all containers and will decorate any container with an existing resource control.
-// Check is based on the container ID and optional Swarm service ID.
-// Container object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
-func decorateContainerList(containerData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
-	decoratedContainerData := make([]interface{}, 0)
-
-	for _, container := range containerData {
-
-		containerObject := container.(map[string]interface{})
-		if containerObject[containerIdentifier] == nil {
-			return nil, ErrDockerContainerIdentifierNotFound
-		}
-
-		containerID := containerObject[containerIdentifier].(string)
-		resourceControl := getResourceControlByResourceID(containerID, resourceControls)
-		if resourceControl != nil {
-			containerObject = decorateObject(containerObject, resourceControl)
-		}
-
-		containerLabels := extractContainerLabelsFromContainerListObject(containerObject)
-		if containerLabels != nil && containerLabels[containerLabelForServiceIdentifier] != nil {
-			serviceID := containerLabels[containerLabelForServiceIdentifier].(string)
-			resourceControl := getResourceControlByResourceID(serviceID, resourceControls)
-			if resourceControl != nil {
-				containerObject = decorateObject(containerObject, resourceControl)
-			}
-		}
-
-		decoratedContainerData = append(decoratedContainerData, containerObject)
-	}
-
-	return decoratedContainerData, nil
-}
-
-// decorateServiceList loops through all services and will decorate any service with an existing resource control.
-// Service object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
-func decorateServiceList(serviceData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
-	decoratedServiceData := make([]interface{}, 0)
-
-	for _, service := range serviceData {
-
-		serviceObject := service.(map[string]interface{})
-		if serviceObject[serviceIdentifier] == nil {
-			return nil, ErrDockerServiceIdentifierNotFound
-		}
-
-		serviceID := serviceObject[serviceIdentifier].(string)
-		resourceControl := getResourceControlByResourceID(serviceID, resourceControls)
-		if resourceControl != nil {
-			serviceObject = decorateObject(serviceObject, resourceControl)
-		}
-		decoratedServiceData = append(decoratedServiceData, serviceObject)
-	}
-
-	return decoratedServiceData, nil
-}
-
-func decorateObject(object map[string]interface{}, resourceControl *portainer.ResourceControl) map[string]interface{} {
-	metadata := make(map[string]interface{})
-	metadata["ResourceControl"] = resourceControl
-	object["Portainer"] = metadata
-	return object
-}

api/http/proxy/factory.go

@@ -1,6 +1,7 @@
 package proxy
 
 import (
+	"net"
 	"net/http"
 	"net/http/httputil"
 	"net/url"
@@ -24,7 +25,7 @@ func (factory *proxyFactory) newHTTPProxy(u *url.URL) http.Handler {
 func (factory *proxyFactory) newHTTPSProxy(u *url.URL, endpoint *portainer.Endpoint) (http.Handler, error) {
 	u.Scheme = "https"
 	proxy := factory.createReverseProxy(u)
-	config, err := crypto.CreateTLSConfiguration(endpoint.TLSCACertPath, endpoint.TLSCertPath, endpoint.TLSKeyPath)
+	config, err := crypto.CreateTLSConfiguration(&endpoint.TLSConfig)
 	if err != nil {
 		return nil, err
 	}
@@ -56,3 +57,15 @@ func (factory *proxyFactory) createReverseProxy(u *url.URL) *httputil.ReversePro
 	proxy.Transport = transport
 	return proxy
 }
+
+func newSocketTransport(socketPath string) *http.Transport {
+	return &http.Transport{
+		Dial: func(proto, addr string) (conn net.Conn, err error) {
+			return net.Dial("unix", socketPath)
+		},
+	}
+}
+
+func newHTTPTransport() *http.Transport {
+	return &http.Transport{}
+}

api/http/proxy/filter.go

@@ -1,112 +0,0 @@
-package proxy
-
-import "github.com/portainer/portainer"
-
-// filterVolumeList loops through all volumes, filters volumes without any resource control (public resources) or with
-// any resource control giving access to the user (these volumes will be decorated).
-// Volume object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
-func filterVolumeList(volumeData []interface{}, resourceControls []portainer.ResourceControl, userID portainer.UserID, userTeamIDs []portainer.TeamID) ([]interface{}, error) {
-	filteredVolumeData := make([]interface{}, 0)
-
-	for _, volume := range volumeData {
-		volumeObject := volume.(map[string]interface{})
-		if volumeObject[volumeIdentifier] == nil {
-			return nil, ErrDockerVolumeIdentifierNotFound
-		}
-
-		volumeID := volumeObject[volumeIdentifier].(string)
-		resourceControl := getResourceControlByResourceID(volumeID, resourceControls)
-		if resourceControl == nil {
-			filteredVolumeData = append(filteredVolumeData, volumeObject)
-		} else if resourceControl != nil && canUserAccessResource(userID, userTeamIDs, resourceControl) {
-			volumeObject = decorateObject(volumeObject, resourceControl)
-			filteredVolumeData = append(filteredVolumeData, volumeObject)
-		}
-	}
-
-	return filteredVolumeData, nil
-}
-
-// filterContainerList loops through all containers, filters containers without any resource control (public resources) or with
-// any resource control giving access to the user (check on container ID and optional Swarm service ID, these containers will be decorated).
-// Container object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
-func filterContainerList(containerData []interface{}, resourceControls []portainer.ResourceControl, userID portainer.UserID, userTeamIDs []portainer.TeamID) ([]interface{}, error) {
-	filteredContainerData := make([]interface{}, 0)
-
-	for _, container := range containerData {
-		containerObject := container.(map[string]interface{})
-		if containerObject[containerIdentifier] == nil {
-			return nil, ErrDockerContainerIdentifierNotFound
-		}
-
-		containerID := containerObject[containerIdentifier].(string)
-		resourceControl := getResourceControlByResourceID(containerID, resourceControls)
-		if resourceControl == nil {
-			// check if container is part of a Swarm service
-			containerLabels := extractContainerLabelsFromContainerListObject(containerObject)
-			if containerLabels != nil && containerLabels[containerLabelForServiceIdentifier] != nil {
-				serviceID := containerLabels[containerLabelForServiceIdentifier].(string)
-				serviceResourceControl := getResourceControlByResourceID(serviceID, resourceControls)
-				if serviceResourceControl == nil {
-					filteredContainerData = append(filteredContainerData, containerObject)
-				} else if serviceResourceControl != nil && canUserAccessResource(userID, userTeamIDs, serviceResourceControl) {
-					containerObject = decorateObject(containerObject, serviceResourceControl)
-					filteredContainerData = append(filteredContainerData, containerObject)
-				}
-			} else {
-				filteredContainerData = append(filteredContainerData, containerObject)
-			}
-		} else if resourceControl != nil && canUserAccessResource(userID, userTeamIDs, resourceControl) {
-			containerObject = decorateObject(containerObject, resourceControl)
-			filteredContainerData = append(filteredContainerData, containerObject)
-		}
-	}
-
-	return filteredContainerData, nil
-}
-
-// filterContainersWithLabels loops through a list of containers, and filters containers that do not contains
-// any labels in the labels black list.
-func filterContainersWithBlackListedLabels(containerData []interface{}, labelBlackList []portainer.Pair) ([]interface{}, error) {
-	filteredContainerData := make([]interface{}, 0)
-
-	for _, container := range containerData {
-		containerObject := container.(map[string]interface{})
-
-		containerLabels := extractContainerLabelsFromContainerListObject(containerObject)
-		if containerLabels != nil {
-			if !containerHasBlackListedLabel(containerLabels, labelBlackList) {
-				filteredContainerData = append(filteredContainerData, containerObject)
-			}
-		} else {
-			filteredContainerData = append(filteredContainerData, containerObject)
-		}
-	}
-
-	return filteredContainerData, nil
-}
-
-// filterServiceList loops through all services, filters services without any resource control (public resources) or with
-// any resource control giving access to the user (these services will be decorated).
-// Service object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
-func filterServiceList(serviceData []interface{}, resourceControls []portainer.ResourceControl, userID portainer.UserID, userTeamIDs []portainer.TeamID) ([]interface{}, error) {
-	filteredServiceData := make([]interface{}, 0)
-
-	for _, service := range serviceData {
-		serviceObject := service.(map[string]interface{})
-		if serviceObject[serviceIdentifier] == nil {
-			return nil, ErrDockerServiceIdentifierNotFound
-		}
-
-		serviceID := serviceObject[serviceIdentifier].(string)
-		resourceControl := getResourceControlByResourceID(serviceID, resourceControls)
-		if resourceControl == nil {
-			filteredServiceData = append(filteredServiceData, serviceObject)
-		} else if resourceControl != nil && canUserAccessResource(userID, userTeamIDs, resourceControl) {
-			serviceObject = decorateObject(serviceObject, resourceControl)
-			filteredServiceData = append(filteredServiceData, serviceObject)
-		}
-	}
-
-	return filteredServiceData, nil
-}

api/http/proxy/manager.go

@@ -37,7 +37,7 @@ func (manager *Manager) CreateAndRegisterProxy(endpoint *portainer.Endpoint) (ht
 	}
 
 	if endpointURL.Scheme == "tcp" {
-		if endpoint.TLS {
+		if endpoint.TLSConfig.TLS {
 			proxy, err = manager.proxyFactory.newHTTPSProxy(endpointURL, endpoint)
 			if err != nil {
 				return nil, err

api/http/proxy/networks.go

@@ -0,0 +1,134 @@
+package proxy
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrDockerNetworkIdentifierNotFound defines an error raised when Portainer is unable to find a network identifier
+	ErrDockerNetworkIdentifierNotFound = portainer.Error("Docker network identifier not found")
+	networkIdentifier                  = "Id"
+	networkLabelForStackIdentifier     = "com.docker.stack.namespace"
+)
+
+// networkListOperation extracts the response as a JSON object, loop through the networks array
+// decorate and/or filter the networks based on resource controls before rewriting the response
+func networkListOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	var err error
+	// NetworkList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.28/#operation/NetworkList
+	responseArray, err := getResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	if executor.operationContext.isAdmin {
+		responseArray, err = decorateNetworkList(responseArray, executor.operationContext.resourceControls)
+	} else {
+		responseArray, err = filterNetworkList(responseArray, executor.operationContext)
+	}
+	if err != nil {
+		return err
+	}
+
+	return rewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// networkInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the network based on resource control and either rewrite an access denied response
+// or a decorated network.
+func networkInspectOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	// NetworkInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/NetworkInspect
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	if responseObject[networkIdentifier] == nil {
+		return ErrDockerNetworkIdentifierNotFound
+	}
+
+	networkID := responseObject[networkIdentifier].(string)
+	responseObject, access := applyResourceAccessControl(responseObject, networkID, executor.operationContext)
+	if !access {
+		return rewriteAccessDeniedResponse(response)
+	}
+
+	networkLabels := extractNetworkLabelsFromNetworkInspectObject(responseObject)
+	responseObject, access = applyResourceAccessControlFromLabel(networkLabels, responseObject, networkLabelForStackIdentifier, executor.operationContext)
+	if !access {
+		return rewriteAccessDeniedResponse(response)
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}
+
+// extractNetworkLabelsFromNetworkInspectObject retrieve the Labels of the network if present.
+// Container schema reference: https://docs.docker.com/engine/api/v1.28/#operation/NetworkInspect
+func extractNetworkLabelsFromNetworkInspectObject(responseObject map[string]interface{}) map[string]interface{} {
+	// Labels are stored under Labels
+	return extractJSONField(responseObject, "Labels")
+}
+
+// extractNetworkLabelsFromNetworkListObject retrieve the Labels of the network if present.
+// Network schema reference: https://docs.docker.com/engine/api/v1.28/#operation/NetworkList
+func extractNetworkLabelsFromNetworkListObject(responseObject map[string]interface{}) map[string]interface{} {
+	// Labels are stored under Labels
+	return extractJSONField(responseObject, "Labels")
+}
+
+// decorateNetworkList loops through all networks and decorates any network with an existing resource control.
+// Resource controls checks are based on: resource identifier, stack identifier (from label).
+// Network object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/NetworkList
+func decorateNetworkList(networkData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
+	decoratedNetworkData := make([]interface{}, 0)
+
+	for _, network := range networkData {
+
+		networkObject := network.(map[string]interface{})
+		if networkObject[networkIdentifier] == nil {
+			return nil, ErrDockerNetworkIdentifierNotFound
+		}
+
+		networkID := networkObject[networkIdentifier].(string)
+		networkObject = decorateResourceWithAccessControl(networkObject, networkID, resourceControls)
+
+		networkLabels := extractNetworkLabelsFromNetworkListObject(networkObject)
+		networkObject = decorateResourceWithAccessControlFromLabel(networkLabels, networkObject, networkLabelForStackIdentifier, resourceControls)
+
+		decoratedNetworkData = append(decoratedNetworkData, networkObject)
+	}
+
+	return decoratedNetworkData, nil
+}
+
+// filterNetworkList loops through all networks and filters public networks (no associated resource control)
+// as well as authorized networks (access granted to the user based on existing resource control).
+// Authorized networks are decorated during the process.
+// Resource controls checks are based on: resource identifier, stack identifier (from label).
+// Network object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/NetworkList
+func filterNetworkList(networkData []interface{}, context *restrictedOperationContext) ([]interface{}, error) {
+	filteredNetworkData := make([]interface{}, 0)
+
+	for _, network := range networkData {
+		networkObject := network.(map[string]interface{})
+		if networkObject[networkIdentifier] == nil {
+			return nil, ErrDockerNetworkIdentifierNotFound
+		}
+
+		networkID := networkObject[networkIdentifier].(string)
+		networkObject, access := applyResourceAccessControl(networkObject, networkID, context)
+		if access {
+			networkLabels := extractNetworkLabelsFromNetworkListObject(networkObject)
+			networkObject, access = applyResourceAccessControlFromLabel(networkLabels, networkObject, networkLabelForStackIdentifier, context)
+			if access {
+				filteredNetworkData = append(filteredNetworkData, networkObject)
+			}
+		}
+	}
+
+	return filteredNetworkData, nil
+}

api/http/proxy/response.go

@@ -85,6 +85,11 @@ func rewriteResponse(response *http.Response, newResponseData interface{}, statu
 	response.StatusCode = statusCode
 	response.Body = body
 	response.ContentLength = int64(len(jsonData))
+
+	if response.Header == nil {
+		response.Header = make(http.Header)
+	}
 	response.Header.Set("Content-Length", strconv.Itoa(len(jsonData)))
+
 	return nil
 }

api/http/proxy/secrets.go

@@ -0,0 +1,107 @@
+package proxy
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrDockerSecretIdentifierNotFound defines an error raised when Portainer is unable to find a secret identifier
+	ErrDockerSecretIdentifierNotFound = portainer.Error("Docker secret identifier not found")
+	secretIdentifier                  = "ID"
+)
+
+// secretListOperation extracts the response as a JSON object, loop through the secrets array
+// decorate and/or filter the secrets based on resource controls before rewriting the response
+func secretListOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	var err error
+
+	// SecretList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.28/#operation/SecretList
+	responseArray, err := getResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	if executor.operationContext.isAdmin {
+		responseArray, err = decorateSecretList(responseArray, executor.operationContext.resourceControls)
+	} else {
+		responseArray, err = filterSecretList(responseArray, executor.operationContext)
+	}
+	if err != nil {
+		return err
+	}
+
+	return rewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// secretInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the secret based on resource control (check are done based on the secretID and optional Swarm service ID)
+// and either rewrite an access denied response or a decorated secret.
+func secretInspectOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	// SecretInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/SecretInspect
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	if responseObject[secretIdentifier] == nil {
+		return ErrDockerSecretIdentifierNotFound
+	}
+
+	secretID := responseObject[secretIdentifier].(string)
+	responseObject, access := applyResourceAccessControl(responseObject, secretID, executor.operationContext)
+	if !access {
+		return rewriteAccessDeniedResponse(response)
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}
+
+// decorateSecretList loops through all secrets and decorates any secret with an existing resource control.
+// Resource controls checks are based on: resource identifier.
+// Secret object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/SecretList
+func decorateSecretList(secretData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
+	decoratedSecretData := make([]interface{}, 0)
+
+	for _, secret := range secretData {
+
+		secretObject := secret.(map[string]interface{})
+		if secretObject[secretIdentifier] == nil {
+			return nil, ErrDockerSecretIdentifierNotFound
+		}
+
+		secretID := secretObject[secretIdentifier].(string)
+		secretObject = decorateResourceWithAccessControl(secretObject, secretID, resourceControls)
+
+		decoratedSecretData = append(decoratedSecretData, secretObject)
+	}
+
+	return decoratedSecretData, nil
+}
+
+// filterSecretList loops through all secrets and filters public secrets (no associated resource control)
+// as well as authorized secrets (access granted to the user based on existing resource control).
+// Authorized secrets are decorated during the process.
+// Resource controls checks are based on: resource identifier.
+// Secret object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/SecretList
+func filterSecretList(secretData []interface{}, context *restrictedOperationContext) ([]interface{}, error) {
+	filteredSecretData := make([]interface{}, 0)
+
+	for _, secret := range secretData {
+		secretObject := secret.(map[string]interface{})
+		if secretObject[secretIdentifier] == nil {
+			return nil, ErrDockerSecretIdentifierNotFound
+		}
+
+		secretID := secretObject[secretIdentifier].(string)
+		secretObject, access := applyResourceAccessControl(secretObject, secretID, context)
+		if access {
+			filteredSecretData = append(filteredSecretData, secretObject)
+		}
+	}
+
+	return filteredSecretData, nil
+}

api/http/proxy/service.go

@@ -1,64 +0,0 @@
-package proxy
-
-import (
-	"net/http"
-
-	"github.com/portainer/portainer"
-)
-
-const (
-	// ErrDockerServiceIdentifierNotFound defines an error raised when Portainer is unable to find a service identifier
-	ErrDockerServiceIdentifierNotFound = portainer.Error("Docker service identifier not found")
-	serviceIdentifier                  = "ID"
-)
-
-// serviceListOperation extracts the response as a JSON array, loop through the service array
-// decorate and/or filter the services based on resource controls before rewriting the response
-func serviceListOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
-	var err error
-	// ServiceList response is a JSON array
-	// https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
-	responseArray, err := getResponseAsJSONArray(response)
-	if err != nil {
-		return err
-	}
-
-	if executor.operationContext.isAdmin {
-		responseArray, err = decorateServiceList(responseArray, executor.operationContext.resourceControls)
-	} else {
-		responseArray, err = filterServiceList(responseArray, executor.operationContext.resourceControls, executor.operationContext.userID, executor.operationContext.userTeamIDs)
-	}
-	if err != nil {
-		return err
-	}
-
-	return rewriteResponse(response, responseArray, http.StatusOK)
-}
-
-// serviceInspectOperation extracts the response as a JSON object, verify that the user
-// has access to the service based on resource control and either rewrite an access denied response
-// or a decorated service.
-func serviceInspectOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
-	// ServiceInspect response is a JSON object
-	// https://docs.docker.com/engine/api/v1.28/#operation/ServiceInspect
-	responseObject, err := getResponseAsJSONOBject(response)
-	if err != nil {
-		return err
-	}
-
-	if responseObject[serviceIdentifier] == nil {
-		return ErrDockerServiceIdentifierNotFound
-	}
-	serviceID := responseObject[serviceIdentifier].(string)
-
-	resourceControl := getResourceControlByResourceID(serviceID, executor.operationContext.resourceControls)
-	if resourceControl != nil {
-		if executor.operationContext.isAdmin || canUserAccessResource(executor.operationContext.userID, executor.operationContext.userTeamIDs, resourceControl) {
-			responseObject = decorateObject(responseObject, resourceControl)
-		} else {
-			return rewriteAccessDeniedResponse(response)
-		}
-	}
-
-	return rewriteResponse(response, responseObject, http.StatusOK)
-}

api/http/proxy/services.go

@@ -0,0 +1,142 @@
+package proxy
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrDockerServiceIdentifierNotFound defines an error raised when Portainer is unable to find a service identifier
+	ErrDockerServiceIdentifierNotFound = portainer.Error("Docker service identifier not found")
+	serviceIdentifier                  = "ID"
+	serviceLabelForStackIdentifier     = "com.docker.stack.namespace"
+)
+
+// serviceListOperation extracts the response as a JSON array, loop through the service array
+// decorate and/or filter the services based on resource controls before rewriting the response
+func serviceListOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	var err error
+	// ServiceList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
+	responseArray, err := getResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	if executor.operationContext.isAdmin {
+		responseArray, err = decorateServiceList(responseArray, executor.operationContext.resourceControls)
+	} else {
+		responseArray, err = filterServiceList(responseArray, executor.operationContext)
+	}
+	if err != nil {
+		return err
+	}
+
+	return rewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// serviceInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the service based on resource control and either rewrite an access denied response
+// or a decorated service.
+func serviceInspectOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	// ServiceInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/ServiceInspect
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	if responseObject[serviceIdentifier] == nil {
+		return ErrDockerServiceIdentifierNotFound
+	}
+
+	serviceID := responseObject[serviceIdentifier].(string)
+	responseObject, access := applyResourceAccessControl(responseObject, serviceID, executor.operationContext)
+	if !access {
+		return rewriteAccessDeniedResponse(response)
+	}
+
+	serviceLabels := extractServiceLabelsFromServiceInspectObject(responseObject)
+	responseObject, access = applyResourceAccessControlFromLabel(serviceLabels, responseObject, serviceLabelForStackIdentifier, executor.operationContext)
+	if !access {
+		return rewriteAccessDeniedResponse(response)
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}
+
+// extractServiceLabelsFromServiceInspectObject retrieve the Labels of the service if present.
+// Service schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ServiceInspect
+func extractServiceLabelsFromServiceInspectObject(responseObject map[string]interface{}) map[string]interface{} {
+	// Labels are stored under Spec.Labels
+	serviceSpecObject := extractJSONField(responseObject, "Spec")
+	if serviceSpecObject != nil {
+		return extractJSONField(serviceSpecObject, "Labels")
+	}
+	return nil
+}
+
+// extractServiceLabelsFromServiceListObject retrieve the Labels of the service if present.
+// Service schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
+func extractServiceLabelsFromServiceListObject(responseObject map[string]interface{}) map[string]interface{} {
+	// Labels are stored under Spec.Labels
+	serviceSpecObject := extractJSONField(responseObject, "Spec")
+	if serviceSpecObject != nil {
+		return extractJSONField(serviceSpecObject, "Labels")
+	}
+	return nil
+}
+
+// decorateServiceList loops through all services and decorates any service with an existing resource control.
+// Resource controls checks are based on: resource identifier, stack identifier (from label).
+// Service object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
+func decorateServiceList(serviceData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
+	decoratedServiceData := make([]interface{}, 0)
+
+	for _, service := range serviceData {
+
+		serviceObject := service.(map[string]interface{})
+		if serviceObject[serviceIdentifier] == nil {
+			return nil, ErrDockerServiceIdentifierNotFound
+		}
+
+		serviceID := serviceObject[serviceIdentifier].(string)
+		serviceObject = decorateResourceWithAccessControl(serviceObject, serviceID, resourceControls)
+
+		serviceLabels := extractServiceLabelsFromServiceListObject(serviceObject)
+		serviceObject = decorateResourceWithAccessControlFromLabel(serviceLabels, serviceObject, serviceLabelForStackIdentifier, resourceControls)
+
+		decoratedServiceData = append(decoratedServiceData, serviceObject)
+	}
+
+	return decoratedServiceData, nil
+}
+
+// filterServiceList loops through all services and filters public services (no associated resource control)
+// as well as authorized services (access granted to the user based on existing resource control).
+// Authorized services are decorated during the process.
+// Resource controls checks are based on: resource identifier, stack identifier (from label).
+// Service object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
+func filterServiceList(serviceData []interface{}, context *restrictedOperationContext) ([]interface{}, error) {
+	filteredServiceData := make([]interface{}, 0)
+
+	for _, service := range serviceData {
+		serviceObject := service.(map[string]interface{})
+		if serviceObject[serviceIdentifier] == nil {
+			return nil, ErrDockerServiceIdentifierNotFound
+		}
+
+		serviceID := serviceObject[serviceIdentifier].(string)
+		serviceObject, access := applyResourceAccessControl(serviceObject, serviceID, context)
+		if access {
+			serviceLabels := extractServiceLabelsFromServiceListObject(serviceObject)
+			serviceObject, access = applyResourceAccessControlFromLabel(serviceLabels, serviceObject, serviceLabelForStackIdentifier, context)
+			if access {
+				filteredServiceData = append(filteredServiceData, serviceObject)
+			}
+		}
+	}
+
+	return filteredServiceData, nil
+}

api/http/proxy/socket.go

@@ -34,6 +34,9 @@ func (proxy *socketProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			w.Header().Add(k, v)
 		}
 	}
+
+	w.WriteHeader(res.StatusCode)
+
 	if _, err := io.Copy(w, res.Body); err != nil {
 		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, nil)
 	}

api/http/proxy/tasks.go

@@ -0,0 +1,78 @@
+package proxy
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrDockerTaskServiceIdentifierNotFound defines an error raised when Portainer is unable to find the service identifier associated to a task
+	ErrDockerTaskServiceIdentifierNotFound = portainer.Error("Docker task service identifier not found")
+	taskServiceIdentifier                  = "ServiceID"
+	taskLabelForStackIdentifier            = "com.docker.stack.namespace"
+)
+
+// taskListOperation extracts the response as a JSON object, loop through the tasks array
+// and filter the tasks based on resource controls before rewriting the response
+func taskListOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	var err error
+
+	// TaskList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.28/#operation/TaskList
+	responseArray, err := getResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	if !executor.operationContext.isAdmin {
+		responseArray, err = filterTaskList(responseArray, executor.operationContext)
+		if err != nil {
+			return err
+		}
+	}
+
+	return rewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// extractTaskLabelsFromTaskListObject retrieve the Labels of the task if present.
+// Task schema reference: https://docs.docker.com/engine/api/v1.28/#operation/TaskList
+func extractTaskLabelsFromTaskListObject(responseObject map[string]interface{}) map[string]interface{} {
+	// Labels are stored under Spec.ContainerSpec.Labels
+	taskSpecObject := extractJSONField(responseObject, "Spec")
+	if taskSpecObject != nil {
+		containerSpecObject := extractJSONField(taskSpecObject, "ContainerSpec")
+		if containerSpecObject != nil {
+			return extractJSONField(containerSpecObject, "Labels")
+		}
+	}
+	return nil
+}
+
+// filterTaskList loops through all tasks and filters public tasks (no associated resource control)
+// as well as authorized tasks (access granted to the user based on existing resource control).
+// Resource controls checks are based on: service identifier, stack identifier (from label).
+// Task object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/TaskList
+// any resource control giving access to the user based on the associated service identifier.
+func filterTaskList(taskData []interface{}, context *restrictedOperationContext) ([]interface{}, error) {
+	filteredTaskData := make([]interface{}, 0)
+
+	for _, task := range taskData {
+		taskObject := task.(map[string]interface{})
+		if taskObject[taskServiceIdentifier] == nil {
+			return nil, ErrDockerTaskServiceIdentifierNotFound
+		}
+
+		serviceID := taskObject[taskServiceIdentifier].(string)
+		taskObject, access := applyResourceAccessControl(taskObject, serviceID, context)
+		if access {
+			taskLabels := extractTaskLabelsFromTaskListObject(taskObject)
+			taskObject, access = applyResourceAccessControlFromLabel(taskLabels, taskObject, taskLabelForStackIdentifier, context)
+			if access {
+				filteredTaskData = append(filteredTaskData, taskObject)
+			}
+		}
+	}
+
+	return filteredTaskData, nil
+}

api/http/proxy/transport.go

@@ -1,7 +1,6 @@
 package proxy
 
 import (
-	"net"
 	"net/http"
 	"path"
 	"strings"
@@ -30,18 +29,6 @@ type (
 	restrictedOperationRequest func(*http.Request, *http.Response, *operationExecutor) error
 )
 
-func newSocketTransport(socketPath string) *http.Transport {
-	return &http.Transport{
-		Dial: func(proto, addr string) (conn net.Conn, err error) {
-			return net.Dial("unix", socketPath)
-		},
-	}
-}
-
-func newHTTPTransport() *http.Transport {
-	return &http.Transport{}
-}
-
 func (p *proxyTransport) RoundTrip(request *http.Request) (*http.Response, error) {
 	return p.proxyDockerRequest(request)
 }
@@ -53,15 +40,46 @@ func (p *proxyTransport) executeDockerRequest(request *http.Request) (*http.Resp
 func (p *proxyTransport) proxyDockerRequest(request *http.Request) (*http.Response, error) {
 	path := request.URL.Path
 
-	if strings.HasPrefix(path, "/containers") {
+	switch {
+	case strings.HasPrefix(path, "/configs"):
+		return p.proxyConfigRequest(request)
+	case strings.HasPrefix(path, "/containers"):
 		return p.proxyContainerRequest(request)
-	} else if strings.HasPrefix(path, "/services") {
+	case strings.HasPrefix(path, "/services"):
 		return p.proxyServiceRequest(request)
-	} else if strings.HasPrefix(path, "/volumes") {
+	case strings.HasPrefix(path, "/volumes"):
 		return p.proxyVolumeRequest(request)
+	case strings.HasPrefix(path, "/networks"):
+		return p.proxyNetworkRequest(request)
+	case strings.HasPrefix(path, "/secrets"):
+		return p.proxySecretRequest(request)
+	case strings.HasPrefix(path, "/swarm"):
+		return p.proxySwarmRequest(request)
+	case strings.HasPrefix(path, "/nodes"):
+		return p.proxyNodeRequest(request)
+	case strings.HasPrefix(path, "/tasks"):
+		return p.proxyTaskRequest(request)
+	default:
+		return p.executeDockerRequest(request)
 	}
+}
 
-	return p.executeDockerRequest(request)
+func (p *proxyTransport) proxyConfigRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
+	case "/configs/create":
+		return p.executeDockerRequest(request)
+
+	case "/configs":
+		return p.rewriteOperation(request, configListOperation)
+
+	default:
+		// assume /configs/{id}
+		if request.Method == http.MethodGet {
+			return p.rewriteOperation(request, configInspectOperation)
+		}
+		configID := path.Base(requestPath)
+		return p.restrictedOperation(request, configID)
+	}
 }
 
 func (p *proxyTransport) proxyContainerRequest(request *http.Request) (*http.Response, error) {
@@ -143,6 +161,73 @@ func (p *proxyTransport) proxyVolumeRequest(request *http.Request) (*http.Respon
 	}
 }
 
+func (p *proxyTransport) proxyNetworkRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
+	case "/networks/create":
+		return p.executeDockerRequest(request)
+
+	case "/networks":
+		return p.rewriteOperation(request, networkListOperation)
+
+	default:
+		// assume /networks/{id}
+		if request.Method == http.MethodGet {
+			return p.rewriteOperation(request, networkInspectOperation)
+		}
+		networkID := path.Base(requestPath)
+		return p.restrictedOperation(request, networkID)
+	}
+}
+
+func (p *proxyTransport) proxySecretRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
+	case "/secrets/create":
+		return p.executeDockerRequest(request)
+
+	case "/secrets":
+		return p.rewriteOperation(request, secretListOperation)
+
+	default:
+		// assume /secrets/{id}
+		if request.Method == http.MethodGet {
+			return p.rewriteOperation(request, secretInspectOperation)
+		}
+		secretID := path.Base(requestPath)
+		return p.restrictedOperation(request, secretID)
+	}
+}
+
+func (p *proxyTransport) proxyNodeRequest(request *http.Request) (*http.Response, error) {
+	requestPath := request.URL.Path
+
+	// assume /nodes/{id}
+	if path.Base(requestPath) != "nodes" {
+		return p.administratorOperation(request)
+	}
+
+	return p.executeDockerRequest(request)
+}
+
+func (p *proxyTransport) proxySwarmRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
+	case "/swarm":
+		return p.executeDockerRequest(request)
+	default:
+		// assume /swarm/{action}
+		return p.administratorOperation(request)
+	}
+}
+
+func (p *proxyTransport) proxyTaskRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
+	case "/tasks":
+		return p.rewriteOperation(request, taskListOperation)
+	default:
+		// assume /tasks/{id}
+		return p.executeDockerRequest(request)
+	}
+}
+
 // restrictedOperation ensures that the current user has the required authorizations
 // before executing the original request.
 func (p *proxyTransport) restrictedOperation(request *http.Request, resourceID string) (*http.Response, error) {

api/http/proxy/utils.go

@@ -1,32 +0,0 @@
-package proxy
-
-import "github.com/portainer/portainer"
-
-func getResourceControlByResourceID(resourceID string, resourceControls []portainer.ResourceControl) *portainer.ResourceControl {
-	for _, resourceControl := range resourceControls {
-		if resourceID == resourceControl.ResourceID {
-			return &resourceControl
-		}
-		for _, subResourceID := range resourceControl.SubResourceIDs {
-			if resourceID == subResourceID {
-				return &resourceControl
-			}
-		}
-	}
-	return nil
-}
-
-func containerHasBlackListedLabel(containerLabels map[string]interface{}, labelBlackList []portainer.Pair) bool {
-	for key, value := range containerLabels {
-		labelName := key
-		labelValue := value.(string)
-
-		for _, blackListedLabel := range labelBlackList {
-			if blackListedLabel.Name == labelName && blackListedLabel.Value == labelValue {
-				return true
-			}
-		}
-	}
-
-	return false
-}

api/http/proxy/volumes.go

@@ -10,6 +10,7 @@ const (
 	// ErrDockerVolumeIdentifierNotFound defines an error raised when Portainer is unable to find a volume identifier
 	ErrDockerVolumeIdentifierNotFound = portainer.Error("Docker volume identifier not found")
 	volumeIdentifier                  = "Name"
+	volumeLabelForStackIdentifier     = "com.docker.stack.namespace"
 )
 
 // volumeListOperation extracts the response as a JSON object, loop through the volume array
@@ -31,7 +32,7 @@ func volumeListOperation(request *http.Request, response *http.Response, executo
 		if executor.operationContext.isAdmin {
 			volumeData, err = decorateVolumeList(volumeData, executor.operationContext.resourceControls)
 		} else {
-			volumeData, err = filterVolumeList(volumeData, executor.operationContext.resourceControls, executor.operationContext.userID, executor.operationContext.userTeamIDs)
+			volumeData, err = filterVolumeList(volumeData, executor.operationContext)
 		}
 		if err != nil {
 			return err
@@ -45,7 +46,7 @@ func volumeListOperation(request *http.Request, response *http.Response, executo
 }
 
 // volumeInspectOperation extracts the response as a JSON object, verify that the user
-// has access to the volume based on resource control and either rewrite an access denied response
+// has access to the volume based on any existing resource control and either rewrite an access denied response
 // or a decorated volume.
 func volumeInspectOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
 	// VolumeInspect response is a JSON object
@@ -58,16 +59,85 @@ func volumeInspectOperation(request *http.Request, response *http.Response, exec
 	if responseObject[volumeIdentifier] == nil {
 		return ErrDockerVolumeIdentifierNotFound
 	}
-	volumeID := responseObject[volumeIdentifier].(string)
 
-	resourceControl := getResourceControlByResourceID(volumeID, executor.operationContext.resourceControls)
-	if resourceControl != nil {
-		if executor.operationContext.isAdmin || canUserAccessResource(executor.operationContext.userID, executor.operationContext.userTeamIDs, resourceControl) {
-			responseObject = decorateObject(responseObject, resourceControl)
-		} else {
-			return rewriteAccessDeniedResponse(response)
-		}
+	volumeID := responseObject[volumeIdentifier].(string)
+	responseObject, access := applyResourceAccessControl(responseObject, volumeID, executor.operationContext)
+	if !access {
+		return rewriteAccessDeniedResponse(response)
+	}
+
+	volumeLabels := extractVolumeLabelsFromVolumeInspectObject(responseObject)
+	responseObject, access = applyResourceAccessControlFromLabel(volumeLabels, responseObject, volumeLabelForStackIdentifier, executor.operationContext)
+	if !access {
+		return rewriteAccessDeniedResponse(response)
 	}
 
 	return rewriteResponse(response, responseObject, http.StatusOK)
 }
+
+// extractVolumeLabelsFromVolumeInspectObject retrieve the Labels of the volume if present.
+// Volume schema reference: https://docs.docker.com/engine/api/v1.28/#operation/VolumeInspect
+func extractVolumeLabelsFromVolumeInspectObject(responseObject map[string]interface{}) map[string]interface{} {
+	// Labels are stored under Labels
+	return extractJSONField(responseObject, "Labels")
+}
+
+// extractVolumeLabelsFromVolumeListObject retrieve the Labels of the volume if present.
+// Volume schema reference: https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+func extractVolumeLabelsFromVolumeListObject(responseObject map[string]interface{}) map[string]interface{} {
+	// Labels are stored under Labels
+	return extractJSONField(responseObject, "Labels")
+}
+
+// decorateVolumeList loops through all volumes and decorates any volume with an existing resource control.
+// Resource controls checks are based on: resource identifier, stack identifier (from label).
+// Volume object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+func decorateVolumeList(volumeData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
+	decoratedVolumeData := make([]interface{}, 0)
+
+	for _, volume := range volumeData {
+
+		volumeObject := volume.(map[string]interface{})
+		if volumeObject[volumeIdentifier] == nil {
+			return nil, ErrDockerVolumeIdentifierNotFound
+		}
+
+		volumeID := volumeObject[volumeIdentifier].(string)
+		volumeObject = decorateResourceWithAccessControl(volumeObject, volumeID, resourceControls)
+
+		volumeLabels := extractVolumeLabelsFromVolumeListObject(volumeObject)
+		volumeObject = decorateResourceWithAccessControlFromLabel(volumeLabels, volumeObject, volumeLabelForStackIdentifier, resourceControls)
+
+		decoratedVolumeData = append(decoratedVolumeData, volumeObject)
+	}
+
+	return decoratedVolumeData, nil
+}
+
+// filterVolumeList loops through all volumes and filters public volumes (no associated resource control)
+// as well as authorized volumes (access granted to the user based on existing resource control).
+// Authorized volumes are decorated during the process.
+// Resource controls checks are based on: resource identifier, stack identifier (from label).
+// Volume object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+func filterVolumeList(volumeData []interface{}, context *restrictedOperationContext) ([]interface{}, error) {
+	filteredVolumeData := make([]interface{}, 0)
+
+	for _, volume := range volumeData {
+		volumeObject := volume.(map[string]interface{})
+		if volumeObject[volumeIdentifier] == nil {
+			return nil, ErrDockerVolumeIdentifierNotFound
+		}
+
+		volumeID := volumeObject[volumeIdentifier].(string)
+		volumeObject, access := applyResourceAccessControl(volumeObject, volumeID, context)
+		if access {
+			volumeLabels := extractVolumeLabelsFromVolumeListObject(volumeObject)
+			volumeObject, access = applyResourceAccessControlFromLabel(volumeLabels, volumeObject, volumeLabelForStackIdentifier, context)
+			if access {
+				filteredVolumeData = append(filteredVolumeData, volumeObject)
+			}
+		}
+	}
+
+	return filteredVolumeData, nil
+}

api/http/security/authorization.go

@@ -22,7 +22,7 @@ func AuthorizedResourceControlDeletion(resourceControl *portainer.ResourceContro
 	if teamAccessesCount > 0 {
 		for _, access := range resourceControl.TeamAccesses {
 			for _, membership := range context.UserMemberships {
-				if membership.TeamID == access.TeamID && membership.Role == portainer.TeamLeader {
+				if membership.TeamID == access.TeamID {
 					return true
 				}
 			}

api/http/security/bouncer.go

@@ -50,7 +50,7 @@ func (bouncer *RequestBouncer) AuthenticatedAccess(h http.Handler) http.Handler
 	return h
 }
 
-// RestrictedAccess defines defines a security check for restricted endpoints.
+// RestrictedAccess defines a security check for restricted endpoints.
 // Authentication is required to access these endpoints.
 // The request context will be enhanced with a RestrictedRequestContext object
 // that might be used later to authorize/filter access to resources.

api/http/security/filter.go

@@ -60,6 +60,24 @@ func FilterUsers(users []portainer.User, context *RestrictedRequestContext) []po
 	return filteredUsers
 }
 
+// FilterRegistries filters registries based on user role and team memberships.
+// Non administrator users only have access to authorized registries.
+func FilterRegistries(registries []portainer.Registry, context *RestrictedRequestContext) ([]portainer.Registry, error) {
+
+	filteredRegistries := registries
+	if !context.IsAdmin {
+		filteredRegistries = make([]portainer.Registry, 0)
+
+		for _, registry := range registries {
+			if isRegistryAccessAuthorized(&registry, context.UserID, context.UserMemberships) {
+				filteredRegistries = append(filteredRegistries, registry)
+			}
+		}
+	}
+
+	return filteredRegistries, nil
+}
+
 // FilterEndpoints filters endpoints based on user role and team memberships.
 // Non administrator users only have access to authorized endpoints.
 func FilterEndpoints(endpoints []portainer.Endpoint, context *RestrictedRequestContext) ([]portainer.Endpoint, error) {
@@ -78,6 +96,22 @@ func FilterEndpoints(endpoints []portainer.Endpoint, context *RestrictedRequestC
 	return filteredEndpoints, nil
 }
 
+func isRegistryAccessAuthorized(registry *portainer.Registry, userID portainer.UserID, memberships []portainer.TeamMembership) bool {
+	for _, authorizedUserID := range registry.AuthorizedUsers {
+		if authorizedUserID == userID {
+			return true
+		}
+	}
+	for _, membership := range memberships {
+		for _, authorizedTeamID := range registry.AuthorizedTeams {
+			if membership.TeamID == authorizedTeamID {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 func isEndpointAccessAuthorized(endpoint *portainer.Endpoint, userID portainer.UserID, memberships []portainer.TeamMembership) bool {
 	for _, authorizedUserID := range endpoint.AuthorizedUsers {
 		if authorizedUserID == userID {

api/http/server.go

@@ -7,6 +7,7 @@ import (
 	"github.com/portainer/portainer/http/security"
 
 	"net/http"
+	"path/filepath"
 )
 
 // Server implements the portainer.Server interface
@@ -25,6 +26,12 @@ type Server struct {
 	CryptoService          portainer.CryptoService
 	JWTService             portainer.JWTService
 	FileService            portainer.FileService
+	RegistryService        portainer.RegistryService
+	DockerHubService       portainer.DockerHubService
+	StackService           portainer.StackService
+	StackManager           portainer.StackManager
+	LDAPService            portainer.LDAPService
+	GitService             portainer.GitService
 	Handler                *handler.Handler
 	SSL                    bool
 	SSLCert                string
@@ -36,16 +43,20 @@ func (server *Server) Start() error {
 	requestBouncer := security.NewRequestBouncer(server.JWTService, server.TeamMembershipService, server.AuthDisabled)
 	proxyManager := proxy.NewManager(server.ResourceControlService, server.TeamMembershipService, server.SettingsService)
 
+	var fileHandler = handler.NewFileHandler(filepath.Join(server.AssetsPath, "public"))
 	var authHandler = handler.NewAuthHandler(requestBouncer, server.AuthDisabled)
 	authHandler.UserService = server.UserService
 	authHandler.CryptoService = server.CryptoService
 	authHandler.JWTService = server.JWTService
+	authHandler.LDAPService = server.LDAPService
+	authHandler.SettingsService = server.SettingsService
 	var userHandler = handler.NewUserHandler(requestBouncer)
 	userHandler.UserService = server.UserService
 	userHandler.TeamService = server.TeamService
 	userHandler.TeamMembershipService = server.TeamMembershipService
 	userHandler.CryptoService = server.CryptoService
 	userHandler.ResourceControlService = server.ResourceControlService
+	userHandler.SettingsService = server.SettingsService
 	var teamHandler = handler.NewTeamHandler(requestBouncer)
 	teamHandler.TeamService = server.TeamService
 	teamHandler.TeamMembershipService = server.TeamMembershipService
@@ -54,6 +65,8 @@ func (server *Server) Start() error {
 	var statusHandler = handler.NewStatusHandler(requestBouncer, server.Status)
 	var settingsHandler = handler.NewSettingsHandler(requestBouncer)
 	settingsHandler.SettingsService = server.SettingsService
+	settingsHandler.LDAPService = server.LDAPService
+	settingsHandler.FileService = server.FileService
 	var templatesHandler = handler.NewTemplatesHandler(requestBouncer)
 	templatesHandler.SettingsService = server.SettingsService
 	var dockerHandler = handler.NewDockerHandler(requestBouncer)
@@ -66,11 +79,23 @@ func (server *Server) Start() error {
 	endpointHandler.EndpointService = server.EndpointService
 	endpointHandler.FileService = server.FileService
 	endpointHandler.ProxyManager = proxyManager
+	var registryHandler = handler.NewRegistryHandler(requestBouncer)
+	registryHandler.RegistryService = server.RegistryService
+	var dockerHubHandler = handler.NewDockerHubHandler(requestBouncer)
+	dockerHubHandler.DockerHubService = server.DockerHubService
 	var resourceHandler = handler.NewResourceHandler(requestBouncer)
 	resourceHandler.ResourceControlService = server.ResourceControlService
 	var uploadHandler = handler.NewUploadHandler(requestBouncer)
 	uploadHandler.FileService = server.FileService
-	var fileHandler = handler.NewFileHandler(server.AssetsPath)
+	var stackHandler = handler.NewStackHandler(requestBouncer)
+	stackHandler.FileService = server.FileService
+	stackHandler.StackService = server.StackService
+	stackHandler.EndpointService = server.EndpointService
+	stackHandler.ResourceControlService = server.ResourceControlService
+	stackHandler.StackManager = server.StackManager
+	stackHandler.GitService = server.GitService
+	stackHandler.RegistryService = server.RegistryService
+	stackHandler.DockerHubService = server.DockerHubService
 
 	server.Handler = &handler.Handler{
 		AuthHandler:           authHandler,
@@ -78,9 +103,12 @@ func (server *Server) Start() error {
 		TeamHandler:           teamHandler,
 		TeamMembershipHandler: teamMembershipHandler,
 		EndpointHandler:       endpointHandler,
+		RegistryHandler:       registryHandler,
+		DockerHubHandler:      dockerHubHandler,
 		ResourceHandler:       resourceHandler,
 		SettingsHandler:       settingsHandler,
 		StatusHandler:         statusHandler,
+		StackHandler:          stackHandler,
 		TemplatesHandler:      templatesHandler,
 		DockerHandler:         dockerHandler,
 		WebSocketHandler:      websocketHandler,

api/ldap/ldap.go

@@ -0,0 +1,126 @@
+package ldap
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/crypto"
+
+	"gopkg.in/ldap.v2"
+)
+
+const (
+	// ErrUserNotFound defines an error raised when the user is not found via LDAP search
+	// or that too many entries (> 1) are returned.
+	ErrUserNotFound = portainer.Error("User not found or too many entries returned")
+)
+
+// Service represents a service used to authenticate users against a LDAP/AD.
+type Service struct{}
+
+func searchUser(username string, conn *ldap.Conn, settings []portainer.LDAPSearchSettings) (string, error) {
+	var userDN string
+	found := false
+	for _, searchSettings := range settings {
+		searchRequest := ldap.NewSearchRequest(
+			searchSettings.BaseDN,
+			ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
+			fmt.Sprintf("(&%s(%s=%s))", searchSettings.Filter, searchSettings.UserNameAttribute, username),
+			[]string{"dn"},
+			nil,
+		)
+
+		// Deliberately skip errors on the search request so that we can jump to other search settings
+		// if any issue arise with the current one.
+		sr, err := conn.Search(searchRequest)
+		if err != nil {
+			continue
+		}
+
+		if len(sr.Entries) == 1 {
+			found = true
+			userDN = sr.Entries[0].DN
+			break
+		}
+	}
+
+	if !found {
+		return "", ErrUserNotFound
+	}
+
+	return userDN, nil
+}
+
+func createConnection(settings *portainer.LDAPSettings) (*ldap.Conn, error) {
+
+	if settings.TLSConfig.TLS || settings.StartTLS {
+		config, err := crypto.CreateTLSConfiguration(&settings.TLSConfig)
+		if err != nil {
+			return nil, err
+		}
+		config.ServerName = strings.Split(settings.URL, ":")[0]
+
+		if settings.TLSConfig.TLS {
+			return ldap.DialTLS("tcp", settings.URL, config)
+		}
+
+		conn, err := ldap.Dial("tcp", settings.URL)
+		if err != nil {
+			return nil, err
+		}
+
+		err = conn.StartTLS(config)
+		if err != nil {
+			return nil, err
+		}
+
+		return conn, nil
+	}
+
+	return ldap.Dial("tcp", settings.URL)
+}
+
+// AuthenticateUser is used to authenticate a user against a LDAP/AD.
+func (*Service) AuthenticateUser(username, password string, settings *portainer.LDAPSettings) error {
+
+	connection, err := createConnection(settings)
+	if err != nil {
+		return err
+	}
+	defer connection.Close()
+
+	err = connection.Bind(settings.ReaderDN, settings.Password)
+	if err != nil {
+		return err
+	}
+
+	userDN, err := searchUser(username, connection, settings.SearchSettings)
+	if err != nil {
+		return err
+	}
+
+	err = connection.Bind(userDN, password)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// TestConnectivity is used to test a connection against the LDAP server using the credentials
+// specified in the LDAPSettings.
+func (*Service) TestConnectivity(settings *portainer.LDAPSettings) error {
+
+	connection, err := createConnection(settings)
+	if err != nil {
+		return err
+	}
+	defer connection.Close()
+
+	err = connection.Bind(settings.ReaderDN, settings.Password)
+	if err != nil {
+		return err
+	}
+	return nil
+}

api/portainer.go

@@ -13,10 +13,10 @@ type (
 	CLIFlags struct {
 		Addr              *string
 		Assets            *string
+		CheckHealth       *bool
 		Data              *string
-		ExternalEndpoints *string
-		SyncInterval      *string
 		Endpoint          *string
+		ExternalEndpoints *string
 		NoAuth            *bool
 		NoAnalytics       *bool
 		TLSVerify         *bool
@@ -26,11 +26,13 @@ type (
 		SSL               *bool
 		SSLCert           *string
 		SSLKey            *string
+		SyncInterval      *string
 		AdminPassword     *string
+		AdminPasswordFile *string
 		// Deprecated fields
+		Labels    *[]Pair
 		Logo      *string
 		Templates *string
-		Labels    *[]Pair
 	}
 
 	// Status represents the application status.
@@ -41,12 +43,43 @@ type (
 		Version            string `json:"Version"`
 	}
 
+	// LDAPSettings represents the settings used to connect to a LDAP server.
+	LDAPSettings struct {
+		ReaderDN       string               `json:"ReaderDN"`
+		Password       string               `json:"Password"`
+		URL            string               `json:"URL"`
+		TLSConfig      TLSConfiguration     `json:"TLSConfig"`
+		StartTLS       bool                 `json:"StartTLS"`
+		SearchSettings []LDAPSearchSettings `json:"SearchSettings"`
+	}
+
+	// TLSConfiguration represents a TLS configuration.
+	TLSConfiguration struct {
+		TLS           bool   `json:"TLS"`
+		TLSSkipVerify bool   `json:"TLSSkipVerify"`
+		TLSCACertPath string `json:"TLSCACert,omitempty"`
+		TLSCertPath   string `json:"TLSCert,omitempty"`
+		TLSKeyPath    string `json:"TLSKey,omitempty"`
+	}
+
+	// LDAPSearchSettings represents settings used to search for users in a LDAP server.
+	LDAPSearchSettings struct {
+		BaseDN            string `json:"BaseDN"`
+		Filter            string `json:"Filter"`
+		UserNameAttribute string `json:"UserNameAttribute"`
+	}
+
 	// Settings represents the application settings.
 	Settings struct {
-		TemplatesURL                string `json:"TemplatesURL"`
-		LogoURL                     string `json:"LogoURL"`
-		BlackListedLabels           []Pair `json:"BlackListedLabels"`
-		DisplayExternalContributors bool   `json:"DisplayExternalContributors"`
+		TemplatesURL                       string               `json:"TemplatesURL"`
+		LogoURL                            string               `json:"LogoURL"`
+		BlackListedLabels                  []Pair               `json:"BlackListedLabels"`
+		DisplayDonationHeader              bool                 `json:"DisplayDonationHeader"`
+		DisplayExternalContributors        bool                 `json:"DisplayExternalContributors"`
+		AuthenticationMethod               AuthenticationMethod `json:"AuthenticationMethod"`
+		LDAPSettings                       LDAPSettings         `json:"LDAPSettings"`
+		AllowBindMountsForRegularUsers     bool                 `json:"AllowBindMountsForRegularUsers"`
+		AllowPrivilegedModeForRegularUsers bool                 `json:"AllowPrivilegedModeForRegularUsers"`
 	}
 
 	// User represents a user account.
@@ -64,6 +97,9 @@ type (
 	// or a regular user
 	UserRole int
 
+	// AuthenticationMethod represents the authentication method used to authenticate a user.
+	AuthenticationMethod int
+
 	// Team represents a list of user accounts.
 	Team struct {
 		ID   TeamID `json:"Id"`
@@ -94,22 +130,63 @@ type (
 		Role     UserRole
 	}
 
+	// StackID represents a stack identifier (it must be composed of Name + "_" + SwarmID to create a unique identifier).
+	StackID string
+
+	// Stack represents a Docker stack created via docker stack deploy.
+	Stack struct {
+		ID          StackID `json:"Id"`
+		Name        string  `json:"Name"`
+		EntryPoint  string  `json:"EntryPoint"`
+		SwarmID     string  `json:"SwarmId"`
+		ProjectPath string
+		Env         []Pair `json:"Env"`
+	}
+
+	// RegistryID represents a registry identifier.
+	RegistryID int
+
+	// Registry represents a Docker registry with all the info required
+	// to connect to it.
+	Registry struct {
+		ID              RegistryID `json:"Id"`
+		Name            string     `json:"Name"`
+		URL             string     `json:"URL"`
+		Authentication  bool       `json:"Authentication"`
+		Username        string     `json:"Username"`
+		Password        string     `json:"Password"`
+		AuthorizedUsers []UserID   `json:"AuthorizedUsers"`
+		AuthorizedTeams []TeamID   `json:"AuthorizedTeams"`
+	}
+
+	// DockerHub represents all the required information to connect and use the
+	// Docker Hub.
+	DockerHub struct {
+		Authentication bool   `json:"Authentication"`
+		Username       string `json:"Username"`
+		Password       string `json:"Password"`
+	}
+
 	// EndpointID represents an endpoint identifier.
 	EndpointID int
 
 	// Endpoint represents a Docker endpoint with all the info required
 	// to connect to it.
 	Endpoint struct {
-		ID              EndpointID `json:"Id"`
-		Name            string     `json:"Name"`
-		URL             string     `json:"URL"`
-		PublicURL       string     `json:"PublicURL"`
-		TLS             bool       `json:"TLS"`
-		TLSCACertPath   string     `json:"TLSCACert,omitempty"`
-		TLSCertPath     string     `json:"TLSCert,omitempty"`
-		TLSKeyPath      string     `json:"TLSKey,omitempty"`
-		AuthorizedUsers []UserID   `json:"AuthorizedUsers"`
-		AuthorizedTeams []TeamID   `json:"AuthorizedTeams"`
+		ID              EndpointID       `json:"Id"`
+		Name            string           `json:"Name"`
+		URL             string           `json:"URL"`
+		PublicURL       string           `json:"PublicURL"`
+		TLSConfig       TLSConfiguration `json:"TLSConfig"`
+		AuthorizedUsers []UserID         `json:"AuthorizedUsers"`
+		AuthorizedTeams []TeamID         `json:"AuthorizedTeams"`
+
+		// Deprecated fields
+		// Deprecated in DBVersion == 4
+		TLS           bool   `json:"TLS,omitempty"`
+		TLSCACertPath string `json:"TLSCACert,omitempty"`
+		TLSCertPath   string `json:"TLSCert,omitempty"`
+		TLSKeyPath    string `json:"TLSKey,omitempty"`
 	}
 
 	// ResourceControlID represents a resource control identifier.
@@ -117,23 +194,21 @@ type (
 
 	// ResourceControl represent a reference to a Docker resource with specific access controls
 	ResourceControl struct {
-		ID                 ResourceControlID   `json:"Id"`
-		ResourceID         string              `json:"ResourceId"`
-		SubResourceIDs     []string            `json:"SubResourceIds"`
-		Type               ResourceControlType `json:"Type"`
-		AdministratorsOnly bool                `json:"AdministratorsOnly"`
-
-		UserAccesses []UserResourceAccess `json:"UserAccesses"`
-		TeamAccesses []TeamResourceAccess `json:"TeamAccesses"`
+		ID                 ResourceControlID    `json:"Id"`
+		ResourceID         string               `json:"ResourceId"`
+		SubResourceIDs     []string             `json:"SubResourceIds"`
+		Type               ResourceControlType  `json:"Type"`
+		AdministratorsOnly bool                 `json:"AdministratorsOnly"`
+		UserAccesses       []UserResourceAccess `json:"UserAccesses"`
+		TeamAccesses       []TeamResourceAccess `json:"TeamAccesses"`
 
 		// Deprecated fields
-		// Deprecated: OwnerID field is deprecated in DBVersion == 2
-		OwnerID UserID `json:"OwnerId"`
-		// Deprecated: AccessLevel field is deprecated in DBVersion == 2
-		AccessLevel ResourceAccessLevel `json:"AccessLevel"`
+		// Deprecated in DBVersion == 2
+		OwnerID     UserID              `json:"OwnerId,omitempty"`
+		AccessLevel ResourceAccessLevel `json:"AccessLevel,omitempty"`
 	}
 
-	// ResourceControlType represents the type of resource associated to the resource control (volume, container, service).
+	// ResourceControlType represents the type of resource associated to the resource control (volume, container, service...).
 	ResourceControlType int
 
 	// UserResourceAccess represents the level of control on a resource for a specific user.
@@ -217,6 +292,31 @@ type (
 		Synchronize(toCreate, toUpdate, toDelete []*Endpoint) error
 	}
 
+	// RegistryService represents a service for managing registry data.
+	RegistryService interface {
+		Registry(ID RegistryID) (*Registry, error)
+		Registries() ([]Registry, error)
+		CreateRegistry(registry *Registry) error
+		UpdateRegistry(ID RegistryID, registry *Registry) error
+		DeleteRegistry(ID RegistryID) error
+	}
+
+	// StackService represents a service for managing stack data.
+	StackService interface {
+		Stack(ID StackID) (*Stack, error)
+		Stacks() ([]Stack, error)
+		StacksBySwarmID(ID string) ([]Stack, error)
+		CreateStack(stack *Stack) error
+		UpdateStack(ID StackID, stack *Stack) error
+		DeleteStack(ID StackID) error
+	}
+
+	// DockerHubService represents a service for managing the DockerHub object.
+	DockerHubService interface {
+		DockerHub() (*DockerHub, error)
+		StoreDockerHub(registry *DockerHub) error
+	}
+
 	// SettingsService represents a service for managing application settings.
 	SettingsService interface {
 		Settings() (*Settings, error)
@@ -253,22 +353,47 @@ type (
 
 	// FileService represents a service for managing files.
 	FileService interface {
-		StoreTLSFile(endpointID EndpointID, fileType TLSFileType, r io.Reader) error
-		GetPathForTLSFile(endpointID EndpointID, fileType TLSFileType) (string, error)
-		DeleteTLSFiles(endpointID EndpointID) error
+		GetFileContent(filePath string) (string, error)
+		RemoveDirectory(directoryPath string) error
+		StoreTLSFile(folder string, fileType TLSFileType, r io.Reader) error
+		GetPathForTLSFile(folder string, fileType TLSFileType) (string, error)
+		DeleteTLSFile(folder string, fileType TLSFileType) error
+		DeleteTLSFiles(folder string) error
+		GetStackProjectPath(stackIdentifier string) string
+		StoreStackFileFromString(stackIdentifier string, stackFileContent string) (string, error)
+		StoreStackFileFromReader(stackIdentifier string, r io.Reader) (string, error)
+	}
+
+	// GitService represents a service for managing Git.
+	GitService interface {
+		CloneRepository(url, destination string) error
 	}
 
 	// EndpointWatcher represents a service to synchronize the endpoints via an external source.
 	EndpointWatcher interface {
 		WatchEndpointFile(endpointFilePath string) error
 	}
+
+	// LDAPService represents a service used to authenticate users against a LDAP/AD.
+	LDAPService interface {
+		AuthenticateUser(username, password string, settings *LDAPSettings) error
+		TestConnectivity(settings *LDAPSettings) error
+	}
+
+	// StackManager represents a service to manage stacks.
+	StackManager interface {
+		Login(dockerhub *DockerHub, registries []Registry, endpoint *Endpoint) error
+		Logout(endpoint *Endpoint) error
+		Deploy(stack *Stack, prune bool, endpoint *Endpoint) error
+		Remove(stack *Stack, endpoint *Endpoint) error
+	}
 )
 
 const (
 	// APIVersion is the version number of the Portainer API.
-	APIVersion = "1.13.2"
+	APIVersion = "1.16.0"
 	// DBVersion is the version number of the Portainer database.
-	DBVersion = 2
+	DBVersion = 7
 	// DefaultTemplatesURL represents the default URL for the templates definitions.
 	DefaultTemplatesURL = "https://raw.githubusercontent.com/portainer/templates/master/templates.json"
 )
@@ -298,6 +423,14 @@ const (
 	StandardUserRole
 )
 
+const (
+	_ AuthenticationMethod = iota
+	// AuthenticationInternal represents the internal authentication method (authentication against Portainer API)
+	AuthenticationInternal
+	// AuthenticationLDAP represents the LDAP authentication method (authentication against a LDAP server)
+	AuthenticationLDAP
+)
+
 const (
 	_ ResourceAccessLevel = iota
 	// ReadWriteAccessLevel represents an access level with read-write permissions on a resource
@@ -312,4 +445,12 @@ const (
 	ServiceResourceControl
 	// VolumeResourceControl represents a resource control associated to a Docker volume
 	VolumeResourceControl
+	// NetworkResourceControl represents a resource control associated to a Docker network
+	NetworkResourceControl
+	// SecretResourceControl represents a resource control associated to a Docker secret
+	SecretResourceControl
+	// StackResourceControl represents a resource control associated to a stack composed of Docker services
+	StackResourceControl
+	// ConfigResourceControl represents a resource control associated to a Docker config
+	ConfigResourceControl
 )

app/__module.js

@@ -0,0 +1,76 @@
+angular.module('portainer', [
+  'ui.bootstrap',
+  'ui.router',
+  'isteven-multi-select',
+  'ngCookies',
+  'ngSanitize',
+  'ngFileUpload',
+  'ngMessages',
+  'angularUtils.directives.dirPagination',
+  'LocalStorageModule',
+  'angular-jwt',
+  'angular-google-analytics',
+  'ui',
+  'angular-loading-bar',
+  'portainer.templates',
+  'portainer.filters',
+  'portainer.rest',
+  'portainer.helpers',
+  'portainer.services',
+  'auth',
+  'dashboard',
+  'config',
+  'configs',
+  'container',
+  'containerConsole',
+  'containerLogs',
+  'containerStats',
+  'containerInspect',
+  'serviceLogs',
+  'containers',
+  'createConfig',
+  'createContainer',
+  'createNetwork',
+  'createRegistry',
+  'createSecret',
+  'createService',
+  'createVolume',
+  'createStack',
+  'engine',
+  'endpoint',
+  'endpointAccess',
+  'endpoints',
+  'events',
+  'extension.storidge',
+  'image',
+  'images',
+  'initAdmin',
+  'initEndpoint',
+  'main',
+  'network',
+  'networks',
+  'node',
+  'registries',
+  'registry',
+  'registryAccess',
+  'secrets',
+  'secret',
+  'service',
+  'services',
+  'settings',
+  'settingsAuthentication',
+  'sidebar',
+  'stack',
+  'stacks',
+  'swarm',
+  'swarmVisualizer',
+  'task',
+  'team',
+  'teams',
+  'templates',
+  'user',
+  'users',
+  'userSettings',
+  'volume',
+  'volumes',
+  'rzModule']);

app/app.js

@@ -1,693 +1,50 @@
-angular.module('portainer.filters', []);
-angular.module('portainer.rest', ['ngResource']);
-angular.module('portainer.services', []);
-angular.module('portainer.helpers', []);
-angular.module('portainer', [
-  'ui.bootstrap',
-  'ui.router',
-  'isteven-multi-select',
-  'ngCookies',
-  'ngSanitize',
-  'ngFileUpload',
-  'angularUtils.directives.dirPagination',
-  'LocalStorageModule',
-  'angular-jwt',
-  'angular-google-analytics',
-  'portainer.templates',
-  'portainer.filters',
-  'portainer.rest',
-  'portainer.helpers',
-  'portainer.services',
-  'auth',
-  'dashboard',
-  'common.accesscontrol.panel',
-  'common.accesscontrol.form',
-  'container',
-  'containerConsole',
-  'containerLogs',
-  'containers',
-  'createContainer',
-  'createNetwork',
-  'createSecret',
-  'createService',
-  'createVolume',
-  'docker',
-  'endpoint',
-  'endpointAccess',
-  'endpointInit',
-  'endpoints',
-  'events',
-  'image',
-  'images',
-  'main',
-  'network',
-  'networks',
-  'node',
-  'secrets',
-  'secret',
-  'service',
-  'services',
-  'settings',
-  'sidebar',
-  'stats',
-  'swarm',
-  'task',
-  'team',
-  'teams',
-  'templates',
-  'user',
-  'users',
-  'userSettings',
-  'volume',
-  'volumes'])
-  .config(['$stateProvider', '$urlRouterProvider', '$httpProvider', 'localStorageServiceProvider', 'jwtOptionsProvider', 'AnalyticsProvider', '$uibTooltipProvider', '$compileProvider', function ($stateProvider, $urlRouterProvider, $httpProvider, localStorageServiceProvider, jwtOptionsProvider, AnalyticsProvider, $uibTooltipProvider, $compileProvider) {
-    'use strict';
+angular.module('portainer')
+.run(['$rootScope', '$state', 'Authentication', 'authManager', 'StateManager', 'EndpointProvider', 'Notifications', 'Analytics', 'cfpLoadingBar', function ($rootScope, $state, Authentication, authManager, StateManager, EndpointProvider, Notifications, Analytics, cfpLoadingBar) {
+  'use strict';
 
-    var environment = '@@ENVIRONMENT';
-    if (environment === 'production') {
-      $compileProvider.debugInfoEnabled(false);
+  EndpointProvider.initialize();
+
+  StateManager.initialize()
+  .then(function success(state) {
+    if (state.application.authentication) {
+      initAuthentication(authManager, Authentication, $rootScope, $state);
     }
+    if (state.application.analytics) {
+      initAnalytics(Analytics, $rootScope);
+    }
+  })
+  .catch(function error(err) {
+    Notifications.error('Failure', err, 'Unable to retrieve application settings');
+  });
 
-    localStorageServiceProvider
-    .setStorageType('sessionStorage')
-    .setPrefix('portainer');
+  $rootScope.$state = $state;
 
-    jwtOptionsProvider.config({
-      tokenGetter: ['LocalStorage', function(LocalStorage) {
-        return LocalStorage.getJWT();
-      }],
-      unauthenticatedRedirector: ['$state', function($state) {
-        $state.go('auth', {error: 'Your session has expired'});
-      }]
-    });
-    $httpProvider.interceptors.push('jwtInterceptor');
+  // Workaround to prevent the loading bar from going backward
+  // https://github.com/chieffancypants/angular-loading-bar/issues/273
+  var originalSet = cfpLoadingBar.set;
+  cfpLoadingBar.set = function overrideSet(n) {
+    if (n > cfpLoadingBar.status()) {
+      originalSet.apply(cfpLoadingBar, arguments);
+    }
+  };
+}]);
 
-    AnalyticsProvider.setAccount('@@CONFIG_GA_ID');
-    AnalyticsProvider.startOffline(true);
 
-    $urlRouterProvider.otherwise('/auth');
+function initAuthentication(authManager, Authentication, $rootScope, $state) {
+  authManager.checkAuthOnRefresh();
+  authManager.redirectWhenUnauthenticated();
+  Authentication.init();
+  $rootScope.$on('tokenHasExpired', function() {
+    $state.go('auth', {error: 'Your session has expired'});
+  });
+}
 
-    toastr.options.timeOut = 3000;
-
-    $uibTooltipProvider.setTriggers({
-      'mouseenter': 'mouseleave',
-      'click': 'click',
-      'focus': 'blur',
-      'outsideClick': 'outsideClick'
-    });
-
-    $stateProvider
-    .state('root', {
-      abstract: true,
-      resolve: {
-        requiresLogin: ['StateManager', function (StateManager) {
-          var applicationState = StateManager.getState();
-          return applicationState.application.authentication;
-        }]
-      }
-    })
-    .state('auth', {
-      parent: 'root',
-      url: '/auth',
-      params: {
-        logout: false,
-        error: ''
-      },
-      views: {
-        'content@': {
-          templateUrl: 'app/components/auth/auth.html',
-          controller: 'AuthenticationController'
-        }
-      },
-      data: {
-        requiresLogin: false
-      }
-    })
-    .state('containers', {
-      parent: 'root',
-      url: '/containers/',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/containers/containers.html',
-          controller: 'ContainersController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('container', {
-      url: '^/containers/:id',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/container/container.html',
-          controller: 'ContainerController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('stats', {
-      url: '^/containers/:id/stats',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/stats/stats.html',
-          controller: 'StatsController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('logs', {
-      url: '^/containers/:id/logs',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/containerLogs/containerlogs.html',
-          controller: 'ContainerLogsController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('console', {
-      url: '^/containers/:id/console',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/containerConsole/containerConsole.html',
-          controller: 'ContainerConsoleController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('dashboard', {
-      parent: 'root',
-      url: '/dashboard',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/dashboard/dashboard.html',
-          controller: 'DashboardController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('actions', {
-      abstract: true,
-      url: '/actions',
-      views: {
-        'content@': {
-          template: '<div ui-view="content@"></div>'
-        },
-        'sidebar@': {
-          template: '<div ui-view="sidebar@"></div>'
-        }
-      }
-    })
-    .state('actions.create', {
-      abstract: true,
-      url: '/create',
-      views: {
-        'content@': {
-          template: '<div ui-view="content@"></div>'
-        },
-        'sidebar@': {
-          template: '<div ui-view="sidebar@"></div>'
-        }
-      }
-    })
-    .state('actions.create.container', {
-      url: '/container',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/createContainer/createcontainer.html',
-          controller: 'CreateContainerController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('actions.create.network', {
-      url: '/network',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/createNetwork/createnetwork.html',
-          controller: 'CreateNetworkController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('actions.create.secret', {
-      url: '/secret',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/createSecret/createsecret.html',
-          controller: 'CreateSecretController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('actions.create.service', {
-      url: '/service',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/createService/createservice.html',
-          controller: 'CreateServiceController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('actions.create.volume', {
-      url: '/volume',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/createVolume/createvolume.html',
-          controller: 'CreateVolumeController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('docker', {
-      url: '/docker/',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/docker/docker.html',
-          controller: 'DockerController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('endpoints', {
-      url: '/endpoints/',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/endpoints/endpoints.html',
-          controller: 'EndpointsController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('endpoint', {
-      url: '^/endpoints/:id',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/endpoint/endpoint.html',
-          controller: 'EndpointController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('endpoint.access', {
-      url: '^/endpoints/:id/access',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/endpointAccess/endpointAccess.html',
-          controller: 'EndpointAccessController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('endpointInit', {
-      url: '/init/endpoint',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/endpointInit/endpointInit.html',
-          controller: 'EndpointInitController'
-        }
-      }
-    })
-    .state('events', {
-      url: '/events/',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/events/events.html',
-          controller: 'EventsController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('images', {
-      url: '/images/',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/images/images.html',
-          controller: 'ImagesController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('image', {
-      url: '^/images/:id/',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/image/image.html',
-          controller: 'ImageController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('networks', {
-      url: '/networks/',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/networks/networks.html',
-          controller: 'NetworksController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('network', {
-      url: '^/networks/:id/',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/network/network.html',
-          controller: 'NetworkController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('node', {
-      url: '^/nodes/:id/',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/node/node.html',
-          controller: 'NodeController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('secrets', {
-      url: '^/secrets/',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/secrets/secrets.html',
-          controller: 'SecretsController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('secret', {
-      url: '^/secret/:id/',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/secret/secret.html',
-          controller: 'SecretController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('services', {
-      url: '/services/',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/services/services.html',
-          controller: 'ServicesController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('service', {
-      url: '^/service/:id/',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/service/service.html',
-          controller: 'ServiceController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('settings', {
-      url: '/settings/',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/settings/settings.html',
-          controller: 'SettingsController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('task', {
-      url: '^/task/:id',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/task/task.html',
-          controller: 'TaskController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('templates', {
-      url: '/templates/',
-      params: {
-        key: 'containers',
-        hide_descriptions: false
-      },
-      views: {
-        'content@': {
-          templateUrl: 'app/components/templates/templates.html',
-          controller: 'TemplatesController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('templates_linuxserver', {
-      url: '^/templates/linuxserver.io',
-      params: {
-        key: 'linuxserver.io',
-        hide_descriptions: true
-      },
-      views: {
-        'content@': {
-          templateUrl: 'app/components/templates/templates.html',
-          controller: 'TemplatesController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('volumes', {
-      url: '/volumes/',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/volumes/volumes.html',
-          controller: 'VolumesController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('volume', {
-      url: '^/volumes/:id',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/volume/volume.html',
-          controller: 'VolumeController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('users', {
-      url: '/users/',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/users/users.html',
-          controller: 'UsersController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('user', {
-      url: '^/users/:id',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/user/user.html',
-          controller: 'UserController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('userSettings', {
-      url: '/userSettings/',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/userSettings/userSettings.html',
-          controller: 'UserSettingsController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('teams', {
-      url: '/teams/',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/teams/teams.html',
-          controller: 'TeamsController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('team', {
-      url: '^/teams/:id',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/team/team.html',
-          controller: 'TeamController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    })
-    .state('swarm', {
-      url: '/swarm/',
-      views: {
-        'content@': {
-          templateUrl: 'app/components/swarm/swarm.html',
-          controller: 'SwarmController'
-        },
-        'sidebar@': {
-          templateUrl: 'app/components/sidebar/sidebar.html',
-          controller: 'SidebarController'
-        }
-      }
-    });
-  }])
-  .run(['$rootScope', '$state', 'Authentication', 'authManager', 'StateManager', 'EndpointProvider', 'Notifications', 'Analytics', function ($rootScope, $state, Authentication, authManager, StateManager, EndpointProvider, Notifications, Analytics) {
-    EndpointProvider.initialize();
-    StateManager.initialize().then(function success(state) {
-      if (state.application.authentication) {
-        authManager.checkAuthOnRefresh();
-        authManager.redirectWhenUnauthenticated();
-        Authentication.init();
-        $rootScope.$on('tokenHasExpired', function($state) {
-          $state.go('auth', {error: 'Your session has expired'});
-        });
-      }
-      if (state.application.analytics) {
-        Analytics.offline(false);
-        Analytics.registerScriptTags();
-        Analytics.registerTrackers();
-        $rootScope.$on('$stateChangeSuccess', function (event, toState, toParams, fromState, fromParams) {
-          Analytics.trackPage(toState.url);
-          Analytics.pageView();
-        });
-      }
-    }, function error(err) {
-      Notifications.error('Failure', err, 'Unable to retrieve application settings');
-    });
-
-    $rootScope.$state = $state;
-  }])
-  // This is your docker url that the api will use to make requests
-  // You need to set this to the api endpoint without the port i.e. http://192.168.1.9
-  // .constant('DOCKER_PORT', '') // Docker port, leave as an empty string if no port is required.  If you have a port, prefix it with a ':' i.e. :4243
-  .constant('DOCKER_ENDPOINT', 'api/docker')
-  .constant('CONFIG_ENDPOINT', 'api/old_settings')
-  .constant('SETTINGS_ENDPOINT', 'api/settings')
-  .constant('STATUS_ENDPOINT', 'api/status')
-  .constant('AUTH_ENDPOINT', 'api/auth')
-  .constant('USERS_ENDPOINT', 'api/users')
-  .constant('TEAMS_ENDPOINT', 'api/teams')
-  .constant('TEAM_MEMBERSHIPS_ENDPOINT', 'api/team_memberships')
-  .constant('RESOURCE_CONTROL_ENDPOINT', 'api/resource_controls')
-  .constant('ENDPOINTS_ENDPOINT', 'api/endpoints')
-  .constant('TEMPLATES_ENDPOINT', 'api/templates')
-  .constant('DEFAULT_TEMPLATES_URL', 'https://raw.githubusercontent.com/portainer/templates/master/templates.json')
-  .constant('PAGINATION_MAX_ITEMS', 10);
-  // .constant('UI_VERSION', 'v1.13.2');
+function initAnalytics(Analytics, $rootScope) {
+  Analytics.offline(false);
+  Analytics.registerScriptTags();
+  Analytics.registerTrackers();
+  $rootScope.$on('$stateChangeSuccess', function (event, toState, toParams, fromState, fromParams) {
+    Analytics.trackPage(toState.url);
+    Analytics.pageView();
+  });
+}

app/components/about/about.html

@@ -0,0 +1,100 @@
+<rd-header>
+  <rd-header-title title="About">
+  </rd-header-title>
+  <rd-header-content>
+    About Portainer
+  </rd-header-content>
+</rd-header>
+
+<div class="row">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-body>
+        <b>Portainer</b> is a <a href="https://github.com/portainer/portainer/blob/develop/LICENSE" target="_blank" >free and open-source software</a> brought to you with <span class="menu-icon fa fa-heart red-icon "></span> by <a href="https://portainer.io/" target="_blank">portainer.io</a> and <a href="https://github.com/portainer/portainer/graphs/contributors" target="_blank">contributors.</a>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-header title="Help support portainer" icon="fa-heartbeat"></rd-widget-header>
+      <rd-widget-body>
+      <div class="small" style="line-height:1.65;">
+        <p>
+          It is a community effort to make <b>Portainer</b> as feature-rich as simple it is to deploy and use. We need all the help we can get!
+        </p>
+        <p>
+          <i class="fa fa-chevron-circle-right" aria-hidden="true"></i> <u>Fund our work</u>
+          <ul>
+            <li>Become a <a href="https://www.patreon.com/Portainerio" target="_blank"><i class="fa fa-money" aria-hidden="true"></i> patron</a></li>
+            <li>Consider a <a href="https://portainer.io/support.html" target="_blank">paid support plan</a></li>
+            <li>Make a <a href="https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=YHXZJQNJQ36H6" target="_blank"><i class="fa fa-paypal" aria-hidden="true"></i> donation</a></li>
+          </ul>
+        </p>
+        <p>
+          <i class="fa fa-chevron-circle-right" aria-hidden="true"></i> <u>Contribute</u>
+          <ul>
+            <li>Found a bug or got a feature idea? Let's talk about it on <a href="https://github.com/portainer/portainer/issues" target="_blank"><i class="fa fa-github" aria-hidden="true"></i> Github</a></li>
+            <li>Follow our <a href="https://portainer.readthedocs.io/en/latest/contribute.html" target="_blank">contribution guidelines</a> to build it locally and make a <a target="_blank" href="https://github.com/portainer/portainer/compare"><i class="fa fa-github" aria-hidden="true"></i> pull request</a></li>
+          </ul>
+        </p>
+        <p>
+          <i class="fa fa-chevron-circle-right" aria-hidden="true"></i> <u>Spread the word</u>
+          <ul>
+            <li>Talk to your friends and colleagues about how awesome Portainer is!</li>
+            <li>Follow us on <a href="https://twitter.com/portainerio" target="_blank"><i class="fa fa-twitter" aria-hidden="true"></i> Twitter</a></li>
+          </ul>
+        </p>
+      </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-header title="Support and services" icon="fa-building-o"></rd-widget-header>
+      <rd-widget-body>
+        <div class="small" style="line-height:1.65;">
+          <p>
+            <i class="fa fa-chevron-circle-right" aria-hidden="true"></i> <u>Documentation</u>
+            <ul>
+              <li>Checkout our <a target="_blank" href="http://portainer.readthedocs.io"><i class="fa fa-book" aria-hidden="true"></i> online documentation</a></li>
+              <li>Be sure to have a look at our <a href="https://portainer.readthedocs.io/en/latest/faq.html" target="_blank">FAQ</a> and our list of <a href="https://github.com/portainer/portainer/issues" target="_blank">open issues</a></li>
+            </ul>
+          </p>
+          <p>
+            <i class="fa fa-chevron-circle-right" aria-hidden="true"></i> <u>Community support</u>
+            <ul>
+              <li>Join us on <a href="https://portainer.io/slack/" target="_blank"><i class="fa fa-slack" aria-hidden="true"></i> Slack</a></li>
+              <li>We're also on <a href="https://gitter.im/portainer/Lobby" target="_blank"><i class="fa fa-github-alt" aria-hidden="true"></i> Gitter</a></li>
+            </ul>
+          </p>
+          <p>
+            <i class="fa fa-chevron-circle-right" aria-hidden="true"></i> <u>Services</u>
+            <ul>
+              <li>Find out more about our <a href="https://portainer.io/support.html" target="_blank">consulting and commercial support plans</a></li>
+              <li>We also propose a fund-a-feature plan, reach out to us at <a target="_blank" href="mailto:info@portainer.io"><i class="fa fa-envelope-o" aria-hidden="true"></i> portainer.io</a></li>
+            </ul>
+          </p>
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-header title="Limitations" icon="fa-plug"></rd-widget-header>
+      <rd-widget-body>
+      <div class="small">
+        Portainer has full support for Docker >=1.10 and Docker Swarm >= 1.2.3, and partial support for Docker 1.9 (some features may not be available).
+      </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>

app/components/auth/auth.html

@@ -1,92 +1,38 @@
 <div class="page-wrapper">
   <!-- login box -->
   <div class="container simple-box">
-    <div class="col-md-6 col-md-offset-3 col-sm-6 col-sm-offset-3">
+    <div class="col-sm-6 col-sm-offset-3">
       <!-- login box logo -->
       <div class="row">
-        <img ng-if="logo" ng-src="{{ logo }}" class="simple-box-logo">
         <img ng-if="!logo" src="images/logo_alt.png" class="simple-box-logo" alt="Portainer">
+        <img ng-if="logo" ng-src="{{ logo }}" class="simple-box-logo">
       </div>
       <!-- !login box logo -->
-      <!-- init password panel -->
-      <div class="panel panel-default" ng-if="initPassword">
-        <div class="panel-body">
-          <!-- init password form -->
-          <form class="login-form form-horizontal" enctype="multipart/form-data" method="POST">
-            <!-- comment -->
-            <div class="input-group">
-              <p style="margin: 5px;">
-                Please specify a password for the <b>admin</b> user account.
-              </p>
-            </div>
-            <!-- !comment input -->
-            <!-- comment -->
-            <div class="input-group">
-              <p style="margin: 5px;">
-                <i ng-class="{true: 'fa fa-check green-icon', false: 'fa fa-times red-icon'}[initPasswordData.password.length >= 8]" aria-hidden="true"></i>
-                Your password must be at least 8 characters long
-              </p>
-            </div>
-            <!-- !comment input -->
-            <!-- password input -->
-            <div class="input-group">
-              <span class="input-group-addon"><i class="fa fa-lock" aria-hidden="true"></i></span>
-              <input id="admin_password" type="password" class="form-control" name="password" ng-model="initPasswordData.password" autofocus>
-            </div>
-            <!-- !password input -->
-            <!-- comment -->
-            <div class="input-group">
-              <p style="margin: 5px;">
-                <i ng-class="{true: 'fa fa-check green-icon', false: 'fa fa-times red-icon'}[initPasswordData.password !== '' && initPasswordData.password === initPasswordData.password_confirmation]" aria-hidden="true"></i>
-                Confirm your password
-              </p>
-            </div>
-            <!-- !comment input -->
-            <!-- password confirmation input -->
-            <div class="input-group">
-              <span class="input-group-addon"><i class="fa fa-lock" aria-hidden="true"></i></span>
-              <input id="password_confirmation" type="password" class="form-control" name="password" ng-model="initPasswordData.password_confirmation">
-            </div>
-            <!-- !password confirmation input -->
-            <!-- validate button -->
-            <div class="form-group">
-              <div class="col-sm-12 controls">
-                <p class="pull-left text-danger" ng-if="initPasswordData.error" style="margin: 5px;">
-                  <i class="fa fa-exclamation-circle" aria-hidden="true"></i> Unable to create default user
-                </p>
-                <button type="submit" class="btn btn-primary pull-right" ng-disabled="initPasswordData.password.length < 8 || initPasswordData.password !== initPasswordData.password_confirmation" ng-click="createAdminUser()"><i class="fa fa-key" aria-hidden="true"></i> Validate</button>
-              </div>
-            </div>
-            <!-- !validate button -->
-          </form>
-          <!-- !init password form -->
-        </div>
-      </div>
-      <!-- !init password panel -->
       <!-- login panel -->
-      <div class="panel panel-default" ng-if="!initPassword">
+      <div class="panel panel-default">
         <div class="panel-body">
           <!-- login form -->
-          <form class="login-form form-horizontal" enctype="multipart/form-data" method="POST">
+          <form class="simple-box-form form-horizontal">
             <!-- username input -->
             <div class="input-group">
               <span class="input-group-addon"><i class="fa fa-user" aria-hidden="true"></i></span>
-              <input id="username" type="text" class="form-control" name="username" ng-model="authData.username" placeholder="Username">
+              <input id="username" type="text" class="form-control" name="username" ng-model="formValues.Username" auto-focus>
             </div>
             <!-- !username input -->
             <!-- password input -->
             <div class="input-group">
               <span class="input-group-addon"><i class="fa fa-lock" aria-hidden="true"></i></span>
-              <input id="password" type="password" class="form-control" name="password" ng-model="authData.password" autofocus>
+              <input id="password" type="password" class="form-control" name="password" ng-model="formValues.Password">
             </div>
             <!-- !password input -->
             <!-- login button -->
             <div class="form-group">
-              <div class="col-sm-12 controls">
-                <p class="pull-left text-danger" ng-if="authData.error" style="margin: 5px;">
-                  <i class="fa fa-exclamation-circle" aria-hidden="true"></i> {{ authData.error }}
-                </p>
-                <button type="submit" class="btn btn-primary pull-right" ng-click="authenticateUser()"><i class="fa fa-sign-in" aria-hidden="true"></i> Login</button>
+              <div class="col-sm-12">
+                <button type="submit" class="btn btn-primary btn-sm pull-right" ng-click="authenticateUser()"><i class="fa fa-sign-in" aria-hidden="true"></i> Login</button>
+                <span class="pull-left" style="margin: 5px;" ng-if="state.AuthenticationError">
+                  <i class="fa fa-exclamation-triangle red-icon" aria-hidden="true" style="margin-right: 2px;"></i>
+                  <span class="small text-danger">{{ state.AuthenticationError }}</span>
+                </span>
               </div>
             </div>
             <!-- !login button -->

app/components/auth/authController.js

@@ -1,113 +1,110 @@
 angular.module('auth', [])
-.controller('AuthenticationController', ['$scope', '$state', '$stateParams', '$window', '$timeout', '$sanitize', 'Authentication', 'Users', 'EndpointService', 'StateManager', 'EndpointProvider', 'Notifications',
-function ($scope, $state, $stateParams, $window, $timeout, $sanitize, Authentication, Users, EndpointService, StateManager, EndpointProvider, Notifications) {
-
-  $scope.authData = {
-    username: 'admin',
-    password: '',
-    error: ''
-  };
-  $scope.initPasswordData = {
-    password: '',
-    password_confirmation: '',
-    error: false
-  };
+.controller('AuthenticationController', ['$scope', '$state', '$transition$', '$window', '$timeout', '$sanitize', 'Authentication', 'Users', 'UserService', 'EndpointService', 'StateManager', 'EndpointProvider', 'Notifications', 'SettingsService',
+function ($scope, $state, $transition$, $window, $timeout, $sanitize, Authentication, Users, UserService, EndpointService, StateManager, EndpointProvider, Notifications, SettingsService) {
 
   $scope.logo = StateManager.getState().application.logo;
 
-  if (!$scope.applicationState.application.authentication) {
-    EndpointService.endpoints()
-    .then(function success(data) {
-      if (data.length > 0)  {
-        endpointID = EndpointProvider.endpointID();
-        if (!endpointID) {
-          endpointID = data[0].Id;
-          EndpointProvider.setEndpointID(endpointID);
-        }
-        StateManager.updateEndpointState(true)
-        .then(function success() {
-          $state.go('dashboard');
-        }, function error(err) {
-          Notifications.error('Failure', err, 'Unable to connect to the Docker endpoint');
-        });
-      }
-      else {
-        $state.go('endpointInit');
-      }
-    }, function error(err) {
-      Notifications.error('Failure', err, 'Unable to retrieve endpoints');
-    });
-  } else {
-    Users.checkAdminUser({}, function () {},
-    function (e) {
-      if (e.status === 404) {
-        $scope.initPassword = true;
-      } else {
-        Notifications.error('Failure', e, 'Unable to verify administrator account existence');
-      }
-    });
-  }
-
-  if ($stateParams.logout) {
-    Authentication.logout();
-  }
-
-  if ($stateParams.error) {
-    $scope.authData.error = $stateParams.error;
-    Authentication.logout();
-  }
-
-  if (Authentication.isAuthenticated()) {
-    $state.go('dashboard');
-  }
-
-  $scope.createAdminUser = function() {
-    var password = $sanitize($scope.initPasswordData.password);
-    Users.initAdminUser({password: password}, function (d) {
-      $scope.initPassword = false;
-      $timeout(function() {
-        var element = $window.document.getElementById('password');
-        if(element) {
-          element.focus();
-        }
-      });
-    }, function (e) {
-      $scope.initPassword.error = true;
-    });
+  $scope.formValues = {
+    Username: '',
+    Password: ''
   };
 
-  $scope.authenticateUser = function() {
-    $scope.authenticationError = false;
-    var username = $sanitize($scope.authData.username);
-    var password = $sanitize($scope.authData.password);
-    Authentication.login(username, password)
+  $scope.state = {
+    AuthenticationError: ''
+  };
+
+  function setActiveEndpointAndRedirectToDashboard(endpoint) {
+    var endpointID = EndpointProvider.endpointID();
+    if (!endpointID) {
+      EndpointProvider.setEndpointID(endpoint.Id);
+    }
+    StateManager.updateEndpointState(true)
     .then(function success(data) {
-      return EndpointService.endpoints();
+      $state.go('dashboard');
     })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to connect to the Docker endpoint');
+    });
+  }
+
+  function unauthenticatedFlow() {
+    EndpointService.endpoints()
     .then(function success(data) {
-      var userDetails = Authentication.getUserDetails();
-      if (data.length > 0)  {
-        endpointID = EndpointProvider.endpointID();
-        if (!endpointID) {
-          endpointID = data[0].Id;
-          EndpointProvider.setEndpointID(endpointID);
-        }
-        StateManager.updateEndpointState(true)
-        .then(function success() {
-          $state.go('dashboard');
-        }, function error(err) {
-          Notifications.error('Failure', err, 'Unable to connect to the Docker endpoint');
-        });
-      }
-      else if (data.length === 0 && userDetails.role === 1) {
-        $state.go('endpointInit');
-      } else if (data.length === 0 && userDetails.role === 2) {
-        Authentication.logout();
-        $scope.authData.error = 'User not allowed. Please contact your administrator.';
+      var endpoints = data;
+      if (endpoints.length > 0)  {
+        setActiveEndpointAndRedirectToDashboard(endpoints[0]);
+      } else {
+        $state.go('init.endpoint');
       }
     })
     .catch(function error(err) {
-      $scope.authData.error = 'Authentication error';
+      Notifications.error('Failure', err, 'Unable to retrieve endpoints');
+    });
+  }
+
+  function authenticatedFlow() {
+    UserService.administratorExists()
+    .then(function success(exists) {
+      if (!exists) {
+        $state.go('init.admin');
+      }
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to verify administrator account existence');
+    });
+  }
+
+  $scope.authenticateUser = function() {
+    var username = $scope.formValues.Username;
+    var password = $scope.formValues.Password;
+
+    SettingsService.publicSettings()
+    .then(function success(data) {
+      var settings = data;
+      if (settings.AuthenticationMethod === 1) {
+        username = $sanitize(username);
+        password = $sanitize(password);
+      }
+      return Authentication.login(username, password);
+    })
+    .then(function success() {
+      return EndpointService.endpoints();
+    })
+    .then(function success(data) {
+      var endpoints = data;
+      var userDetails = Authentication.getUserDetails();
+      if (endpoints.length > 0)  {
+        setActiveEndpointAndRedirectToDashboard(endpoints[0]);
+      } else if (endpoints.length === 0 && userDetails.role === 1) {
+        $state.go('init.endpoint');
+      } else if (endpoints.length === 0 && userDetails.role === 2) {
+        Authentication.logout();
+        $scope.state.AuthenticationError = 'User not allowed. Please contact your administrator.';
+      }
+    })
+    .catch(function error() {
+      $scope.state.AuthenticationError = 'Invalid credentials';
     });
   };
+
+  function initView() {
+    if ($transition$.params().logout || $transition$.params().error) {
+      Authentication.logout();
+      $scope.state.AuthenticationError = $transition$.params().error;
+      return;
+    }
+
+    if (Authentication.isAuthenticated()) {
+      $state.go('dashboard');
+    }
+
+    var authenticationEnabled = $scope.applicationState.application.authentication;
+    if (!authenticationEnabled) {
+      unauthenticatedFlow();
+    } else {
+      authenticatedFlow();
+    }
+  }
+
+  initView();
 }]);

app/components/common/accessControlForm/accessControlForm.html

@@ -1,126 +0,0 @@
-<div ng-controller="AccessControlFormController">
-  <div class="col-sm-12 form-section-title">
-    Access control
-  </div>
-  <!-- access-control-switch -->
-  <div class="form-group">
-    <div class="col-sm-12">
-      <label for="ownership" class="control-label text-left">
-        Enable access control
-        <portainer-tooltip position="bottom" message="When enabled, you can restrict the access and management of this resource."></portainer-tooltip>
-      </label>
-      <label class="switch" style="margin-left: 20px;">
-        <input name="ownership" type="checkbox" ng-model="formValues.enableAccessControl" ng-click="synchronizeFormData()"><i></i>
-      </label>
-    </div>
-  </div>
-  <!-- !access-control-switch -->
-  <!-- restricted-access -->
-  <div class="form-group" ng-if="formValues.enableAccessControl" style="margin-bottom: 0">
-    <div class="ownership_wrapper">
-      <div ng-if="isAdmin">
-        <input type="radio" id="access_administrators" ng-model="formValues.Ownership" ng-click="synchronizeFormData()" value="administrators">
-        <label for="access_administrators">
-          <div class="ownership_header">
-            <i ng-class="'administrators' | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
-            Administrators
-          </div>
-          <p>I want to restrict the management of this resource to administrators only</p>
-        </label>
-      </div>
-      <div ng-if="isAdmin">
-        <input type="radio" id="access_restricted" ng-model="formValues.Ownership" ng-click="synchronizeFormData()" value="restricted">
-        <label for="access_restricted">
-          <div class="ownership_header">
-            <i ng-class="'restricted' | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
-            Restricted
-          </div>
-          <p>
-            I want to restrict the management of this resource to a set of users and/or teams
-          </p>
-        </label>
-      </div>
-      <div ng-if="!isAdmin">
-        <input type="radio" id="access_private" ng-model="formValues.Ownership" ng-click="synchronizeFormData()" value="private">
-        <label for="access_private">
-          <div class="ownership_header">
-            <i ng-class="'private' | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
-            Private
-          </div>
-          <p>
-            I want to this resource to be manageable by myself only
-          </p>
-        </label>
-      </div>
-      <div ng-if="!isAdmin && availableTeams.length > 0">
-        <input type="radio" id="access_restricted" ng-model="formValues.Ownership" ng-click="synchronizeFormData()" value="restricted">
-        <label for="access_restricted">
-          <div class="ownership_header">
-            <i ng-class="'restricted' | ownershipicon" aria-hidden="true" style="margin-right: 2px;"></i>
-            Restricted
-          </div>
-          <p ng-if="availableTeams.length === 1">
-            I want any member of my team (<b>{{ availableTeams[0].Name }}</b>) to be able to manage this resource
-          </p>
-          <p ng-if="availableTeams.length > 1">
-            I want to restrict the management of this resource to one or more of my teams
-          </p>
-        </label>
-      </div>
-    </div>
-  </div>
-  <!-- restricted-access -->
-  <!-- authorized-teams -->
-  <div class="form-group" ng-if="formValues.enableAccessControl && formValues.Ownership === 'restricted' && (isAdmin || (!isAdmin && availableTeams.length > 1))" >
-    <div class="col-sm-12">
-      <label for="group-access" class="control-label text-left">
-        Authorized teams
-        <portainer-tooltip ng-if="isAdmin && availableTeams.length > 0" position="bottom" message="You can select which teams(s) will be able to manage this resource."></portainer-tooltip>
-        <portainer-tooltip ng-if="!isAdmin && availableTeams.length > 1" position="bottom" message="As you are a member of multiple teams, you can select which teams(s) will be able to manage this resource."></portainer-tooltip>
-      </label>
-      <span ng-if="isAdmin && availableTeams.length === 0" class="small text-muted" style="margin-left: 20px;">
-        You have not yet created any team. Head over the <a ui-sref="teams">teams view</a> to manage user teams.</span>
-      </span>
-      <span isteven-multi-select
-      ng-if="(isAdmin && availableTeams.length > 0) || (!isAdmin && availableTeams.length > 1)"
-      input-model="availableTeams"
-      output-model="formValues.Ownership_Teams"
-      button-label="Name"
-      item-label="Name"
-      tick-property="ticked"
-      helper-elements="filter"
-      search-property="Name"
-      on-item-click="synchronizeFormData()"
-      translation="{nothingSelected: 'Select one or more teams', search: 'Search...'}"
-      style="margin-left: 20px;"
-    </span>
-  </div>
-</div>
-<!-- !authorized-teams -->
-<!-- authorized-users -->
-<div class="form-group" ng-if="formValues.enableAccessControl && formValues.Ownership === 'restricted' && isAdmin">
-  <div class="col-sm-12">
-    <label for="group-access" class="control-label text-left">
-      Authorized users
-      <portainer-tooltip ng-if="isAdmin && availableUsers.length > 0" position="bottom" message="You can select which user(s) will be able to manage this resource."></portainer-tooltip>
-    </label>
-    <span ng-if="availableUsers.length === 0" class="small text-muted" style="margin-left: 20px;">
-      You have not yet created any user. Head over the <a ui-sref="users">users view</a> to manage users.</span>
-    </span>
-    <span isteven-multi-select
-    ng-if="availableUsers.length > 0"
-    input-model="availableUsers"
-    output-model="formValues.Ownership_Users"
-    button-label="Username"
-    item-label="Username"
-    tick-property="ticked"
-    helper-elements="filter"
-    search-property="Username"
-    on-item-click="synchronizeFormData()"
-    translation="{nothingSelected: 'Select one or more users', search: 'Search...'}"
-    style="margin-left: 20px;"
-  </span>
-</div>
-</div>
-<!-- !authorized-users -->
-</div>

app/components/common/accessControlForm/accessControlFormController.js

@@ -1,55 +0,0 @@
-angular.module('common.accesscontrol.form', [])
-.controller('AccessControlFormController', ['$q', '$scope', '$state', 'UserService', 'ResourceControlService', 'Notifications', 'Authentication', 'ModalService', 'ControllerDataPipeline',
-function ($q, $scope, $state, UserService, ResourceControlService, Notifications, Authentication, ModalService, ControllerDataPipeline) {
-
-  $scope.availableTeams = [];
-  $scope.availableUsers = [];
-
-  $scope.formValues = {
-    enableAccessControl: true,
-    Ownership_Teams: [],
-    Ownership_Users: [],
-    Ownership: 'private'
-  };
-
-  $scope.synchronizeFormData = function() {
-    ControllerDataPipeline.setAccessControlFormData($scope.formValues.enableAccessControl,
-      $scope.formValues.Ownership, $scope.formValues.Ownership_Users, $scope.formValues.Ownership_Teams);
-  };
-
-  function initAccessControlForm() {
-    $('#loadingViewSpinner').show();
-
-    var userDetails = Authentication.getUserDetails();
-    var isAdmin = userDetails.role === 1 ? true: false;
-    $scope.isAdmin = isAdmin;
-
-    if (isAdmin) {
-      $scope.formValues.Ownership = 'administrators';
-    }
-
-    $q.all({
-      availableTeams: UserService.userTeams(userDetails.ID),
-      availableUsers: isAdmin ? UserService.users(false) : []
-    })
-    .then(function success(data) {
-      $scope.availableUsers = data.availableUsers;
-
-      var availableTeams = data.availableTeams;
-      $scope.availableTeams = availableTeams;
-      if (!isAdmin && availableTeams.length === 1) {
-        $scope.formValues.Ownership_Teams = availableTeams;
-      }
-
-      $scope.synchronizeFormData();
-    })
-    .catch(function error(err) {
-      Notifications.error('Failure', err, 'Unable to retrieve access control information');
-    })
-    .finally(function final() {
-      $('#loadingViewSpinner').hide();
-    });
-  }
-
-  initAccessControlForm();
-}]);

app/components/common/accessControlPanel/accessControlPanelController.js

@@ -1,158 +0,0 @@
-angular.module('common.accesscontrol.panel', [])
-.controller('AccessControlPanelController', ['$q', '$scope', '$state', 'UserService', 'ResourceControlService', 'Notifications', 'Authentication', 'ModalService', 'ControllerDataPipeline', 'FormValidator',
-function ($q, $scope, $state, UserService, ResourceControlService, Notifications, Authentication, ModalService, ControllerDataPipeline, FormValidator) {
-
-  $scope.state = {
-    displayAccessControlPanel: false,
-    canEditOwnership: false,
-    editOwnership: false,
-    formValidationError: ''
-  };
-
-  $scope.formValues = {
-    Ownership: 'public',
-    Ownership_Users: [],
-    Ownership_Teams: []
-  };
-
-  $scope.authorizedUsers = [];
-  $scope.availableUsers = [];
-  $scope.authorizedTeams = [];
-  $scope.availableTeams = [];
-
-  $scope.confirmUpdateOwnership = function (force) {
-    if (!validateForm()) {
-      return;
-    }
-    ModalService.confirmAccessControlUpdate(function (confirmed) {
-      if(!confirmed) { return; }
-      updateOwnership();
-    });
-  };
-
-  function processOwnershipFormValues() {
-    var userIds = [];
-    angular.forEach($scope.formValues.Ownership_Users, function(user) {
-      userIds.push(user.Id);
-    });
-    var teamIds = [];
-    angular.forEach($scope.formValues.Ownership_Teams, function(team) {
-      teamIds.push(team.Id);
-    });
-    var administratorsOnly = $scope.formValues.Ownership === 'administrators' ? true : false;
-
-    return {
-      ownership: $scope.formValues.Ownership,
-      authorizedUserIds: administratorsOnly ? [] : userIds,
-      authorizedTeamIds: administratorsOnly ? [] : teamIds,
-      administratorsOnly: administratorsOnly
-    };
-  }
-
-  function validateForm() {
-    $scope.state.formValidationError = '';
-    var error = '';
-
-    var accessControlData = {
-      ownership: $scope.formValues.Ownership,
-      authorizedUsers: $scope.formValues.Ownership_Users,
-      authorizedTeams: $scope.formValues.Ownership_Teams
-    };
-    var isAdmin = $scope.isAdmin;
-    error = FormValidator.validateAccessControl(accessControlData, isAdmin);
-    if (error) {
-      $scope.state.formValidationError = error;
-      return false;
-    }
-    return true;
-  }
-
-  function updateOwnership() {
-    $('#loadingViewSpinner').show();
-
-    var accessControlData = ControllerDataPipeline.getAccessControlData();
-    var resourceId = accessControlData.resourceId;
-    var ownershipParameters = processOwnershipFormValues();
-
-    ResourceControlService.applyResourceControlChange(accessControlData.resourceType, resourceId,
-      $scope.resourceControl, ownershipParameters)
-    .then(function success(data) {
-      Notifications.success('Access control successfully updated');
-      $state.reload();
-    })
-    .catch(function error(err) {
-      Notifications.error('Failure', err, 'Unable to update access control');
-    })
-    .finally(function final() {
-      $('#loadingViewSpinner').hide();
-    });
-  }
-
-  function initAccessControlPanel() {
-    $('#loadingViewSpinner').show();
-
-    var userDetails = Authentication.getUserDetails();
-    var isAdmin = userDetails.role === 1 ? true: false;
-    var userId = userDetails.ID;
-    $scope.isAdmin = isAdmin;
-
-    var accessControlData = ControllerDataPipeline.getAccessControlData();
-    var resourceControl = accessControlData.resourceControl;
-    $scope.resourceType = accessControlData.resourceType;
-    $scope.resourceControl = resourceControl;
-
-    if (isAdmin) {
-      if (resourceControl) {
-        $scope.formValues.Ownership = resourceControl.Ownership === 'private' ? 'restricted' : resourceControl.Ownership;
-      } else {
-        $scope.formValues.Ownership = 'public';
-      }
-    } else {
-      $scope.formValues.Ownership = 'public';
-    }
-
-    ResourceControlService.retrieveOwnershipDetails(resourceControl)
-    .then(function success(data) {
-      $scope.authorizedUsers = data.authorizedUsers;
-      $scope.authorizedTeams = data.authorizedTeams;
-      return ResourceControlService.retrieveUserPermissionsOnResource(userId, isAdmin, resourceControl);
-    })
-    .then(function success(data) {
-      $scope.state.canEditOwnership = data.isPartOfRestrictedUsers || data.isLeaderOfAnyRestrictedTeams;
-      $scope.state.canChangeOwnershipToTeam = data.isPartOfRestrictedUsers;
-
-      return $q.all({
-        availableUsers: isAdmin ? UserService.users(false) : [],
-        availableTeams: isAdmin || data.isPartOfRestrictedUsers ? UserService.userTeams(userId) : []
-      });
-    })
-    .then(function success(data) {
-      $scope.availableUsers = data.availableUsers;
-      angular.forEach($scope.availableUsers, function(user) {
-        var found = _.find($scope.authorizedUsers, { Id: user.Id });
-        if (found) {
-          user.selected = true;
-        }
-      });
-      $scope.availableTeams = data.availableTeams;
-      angular.forEach(data.availableTeams, function(team) {
-        var found = _.find($scope.authorizedTeams, { Id: team.Id });
-        if (found) {
-          team.selected = true;
-        }
-      });
-      if (data.availableTeams.length === 1) {
-        $scope.formValues.Ownership_Teams.push(data.availableTeams[0]);
-      }
-      $scope.state.displayAccessControlPanel = true;
-    })
-    .catch(function error(err) {
-      Notifications.error('Failure', err, 'Unable to retrieve access control information');
-    })
-    .finally(function final() {
-      $('#loadingViewSpinner').hide();
-    });
-  }
-
-  initAccessControlPanel();
-}]);

app/components/config/config.html

@@ -0,0 +1,80 @@
+<rd-header>
+  <rd-header-title title="Config details">
+    <a data-toggle="tooltip" title="Refresh" ui-sref="config({id: config.Id})" ui-sref-opts="{reload: true}">
+      <i class="fa fa-refresh" aria-hidden="true"></i>
+    </a>
+  </rd-header-title>
+  <rd-header-content>
+    <a ui-sref="configs">Configs</a> &gt; <a ui-sref="config({id: config.Id})">{{ config.Name }}</a>
+  </rd-header-content>
+</rd-header>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="fa-file-code-o" title="Config details"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <tr>
+              <td>Name</td>
+              <td>{{ config.Name }}</td>
+            </tr>
+            <tr>
+              <td>ID</td>
+              <td>
+                {{ config.Id }}
+                <button class="btn btn-xs btn-danger" ng-click="removeConfig(config.Id)"><i class="fa fa-trash space-right" aria-hidden="true"></i>Delete this config</button>
+              </td>
+            </tr>
+            <tr>
+              <td>Created</td>
+              <td>{{ config.CreatedAt | getisodate }}</td>
+            </tr>
+            <tr>
+              <td>Last updated</td>
+              <td>{{ config.UpdatedAt | getisodate }}</td>
+            </tr>
+            <tr ng-if="!(config.Labels | emptyobject)">
+              <td>Labels</td>
+              <td>
+                <table class="table table-bordered table-condensed">
+                  <tr ng-repeat="(k, v) in config.Labels">
+                    <td>{{ k }}</td>
+                    <td>{{ v }}</td>
+                  </tr>
+                </table>
+              </td>
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<!-- access-control-panel -->
+<por-access-control-panel
+  ng-if="config && applicationState.application.authentication"
+  resource-id="config.Id"
+  resource-control="config.ResourceControl"
+  resource-type="'config'">
+</por-access-control-panel>
+<!-- !access-control-panel -->
+
+<div class="row" ng-if="config">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-header icon="fa-file-code-o" title="Config content"></rd-widget-header>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <div class="form-group">
+            <div class="col-sm-12">
+              <textarea id="config-editor" ng-model="config.Data" class="form-control"></textarea>
+            </div>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>

app/components/config/configController.js

@@ -0,0 +1,37 @@
+angular.module('config', [])
+.controller('ConfigController', ['$scope', '$transition$', '$state',  '$document', 'ConfigService', 'Notifications', 'CodeMirrorService',
+function ($scope, $transition$, $state, $document, ConfigService, Notifications, CodeMirrorService) {
+
+  $scope.removeConfig = function removeConfig(configId) {
+    ConfigService.remove(configId)
+    .then(function success(data) {
+      Notifications.success('Config successfully removed');
+      $state.go('configs', {});
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to remove config');
+    });
+  };
+
+  function initEditor() {
+    $document.ready(function() {
+      var webEditorElement = $document[0].getElementById('config-editor');
+      if (webEditorElement) {
+        $scope.editor = CodeMirrorService.applyCodeMirrorOnElement(webEditorElement, false, true);
+      }
+    });
+  }
+
+  function initView() {
+    ConfigService.config($transition$.params().id)
+    .then(function success(data) {
+      $scope.config = data;
+      initEditor();
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve config details');
+    });
+  }
+
+  initView();
+}]);

app/components/configs/configs.html

@@ -0,0 +1,20 @@
+<rd-header>
+  <rd-header-title title="Configs list">
+    <a data-toggle="tooltip" title="Refresh" ui-sref="configs" ui-sref-opts="{reload: true}">
+      <i class="fa fa-refresh" aria-hidden="true"></i>
+    </a>
+  </rd-header-title>
+  <rd-header-content>Configs</rd-header-content>
+</rd-header>
+
+<div class="row">
+  <div class="col-sm-12">
+    <configs-datatable
+    title="Configs" title-icon="fa-file-code-o"
+    dataset="configs" table-key="configs"
+    order-by="Name" show-text-filter="true"
+    show-ownership-column="applicationState.application.authentication"
+    remove-action="removeAction"
+    ></configs-datatable>
+  </div>
+</div>

app/components/configs/configsController.js

@@ -0,0 +1,38 @@
+angular.module('configs', [])
+.controller('ConfigsController', ['$scope', '$state', 'ConfigService', 'Notifications',
+function ($scope, $state, ConfigService, Notifications) {
+  
+  $scope.removeAction = function (selectedItems) {
+    var actionCount = selectedItems.length;
+    angular.forEach(selectedItems, function (config) {
+      ConfigService.remove(config.Id)
+      .then(function success() {
+        Notifications.success('Config successfully removed', config.Name);
+        var index = $scope.configs.indexOf(config);
+        $scope.configs.splice(index, 1);
+      })
+      .catch(function error(err) {
+        Notifications.error('Failure', err, 'Unable to remove config');
+      })
+      .finally(function final() {
+        --actionCount;
+        if (actionCount === 0) {
+          $state.reload();
+        }
+      });
+    });
+  };
+
+  function initView() {
+    ConfigService.configs()
+    .then(function success(data) {
+      $scope.configs = data;
+    })
+    .catch(function error(err) {
+      $scope.configs = [];
+      Notifications.error('Failure', err, 'Unable to retrieve configs');
+    });
+  }
+
+  initView();
+}]);

app/components/container/container.html

@@ -1,306 +1,285 @@
 <rd-header>
   <rd-header-title title="Container details">
-    <i id="loadingViewSpinner" class="fa fa-cog fa-spin"></i>
   </rd-header-title>
   <rd-header-content>
-    <a ui-sref="containers">Containers</a> > <a ui-sref="container({id: container.Id})">{{ container.Name|trimcontainername }}</a>
+    <a ui-sref="containers">Containers</a> &gt; <a ui-sref="container({id: container.Id})">{{ container.Name|trimcontainername }}</a>
   </rd-header-content>
 </rd-header>
 
-<div class="row">
-  <div class="col-lg-12 col-md-12 col-xs-12">
-    <rd-widget>
-      <rd-widget-header icon="fa-cogs" title="Actions"></rd-widget-header>
-      <rd-widget-body classes="padding">
-        <div class="btn-group" role="group" aria-label="...">
-          <button class="btn btn-success" ng-click="start()" ng-disabled="container.State.Running"><i class="fa fa-play space-right" aria-hidden="true"></i>Start</button>
-          <button class="btn btn-danger" ng-click="stop()" ng-disabled="!container.State.Running"><i class="fa fa-stop space-right" aria-hidden="true"></i>Stop</button>
-          <button class="btn btn-danger" ng-click="kill()" ng-disabled="!container.State.Running"><i class="fa fa-bomb space-right" aria-hidden="true"></i>Kill</button>
-          <button class="btn btn-primary" ng-click="restart()" ng-disabled="!container.State.Running"><i class="fa fa-refresh space-right" aria-hidden="true"></i>Restart</button>
-          <button class="btn btn-primary" ng-click="pause()" ng-disabled="!container.State.Running || container.State.Paused"><i class="fa fa-pause space-right" aria-hidden="true"></i>Pause</button>
-          <button class="btn btn-primary" ng-click="unpause()" ng-disabled="!container.State.Paused"><i class="fa fa-play space-right" aria-hidden="true"></i>Resume</button>
-          <button class="btn btn-danger" ng-click="confirmRemove()"><i class="fa fa-trash space-right" aria-hidden="true"></i>Remove</button>
-        </div>
-      </rd-widget-body>
-    </rd-widget>
-  </div>
-</div>
-
-<div class="row">
-  <div class="col-lg-12 col-md-12 col-xs-12">
-    <rd-widget>
-      <rd-widget-header icon="fa-server" title="Container status"></rd-widget-header>
-      <rd-widget-body classes="no-padding">
-        <table class="table">
-          <tbody>
-            <tr>
-              <td>Name</td>
-              <td ng-if="!container.edit">
-                {{ container.Name|trimcontainername }}
-                <a href="" data-toggle="tooltip" title="Edit container name" ng-click="container.edit = true;"><i class="fa fa-edit"></i></a>
-              </td>
-              <td ng-if="container.edit">
-                <form ng-submit="renameContainer()">
-                  <input type="text" class="containerNameInput" ng-model="container.newContainerName">
-                  <a href="" ng-click="container.edit = false;"><i class="fa fa-times"></i></a>
-                  <a href="" ng-click="renameContainer()"><i class="fa fa-check-square-o"></i></a>
-                </form>
-              </td>
-            </tr>
-            <tr ng-if="container.NetworkSettings.IPAddress">
-              <td>IP address</td>
-              <td>{{ container.NetworkSettings.IPAddress }}</td>
-            </tr>
-            <tr>
-              <td>Status</td>
-              <td>
-                <i class="fa fa-heartbeat space-right green-icon" ng-if="container.State.Running"></i>
-                <i class="fa fa-heartbeat space-right red-icon" ng-if="!container.State.Running && container.State.Status !== 'created'"></i>
-                {{ container.State|getstatetext }} since {{ activityTime }}<span ng-if="!container.State.Running && container.State.Status !== 'created'"> with exit code {{ container.State.ExitCode }}</span>
-              </td>
-            </tr>
-            <tr>
-              <td>Created</td>
-              <td>{{ container.Created|getisodate }}</td>
-            </tr>
-            <tr ng-if="container.State.Running">
-              <td>Start time</td>
-              <td>{{ container.State.StartedAt|getisodate }}</td>
-            </tr>
-            <tr ng-if="!container.State.Running && container.State.Status !== 'created'">
-              <td>Finished</td>
-              <td>{{ container.State.FinishedAt|getisodate }}</td>
-            </tr>
-            <tr>
-              <td colspan="2">
-                <div class="btn-group" role="group" aria-label="...">
-                  <a class="btn btn-outline-secondary" type="button" ui-sref="stats({id: container.Id})"><i class="fa fa-area-chart space-right" aria-hidden="true"></i>Stats</a>
-                  <a class="btn btn-outline-secondary" type="button" ui-sref="logs({id: container.Id})"><i class="fa fa-exclamation-circle space-right" aria-hidden="true"></i>Logs</a>
-                  <a class="btn btn-outline-secondary" type="button" ui-sref="console({id: container.Id})"><i class="fa fa-terminal space-right" aria-hidden="true"></i>Console</a>
-                </div>
-              </td>
-            </tr>
-          </tbody>
-        </table>
-      </rd-widget-body>
-    </rd-widget>
-  </div>
-</div>
-
-<div ng-include="'app/components/common/accessControlPanel/accessControlPanel.html'" ng-if="container && applicationState.application.authentication"></div>
-
-<div ng-if="container.State.Health" class="row">
-  <div class="col-lg-12 col-md-12 col-xs-12">
-    <rd-widget>
-      <rd-widget-header icon="fa-server" title="Container health"></rd-widget-header>
-      <rd-widget-body classes="no-padding">
-        <table class="table">
-          <tbody>
-            <tr>
-              <td>Status</td>
-              <td>
-                <i ng-class="{'healthy': 'fa fa-heartbeat space-right green-icon', 'unhealthy': 'fa fa-heartbeat space-right red-icon', 'starting': 'fa fa-heartbeat space-right orange-icon'}[container.State.Health.Status]"></i>
-                {{ container.State.Health.Status }}
-              </td>
-            </tr>
-            <tr>
-              <td>Failure count</td>
-              <td>{{ container.State.Health.FailingStreak }}</td>
-            </tr>
-            <tr>
-              <td>Last output</td>
-              <td>{{ container.State.Health.Log[container.State.Health.Log.length - 1].Output }}</td>
-            </tr>
-          </tbody>
-        </table>
-      </rd-widget-body>
-    </rd-widge>
-  </div>
-</div>
-
-<div class="row">
-  <div class="col-lg-12 col-md-12 col-xs-12">
-    <rd-widget>
-      <rd-widget-header icon="fa-clone" title="Create image"></rd-widget-header>
-      <rd-widget-body>
-        <form class="form-horizontal">
-          <!-- tag-description -->
-          <div class="form-group">
-            <div class="col-sm-12">
-              <span class="small text-muted">
-                You can create an image from this container, this allows you to backup important data or save
-                helpful configurations. You'll be able to spin up another container based on this image afterward.
-              </span>
-            </div>
+  <div class="row">
+    <div class="col-lg-12 col-md-12 col-xs-12">
+      <rd-widget>
+        <rd-widget-header icon="fa-cogs" title="Actions"></rd-widget-header>
+        <rd-widget-body classes="padding">
+          <div class="btn-group" role="group" aria-label="...">
+            <button class="btn btn-success btn-sm" ng-click="start()" ng-disabled="container.State.Running"><i class="fa fa-play space-right" aria-hidden="true"></i>Start</button>
+            <button class="btn btn-danger btn-sm" ng-click="stop()" ng-disabled="!container.State.Running"><i class="fa fa-stop space-right" aria-hidden="true"></i>Stop</button>
+            <button class="btn btn-danger btn-sm" ng-click="kill()" ng-disabled="!container.State.Running"><i class="fa fa-bomb space-right" aria-hidden="true"></i>Kill</button>
+            <button class="btn btn-primary btn-sm" ng-click="restart()" ng-disabled="!container.State.Running"><i class="fa fa-refresh space-right" aria-hidden="true"></i>Restart</button>
+            <button class="btn btn-primary btn-sm" ng-click="pause()" ng-disabled="!container.State.Running || container.State.Paused"><i class="fa fa-pause space-right" aria-hidden="true"></i>Pause</button>
+            <button class="btn btn-primary btn-sm" ng-click="unpause()" ng-disabled="!container.State.Paused"><i class="fa fa-play space-right" aria-hidden="true"></i>Resume</button>
+            <button class="btn btn-danger btn-sm" ng-click="confirmRemove()"><i class="fa fa-trash space-right" aria-hidden="true"></i>Remove</button>
           </div>
-          <!-- !tag-description -->
-          <!-- name-and-registry-inputs -->
-          <div class="form-group">
-            <label for="image_name" class="col-sm-1 control-label text-left">Name</label>
-            <div class="col-sm-11 col-md-6">
-              <input type="text" class="form-control" ng-model="config.Image" id="image_name" placeholder="e.g. myImage:myTag">
-            </div>
-            <label for="image_registry" class="col-sm-2 margin-sm-top control-label text-left">
-              Registry
-              <portainer-tooltip position="bottom" message="A registry to pull the image from. Leave empty to use the official Docker registry."></portainer-tooltip>
-            </label>
-            <div class="col-sm-10 col-md-3 margin-sm-top">
-              <input type="text" class="form-control" ng-model="config.Registry" id="image_registry" placeholder="optional">
-            </div>
+          <div class="btn-group" role="group" aria-label="...">
+            <button type="button" class="btn btn-danger btn-sm" ng-disabled="state.recreateContainerInProgress" ng-click="recreate()" button-spinner="state.recreateContainerInProgress" ng-if="!container.Config.Labels['com.docker.swarm.service.id']">
+              <span ng-hide="state.recreateContainerInProgress"><i class="fa fa-refresh space-right" aria-hidden="true"></i>Recreate</span>
+              <span ng-show="state.recreateContainerInProgress">Recreation in progress...</span>
+            </button>
+            <button class="btn btn-primary btn-sm" ng-click="duplicate()" ng-if="!container.Config.Labels['com.docker.swarm.service.id']"><i class="fa fa-files-o space-right" aria-hidden="true"></i>Duplicate/Edit</button>
           </div>
-          <!-- !name-and-registry-inputs -->
-          <!-- tag-note -->
-          <div class="form-group">
-            <div class="col-sm-12">
-              <span class="small text-muted">Note: if you don't specify the tag in the image name, <span class="label label-default">latest</span> will be used.</span>
+        </rd-widget-body>
+      </rd-widget>
+    </div>
+  </div>
+
+  <div class="row">
+    <div class="col-lg-12 col-md-12 col-xs-12">
+      <rd-widget>
+        <rd-widget-header icon="fa-server" title="Container status"></rd-widget-header>
+        <rd-widget-body classes="no-padding">
+          <table class="table">
+            <tbody>
+              <tr>
+                <td>ID</td>
+                <td>{{ container.Id }}</td>
+              </tr>
+              <tr>
+                <td>Name</td>
+                <td ng-if="!container.edit">
+                  {{ container.Name|trimcontainername }}
+                  <a href="" data-toggle="tooltip" title="Edit container name" ng-click="container.edit = true;"><i class="fa fa-edit"></i></a>
+                </td>
+                <td ng-if="container.edit">
+                  <form ng-submit="renameContainer()">
+                    <input type="text" class="containerNameInput" ng-model="container.newContainerName">
+                    <a href="" ng-click="container.edit = false;"><i class="fa fa-times"></i></a>
+                    <a href="" ng-click="renameContainer()"><i class="fa fa-check-square-o"></i></a>
+                  </form>
+                </td>
+              </tr>
+              <tr ng-if="container.NetworkSettings.IPAddress">
+                <td>IP address</td>
+                <td>{{ container.NetworkSettings.IPAddress }}</td>
+              </tr>
+              <tr>
+                <td>Status</td>
+                <td>
+                  <i class="fa fa-heartbeat space-right green-icon" ng-if="container.State.Running"></i>
+                  <i class="fa fa-heartbeat space-right red-icon" ng-if="!container.State.Running && container.State.Status !== 'created'"></i>
+                  {{ container.State|getstatetext }} since {{ activityTime }}<span ng-if="!container.State.Running && container.State.Status !== 'created'"> with exit code {{ container.State.ExitCode }}</span>
+                </td>
+              </tr>
+              <tr>
+                <td>Created</td>
+                <td>{{ container.Created|getisodate }}</td>
+              </tr>
+              <tr ng-if="container.State.Running">
+                <td>Start time</td>
+                <td>{{ container.State.StartedAt|getisodate }}</td>
+              </tr>
+              <tr ng-if="!container.State.Running && container.State.Status !== 'created'">
+                <td>Finished</td>
+                <td>{{ container.State.FinishedAt|getisodate }}</td>
+              </tr>
+              <tr>
+                <td colspan="2">
+                  <div class="btn-group" role="group" aria-label="...">
+                    <a class="btn" type="button" ui-sref="stats({id: container.Id})"><i class="fa fa-area-chart space-right" aria-hidden="true"></i>Stats</a>
+                    <a class="btn" type="button" ui-sref="containerlogs({id: container.Id})"><i class="fa fa-exclamation-circle space-right" aria-hidden="true"></i>Logs</a>
+                    <a class="btn" type="button" ui-sref="console({id: container.Id})"><i class="fa fa-terminal space-right" aria-hidden="true"></i>Console</a>
+                    <a class="btn" type="button" ui-sref="inspect({id: container.Id})"><i class="fa fa-info-circle space-right" aria-hidden="true"></i>Inspect</a>
+                  </div>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </rd-widget-body>
+      </rd-widget>
+    </div>
+  </div>
+
+  <!-- access-control-panel -->
+  <por-access-control-panel
+    ng-if="container && applicationState.application.authentication"
+    resource-id="container.Id"
+    resource-control="container.ResourceControl"
+    resource-type="'container'">
+  </por-access-control-panel>
+  <!-- !access-control-panel -->
+
+  <div ng-if="container.State.Health" class="row">
+    <div class="col-lg-12 col-md-12 col-xs-12">
+      <rd-widget>
+        <rd-widget-header icon="fa-server" title="Container health"></rd-widget-header>
+        <rd-widget-body classes="no-padding">
+          <table class="table">
+            <tbody>
+              <tr>
+                <td>Status</td>
+                <td>
+                  <i ng-class="{'healthy': 'fa fa-heartbeat space-right green-icon', 'unhealthy': 'fa fa-heartbeat space-right red-icon', 'starting': 'fa fa-heartbeat space-right orange-icon'}[container.State.Health.Status]"></i>
+                  {{ container.State.Health.Status }}
+                </td>
+              </tr>
+              <tr>
+                <td>Failure count</td>
+                <td>{{ container.State.Health.FailingStreak }}</td>
+              </tr>
+              <tr>
+                <td>Last output</td>
+                <td>{{ container.State.Health.Log[container.State.Health.Log.length - 1].Output }}</td>
+              </tr>
+            </tbody>
+          </table>
+        </rd-widget-body>
+      </rd-widget>
+    </div>
+  </div>
+
+  <div class="row">
+    <div class="col-lg-12 col-md-12 col-xs-12">
+      <rd-widget>
+        <rd-widget-header icon="fa-clone" title="Create image"></rd-widget-header>
+        <rd-widget-body>
+          <form class="form-horizontal">
+            <!-- tag-description -->
+            <div class="form-group">
+              <div class="col-sm-12">
+                <span class="small text-muted">
+                  You can create an image from this container, this allows you to backup important data or save
+                  helpful configurations. You'll be able to spin up another container based on this image afterward.
+                </span>
+              </div>
             </div>
-          </div>
-          <!-- !tag-note -->
-          <div class="form-group">
-            <div class="col-sm-12">
-              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!config.Image" ng-click="commit()">Create</button>
-              <i id="createImageSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+            <!-- !tag-description -->
+            <!-- image-and-registry -->
+            <div class="form-group">
+              <por-image-registry image="config.Image" registry="config.Registry"></por-image-registry>
             </div>
-          </div>
-        </form>
-      </rd-widget-body>
-    </rd-widget>
+            <!-- !image-and-registry -->
+            <!-- tag-note -->
+            <div class="form-group">
+              <div class="col-sm-12">
+                <span class="small text-muted">Note: if you don't specify the tag in the image name, <span class="label label-default">latest</span> will be used.</span>
+              </div>
+            </div>
+            <!-- !tag-note -->
+            <div class="form-group">
+              <div class="col-sm-12">
+                <button type="button" class="btn btn-primary btn-sm" ng-disabled="!config.Image" ng-click="commit()">Create</button>
+              </div>
+            </div>
+          </form>
+        </rd-widget-body>
+      </rd-widget>
+    </div>
   </div>
-</div>
 
-<div class="row">
-  <div class="col-lg-12 col-md-12 col-xs-12">
-    <rd-widget>
-      <rd-widget-header icon="fa-server" title="Container details"></rd-widget-header>
-      <rd-widget-body classes="no-padding">
-        <table class="table">
-          <tbody>
-            <tr>
-              <td>Image</td>
-              <td><a ui-sref="image({id: container.Image})">{{ container.Image }}</a></td>
-            </tr>
-            <tr ng-if="portBindings.length > 0">
-              <td>Port configuration</td>
-              <td>
-                <div ng-repeat="portMapping in portBindings">
-                  {{ portMapping.container }} <i class="fa fa-long-arrow-right"></i> {{ portMapping.host }}
-                </div>
-              </td>
-            </tr>
-            <tr>
-              <td>CMD</td>
-              <td><code>{{ container.Config.Cmd|command }}</code></td>
-            </tr>
-            <tr>
-              <td>ENV</td>
-              <td>
-                <table class="table table-bordered table-condensed">
-                  <tr ng-repeat="var in container.Config.Env track by $index">
-                    <td>{{ var|key: '=' }}</td>
-                    <td>{{ var|value: '=' }}</td>
-                  </tr>
-                </table>
-              </td>
-            </tr>
-            <tr ng-if="!(container.Config.Labels | emptyobject)">
-              <td>Labels</td>
-              <td>
-                <table class="table table-bordered table-condensed">
-                  <tr ng-repeat="(k, v) in container.Config.Labels">
-                    <td>{{ k }}</td>
-                    <td>{{ v }}</td>
-                  </tr>
-                </table>
-              </td>
-            </tr>
-            <tr ng-if="container.HostConfig.RestartPolicy.Name !== 'no'">
-              <td>Restart policies</td>
-              <td>
-                <table class="table table-bordered table-condensed">
-                  <tr>
-                    <td class="col-md-3">Name</td>
-                    <td>{{ container.HostConfig.RestartPolicy.Name }}</td>
-                  </tr>
-                  <tr>
-                    <td class="col-md-3">MaximumRetryCount</td>
-                    <td>
-                      {{ container.HostConfig.RestartPolicy.MaximumRetryCount }}
-                    </td>
-                  </tr>
-                </table>
-              </td>
-            </tr>
-          </tbody>
-        </table>
-      </rd-widget-body>
-    </rd-widget>
+  <div class="row">
+    <div class="col-lg-12 col-md-12 col-xs-12">
+      <rd-widget>
+        <rd-widget-header icon="fa-server" title="Container details"></rd-widget-header>
+        <rd-widget-body classes="no-padding">
+          <table class="table">
+            <tbody>
+              <tr>
+                <td>Image</td>
+                <td><a ui-sref="image({id: container.Image})">{{ container.Image }}</a></td>
+              </tr>
+              <tr ng-if="portBindings.length > 0">
+                <td>Port configuration</td>
+                <td>
+                  <div ng-repeat="portMapping in portBindings">
+                    {{ portMapping.container }} <i class="fa fa-long-arrow-right"></i> {{ portMapping.host }}
+                  </div>
+                </td>
+              </tr>
+              <tr>
+                <td>CMD</td>
+                <td><code>{{ container.Config.Cmd|command }}</code></td>
+              </tr>
+              <tr>
+                <td>ENV</td>
+                <td>
+                  <table class="table table-bordered table-condensed">
+                    <tr ng-repeat="var in container.Config.Env track by $index">
+                      <td>{{ var|key: '=' }}</td>
+                      <td>{{ var|value: '=' }}</td>
+                    </tr>
+                  </table>
+                </td>
+              </tr>
+              <tr ng-if="!(container.Config.Labels | emptyobject)">
+                <td>Labels</td>
+                <td>
+                  <table class="table table-bordered table-condensed">
+                    <tr ng-repeat="(k, v) in container.Config.Labels">
+                      <td>{{ k }}</td>
+                      <td>{{ v }}</td>
+                    </tr>
+                  </table>
+                </td>
+              </tr>
+              <tr ng-if="container.HostConfig.RestartPolicy.Name !== 'no'">
+                <td>Restart policies</td>
+                <td>
+                  <table class="table table-bordered table-condensed">
+                    <tr>
+                      <td class="col-md-3">Name</td>
+                      <td>{{ container.HostConfig.RestartPolicy.Name }}</td>
+                    </tr>
+                    <tr>
+                      <td class="col-md-3">MaximumRetryCount</td>
+                      <td>
+                        {{ container.HostConfig.RestartPolicy.MaximumRetryCount }}
+                      </td>
+                    </tr>
+                  </table>
+                </td>
+              </tr>
+            </tbody>
+          </table>
+        </rd-widget-body>
+      </rd-widget>
+    </div>
   </div>
-</div>
 
-<div class="row" ng-if="container.HostConfig.Binds.length > 0">
-  <div class="col-lg-12 col-md-12 col-xs-12">
-    <rd-widget>
-      <rd-widget-header icon="fa-cubes" title="Volumes"></rd-widget-header>
-      <rd-widget-body classes="no-padding">
-        <table class="table">
-          <thead>
-            <tr>
-              <th>Host</th>
-              <th>Container</th>
-            </tr>
-          </thead>
-          <tbody>
-            <tr ng-repeat="vol in container.HostConfig.Binds">
-              <td>{{ vol|key: ':' }}</td>
-              <td>{{ vol|value: ':' }}</td>
-            </tr>
-          </tbody>
-        </table>
-      </rd-widget-body>
-    </rd-widget>
+  <div class="row" ng-if="container.Mounts.length > 0">
+    <div class="col-lg-12 col-md-12 col-xs-12">
+      <rd-widget>
+        <rd-widget-header icon="fa-cubes" title="Volumes"></rd-widget-header>
+        <rd-widget-body classes="no-padding">
+          <table class="table">
+            <thead>
+              <tr>
+                <th>Host/volume</th>
+                <th>Path in container</th>
+              </tr>
+            </thead>
+            <tbody>
+              <tr ng-repeat="vol in container.Mounts">
+                <td ng-if="vol.Type === 'bind'">{{ vol.Source }}</td>
+                <td ng-if="vol.Type === 'volume'"><a ui-sref="volume({id: vol.Name})">{{ vol.Name }}</a></td>
+                <td>{{ vol.Destination }}</td>
+              </tr>
+            </tbody>
+          </table>
+        </rd-widget-body>
+      </rd-widget>
+    </div>
   </div>
-</div>
 
-<div class="row" ng-if="!(container.NetworkSettings.Networks | emptyobject)">
-  <div class="col-lg-12 col-md-12 col-xs-12">
-    <rd-widget>
-      <rd-widget-header icon="fa-sitemap" title="Connected networks">
-        <div class="pull-right">
-          Items per page:
-          <select ng-model="state.pagination_count" ng-change="changePaginationCount()">
-            <option value="0">All</option>
-            <option value="10">10</option>
-            <option value="25">25</option>
-            <option value="50">50</option>
-            <option value="100">100</option>
-          </select>
-        </div>
-      </rd-widget-header>
-      <rd-widget-body classes="no-padding">
-        <table class="table">
-          <thead>
-            <th>Network Name</th>
-            <th>IP Address</th>
-            <th>Gateway</th>
-            <th>MacAddress</th>
-            <th>Actions</th>
-          </thead>
-          <tbody>
-            <tr dir-paginate="(key, value) in container.NetworkSettings.Networks | itemsPerPage: state.pagination_count">
-              <td><a ui-sref="network({id: value.NetworkID})">{{ key }}</a></td>
-              <td>{{ value.IPAddress || '-' }}</td>
-              <td>{{ value.Gateway || '-' }}</td>
-              <td>{{ value.MacAddress || '-' }}</td>
-              <td>
-                <button type="button" class="btn btn-xs btn-danger" ng-click="containerLeaveNetwork(container, value.NetworkID)"><i class="fa fa-trash space-right" aria-hidden="true"></i>Leave Network</button>
-              </td>
-            </tr>
-          </tbody>
-        </table>
-        <div class="pagination-controls">
-          <dir-pagination-controls></dir-pagination-controls>
-        </div>
-      </rd-widget-body>
-    </rd-widget>
+  <div class="row">
+    <div class="col-sm-12">
+      <container-networks-datatable
+      title="Connected networks" title-icon="fa-sitemap"
+      dataset="container.NetworkSettings.Networks" table-key="container-networks"
+      container="container"
+      available-networks="availableNetworks"
+      join-network-action="containerJoinNetwork"
+      join-network-action-in-progress="state.joinNetworkInProgress"
+      leave-network-action="containerLeaveNetwork"
+      leave-network-action-in-progress="state.leaveNetworkInProgress"
+      ></container-networks-datatable>
+    </div>
   </div>
-</div>

app/components/container/containerController.js

@@ -1,25 +1,24 @@
 angular.module('container', [])
-.controller('ContainerController', ['$scope', '$state','$stateParams', '$filter', 'Container', 'ContainerCommit', 'ContainerService', 'ImageHelper', 'Network', 'Notifications', 'Pagination', 'ModalService', 'ControllerDataPipeline',
-function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, ContainerService, ImageHelper, Network, Notifications, Pagination, ModalService, ControllerDataPipeline) {
+.controller('ContainerController', ['$q', '$scope', '$state','$transition$', '$filter', 'Container', 'ContainerCommit', 'ContainerHelper', 'ContainerService', 'ImageHelper', 'Network', 'NetworkService', 'Notifications', 'ModalService', 'ResourceControlService', 'RegistryService', 'ImageService',
+function ($q, $scope, $state, $transition$, $filter, Container, ContainerCommit, ContainerHelper, ContainerService, ImageHelper, Network, NetworkService, Notifications, ModalService, ResourceControlService, RegistryService, ImageService) {
   $scope.activityTime = 0;
   $scope.portBindings = [];
+
   $scope.config = {
     Image: '',
     Registry: ''
   };
-  $scope.state = {};
-  $scope.state.pagination_count = Pagination.getPaginationCount('container_networks');
 
-  $scope.changePaginationCount = function() {
-    Pagination.setPaginationCount('container_networks', $scope.state.pagination_count);
+  $scope.state = {
+    recreateContainerInProgress: false,
+    joinNetworkInProgress: false,
+    leaveNetworkInProgress: false
   };
 
   var update = function () {
-    $('#loadingViewSpinner').show();
-    Container.get({id: $stateParams.id}, function (d) {
+    Container.get({id: $transition$.params().id}, function (d) {
       var container = new ContainerDetailsViewModel(d);
       $scope.container = container;
-      ControllerDataPipeline.setAccessControlData('container', $stateParams.id, container.ResourceControl);
       $scope.container.edit = false;
       $scope.container.newContainerName = $filter('trimcontainername')(container.Name);
 
@@ -42,18 +41,15 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Con
           }
         });
       }
-      $('#loadingViewSpinner').hide();
     }, function (e) {
-      $('#loadingViewSpinner').hide();
       Notifications.error('Failure', e, 'Unable to retrieve container info');
     });
   };
 
   $scope.start = function () {
-    $('#loadingViewSpinner').show();
     Container.start({id: $scope.container.Id}, {}, function (d) {
       update();
-      Notifications.success('Container started', $stateParams.id);
+      Notifications.success('Container started', $transition$.params().id);
     }, function (e) {
       update();
       Notifications.error('Failure', e, 'Unable to start container');
@@ -61,10 +57,9 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Con
   };
 
   $scope.stop = function () {
-    $('#loadingViewSpinner').show();
-    Container.stop({id: $stateParams.id}, function (d) {
+    Container.stop({id: $transition$.params().id}, function (d) {
       update();
-      Notifications.success('Container stopped', $stateParams.id);
+      Notifications.success('Container stopped', $transition$.params().id);
     }, function (e) {
       update();
       Notifications.error('Failure', e, 'Unable to stop container');
@@ -72,10 +67,9 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Con
   };
 
   $scope.kill = function () {
-    $('#loadingViewSpinner').show();
-    Container.kill({id: $stateParams.id}, function (d) {
+    Container.kill({id: $transition$.params().id}, function (d) {
       update();
-      Notifications.success('Container killed', $stateParams.id);
+      Notifications.success('Container killed', $transition$.params().id);
     }, function (e) {
       update();
       Notifications.error('Failure', e, 'Unable to kill container');
@@ -83,26 +77,22 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Con
   };
 
   $scope.commit = function () {
-    $('#createImageSpinner').show();
     var image = $scope.config.Image;
     var registry = $scope.config.Registry;
-    var imageConfig = ImageHelper.createImageConfigForCommit(image, registry);
-    ContainerCommit.commit({id: $stateParams.id, tag: imageConfig.tag, repo: imageConfig.repo}, function (d) {
-      $('#createImageSpinner').hide();
+    var imageConfig = ImageHelper.createImageConfigForCommit(image, registry.URL);
+    ContainerCommit.commit({id: $transition$.params().id, tag: imageConfig.tag, repo: imageConfig.repo}, function (d) {
       update();
-      Notifications.success('Container commited', $stateParams.id);
+      Notifications.success('Container commited', $transition$.params().id);
     }, function (e) {
-      $('#createImageSpinner').hide();
       update();
       Notifications.error('Failure', e, 'Unable to commit container');
     });
   };
 
   $scope.pause = function () {
-    $('#loadingViewSpinner').show();
-    Container.pause({id: $stateParams.id}, function (d) {
+    Container.pause({id: $transition$.params().id}, function (d) {
       update();
-      Notifications.success('Container paused', $stateParams.id);
+      Notifications.success('Container paused', $transition$.params().id);
     }, function (e) {
       update();
       Notifications.error('Failure', e, 'Unable to pause container');
@@ -110,10 +100,9 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Con
   };
 
   $scope.unpause = function () {
-    $('#loadingViewSpinner').show();
-    Container.unpause({id: $stateParams.id}, function (d) {
+    Container.unpause({id: $transition$.params().id}, function (d) {
       update();
-      Notifications.success('Container unpaused', $stateParams.id);
+      Notifications.success('Container unpaused', $transition$.params().id);
     }, function (e) {
       update();
       Notifications.error('Failure', e, 'Unable to unpause container');
@@ -139,7 +128,6 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Con
   };
 
   $scope.remove = function(cleanAssociatedVolumes) {
-    $('#loadingViewSpinner').show();
     ContainerService.remove($scope.container, cleanAssociatedVolumes)
     .then(function success() {
       Notifications.success('Container successfully removed');
@@ -147,17 +135,13 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Con
     })
     .catch(function error(err) {
       Notifications.error('Failure', err, 'Unable to remove container');
-    })
-    .finally(function final() {
-      $('#loadingViewSpinner').hide();
     });
   };
 
   $scope.restart = function () {
-    $('#loadingViewSpinner').show();
-    Container.restart({id: $stateParams.id}, function (d) {
+    Container.restart({id: $transition$.params().id}, function (d) {
       update();
-      Notifications.success('Container restarted', $stateParams.id);
+      Notifications.success('Container restarted', $transition$.params().id);
     }, function (e) {
       update();
       Notifications.error('Failure', e, 'Unable to restart container');
@@ -166,7 +150,7 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Con
 
   $scope.renameContainer = function () {
     var container = $scope.container;
-    Container.rename({id: $stateParams.id, 'name': container.newContainerName}, function (d) {
+    Container.rename({id: $transition$.params().id, 'name': container.newContainerName}, function (d) {
       if (d.message) {
         container.newContainerName = container.Name;
         Notifications.error('Unable to rename container', {}, d.message);
@@ -181,21 +165,125 @@ function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, Con
   };
 
   $scope.containerLeaveNetwork = function containerLeaveNetwork(container, networkId) {
-    $('#loadingViewSpinner').show();
-    Network.disconnect({id: networkId}, { Container: $stateParams.id, Force: false }, function (d) {
+    $scope.state.leaveNetworkInProgress = true;
+    Network.disconnect({id: networkId}, { Container: $transition$.params().id, Force: false }, function (d) {
       if (container.message) {
-        $('#loadingViewSpinner').hide();
         Notifications.error('Error', d, 'Unable to disconnect container from network');
       } else {
-        $('#loadingViewSpinner').hide();
-        Notifications.success('Container left network', $stateParams.id);
-        $state.go('container', {id: $stateParams.id}, {reload: true});
+        Notifications.success('Container left network', $transition$.params().id);
+        $state.go('container', {id: $transition$.params().id}, {reload: true});
       }
+      $scope.state.leaveNetworkInProgress = false;
     }, function (e) {
-      $('#loadingViewSpinner').hide();
       Notifications.error('Failure', e, 'Unable to disconnect container from network');
+      $scope.state.leaveNetworkInProgress = false;
     });
   };
 
+  $scope.duplicate = function() {
+    $state.go('actions.create.container', {from: $transition$.params().id}, {reload: true});
+  };
+
+  $scope.confirmRemove = function () {
+    var title = 'You are about to remove a container.';
+    if ($scope.container.State.Running) {
+      title = 'You are about to remove a running container.';
+    }
+    ModalService.confirmContainerDeletion(
+      title,
+      function (result) {
+        if(!result) { return; }
+        var cleanAssociatedVolumes = false;
+        if (result[0]) {
+          cleanAssociatedVolumes = true;
+        }
+        $scope.remove(cleanAssociatedVolumes);
+      }
+    );
+  };
+
+  function recreateContainer(pullImage) {
+    var container = $scope.container;
+    var config = ContainerHelper.configFromContainer(container.Model);
+    $scope.state.recreateContainerInProgress = true;
+    ContainerService.remove(container, true)
+    .then(function success() {
+      return RegistryService.retrieveRegistryFromRepository(container.Config.Image);
+    })
+    .then(function success(data) {
+      return $q.when(!pullImage || ImageService.pullImage(container.Config.Image, data, true));
+    })
+    .then(function success() {
+      return ContainerService.createAndStartContainer(config);
+    })
+    .then(function success(data) {
+      if (!container.ResourceControl) {
+        return true;
+      } else {
+        var containerIdentifier = data.Id;
+        var resourceControl = container.ResourceControl;
+        var users = resourceControl.UserAccesses.map(function(u) {
+          return u.UserId;
+        });
+        var teams = resourceControl.TeamAccesses.map(function(t) {
+          return t.TeamId;
+        });
+        return ResourceControlService.createResourceControl(resourceControl.AdministratorsOnly,
+          users, teams, containerIdentifier, 'container', []);
+      }
+    })
+    .then(function success(data) {
+      Notifications.success('Container successfully re-created');
+      $state.go('containers', {}, {reload: true});
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to re-create container');
+      $scope.state.recreateContainerInProgress = false;
+    });
+  }
+
+  $scope.recreate = function() {
+    ModalService.confirmContainerRecreation(function (result) {
+      if(!result) { return; }
+      var pullImage = false;
+      if (result[0]) {
+        pullImage = true;
+      }
+      recreateContainer(pullImage);
+    });
+  };
+
+  $scope.containerJoinNetwork = function containerJoinNetwork(container, networkId) {
+    $scope.state.joinNetworkInProgress = true;
+    Network.connect({id: networkId}, { Container: $transition$.params().id }, function (d) {
+      if (container.message) {
+        Notifications.error('Error', d, 'Unable to connect container to network');
+      } else {
+        Notifications.success('Container joined network', $transition$.params().id);
+        $state.go('container', {id: $transition$.params().id}, {reload: true});
+      }
+      $scope.state.joinNetworkInProgress = false;
+    }, function (e) {
+      Notifications.error('Failure', e, 'Unable to connect container to network');
+      $scope.state.joinNetworkInProgress = false;
+    });
+  };
+
+  var provider = $scope.applicationState.endpoint.mode.provider;
+  var apiVersion = $scope.applicationState.endpoint.apiVersion;
+  NetworkService.networks(
+    provider === 'DOCKER_STANDALONE' || provider === 'DOCKER_SWARM_MODE',
+    false,
+    provider === 'DOCKER_SWARM_MODE' && apiVersion >= 1.25,
+    provider === 'DOCKER_SWARM'
+  )
+  .then(function success(data) {
+    var networks = data;
+    $scope.availableNetworks = networks;
+  })
+  .catch(function error(err) {
+    Notifications.error('Failure', err, 'Unable to retrieve networks');
+  });
+
   update();
 }]);

app/components/containerConsole/containerConsole.html

@@ -1,44 +1,65 @@
 <rd-header>
-  <rd-header-title title="Container console">
-    <i id="loadingViewSpinner" class="fa fa-cog fa-spin"></i>
-  </rd-header-title>
+  <rd-header-title title="Container console"></rd-header-title>
   <rd-header-content ng-if="state.loaded">
-    <a ui-sref="containers">Containers</a> > <a ui-sref="container({id: container.Id})">{{ container.Name|trimcontainername }}</a> > Console
+    <a ui-sref="containers">Containers</a> &gt; <a ui-sref="container({id: container.Id})">{{ container.Name|trimcontainername }}</a> &gt; Console
   </rd-header-content>
 </rd-header>
 
 <div class="row" ng-if="state.loaded">
   <div class="col-lg-12 col-md-12 col-xs-12">
     <rd-widget>
-      <rd-widget-header icon="fa-terminal" title="Console">
-        <div class="pull-right">
-          <i id="loadConsoleSpinner" class="fa fa-cog fa-2x fa-spin" style="margin-top: 5px; display: none;"></i>
-        </div>
-      </rd-widget-header>
+      <rd-widget-header icon="fa-terminal" title="Console"></rd-widget-header>
       <rd-widget-body>
-        <form>
-          <div class="row">
+        <form class="form-horizontal">
+          <div ng-if="!state.connected">
             <!-- command-list -->
-            <div class="col-sm-4">
-              <div class="input-group">
-                <span class="input-group-addon">
-                  <i class="fa fa-linux" aria-hidden="true" ng-if="imageOS == 'linux'"></i>
-                  <i class="fa fa-windows" aria-hidden="true" ng-if="imageOS == 'windows'"></i>
-                </span>
-                <select class="form-control" ng-model="state.command" id="command">
-                  <option value="bash" ng-if="imageOS == 'linux'">/bin/bash</option>
-                  <option value="sh" ng-if="imageOS == 'linux'">/bin/sh</option>
-                  <option value="powershell" ng-if="imageOS == 'windows'">powershell</option>
-                  <option value="cmd.exe" ng-if="imageOS == 'windows'">cmd.exe</option>
-                </select>
+              <div class="form-group">
+                <label for="command" class="col-lg-1 text-left col-sm-2 control-label">Command</label>
+                <div class="col-lg-11 col-sm-10">
+                  <div class="input-group" ng-if="!formValues.isCustomCommand">
+                    <span class="input-group-addon">
+                      <i class="fa fa-linux" aria-hidden="true" ng-if="imageOS == 'linux'"></i>
+                      <i class="fa fa-windows" aria-hidden="true" ng-if="imageOS == 'windows'"></i>
+                    </span>
+                    <select class="form-control" ng-model="formValues.command" id="command">
+                      <option value="bash" ng-if="imageOS == 'linux'">/bin/bash</option>
+                      <option value="sh" ng-if="imageOS == 'linux'">/bin/sh</option>
+                      <option value="powershell" ng-if="imageOS == 'windows'">powershell</option>
+                      <option value="cmd.exe" ng-if="imageOS == 'windows'">cmd.exe</option>
+                    </select>
+                  </div>
+                  <input class="form-control" ng-if="formValues.isCustomCommand" type="text" name="custom-command" ng-model="formValues.customCommand" placeholder="e.g. ps aux">
+                </div>
+              </div>
+            <!-- !command-list -->
+            <div class="form-group col-lg-12">
+              <label for="command" class="text-left control-label">Use custom command</label>
+              <label class="switch" style="margin-left: 20px;">
+                <input type="checkbox" ng-model="formValues.isCustomCommand"><i></i>
+              </label>
+            </div>
+            <div class="form-group">
+              <label for="username" class="col-lg-1 text-left col-sm-2 control-label">
+                User
+                <portainer-tooltip position="bottom" message="Format is one of: user, user:group, uid or uid:gid"></portainer-tooltip>
+              </label>
+              <div class="col-lg-11 col-sm-10">
+                <input class="form-control" type="text" name="username" ng-model="formValues.user" placeholder="root">
               </div>
             </div>
-            <!-- !command-list -->
-            <div class="col-sm-8">
-              <button type="button" class="btn btn-primary" ng-click="connect()" ng-disabled="state.connected">Connect</button>
-              <button type="button" class="btn btn-default" ng-click="disconnect()" ng-disabled="!state.connected">Disconnect</button>
+            <div class="form-group">
+              <div class="col-sm-12">
+                <button type="button" class="btn btn-primary" ng-disabled="state.connected" button-spinner="state.connected" ng-click="connect()">
+                  <span ng-hide="state.leaveNetworkInProgress">Connect</span>
+                  <span ng-show="state.leaveNetworkInProgress">Connecting...</span>
+                </button>
+              </div>
             </div>
           </div>
+          <div ng-if="state.connected">
+            <label>Exec into container as <code>{{ ::formValues.user || 'default user' }}</code> using command <code>{{ formValues.isCustomCommand ? formValues.customCommand : formValues.command }}</code></label>
+            <button type="button" class="btn btn-default" ng-click="disconnect()">Disconnect</button>
+          </div>
         </form>
       </rd-widget-body>
     </rd-widget>

app/components/containerConsole/containerConsoleController.js

@@ -1,9 +1,12 @@
 angular.module('containerConsole', [])
-.controller('ContainerConsoleController', ['$scope', '$stateParams', 'Container', 'Image', 'Exec', '$timeout', 'EndpointProvider', 'Notifications',
-function ($scope, $stateParams, Container, Image, Exec, $timeout, EndpointProvider, Notifications) {
-  $scope.state = {};
-  $scope.state.loaded = false;
-  $scope.state.connected = false;
+.controller('ContainerConsoleController', ['$scope', '$transition$', 'Container', 'Image', 'EndpointProvider', 'Notifications', 'ContainerHelper', 'ContainerService', 'ExecService',
+function ($scope, $transition$, Container, Image, EndpointProvider, Notifications, ContainerHelper, ContainerService, ExecService) {
+  $scope.state = {
+    loaded: false,
+    connected: false
+  };
+
+  $scope.formValues = {};
 
   var socket, term;
 
@@ -14,58 +17,53 @@ function ($scope, $stateParams, Container, Image, Exec, $timeout, EndpointProvid
     }
   });
 
-  Container.get({id: $stateParams.id}, function(d) {
+  Container.get({id: $transition$.params().id}, function(d) {
     $scope.container = d;
     if (d.message) {
       Notifications.error('Error', d, 'Unable to retrieve container details');
-      $('#loadingViewSpinner').hide();
     } else {
       Image.get({id: d.Image}, function(imgData) {
         $scope.imageOS = imgData.Os;
-        $scope.state.command = imgData.Os === 'windows' ? 'powershell' : 'bash';
+        $scope.formValues.command = imgData.Os === 'windows' ? 'powershell' : 'bash';
         $scope.state.loaded = true;
-        $('#loadingViewSpinner').hide();
       }, function (e) {
         Notifications.error('Failure', e, 'Unable to retrieve image details');
-        $('#loadingViewSpinner').hide();
       });
     }
   }, function (e) {
     Notifications.error('Failure', e, 'Unable to retrieve container details');
-    $('#loadingViewSpinner').hide();
   });
 
   $scope.connect = function() {
-    $('#loadConsoleSpinner').show();
-    var termWidth = Math.round($('#terminal-container').width() / 8.2);
+    var termWidth = Math.floor(($('#terminal-container').width() - 20) / 8.39);
     var termHeight = 30;
+    var command = $scope.formValues.isCustomCommand ?
+                    $scope.formValues.customCommand : $scope.formValues.command;
     var execConfig = {
-      id: $stateParams.id,
+      id: $transition$.params().id,
       AttachStdin: true,
       AttachStdout: true,
       AttachStderr: true,
       Tty: true,
-      Cmd: $scope.state.command.replace(' ', ',').split(',')
+      User: $scope.formValues.user,
+      Cmd: ContainerHelper.commandStringToArray(command)
     };
 
-    Container.exec(execConfig, function(d) {
-      if (d.message) {
-        $('#loadConsoleSpinner').hide();
-        Notifications.error('Error', {}, d.message);
+    var execId;
+    ContainerService.createExec(execConfig)
+    .then(function success(data) {
+      execId = data.Id;
+      var url = window.location.href.split('#')[0] + 'api/websocket/exec?id=' + execId + '&endpointId=' + EndpointProvider.endpointID();
+      if (url.indexOf('https') > -1) {
+        url = url.replace('https://', 'wss://');
       } else {
-        var execId = d.Id;
-        resizeTTY(execId, termHeight, termWidth);
-        var url = window.location.href.split('#')[0] + 'api/websocket/exec?id=' + execId + '&endpointId=' + EndpointProvider.endpointID();
-        if (url.indexOf('https') > -1) {
-          url = url.replace('https://', 'wss://');
-        } else {
-          url = url.replace('http://', 'ws://');
-        }
-        initTerm(url, termHeight, termWidth);
+        url = url.replace('http://', 'ws://');
       }
-    }, function (e) {
-      $('#loadConsoleSpinner').hide();
-      Notifications.error('Failure', e, 'Unable to start an exec instance');
+      initTerm(url, termHeight, termWidth);
+      return ExecService.resizeTTY(execId, termHeight, termWidth, 2000);
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to exec into container');
     });
   };
 
@@ -79,33 +77,24 @@ function ($scope, $stateParams, Container, Image, Exec, $timeout, EndpointProvid
     }
   };
 
-  function resizeTTY(execId, height, width) {
-    $timeout(function() {
-      Exec.resize({id: execId, height: height, width: width}, function (d) {
-        if (d.message) {
-          Notifications.error('Error', {}, 'Unable to resize TTY');
-        }
-      }, function (e) {
-        Notifications.error('Failure', {}, 'Unable to resize TTY');
-      });
-    }, 2000);
-
-  }
-
   function initTerm(url, height, width) {
     socket = new WebSocket(url);
 
     $scope.state.connected = true;
     socket.onopen = function(evt) {
-      $('#loadConsoleSpinner').hide();
       term = new Terminal();
 
       term.on('data', function (data) {
         socket.send(data);
       });
-      term.open(document.getElementById('terminal-container'));
+      term.open(document.getElementById('terminal-container'), true);
       term.resize(width, height);
       term.setOption('cursorBlink', true);
+      term.fit();
+
+      window.onresize = function() {
+        term.fit();
+      };
 
       socket.onmessage = function (e) {
         term.write(e.data);

app/components/containerInspect/containerInspect.html

@@ -0,0 +1,24 @@
+<rd-header>
+  <rd-header-title title="Container inspect">
+  </rd-header-title>
+  <rd-header-content>
+    <a ui-sref="containers">Containers</a> &gt; <a ui-sref="container({id: containerInfo.Id})">{{ containerInfo.Name|trimcontainername }}</a> &gt; Inspect
+  </rd-header-content>
+</rd-header>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="fa-icon-circle" title="Inspect">
+        <span class="btn-group btn-group-sm">
+          <label class="btn btn-primary" ng-model="state.DisplayTextView" uib-btn-radio="false"><i class="fa fa-code space-right" aria-hidden="true"></i>Tree</label>
+          <label class="btn btn-primary" ng-model="state.DisplayTextView" uib-btn-radio="true"><i class="fa fa-file-text-o space-right" aria-hidden="true"></i>Text</label>
+        </span>
+      </rd-widget-header>
+      <rd-widget-body>
+        <pre ng-show="state.DisplayTextView">{{ containerInfo|json:4 }}</pre>
+        <json-tree ng-hide="state.DisplayTextView" object="containerInfo" root-name="containerInfo.Id" start-expanded="true"></json-tree>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>

app/components/containerInspect/containerInspectController.js

@@ -0,0 +1,21 @@
+angular.module('containerInspect', ['angular-json-tree'])
+.controller('ContainerInspectController', ['$scope', '$transition$', 'Notifications', 'ContainerService',
+function ($scope, $transition$, Notifications, ContainerService) {
+
+  $scope.state = {
+    DisplayTextView: false
+  };
+  $scope.containerInfo = {};
+
+  function initView() {
+    ContainerService.inspect($transition$.params().id)
+    .then(function success(d) {
+      $scope.containerInfo = d;
+    })
+    .catch(function error(e) {
+      Notifications.error('Failure', e, 'Unable to inspect container');
+    });
+  }
+
+  initView();
+}]);

app/components/containerLogs/containerLogsController.js

@@ -1,6 +1,6 @@
 angular.module('containerLogs', [])
-.controller('ContainerLogsController', ['$scope', '$stateParams', '$anchorScroll', 'ContainerLogs', 'Container',
-function ($scope, $stateParams, $anchorScroll, ContainerLogs, Container) {
+.controller('ContainerLogsController', ['$scope', '$transition$', '$anchorScroll', 'ContainerLogs', 'Container', 'Notifications',
+function ($scope, $transition$, $anchorScroll, ContainerLogs, Container, Notifications) {
   $scope.state = {};
   $scope.state.displayTimestampsOut = false;
   $scope.state.displayTimestampsErr = false;
@@ -8,24 +8,19 @@ function ($scope, $stateParams, $anchorScroll, ContainerLogs, Container) {
   $scope.stderr = '';
   $scope.tailLines = 2000;
 
-  $('#loadingViewSpinner').show();
-  Container.get({id: $stateParams.id}, function (d) {
+  Container.get({id: $transition$.params().id}, function (d) {
     $scope.container = d;
-    $('#loadingViewSpinner').hide();
   }, function (e) {
-    $('#loadingViewSpinner').hide();
     Notifications.error('Failure', e, 'Unable to retrieve container info');
   });
 
   function getLogs() {
-    $('#loadingViewSpinner').show();
     getLogsStdout();
     getLogsStderr();
-    $('#loadingViewSpinner').hide();
   }
 
   function getLogsStderr() {
-    ContainerLogs.get($stateParams.id, {
+    ContainerLogs.get($transition$.params().id, {
       stdout: 0,
       stderr: 1,
       timestamps: $scope.state.displayTimestampsErr,
@@ -41,7 +36,7 @@ function ($scope, $stateParams, $anchorScroll, ContainerLogs, Container) {
   }
 
   function getLogsStdout() {
-    ContainerLogs.get($stateParams.id, {
+    ContainerLogs.get($transition$.params().id, {
       stdout: 1,
       stderr: 0,
       timestamps: $scope.state.displayTimestampsOut,

app/components/containerLogs/containerlogs.html

@@ -1,9 +1,7 @@
 <rd-header>
-  <rd-header-title title="Container logs">
-      <i id="loadingViewSpinner" class="fa fa-cog fa-spin"></i>
-  </rd-header-title>
+  <rd-header-title title="Container logs"></rd-header-title>
   <rd-header-content>
-    <a ui-sref="containers">Containers</a> > <a ui-sref="container({id: container.Id})">{{ container.Name|trimcontainername }}</a> > Logs
+    <a ui-sref="containers">Containers</a> &gt; <a ui-sref="container({id: container.Id})">{{ container.Name|trimcontainername }}</a> &gt; Logs
   </rd-header-content>
 </rd-header>
 

app/components/containerStats/containerStats.html

@@ -0,0 +1,92 @@
+<rd-header>
+  <rd-header-title title="Container statistics"></rd-header-title>
+  <rd-header-content>
+    <a ui-sref="containers">Containers</a> &gt; <a ui-sref="container({id: container.Id})">{{ container.Name|trimcontainername }}</a> &gt; Stats
+  </rd-header-content>
+</rd-header>
+
+<div class="row">
+  <div class="col-md-12">
+    <rd-widget>
+      <rd-widget-header icon="fa-info-circle" title="About statistics">
+      </rd-widget-header>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <div class="form-group">
+            <div class="col-sm-12">
+              <span class="small text-muted">
+                This view displays real-time statistics about the container <b>{{ container.Name|trimcontainername }}</b> as well as a list of the running processes
+                inside this container.
+              </span>
+            </div>
+          </div>
+          <div class="form-group">
+            <label for="refreshRate" class="col-sm-3 col-md-2 col-lg-2 margin-sm-top control-label text-left">
+              Refresh rate
+            </label>
+            <div class="col-sm-3 col-md-2">
+              <select id="refreshRate" ng-model="state.refreshRate" ng-change="changeUpdateRepeater()" class="form-control">
+                <option value="5">5s</option>
+                <option value="10">10s</option>
+                <option value="30">30s</option>
+                <option value="60">60s</option>
+              </select>
+            </div>
+            <span>
+              <i id="refreshRateChange" class="fa fa-check green-icon" aria-hidden="true" style="margin-top: 7px; display: none;"></i>
+            </span>
+          </div>
+          <div class="form-group" ng-if="state.networkStatsUnavailable">
+            <div class="col-sm-12">
+              <span class="small text-muted">
+                <i class="fa fa-exclamation-triangle orange-icon" aria-hidden="true"></i> Network stats are unavailable for this container.
+              </span>
+            </div>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row">
+  <div ng-class="{true: 'col-md-6 col-sm-12', false: 'col-lg-4 col-md-6 col-sm-12'}[state.networkStatsUnavailable]">
+    <rd-widget>
+      <rd-widget-header icon="fa-area-chart" title="Memory usage"></rd-widget-header>
+      <rd-widget-body>
+        <div class="chart-container" style="position: relative;">
+          <canvas id="memoryChart" width="770" height="300"></canvas>
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+  <div ng-class="{true: 'col-md-6 col-sm-12', false: 'col-lg-4 col-md-6 col-sm-12'}[state.networkStatsUnavailable]">
+    <rd-widget>
+      <rd-widget-header icon="fa-area-chart" title="CPU usage"></rd-widget-header>
+      <rd-widget-body>
+        <div class="chart-container" style="position: relative;">
+          <canvas id="cpuChart" width="770" height="300"></canvas>
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+  <div class="col-lg-4 col-md-12 col-sm-12" ng-if="!state.networkStatsUnavailable">
+    <rd-widget>
+      <rd-widget-header icon="fa-area-chart" title="Network usage"></rd-widget-header>
+      <rd-widget-body>
+        <div class="chart-container" style="position: relative;">
+          <canvas id="networkChart" width="770" height="300"></canvas>
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+
+  <div class="col-sm-12" ng-if="applicationState.endpoint.mode.provider !== 'VMWARE_VIC'">
+    <container-processes-datatable
+    title="Processes" title-icon="fa-tasks"
+    dataset="processInfo.Processes" headerset="processInfo.Titles"
+    table-key="container-processes"
+    show-text-filter="true"
+    ></container-processes>
+  </div>
+</div>

app/components/containerStats/containerStatsController.js

@@ -0,0 +1,143 @@
+angular.module('containerStats', [])
+.controller('ContainerStatsController', ['$q', '$scope', '$transition$', '$document', '$interval', 'ContainerService', 'ChartService', 'Notifications',
+function ($q, $scope, $transition$, $document, $interval, ContainerService, ChartService, Notifications) {
+
+  $scope.state = {
+    refreshRate: '5',
+    networkStatsUnavailable: false
+  };
+
+  $scope.$on('$destroy', function() {
+    stopRepeater();
+  });
+
+  function stopRepeater() {
+    var repeater = $scope.repeater;
+    if (angular.isDefined(repeater)) {
+      $interval.cancel(repeater);
+      repeater = null;
+    }
+  }
+
+  function updateNetworkChart(stats, chart) {
+    if (stats.Networks.length > 0) {
+      var rx = stats.Networks[0].rx_bytes;
+      var tx = stats.Networks[0].tx_bytes;
+      var label = moment(stats.Date).format('HH:mm:ss');
+
+      ChartService.UpdateNetworkChart(label, rx, tx, chart);
+    }
+  }
+
+  function updateMemoryChart(stats, chart) {
+    var label = moment(stats.Date).format('HH:mm:ss');
+    var value = stats.MemoryUsage;
+
+    ChartService.UpdateMemoryChart(label, value, chart);
+  }
+
+  function updateCPUChart(stats, chart) {
+    var label = moment(stats.Date).format('HH:mm:ss');
+    var value = calculateCPUPercentUnix(stats);
+
+    ChartService.UpdateCPUChart(label, value, chart);
+  }
+
+  function calculateCPUPercentUnix(stats) {
+    var cpuPercent = 0.0;
+    var cpuDelta = stats.CurrentCPUTotalUsage - stats.PreviousCPUTotalUsage;
+    var systemDelta = stats.CurrentCPUSystemUsage - stats.PreviousCPUSystemUsage;
+
+    if (systemDelta > 0.0 && cpuDelta > 0.0) {
+      cpuPercent = (cpuDelta / systemDelta) * stats.CPUCores * 100.0;
+    }
+
+    return cpuPercent;
+  }
+
+  $scope.changeUpdateRepeater = function() {
+    var networkChart = $scope.networkChart;
+    var cpuChart = $scope.cpuChart;
+    var memoryChart = $scope.memoryChart;
+
+    stopRepeater();
+    setUpdateRepeater(networkChart, cpuChart, memoryChart);
+    $('#refreshRateChange').show();
+    $('#refreshRateChange').fadeOut(1500);
+  };
+
+  function startChartUpdate(networkChart, cpuChart, memoryChart) {
+    $q.all({
+      stats: ContainerService.containerStats($transition$.params().id),
+      top: ContainerService.containerTop($transition$.params().id)
+    })
+    .then(function success(data) {
+      var stats = data.stats;
+      $scope.processInfo = data.top;
+      if (stats.Networks.length === 0) {
+        $scope.state.networkStatsUnavailable = true;
+      }
+      updateNetworkChart(stats, networkChart);
+      updateMemoryChart(stats, memoryChart);
+      updateCPUChart(stats, cpuChart);
+      setUpdateRepeater(networkChart, cpuChart, memoryChart);
+    })
+    .catch(function error(err) {
+      stopRepeater();
+      Notifications.error('Failure', err, 'Unable to retrieve container statistics');
+    });
+  }
+
+  function setUpdateRepeater(networkChart, cpuChart, memoryChart) {
+    var refreshRate = $scope.state.refreshRate;
+    $scope.repeater = $interval(function() {
+      $q.all({
+        stats: ContainerService.containerStats($transition$.params().id),
+        top: ContainerService.containerTop($transition$.params().id)
+      })
+      .then(function success(data) {
+        var stats = data.stats;
+        $scope.processInfo = data.top;
+        updateNetworkChart(stats, networkChart);
+        updateMemoryChart(stats, memoryChart);
+        updateCPUChart(stats, cpuChart);
+      })
+      .catch(function error(err) {
+        stopRepeater();
+        Notifications.error('Failure', err, 'Unable to retrieve container statistics');
+      });
+    }, refreshRate * 1000);
+  }
+
+  function initCharts() {
+    var networkChartCtx = $('#networkChart');
+    var networkChart = ChartService.CreateNetworkChart(networkChartCtx);
+    $scope.networkChart = networkChart;
+
+    var cpuChartCtx = $('#cpuChart');
+    var cpuChart = ChartService.CreateCPUChart(cpuChartCtx);
+    $scope.cpuChart = cpuChart;
+
+    var memoryChartCtx = $('#memoryChart');
+    var memoryChart = ChartService.CreateMemoryChart(memoryChartCtx);
+    $scope.memoryChart = memoryChart;
+
+    startChartUpdate(networkChart, cpuChart, memoryChart);
+  }
+
+  function initView() {
+    ContainerService.container($transition$.params().id)
+    .then(function success(data) {
+      $scope.container = data;
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve container information');
+    });
+
+    $document.ready(function() {
+      initCharts();
+    });
+  }
+
+  initView();
+}]);

app/components/containers/containers.html

@@ -3,139 +3,27 @@
     <a data-toggle="tooltip" title="Refresh" ui-sref="containers" ui-sref-opts="{reload: true}">
       <i class="fa fa-refresh" aria-hidden="true"></i>
     </a>
-    <i id="loadContainersSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px;"></i>
   </rd-header-title>
   <rd-header-content>Containers</rd-header-content>
 </rd-header>
 
-<div class="col-lg-12">
-  <rd-widget>
-    <rd-widget-header icon="fa-server" title="Containers">
-      <div class="pull-right">
-        Items per page:
-        <select ng-model="state.pagination_count" ng-change="changePaginationCount()">
-          <option value="0">All</option>
-          <option value="10">10</option>
-          <option value="25">25</option>
-          <option value="50">50</option>
-          <option value="100">100</option>
-        </select>
-      </div>
-    </rd-widget-header>
-    <rd-widget-taskbar classes="col-lg-12">
-      <div class="pull-left">
-        <div class="btn-group" role="group" aria-label="...">
-          <button type="button" class="btn btn-success btn-responsive" ng-click="startAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-play space-right" aria-hidden="true"></i>Start</button>
-          <button type="button" class="btn btn-danger btn-responsive" ng-click="stopAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-stop space-right" aria-hidden="true"></i>Stop</button>
-          <button type="button" class="btn btn-danger btn-responsive" ng-click="killAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-bomb space-right" aria-hidden="true"></i>Kill</button>
-          <button type="button" class="btn btn-primary btn-responsive" ng-click="restartAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-refresh space-right" aria-hidden="true"></i>Restart</button>
-          <button type="button" class="btn btn-primary btn-responsive" ng-click="pauseAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-pause space-right" aria-hidden="true"></i>Pause</button>
-          <button type="button" class="btn btn-primary btn-responsive" ng-click="unpauseAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-play space-right" aria-hidden="true"></i>Resume</button>
-          <button type="button" class="btn btn-danger btn-responsive" ng-click="confirmRemoveAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-trash space-right" aria-hidden="true"></i>Remove</button>
-        </div>
-        <a class="btn btn-primary" type="button" ui-sref="actions.create.container"><i class="fa fa-plus space-right" aria-hidden="true"></i>Add container</a>
-      </div>
-      <div class="pull-right">
-        <input type="checkbox" ng-model="state.displayAll" id="displayAll" ng-change="toggleGetAll()" style="margin-top: -2px; margin-right: 5px;"/><label for="displayAll">Show all containers</label>
-        <input type="text" id="filter" ng-model="state.filter" placeholder="Filter..." class="form-control input-sm" />
-      </div>
-    </rd-widget-taskbar>
-    <rd-widget-body classes="no-padding">
-      <div class="table-responsive">
-        <table class="table table-hover">
-          <thead>
-            <tr>
-              <th>
-                <input type="checkbox" ng-model="allSelected" ng-change="selectItems(allSelected)" />
-              </th>
-              <th>
-                <a ui-sref="containers" ng-click="order('Status')">
-                  State
-                  <span ng-show="sortType == 'Status' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
-                  <span ng-show="sortType == 'Status' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
-                </a>
-              </th>
-              <th>
-                <a ui-sref="containers" ng-click="order('Names')">
-                  Name
-                  <span ng-show="sortType == 'Names' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
-                  <span ng-show="sortType == 'Names' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
-                </a>
-              </th>
-              <th>
-                <a ui-sref="containers" ng-click="order('Image')">
-                  Image
-                  <span ng-show="sortType == 'Image' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
-                  <span ng-show="sortType == 'Image' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
-                </a>
-              </th>
-              <th ng-if="state.displayIP">
-                <a ui-sref="containers" ng-click="order('IP')">
-                  IP Address
-                  <span ng-show="sortType == 'IP' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
-                  <span ng-show="sortType == 'IP' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
-                </a>
-              </th>
-              <th ng-if="applicationState.endpoint.mode.provider === 'DOCKER_SWARM'">
-                <a ui-sref="containers" ng-click="order('Host')">
-                  Host IP
-                  <span ng-show="sortType == 'Host' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
-                  <span ng-show="sortType == 'Host' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
-                </a>
-              </th>
-              <th>
-                <a ui-sref="containers" ng-click="order('Ports')">
-                  Published Ports
-                  <span ng-show="sortType == 'Ports' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
-                  <span ng-show="sortType == 'Ports' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
-                </a>
-              </th>
-              <th ng-if="applicationState.application.authentication">
-                <a ui-sref="containers" ng-click="order('ResourceControl.Ownership')">
-                  Ownership
-                  <span ng-show="sortType == 'ResourceControl.Ownership' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
-                  <span ng-show="sortType == 'ResourceControl.Ownership' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
-                </a>
-              </th>
-            </tr>
-          </thead>
-          <tbody>
-            <tr dir-paginate="container in (state.filteredContainers = ( containers | filter:state.filter | orderBy:sortType:sortReverse | itemsPerPage: state.pagination_count))">
-              <td><input type="checkbox" ng-model="container.Checked" ng-change="selectItem(container)"/></td>
-              <td>
-                <span ng-if="['starting','healthy','unhealthy'].indexOf(container.Status) !== -1" class="label label-{{ container.Status|containerstatusbadge }} interactive" uib-tooltip="This container has a health check">{{ container.Status }}</span>
-                <span ng-if="['starting','healthy','unhealthy'].indexOf(container.Status) === -1" class="label label-{{ container.Status|containerstatusbadge }}">{{ container.Status }}</span>
-              </td>
-              <td ng-if="applicationState.endpoint.mode.provider === 'DOCKER_SWARM'"><a ui-sref="container({id: container.Id})">{{ container|swarmcontainername|truncate: 40}}</a></td>
-              <td ng-if="applicationState.endpoint.mode.provider !== 'DOCKER_SWARM'"><a ui-sref="container({id: container.Id})">{{ container|containername|truncate: 40}}</a></td>
-              <td><a ui-sref="image({id: container.Image})">{{ container.Image | hideshasum }}</a></td>
-              <td ng-if="state.displayIP">{{ container.IP ? container.IP : '-' }}</td>
-              <td ng-if="applicationState.endpoint.mode.provider === 'DOCKER_SWARM'">{{ container.hostIP }}</td>
-              <td>
-                <a ng-if="container.Ports.length > 0" ng-repeat="p in container.Ports" class="image-tag" ng-href="http://{{ PublicURL || p.host }}:{{p.public}}" target="_blank">
-                  <i class="fa fa-external-link" aria-hidden="true"></i> {{p.public}}:{{ p.private }}
-                </a>
-                <span ng-if="container.Ports.length == 0" >-</span>
-              </td>
-              <td ng-if="applicationState.application.authentication">
-                <span>
-                  <i ng-class="container.ResourceControl.Ownership | ownershipicon" aria-hidden="true"></i>
-                  {{ container.ResourceControl.Ownership ? container.ResourceControl.Ownership : container.ResourceControl.Ownership = 'public' }}
-                </span>
-              </td>
-            </tr>
-            <tr ng-if="!containers">
-              <td colspan="9" class="text-center text-muted">Loading...</td>
-            </tr>
-            <tr ng-if="containers.length == 0">
-              <td colspan="9" class="text-center text-muted">No containers available.</td>
-            </tr>
-          </tbody>
-        </table>
-        <div ng-if="containers" class="pull-left pagination-controls">
-          <dir-pagination-controls></dir-pagination-controls>
-        </div>
-      </div>
-    </rd-widget-body>
-  <rd-widget>
+<div class="row">
+  <div class="col-sm-12" ng-if="containers">
+    <containers-datatable
+      title="Containers" title-icon="fa-server"
+      dataset="containers" table-key="containers"
+      order-by="Status" show-text-filter="true"
+      show-ownership-column="applicationState.application.authentication"
+      swarm-containers="applicationState.endpoint.mode.provider === 'DOCKER_SWARM'"
+      public-url="state.publicURL"
+      container-name-truncate-size="truncate_size"
+      start-action="startAction"
+      stop-action="stopAction"
+      restart-action="restartAction"
+      kill-action="killAction"
+      pause-action="pauseAction"
+      resume-action="resumeAction"
+      remove-action="confirmRemoveAction"
+    ></containers-datatable>
+  </div>
 </div>

app/components/containers/containersController.js

@@ -1,192 +1,110 @@
 angular.module('containers', [])
-  .controller('ContainersController', ['$q', '$scope', '$filter', 'Container', 'ContainerService', 'ContainerHelper', 'Info', 'Notifications', 'Pagination', 'EntityListService', 'ModalService', 'ResourceControlService', 'EndpointProvider',
-  function ($q, $scope, $filter, Container, ContainerService, ContainerHelper, Info, Notifications, Pagination, EntityListService, ModalService, ResourceControlService, EndpointProvider) {
-  $scope.state = {};
-  $scope.state.pagination_count = Pagination.getPaginationCount('containers');
-  $scope.state.displayAll = true;
-  $scope.state.displayIP = false;
-  $scope.sortType = 'State';
-  $scope.sortReverse = false;
-  $scope.state.selectedItemCount = 0;
-  $scope.order = function (sortType) {
-    $scope.sortReverse = ($scope.sortType === sortType) ? !$scope.sortReverse : false;
-    $scope.sortType = sortType;
-  };
-  $scope.PublicURL = EndpointProvider.endpointPublicURL();
-
-  $scope.changePaginationCount = function() {
-    Pagination.setPaginationCount('containers', $scope.state.pagination_count);
+  .controller('ContainersController', ['$q', '$scope', '$state', '$filter', '$transition$', 'ContainerService', 'SystemService', 'Notifications', 'ModalService', 'EndpointProvider',
+  function ($q, $scope, $state, $filter, $transition$, ContainerService, SystemService, Notifications, ModalService, EndpointProvider) {
+  $scope.state = {
+    publicURL: EndpointProvider.endpointPublicURL()
   };
 
-  $scope.cleanAssociatedVolumes = false;
-
-  var update = function (data) {
-    $('#loadContainersSpinner').show();
-    $scope.state.selectedItemCount = 0;
-    Container.query(data, function (d) {
-      var containers = d;
-      $scope.containers = containers.map(function (container) {
-        var model = new ContainerViewModel(container);
-        model.Status = $filter('containerstatus')(model.Status);
-
-        EntityListService.rememberPreviousSelection($scope.containers, model, function onSelect(model){
-          $scope.selectItem(model);
-        });
-
-        if (model.IP) {
-          $scope.state.displayIP = true;
-        }
-        if ($scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM') {
-          model.hostIP = $scope.swarm_hosts[_.split(container.Names[0], '/')[1]];
-        }
-        return model;
-      });
-      $('#loadContainersSpinner').hide();
-    }, function (e) {
-      $('#loadContainersSpinner').hide();
-      Notifications.error('Failure', e, 'Unable to retrieve containers');
-      $scope.containers = [];
-    });
+  $scope.startAction = function(selectedItems) {
+    var successMessage = 'Container successfully started';
+    var errorMessage = 'Unable to start container';
+    executeActionOnContainerList(selectedItems, ContainerService.startContainer, successMessage, errorMessage);
   };
 
-  var batch = function (items, action, msg) {
-    $('#loadContainersSpinner').show();
-    var counter = 0;
-    var complete = function () {
-      counter = counter - 1;
-      if (counter === 0) {
-        $('#loadContainersSpinner').hide();
-        update({all: $scope.state.displayAll ? 1 : 0});
-      }
-    };
-    angular.forEach(items, function (c) {
-      if (c.Checked) {
-        counter = counter + 1;
-        if (action === Container.start) {
-          action({id: c.Id}, {}, function (d) {
-            Notifications.success('Container ' + msg, c.Id);
-            complete();
-          }, function (e) {
-            Notifications.error('Failure', e, 'Unable to start container');
-            complete();
-          });
-        }
-        else if (action === Container.remove) {
-          ContainerService.remove(c, $scope.cleanAssociatedVolumes)
-          .then(function success() {
-            Notifications.success('Container successfully removed');
-          })
-          .catch(function error(err) {
-            Notifications.error('Failure', err, 'Unable to remove container');
-          })
-          .finally(function final() {
-            complete();
-          });
-        }
-        else if (action === Container.pause) {
-          action({id: c.Id}, function (d) {
-            if (d.message) {
-              Notifications.success('Container is already paused', c.Id);
-            } else {
-              Notifications.success('Container ' + msg, c.Id);
-            }
-            complete();
-          }, function (e) {
-            Notifications.error('Failure', e, 'Unable to pause container');
-            complete();
-          });
-        }
-        else {
-          action({id: c.Id}, function (d) {
-            Notifications.success('Container ' + msg, c.Id);
-            complete();
-          }, function (e) {
-            Notifications.error('Failure', e, 'An error occured');
-            complete();
-          });
-
-        }
-      }
-    });
-    if (counter === 0) {
-      $('#loadContainersSpinner').hide();
-    }
+  $scope.stopAction = function(selectedItems) {
+    var successMessage = 'Container successfully stopped';
+    var errorMessage = 'Unable to stop container';
+    executeActionOnContainerList(selectedItems, ContainerService.stopContainer, successMessage, errorMessage);
   };
 
-  $scope.selectItems = function (allSelected) {
-    angular.forEach($scope.state.filteredContainers, function (container) {
-      if (container.Checked !== allSelected) {
-        container.Checked = allSelected;
-        $scope.selectItem(container);
-      }
-    });
+  $scope.restartAction = function(selectedItems) {
+    var successMessage = 'Container successfully restarted';
+    var errorMessage = 'Unable to restart container';
+    executeActionOnContainerList(selectedItems, ContainerService.restartContainer, successMessage, errorMessage);
   };
 
-  $scope.selectItem = function (item) {
-    if (item.Checked) {
-      $scope.state.selectedItemCount++;
-    } else {
-      $scope.state.selectedItemCount--;
-    }
+  $scope.killAction = function(selectedItems) {
+    var successMessage = 'Container successfully killed';
+    var errorMessage = 'Unable to kill container';
+    executeActionOnContainerList(selectedItems, ContainerService.killContainer, successMessage, errorMessage);
   };
 
-  $scope.toggleGetAll = function () {
-    update({all: $scope.state.displayAll ? 1 : 0});
+  $scope.pauseAction = function(selectedItems) {
+    var successMessage = 'Container successfully paused';
+    var errorMessage = 'Unable to pause container';
+    executeActionOnContainerList(selectedItems, ContainerService.pauseContainer, successMessage, errorMessage);
   };
 
-  $scope.startAction = function () {
-    batch($scope.containers, Container.start, 'Started');
+  $scope.resumeAction = function(selectedItems) {
+    var successMessage = 'Container successfully resumed';
+    var errorMessage = 'Unable to resume container';
+    executeActionOnContainerList(selectedItems, ContainerService.resumeContainer, successMessage, errorMessage);
   };
 
-  $scope.stopAction = function () {
-    batch($scope.containers, Container.stop, 'Stopped');
-  };
-
-  $scope.restartAction = function () {
-    batch($scope.containers, Container.restart, 'Restarted');
-  };
-
-  $scope.killAction = function () {
-    batch($scope.containers, Container.kill, 'Killed');
-  };
-
-  $scope.pauseAction = function () {
-    batch($scope.containers, Container.pause, 'Paused');
-  };
-
-  $scope.unpauseAction = function () {
-    batch($scope.containers, Container.unpause, 'Unpaused');
-  };
-
-  $scope.removeAction = function () {
-    batch($scope.containers, Container.remove, 'Removed');
-  };
-
-  $scope.confirmRemoveAction = function () {
+  $scope.confirmRemoveAction = function(selectedItems) {
     var isOneContainerRunning = false;
-    angular.forEach($scope.containers, function (c) {
-      if (c.Checked && c.State === 'running') {
+    for (var i = 0; i < selectedItems.length; i++) {
+      var container = selectedItems[i];
+      if (container.State === 'running') {
         isOneContainerRunning = true;
-        return;
+        break;
       }
-    });
+    }
+
     var title = 'You are about to remove one or more container.';
     if (isOneContainerRunning) {
-      title = 'You are about to remove one or more running containers.';
+      title = 'You are about to remove one or more running container.';
     }
-    ModalService.confirmContainerDeletion(
-      title,
-      function (result) {
+
+    ModalService.confirmContainerDeletion(title, function (result) {
         if(!result) { return; }
-        $scope.cleanAssociatedVolumes = false;
+        var cleanVolumes = false;
         if (result[0]) {
-          $scope.cleanAssociatedVolumes = true;
+          cleanVolumes = true;
         }
-        $scope.removeAction();
+        removeAction(selectedItems, cleanVolumes);
       }
     );
   };
 
+  function executeActionOnContainerList(containers, action, successMessage, errorMessage) {
+    var actionCount = containers.length;
+    angular.forEach(containers, function (container) {
+      action(container.Id)
+      .then(function success() {
+        Notifications.success(successMessage, container.Names[0]);
+      })
+      .catch(function error(err) {
+        Notifications.error('Failure', err, errorMessage);
+      })
+      .finally(function final() {
+        --actionCount;
+        if (actionCount === 0) {
+          $state.transitionTo($state.current, { selectedContainers: containers }, { reload: true });
+        }
+      });
+    });
+  }
+
+  function removeAction(containers, cleanVolumes) {
+    var actionCount = containers.length;
+    angular.forEach(containers, function (container) {
+      ContainerService.remove(container, cleanVolumes)
+      .then(function success() {
+        Notifications.success('Container successfully removed', container.Names[0]);
+      })
+      .catch(function error(err) {
+        Notifications.error('Failure', err, 'Unable to remove container');
+      })
+      .finally(function final() {
+        --actionCount;
+        if (actionCount === 0) {
+          $state.reload();
+        }
+      });
+    });
+  }
+
   function retrieveSwarmHostsInfo(data) {
     var swarm_hosts = {};
     var systemStatus = data.SystemStatus;
@@ -202,15 +120,43 @@ angular.module('containers', [])
     return swarm_hosts;
   }
 
-  function initView(){
-    if ($scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM') {
-      Info.get({}, function (d) {
-        $scope.swarm_hosts = retrieveSwarmHostsInfo(d);
-        update({all: $scope.state.displayAll ? 1 : 0});
+  function assignContainers(containers, provider) {
+    var previouslySelectedContainers = $transition$.params().selectedContainers || [];
+    $scope.containers = containers.map(function (container) {
+      container.Status = $filter('containerstatus')(container.Status);
+      if (provider === 'DOCKER_SWARM') {
+        container.hostIP = $scope.swarm_hosts[_.split(container.Names[0], '/')[1]];
+      }
+
+      var previousContainer = _.find(previouslySelectedContainers, function(item) {
+        return item.Id === container.Id;
       });
-    } else {
-      update({all: $scope.state.displayAll ? 1 : 0});
-    }
+
+      if (previousContainer && previousContainer.Checked) {
+        container.Checked = true;
+      }
+
+      return container;
+    });
+  }
+
+  function initView() {
+    var provider = $scope.applicationState.endpoint.mode.provider;
+
+    $q.all({
+      swarm: provider !== 'DOCKER_SWARM' || SystemService.info(),
+      containers: ContainerService.containers(1)
+    })
+    .then(function success(data) {
+      if (provider === 'DOCKER_SWARM') {
+        $scope.swarm_hosts = retrieveSwarmHostsInfo(data.swarm);
+      }
+      assignContainers(data.containers, provider);
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve containers');
+      $scope.containers = [];
+    });
   }
 
   initView();

app/components/createConfig/createConfigController.js

@@ -0,0 +1,96 @@
+angular.module('createConfig', [])
+.controller('CreateConfigController', ['$scope', '$state', '$document', 'Notifications', 'ConfigService', 'Authentication', 'FormValidator', 'ResourceControlService', 'CodeMirrorService',
+function ($scope, $state, $document, Notifications, ConfigService, Authentication, FormValidator, ResourceControlService, CodeMirrorService) {
+
+  $scope.formValues = {
+    Name: '',
+    Labels: [],
+    AccessControlData: new AccessControlFormData()
+  };
+
+  $scope.state = {
+    formValidationError: ''
+  };
+
+  $scope.addLabel = function() {
+    $scope.formValues.Labels.push({ name: '', value: ''});
+  };
+
+  $scope.removeLabel = function(index) {
+    $scope.formValues.Labels.splice(index, 1);
+  };
+
+  function prepareLabelsConfig(config) {
+    var labels = {};
+    $scope.formValues.Labels.forEach(function (label) {
+      if (label.name && label.value) {
+          labels[label.name] = label.value;
+      }
+    });
+    config.Labels = labels;
+  }
+
+  function prepareConfigData(config) {
+    // The codemirror editor does not work with ng-model so we need to retrieve
+    // the value directly from the editor.
+    var configData = $scope.editor.getValue();
+    config.Data = btoa(unescape(encodeURIComponent(configData)));
+  }
+
+  function prepareConfiguration() {
+    var config = {};
+    config.Name = $scope.formValues.Name;
+    prepareConfigData(config);
+    prepareLabelsConfig(config);
+    return config;
+  }
+
+  function validateForm(accessControlData, isAdmin) {
+    $scope.state.formValidationError = '';
+    var error = '';
+    error = FormValidator.validateAccessControl(accessControlData, isAdmin);
+
+    if (error) {
+      $scope.state.formValidationError = error;
+      return false;
+    }
+    return true;
+  }
+
+  $scope.create = function () {
+    var accessControlData = $scope.formValues.AccessControlData;
+    var userDetails = Authentication.getUserDetails();
+    var isAdmin = userDetails.role === 1;
+
+    if (!validateForm(accessControlData, isAdmin)) {
+      return;
+    }
+
+    var config = prepareConfiguration();
+
+    ConfigService.create(config)
+    .then(function success(data) {
+      var configIdentifier = data.ID;
+      var userId = userDetails.ID;
+      return ResourceControlService.applyResourceControl('config', configIdentifier, userId, accessControlData, []);
+    })
+    .then(function success() {
+      Notifications.success('Config successfully created');
+      $state.go('configs', {}, {reload: true});
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to create config');
+    });
+  };
+
+  function initView() {
+    $document.ready(function() {
+      var webEditorElement = $document[0].getElementById('config-editor', false);
+      if (webEditorElement) {
+        $scope.editor = CodeMirrorService.applyCodeMirrorOnElement(webEditorElement, false, false);
+      }
+    });
+  }
+
+  initView();
+}]);

app/components/createConfig/createconfig.html

@@ -0,0 +1,72 @@
+<rd-header>
+  <rd-header-title title="Create config"></rd-header-title>
+  <rd-header-content>
+    <a ui-sref="configs">Configs</a> &gt; Add config
+  </rd-header-content>
+</rd-header>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <!-- name-input -->
+          <div class="form-group">
+            <label for="config_name" class="col-sm-1 control-label text-left">Name</label>
+            <div class="col-sm-11">
+              <input type="text" class="form-control" ng-model="formValues.Name" id="config_name" placeholder="e.g. myConfig">
+            </div>
+          </div>
+          <!-- !name-input -->
+          <!-- config-data -->
+          <div class="form-group">
+            <div class="col-sm-12">
+              <textarea id="config-editor" class="form-control"></textarea>
+            </div>
+          </div>
+          <!-- !config-data -->
+          <!-- labels -->
+          <div class="form-group">
+            <div class="col-sm-12" style="margin-top: 5px;">
+              <label class="control-label text-left">Labels</label>
+              <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addLabel()">
+                <i class="fa fa-plus-circle" aria-hidden="true"></i> add label
+              </span>
+            </div>
+            <!-- labels-input-list -->
+            <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+              <div ng-repeat="label in formValues.Labels" style="margin-top: 2px;">
+                <div class="input-group col-sm-5 input-group-sm">
+                  <span class="input-group-addon">name</span>
+                  <input type="text" class="form-control" ng-model="label.name" placeholder="e.g. com.example.foo">
+                </div>
+                <div class="input-group col-sm-5 input-group-sm">
+                  <span class="input-group-addon">value</span>
+                  <input type="text" class="form-control" ng-model="label.value" placeholder="e.g. bar">
+                </div>
+                <button class="btn btn-sm btn-danger" type="button" ng-click="removeLabel($index)">
+                  <i class="fa fa-trash" aria-hidden="true"></i>
+                </button>
+              </div>
+            </div>
+            <!-- !labels-input-list -->
+          </div>
+          <!-- !labels-->
+          <!-- access-control -->
+          <por-access-control-form form-data="formValues.AccessControlData" ng-if="applicationState.application.authentication"></por-access-control-form>
+          <!-- !access-control -->
+          <!-- actions -->
+          <div class="col-sm-12 form-section-title">
+            Actions
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!formValues.Name" ng-click="create()">Create config</button>
+            </div>
+          </div>
+          <!-- !actions -->
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>

app/components/createContainer/createContainerController.js

@@ -1,29 +1,41 @@
 // @@OLD_SERVICE_CONTROLLER: this service should be rewritten to use services.
 // See app/components/templates/templatesController.js as a reference.
 angular.module('createContainer', [])
-.controller('CreateContainerController', ['$q', '$scope', '$state', '$stateParams', '$filter', 'Info', 'Container', 'ContainerHelper', 'Image', 'ImageHelper', 'Volume', 'Network', 'ResourceControlService', 'Authentication', 'Notifications', 'ContainerService', 'ImageService', 'ControllerDataPipeline', 'FormValidator',
-function ($q, $scope, $state, $stateParams, $filter, Info, Container, ContainerHelper, Image, ImageHelper, Volume, Network, ResourceControlService, Authentication, Notifications, ContainerService, ImageService, ControllerDataPipeline, FormValidator) {
+.controller('CreateContainerController', ['$q', '$scope', '$state', '$timeout', '$transition$', '$filter', 'Container', 'ContainerHelper', 'Image', 'ImageHelper', 'Volume', 'NetworkService', 'ResourceControlService', 'Authentication', 'Notifications', 'ContainerService', 'ImageService', 'FormValidator', 'ModalService', 'RegistryService', 'SystemService', 'SettingsService',
+function ($q, $scope, $state, $timeout, $transition$, $filter, Container, ContainerHelper, Image, ImageHelper, Volume, NetworkService, ResourceControlService, Authentication, Notifications, ContainerService, ImageService, FormValidator, ModalService, RegistryService, SystemService, SettingsService) {
 
   $scope.formValues = {
     alwaysPull: true,
     Console: 'none',
     Volumes: [],
-    Registry: '',
     NetworkContainer: '',
     Labels: [],
     ExtraHosts: [],
+    MacAddress: '',
     IPv4: '',
-    IPv6: ''
+    IPv6: '',
+    AccessControlData: new AccessControlFormData(),
+    CpuLimit: 0,
+    MemoryLimit: 0,
+    MemoryReservation: 0
   };
 
   $scope.state = {
-    formValidationError: ''
+    formValidationError: '',
+    actionInProgress: false
+  };
+
+  $scope.refreshSlider = function () {
+    $timeout(function () {
+      $scope.$broadcast('rzSliderForceRender');
+    });
   };
 
   $scope.config = {
     Image: '',
     Env: [],
     Cmd: '',
+    MacAddress: '',
     ExposedPorts: {},
     HostConfig: {
       RestartPolicy: {
@@ -91,10 +103,12 @@ function ($q, $scope, $state, $stateParams, $filter, Info, Container, ContainerH
     $scope.config.HostConfig.Devices.splice(index, 1);
   };
 
+  $scope.fromContainerMultipleNetworks = false;
+
   function prepareImageConfig(config) {
     var image = config.Image;
     var registry = $scope.formValues.Registry;
-    var imageConfig = ImageHelper.createImageConfigForContainer(image, registry);
+    var imageConfig = ImageHelper.createImageConfigForContainer(image, registry.URL);
     config.Image = imageConfig.fromImage + ':' + imageConfig.tag;
     $scope.imageConfig = imageConfig;
   }
@@ -178,8 +192,10 @@ function ($q, $scope, $state, $stateParams, $filter, Info, Container, ContainerH
     var networkMode = mode;
     if (containerName) {
       networkMode += ':' + containerName;
+      config.Hostname = '';
     }
     config.HostConfig.NetworkMode = networkMode;
+    config.MacAddress = $scope.formValues.MacAddress;
 
     config.NetworkingConfig.EndpointsConfig[networkMode] = {
       IPAMConfig: {
@@ -218,6 +234,25 @@ function ($q, $scope, $state, $stateParams, $filter, Info, Container, ContainerH
     config.HostConfig.Devices = path;
   }
 
+  function prepareResources(config) {
+    // Memory Limit - Round to 0.125
+    var memoryLimit = (Math.round($scope.formValues.MemoryLimit * 8) / 8).toFixed(3);
+    memoryLimit *= 1024 * 1024;
+    if (memoryLimit > 0) {
+      config.HostConfig.Memory = memoryLimit;
+    }
+    // Memory Resevation - Round to 0.125
+    var memoryReservation = (Math.round($scope.formValues.MemoryReservation * 8) / 8).toFixed(3);
+    memoryReservation *= 1024 * 1024;
+    if (memoryReservation > 0) {
+      config.HostConfig.MemoryReservation = memoryReservation;
+    }
+    // CPU Limit
+    if ($scope.formValues.CpuLimit > 0) {
+      config.HostConfig.NanoCpus = $scope.formValues.CpuLimit * 1000000000;
+    }
+  }
+
   function prepareConfiguration() {
     var config = angular.copy($scope.config);
     config.Cmd = ContainerHelper.commandStringToArray(config.Cmd);
@@ -229,9 +264,237 @@ function ($q, $scope, $state, $stateParams, $filter, Info, Container, ContainerH
     prepareVolumes(config);
     prepareLabels(config);
     prepareDevices(config);
+    prepareResources(config);
     return config;
   }
 
+  function confirmCreateContainer() {
+    var deferred = $q.defer();
+    Container.query({ all: 1, filters: {name: ['^/' + $scope.config.name + '$'] }}).$promise
+    .then(function success(data) {
+      var existingContainer = data[0];
+      if (existingContainer) {
+        ModalService.confirm({
+          title: 'Are you sure ?',
+          message: 'A container with the same name already exists. Portainer can automatically remove it and re-create one. Do you want to replace it?',
+          buttons: {
+            confirm: {
+              label: 'Replace',
+              className: 'btn-danger'
+            }
+          },
+          callback: function onConfirm(confirmed) {
+            if(!confirmed) { deferred.resolve(false); }
+            else {
+              // Remove old container
+              ContainerService.remove(existingContainer, true)
+              .then(function success(data) {
+                Notifications.success('Container Removed', existingContainer.Id);
+                deferred.resolve(true);
+              })
+              .catch(function error(err) {
+                deferred.reject({ msg: 'Unable to remove container', err: err });
+              });
+            }
+          }
+        });
+      } else {
+        deferred.resolve(true);
+      }
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve containers');
+      return undefined;
+    });
+    return deferred.promise;
+  }
+
+  function loadFromContainerCmd(d) {
+    if ($scope.config.Cmd) {
+      $scope.config.Cmd = ContainerHelper.commandArrayToString($scope.config.Cmd);
+    } else {
+      $scope.config.Cmd = '';
+    }
+  }
+
+  function loadFromContainerPortBindings(d) {
+    var bindings = [];
+    for (var p in $scope.config.HostConfig.PortBindings) {
+      if ({}.hasOwnProperty.call($scope.config.HostConfig.PortBindings, p)) {
+	var hostPort = '';
+        if ($scope.config.HostConfig.PortBindings[p][0].HostIp) {
+          hostPort = $scope.config.HostConfig.PortBindings[p][0].HostIp + ':';
+        }
+        hostPort += $scope.config.HostConfig.PortBindings[p][0].HostPort;
+        var b = {
+          'hostPort': hostPort,
+          'containerPort': p.split('/')[0],
+          'protocol': p.split('/')[1]
+        };
+        bindings.push(b);
+      }
+    }
+    $scope.config.HostConfig.PortBindings = bindings;
+  }
+
+  function loadFromContainerVolumes(d) {
+    for (var v in d.Mounts) {
+      if ({}.hasOwnProperty.call(d.Mounts, v)) {
+        var mount = d.Mounts[v];
+        var volume = {
+          'type': mount.Type,
+          'name': mount.Name || mount.Source,
+          'containerPath': mount.Destination,
+          'readOnly': mount.RW === false
+        };
+        $scope.formValues.Volumes.push(volume);
+      }
+    }
+  }
+
+  $scope.resetNetworkConfig = function() {
+    $scope.config.NetworkingConfig = {
+      EndpointsConfig: {}
+    };
+  };
+
+  function loadFromContainerNetworkConfig(d) {
+    $scope.config.NetworkingConfig = {
+      EndpointsConfig: {}
+    };
+    var networkMode = d.HostConfig.NetworkMode;
+    if (networkMode === 'default') {
+      $scope.config.HostConfig.NetworkMode = 'bridge';
+      if (!_.find($scope.availableNetworks, {'Name': 'bridge'})) {
+        $scope.config.HostConfig.NetworkMode = 'nat';
+      }
+    }
+    if ($scope.config.HostConfig.NetworkMode.indexOf('container:') === 0) {
+      var netContainer = $scope.config.HostConfig.NetworkMode.split(/^container:/)[1];
+      $scope.config.HostConfig.NetworkMode = 'container';
+      for (var c in $scope.runningContainers) {
+        if ($scope.runningContainers[c].Names && $scope.runningContainers[c].Names[0] === '/' + netContainer) {
+          $scope.formValues.NetworkContainer = $scope.runningContainers[c];
+        }
+      }
+    }
+    $scope.fromContainerMultipleNetworks = Object.keys(d.NetworkSettings.Networks).length >= 2;
+    if (d.NetworkSettings.Networks[$scope.config.HostConfig.NetworkMode]) {
+      if (d.NetworkSettings.Networks[$scope.config.HostConfig.NetworkMode].IPAMConfig) {
+        if (d.NetworkSettings.Networks[$scope.config.HostConfig.NetworkMode].IPAMConfig.IPv4Address) {
+          $scope.formValues.IPv4 = d.NetworkSettings.Networks[$scope.config.HostConfig.NetworkMode].IPAMConfig.IPv4Address;
+        }
+        if (d.NetworkSettings.Networks[$scope.config.HostConfig.NetworkMode].IPAMConfig.IPv6Address) {
+          $scope.formValues.IPv6 = d.NetworkSettings.Networks[$scope.config.HostConfig.NetworkMode].IPAMConfig.IPv6Address;
+        }
+      }
+    }
+    $scope.config.NetworkingConfig.EndpointsConfig[$scope.config.HostConfig.NetworkMode] = d.NetworkSettings.Networks[$scope.config.HostConfig.NetworkMode];
+    // Mac Address
+    $scope.formValues.MacAddress = d.NetworkSettings.Networks[$scope.config.HostConfig.NetworkMode].MacAddress;
+    // ExtraHosts
+    for (var h in $scope.config.HostConfig.ExtraHosts) {
+      if ({}.hasOwnProperty.call($scope.config.HostConfig.ExtraHosts, h)) {
+        $scope.formValues.ExtraHosts.push({'value': $scope.config.HostConfig.ExtraHosts[h]});
+        $scope.config.HostConfig.ExtraHosts = [];
+      }
+    }
+  }
+
+  function loadFromContainerEnvironmentVariables(d) {
+    var envArr = [];
+    for (var e in $scope.config.Env) {
+      if ({}.hasOwnProperty.call($scope.config.Env, e)) {
+        var arr = $scope.config.Env[e].split(/\=(.+)/);
+        envArr.push({'name': arr[0], 'value': arr[1]});
+      }
+    }
+    $scope.config.Env = envArr;
+  }
+
+  function loadFromContainerLabels(d) {
+    for (var l in $scope.config.Labels) {
+      if ({}.hasOwnProperty.call($scope.config.Labels, l)) {
+        $scope.formValues.Labels.push({ name: l, value: $scope.config.Labels[l]});
+      }
+    }
+  }
+
+  function loadFromContainerConsole(d) {
+    if ($scope.config.OpenStdin && $scope.config.Tty) {
+      $scope.formValues.Console = 'both';
+    } else if (!$scope.config.OpenStdin && $scope.config.Tty) {
+      $scope.formValues.Console = 'tty';
+    } else if ($scope.config.OpenStdin && !$scope.config.Tty) {
+      $scope.formValues.Console = 'interactive';
+    } else if (!$scope.config.OpenStdin && !$scope.config.Tty) {
+      $scope.formValues.Console = 'none';
+    }
+  }
+
+  function loadFromContainerDevices(d) {
+    var path = [];
+    for (var dev in $scope.config.HostConfig.Devices) {
+      if ({}.hasOwnProperty.call($scope.config.HostConfig.Devices, dev)) {
+        var device = $scope.config.HostConfig.Devices[dev];
+        path.push({'pathOnHost': device.PathOnHost, 'pathInContainer': device.PathInContainer});
+      }
+    }
+    $scope.config.HostConfig.Devices = path;
+  }
+
+  function loadFromContainerImageConfig(d) {
+    var imageInfo = ImageHelper.extractImageAndRegistryFromRepository($scope.config.Image);
+    RegistryService.retrieveRegistryFromRepository($scope.config.Image)
+    .then(function success(data) {
+      if (data) {
+        $scope.config.Image = imageInfo.image;
+        $scope.formValues.Registry = data;
+      }
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrive registry');
+    });
+  }
+
+  function loadFromContainerResources(d) {
+    if (d.HostConfig.NanoCpus) {
+      $scope.formValues.CpuLimit = d.HostConfig.NanoCpus / 1000000000;
+    }
+    if (d.HostConfig.Memory) {
+      $scope.formValues.MemoryLimit = d.HostConfig.Memory / 1024 / 1024;
+    }
+    if (d.HostConfig.MemoryReservation) {
+      $scope.formValues.MemoryReservation = d.HostConfig.MemoryReservation / 1024 / 1024;
+    }
+  }
+
+  function loadFromContainerSpec() {
+    // Get container
+    Container.get({ id: $transition$.params().from }).$promise
+    .then(function success(d) {
+      var fromContainer = new ContainerDetailsViewModel(d);
+      if (!fromContainer.ResourceControl) {
+        $scope.formValues.AccessControlData.AccessControlEnabled = false;
+      }
+      $scope.fromContainer = fromContainer;
+      $scope.config = ContainerHelper.configFromContainer(fromContainer.Model);
+      loadFromContainerCmd(d);
+      loadFromContainerPortBindings(d);
+      loadFromContainerVolumes(d);
+      loadFromContainerNetworkConfig(d);
+      loadFromContainerEnvironmentVariables(d);
+      loadFromContainerLabels(d);
+      loadFromContainerConsole(d);
+      loadFromContainerDevices(d);
+      loadFromContainerImageConfig(d);
+      loadFromContainerResources(d);
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve container');
+    });
+  }
+
   function initView() {
     Volume.query({}, function (d) {
       $scope.availableVolumes = d.Volumes;
@@ -239,35 +502,66 @@ function ($q, $scope, $state, $stateParams, $filter, Info, Container, ContainerH
       Notifications.error('Failure', e, 'Unable to retrieve volumes');
     });
 
-    Network.query({}, function (d) {
-      var networks = d;
-      if ($scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM' || $scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM_MODE') {
-        networks = d.filter(function (network) {
-          if (network.Scope === 'global') {
-            return network;
-          }
-        });
-        $scope.globalNetworkCount = networks.length;
-        networks.push({Name: 'bridge'});
-        networks.push({Name: 'host'});
-        networks.push({Name: 'none'});
-      }
-      networks.push({Name: 'container'});
+    var provider = $scope.applicationState.endpoint.mode.provider;
+    var apiVersion = $scope.applicationState.endpoint.apiVersion;
+    NetworkService.networks(
+      provider === 'DOCKER_STANDALONE' || provider === 'DOCKER_SWARM_MODE',
+      false,
+      provider === 'DOCKER_SWARM_MODE' && apiVersion >= 1.25,
+      provider === 'DOCKER_SWARM'
+    )
+    .then(function success(data) {
+      var networks = data;
+      networks.push({ Name: 'container' });
       $scope.availableNetworks = networks;
-      if (!_.find(networks, {'Name': 'bridge'})) {
+
+      if (_.find(networks, {'Name': 'nat'})) {
         $scope.config.HostConfig.NetworkMode = 'nat';
       }
-    }, function (e) {
-      Notifications.error('Failure', e, 'Unable to retrieve networks');
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve networks');
     });
 
     Container.query({}, function (d) {
       var containers = d;
       $scope.runningContainers = containers;
+      if ($transition$.params().from !== '') {
+        loadFromContainerSpec();
+      } else {
+        $scope.fromContainer = {};
+        $scope.formValues.Registry = {};
+      }
     }, function(e) {
       Notifications.error('Failure', e, 'Unable to retrieve running containers');
     });
 
+    SystemService.info()
+    .then(function success(data) {
+      $scope.state.sliderMaxCpu = 32;
+      if (data.NCPU) {
+        $scope.state.sliderMaxCpu = data.NCPU;
+      }
+      $scope.state.sliderMaxMemory = 32768;
+      if (data.MemTotal) {
+        $scope.state.sliderMaxMemory = Math.floor(data.MemTotal / 1000 / 1000);
+      }
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve engine details');
+    });
+
+    SettingsService.publicSettings()
+    .then(function success(data) {
+      $scope.allowBindMounts = data.AllowBindMountsForRegularUsers;
+      $scope.allowPrivilegedMode = data.AllowPrivilegedModeForRegularUsers;
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve application settings');
+    });
+
+    var userDetails = Authentication.getUserDetails();
+    $scope.isAdmin = userDetails.role === 1;
   }
 
   function validateForm(accessControlData, isAdmin) {
@@ -283,23 +577,31 @@ function ($q, $scope, $state, $stateParams, $filter, Info, Container, ContainerH
   }
 
   $scope.create = function () {
-    $('#createContainerSpinner').show();
+    confirmCreateContainer()
+    .then(function success(confirm) {
+      if (!confirm) {
+        return false;
+      }
 
-    var accessControlData = ControllerDataPipeline.getAccessControlFormData();
-    var userDetails = Authentication.getUserDetails();
-    var isAdmin = userDetails.role === 1 ? true : false;
+      var accessControlData = $scope.formValues.AccessControlData;
+      var userDetails = Authentication.getUserDetails();
+      var isAdmin = userDetails.role === 1;
 
-    if (!validateForm(accessControlData, isAdmin)) {
-      $('#createContainerSpinner').hide();
-      return;
-    }
+      if (!validateForm(accessControlData, isAdmin)) {
+        return;
+      }
 
-    var config = prepareConfiguration();
-    createContainer(config, accessControlData);
+      $scope.state.actionInProgress = true;
+      var config = prepareConfiguration();
+      createContainer(config, accessControlData);
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to create container');
+    });
   };
 
   function createContainer(config, accessControlData) {
-    $q.when(!$scope.formValues.alwaysPull || ImageService.pullImage($scope.config.Image, $scope.formValues.Registry))
+    $q.when(!$scope.formValues.alwaysPull || ImageService.pullImage($scope.config.Image, $scope.formValues.Registry, true))
     .finally(function final() {
       ContainerService.createAndStartContainer(config)
       .then(function success(data) {
@@ -315,7 +617,7 @@ function ($q, $scope, $state, $stateParams, $filter, Info, Container, ContainerH
         Notifications.error('Failure', err, 'Unable to create container');
       })
       .finally(function final() {
-        $('#createContainerSpinner').hide();
+        $scope.state.actionInProgress = false;
       });
     });
   }

app/components/createContainer/createcontainer.html

@@ -1,7 +1,7 @@
 <rd-header>
   <rd-header-title title="Create container"></rd-header-title>
   <rd-header-content>
-    <a ui-sref="containers">Containers</a> > Add container
+    <a ui-sref="containers">Containers</a> &gt; Add container
   </rd-header-content>
 </rd-header>
 
@@ -9,7 +9,7 @@
   <div class="col-lg-12 col-md-12 col-xs-12">
     <rd-widget>
       <rd-widget-body>
-        <form class="form-horizontal">
+        <form class="form-horizontal" autocomplete="off">
           <!-- name-input -->
           <div class="form-group">
             <label for="container_name" class="col-sm-1 control-label text-left">Name</label>
@@ -21,34 +21,30 @@
           <div class="col-sm-12 form-section-title">
             Image configuration
           </div>
-          <!-- image-and-registry-inputs -->
-          <div class="form-group">
-            <label for="container_image" class="col-sm-1 control-label text-left">Image</label>
-            <div class="col-sm-11 col-md-6">
-              <input type="text" class="form-control" ng-model="config.Image" id="container_image" placeholder="e.g. ubuntu:trusty">
-            </div>
-            <label for="image_registry" class="col-sm-2 margin-sm-top control-label text-left">
-              Registry
-              <portainer-tooltip position="bottom" message="A registry to pull the image from. Leave empty to use the official Docker registry."></portainer-tooltip>
-            </label>
-            <div class="col-sm-10 col-md-3 margin-sm-top">
-              <input type="text" class="form-control" ng-model="formValues.Registry" id="image_registry" placeholder="e.g. myregistry.mydomain">
-            </div>
+          <div ng-if="!formValues.Registry && fromContainer">
+            <i class="fa fa-exclamation-triangle orange-icon" aria-hidden="true"></i>
+            <span class="small text-danger" style="margin-left: 5px;">The Docker registry for the <code>{{ config.Image }}</code> image is not registered inside Portainer, you will not be able to create a container. Please register that registry first.</span>
           </div>
-          <!-- !image-and-registry-inputs -->
-          <!-- always-pull -->
-          <div class="form-group">
-            <div class="col-sm-12">
-              <label for="ownership" class="control-label text-left">
-                Always pull the image
-                <portainer-tooltip position="bottom" message="When enabled, Portainer will automatically try to pull the specified image before creating the container."></portainer-tooltip>
-              </label>
-              <label class="switch" style="margin-left: 20px;">
-                <input type="checkbox" ng-model="formValues.alwaysPull"><i></i>
-              </label>
+          <div ng-if="formValues.Registry || !fromContainer">
+            <!-- image-and-registry -->
+            <div class="form-group">
+              <por-image-registry image="config.Image" registry="formValues.Registry" ng-if="formValues.Registry" auto-complete="true"></por-image-registry>
             </div>
+            <!-- !image-and-registry -->
+            <!-- always-pull -->
+            <div class="form-group">
+              <div class="col-sm-12">
+                <label for="ownership" class="control-label text-left">
+                  Always pull the image
+                  <portainer-tooltip position="bottom" message="When enabled, Portainer will automatically try to pull the specified image before creating the container."></portainer-tooltip>
+                </label>
+                <label class="switch" style="margin-left: 20px;">
+                  <input type="checkbox" ng-model="formValues.alwaysPull"><i></i>
+                </label>
+              </div>
+            </div>
+            <!-- !always-pull -->
           </div>
-          <!-- !always-pull -->
           <div class="col-sm-12 form-section-title">
             Ports configuration
           </div>
@@ -108,7 +104,7 @@
           </div>
           <!-- !port-mapping -->
           <!-- access-control -->
-          <div ng-include="'app/components/common/accessControlForm/accessControlForm.html'" ng-if="applicationState.application.authentication"></div>
+          <por-access-control-form form-data="formValues.AccessControlData" resource-control="fromContainer.ResourceControl" ng-if="applicationState.application.authentication && fromContainer"></por-access-control-form>
           <!-- !access-control -->
           <!-- actions -->
           <div class="col-sm-12 form-section-title">
@@ -116,10 +112,15 @@
           </div>
           <div class="form-group">
             <div class="col-sm-12">
-              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!config.Image" ng-click="create()">Start container</button>
-              <a type="button" class="btn btn-default btn-sm" ui-sref="containers">Cancel</a>
-              <i id="createContainerSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+              <button type="button" class="btn btn-primary btn-sm" ng-disabled="state.actionInProgress || !config.Image || (!formValues.Registry && fromContainer)" ng-click="create()" button-spinner="state.actionInProgress">
+                <span ng-hide="state.actionInProgress">Deploy the container</span>
+                <span ng-show="state.actionInProgress">Deployment in progress...</span>
+              </button>
               <span class="text-danger" ng-if="state.formValidationError" style="margin-left: 5px;">{{ state.formValidationError }}</span>
+              <span ng-if="fromContainerMultipleNetworks" style="margin-left: 10px">
+                <i class="fa fa-exclamation-triangle" aria-hidden="true"></i>
+                <span class="small text-muted" style="margin-left: 5px;">This container is connected to multiple networks, only one network will be kept at creation time.</span>
+              </span>
             </div>
           </div>
           <!-- !actions -->
@@ -141,7 +142,7 @@
           <li class="interactive"><a data-target="#env" data-toggle="tab">Env</a></li>
           <li class="interactive"><a data-target="#labels" data-toggle="tab">Labels</a></li>
           <li class="interactive"><a data-target="#restart-policy" data-toggle="tab">Restart policy</a></li>
-          <li class="interactive"><a data-target="#runtime" data-toggle="tab">Runtime</a></li>
+          <li class="interactive"><a data-target="#runtime-resources" ng-click="refreshSlider()" data-toggle="tab">Runtime & Resources</a></li>
         </ul>
         <!-- tab-content -->
         <div class="tab-content">
@@ -235,7 +236,7 @@
                       </div>
                       <!-- !container-path -->
                       <!-- volume-type -->
-                      <div class="input-group col-sm-5" style="margin-left: 5px;">
+                      <div class="input-group col-sm-5" style="margin-left: 5px;" ng-if="isAdmin || allowBindMounts">
                         <div class="btn-group btn-group-sm">
                           <label class="btn btn-primary" ng-model="volume.type" uib-btn-radio="'volume'" ng-click="volume.name = ''">Volume</label>
                           <label class="btn btn-primary" ng-model="volume.type" uib-btn-radio="'bind'" ng-click="volume.name = ''">Bind</label>
@@ -295,7 +296,7 @@
               <div class="form-group">
                 <label for="container_network" class="col-sm-2 col-lg-1 control-label text-left">Network</label>
                 <div class="col-sm-9">
-                  <select class="form-control" ng-model="config.HostConfig.NetworkMode" id="container_network">
+                  <select class="form-control" ng-model="config.HostConfig.NetworkMode" id="container_network" ng-change="resetNetworkConfig()">
                     <option selected disabled hidden value="">Select a network</option>
                     <option ng-repeat="net in availableNetworks" ng-value="net.Name">{{ net.Name }}</option>
                   </select>
@@ -331,6 +332,14 @@
                 </div>
               </div>
               <!-- !domainname -->
+              <!-- mac-address-input -->
+              <div class="form-group">
+                <label for="container_macaddress" class="col-sm-2 col-lg-1 control-label text-left">Mac Address</label>
+                <div class="col-sm-9">
+                  <input type="text" class="form-control" ng-model="formValues.MacAddress" id="container_macaddress" placeholder="e.g. 12-34-56-78-9a-bc">
+                </div>
+              </div>
+              <!-- !mac-address-input -->
               <!-- ipv4-input -->
               <div class="form-group">
                 <label for="container_ipv4" class="col-sm-2 col-lg-1 control-label text-left">IPv4 Address</label>
@@ -466,17 +475,20 @@
             </form>
           </div>
           <!-- !tab-restart-policy -->
-          <!-- tab-runtime -->
-          <div class="tab-pane" id="runtime">
+          <!-- tab-runtime-resources -->
+          <div class="tab-pane" id="runtime-resources">
             <form class="form-horizontal" style="margin-top: 15px;">
+              <div class="col-sm-12 form-section-title">
+                Runtime
+              </div>
               <!-- privileged-mode -->
-              <div class="form-group">
+              <div class="form-group" ng-if="isAdmin || allowPrivilegedMode">
                 <div class="col-sm-12">
-                  <label for="ownership" class="control-label text-left">
+                  <label for="privileged_mode" class="control-label text-left">
                     Privileged mode
                   </label>
                   <label class="switch" style="margin-left: 20px;">
-                    <input type="checkbox" ng-model="config.HostConfig.Privileged"><i></i>
+                    <input type="checkbox" name="privileged_mode" ng-model="config.HostConfig.Privileged"><i></i>
                   </label>
                 </div>
               </div>
@@ -510,10 +522,63 @@
                 <!-- !devices-input-list -->
               </div>
               <!-- !devices-->
+              <div class="col-sm-12 form-section-title">
+                Resources
+              </div>
+              <!-- memory-reservation-input -->
+              <div class="form-group">
+                <label for="memory-reservation" class="col-sm-3 col-lg-2 control-label text-left" style="margin-top: 20px;">
+                  Memory reservation
+                </label>
+                <div class="col-sm-3">
+                  <slider model="formValues.MemoryReservation" floor="0" ceil="state.sliderMaxMemory" step="256" ng-if="state.sliderMaxMemory"></slider>
+                </div>
+                <div class="col-sm-2">
+                  <input type="number" min="0" class="form-control" ng-model="formValues.MemoryReservation" id="memory-reservation">
+                </div>
+                <div class="col-sm-4">
+                  <p class="small text-muted" style="margin-top: 7px;">
+                    Memory soft limit (<b>MB</b>)
+                  </p>
+                </div>
+              </div>
+              <!-- !memory-reservation-input -->
+              <!-- memory-limit-input -->
+              <div class="form-group">
+                <label for="memory-limit" class="col-sm-3 col-lg-2 control-label text-left" style="margin-top: 20px;">
+                  Memory limit
+                </label>
+                <div class="col-sm-3">
+                  <slider model="formValues.MemoryLimit" floor="0" ceil="state.sliderMaxMemory" step="256" ng-if="state.sliderMaxMemory"></slider>
+                </div>
+                <div class="col-sm-2">
+                  <input type="number" min="0" class="form-control" ng-model="formValues.MemoryLimit" id="memory-limit">
+                </div>
+                <div class="col-sm-4">
+                  <p class="small text-muted" style="margin-top: 7px;">
+                    Memory limit (<b>MB</b>)
+                  </p>
+                </div>
+              </div>
+              <!-- !memory-limit-input -->
+              <!-- cpu-limit-input -->
+              <div class="form-group">
+                <label for="cpu-limit" class="col-sm-3 col-lg-2 control-label text-left" style="margin-top: 20px;">
+                  CPU limit
+                </label>
+                <div class="col-sm-5">
+                  <slider model="formValues.CpuLimit" floor="0" ceil="state.sliderMaxCpu" step="0.25" precision="2" ng-if="state.sliderMaxCpu"></slider>
+                </div>
+                <div class="col-sm-4" style="margin-top: 20px;">
+                  <p class="small text-muted">
+                    Maximum CPU usage
+                  </p>
+                </div>
+              </div>
+              <!-- !cpu-limit-input -->
             </form>
-
           </div>
-          <!-- !tab-runtime -->
+          <!-- !tab-runtime-resources -->
         </div>
       </rd-widget-body>
     </rd-widget>

app/components/createNetwork/createNetworkController.js

@@ -1,13 +1,22 @@
 angular.module('createNetwork', [])
-.controller('CreateNetworkController', ['$scope', '$state', 'Notifications', 'Network',
-function ($scope, $state, Notifications, Network) {
+.controller('CreateNetworkController', ['$q', '$scope', '$state', 'PluginService', 'Notifications', 'NetworkService', 'LabelHelper', 'Authentication', 'ResourceControlService', 'FormValidator',
+function ($q, $scope, $state, PluginService, Notifications, NetworkService, LabelHelper, Authentication, ResourceControlService, FormValidator) {
+
   $scope.formValues = {
     DriverOptions: [],
     Subnet: '',
     Gateway: '',
-    Labels: []
+    Labels: [],
+    AccessControlData: new AccessControlFormData()
   };
 
+  $scope.state = {
+    formValidationError: '',
+    actionInProgress: false
+  };
+
+  $scope.availableNetworkDrivers = [];
+
   $scope.config = {
     Driver: 'bridge',
     CheckDuplicate: true,
@@ -30,30 +39,13 @@ function ($scope, $state, Notifications, Network) {
   };
 
   $scope.addLabel = function() {
-    $scope.formValues.Labels.push({ name: '', value: ''});
+    $scope.formValues.Labels.push({ key: '', value: ''});
   };
 
   $scope.removeLabel = function(index) {
     $scope.formValues.Labels.splice(index, 1);
   };
 
-  function createNetwork(config) {
-    $('#createNetworkSpinner').show();
-    Network.create(config, function (d) {
-      if (d.message) {
-        $('#createNetworkSpinner').hide();
-        Notifications.error('Unable to create network', {}, d.message);
-      } else {
-        Notifications.success('Network created', d.Id);
-        $('#createNetworkSpinner').hide();
-        $state.go('networks', {}, {reload: true});
-      }
-    }, function (e) {
-      $('#createNetworkSpinner').hide();
-      Notifications.error('Failure', e, 'Unable to create network');
-    });
-  }
-
   function prepareIPAMConfiguration(config) {
     if ($scope.formValues.Subnet) {
       var ipamConfig = {};
@@ -74,13 +66,7 @@ function ($scope, $state, Notifications, Network) {
   }
 
   function prepareLabelsConfig(config) {
-    var labels = {};
-    $scope.formValues.Labels.forEach(function (label) {
-      if (label.name && label.value) {
-          labels[label.name] = label.value;
-      }
-    });
-    config.Labels = labels;
+    config.Labels = LabelHelper.fromKeyValueToLabelHash($scope.formValues.Labels);
   }
 
   function prepareConfiguration() {
@@ -91,8 +77,60 @@ function ($scope, $state, Notifications, Network) {
     return config;
   }
 
+  function validateForm(accessControlData, isAdmin) {
+    $scope.state.formValidationError = '';
+    var error = '';
+    error = FormValidator.validateAccessControl(accessControlData, isAdmin);
+
+    if (error) {
+      $scope.state.formValidationError = error;
+      return false;
+    }
+    return true;
+  }
+
   $scope.create = function () {
-    var config = prepareConfiguration();
-    createNetwork(config);
+    var networkConfiguration = prepareConfiguration();
+    var accessControlData = $scope.formValues.AccessControlData;
+    var userDetails = Authentication.getUserDetails();
+    var isAdmin = userDetails.role === 1;
+
+    if (!validateForm(accessControlData, isAdmin)) {
+      return;
+    }
+
+    $scope.state.actionInProgress = true;
+    NetworkService.create(networkConfiguration)
+    .then(function success(data) {
+      var networkIdentifier = data.Id;
+      var userId = userDetails.ID;
+      return ResourceControlService.applyResourceControl('network', networkIdentifier, userId, accessControlData, []);
+    })
+    .then(function success() {
+      Notifications.success('Network successfully created');
+      $state.go('networks', {}, {reload: true});
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'An error occured during network creation');
+    })
+    .finally(function final() {
+      $scope.state.actionInProgress = false;
+    });
   };
+
+  function initView() {
+    var endpointProvider = $scope.applicationState.endpoint.mode.provider;
+    var apiVersion = $scope.applicationState.endpoint.apiVersion;
+    if(endpointProvider !== 'DOCKER_SWARM') {
+      PluginService.networkPlugins(apiVersion < 1.25)
+      .then(function success(data){
+          $scope.availableNetworkDrivers = data;
+      })
+      .catch(function error(err) {
+        Notifications.error('Failure', err, 'Unable to retrieve network drivers');
+      });
+    }
+  }
+
+  initView();
 }]);

app/components/createNetwork/createnetwork.html

@@ -1,7 +1,7 @@
 <rd-header>
   <rd-header-title title="Create network"></rd-header-title>
   <rd-header-content>
-    <a ui-sref="networks">Networks</a> > Add network
+    <a ui-sref="networks">Networks</a> &gt; Add network
   </rd-header-content>
 </rd-header>
 
@@ -39,8 +39,11 @@
           <!-- driver-input -->
           <div class="form-group">
             <label for="network_driver" class="col-sm-2 col-lg-1 control-label text-left">Driver</label>
-            <div class="col-sm-10">
-              <input type="text" class="form-control" ng-model="config.Driver" id="network_driver" placeholder="e.g. driverName">
+            <div class="col-sm-11">
+              <select class="form-control" ng-options="driver for driver in availableNetworkDrivers" ng-model="config.Driver" ng-if="availableNetworkDrivers.length > 0">
+                <option disabled hidden value="">Select a driver</option>
+              </select>
+              <input type="text" class="form-control" ng-model="config.Driver" id="network_driver" placeholder="e.g. driverName" ng-if="availableNetworkDrivers.length === 0">
             </div>
           </div>
           <!-- !driver-input -->
@@ -90,7 +93,7 @@
               <div ng-repeat="label in formValues.Labels" style="margin-top: 2px;">
                 <div class="input-group col-sm-5 input-group-sm">
                   <span class="input-group-addon">name</span>
-                  <input type="text" class="form-control" ng-model="label.name" placeholder="e.g. com.example.foo">
+                  <input type="text" class="form-control" ng-model="label.key" placeholder="e.g. com.example.foo">
                 </div>
                 <div class="input-group col-sm-5 input-group-sm">
                   <span class="input-group-addon">value</span>
@@ -116,15 +119,21 @@
             </div>
           </div>
           <!-- !internal -->
+          <!-- access-control -->
+          <por-access-control-form form-data="formValues.AccessControlData" ng-if="applicationState.application.authentication"></por-access-control-form>
+          <!-- !access-control -->
           <!-- actions -->
           <div class="col-sm-12 form-section-title">
             Actions
           </div>
           <div class="form-group">
             <div class="col-sm-12">
-              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!config.Name" ng-click="create()">Create network</button>
-              <a type="button" class="btn btn-default btn-sm" ui-sref="networks">Cancel</a>
-              <i id="createNetworkSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+              <button type="button" class="btn btn-primary btn-sm" ng-disabled="state.actionInProgress || !config.Name" ng-click="create()" button-spinner="state.actionInProgress">
+                <span ng-hide="state.actionInProgress">Create the network</span>
+                <span ng-show="state.actionInProgress">Creating network...</span>
+              </button>
+              <i id="createResourceSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+              <span class="text-danger" ng-if="state.formValidationError" style="margin-left: 5px;">{{ state.formValidationError }}</span>
             </div>
           </div>
           <!-- !actions -->

app/components/createRegistry/createRegistryController.js

@@ -0,0 +1,50 @@
+angular.module('createRegistry', [])
+.controller('CreateRegistryController', ['$scope', '$state', 'RegistryService', 'Notifications',
+function ($scope, $state, RegistryService, Notifications) {
+
+  $scope.state = {
+    RegistryType: 'quay',
+    actionInProgress: false
+  };
+
+  $scope.formValues = {
+    Name: 'Quay',
+    URL: 'quay.io',
+    Authentication: true,
+    Username: '',
+    Password: ''
+  };
+
+  $scope.selectQuayRegistry = function() {
+    $scope.formValues.Name = 'Quay';
+    $scope.formValues.URL = 'quay.io';
+    $scope.formValues.Authentication = true;
+  };
+
+  $scope.selectCustomRegistry = function() {
+    $scope.formValues.Name = '';
+    $scope.formValues.URL = '';
+    $scope.formValues.Authentication = false;
+  };
+
+  $scope.addRegistry = function() {
+    var registryName = $scope.formValues.Name;
+    var registryURL = $scope.formValues.URL.replace(/^https?\:\/\//i, '');
+    var authentication = $scope.formValues.Authentication;
+    var username = $scope.formValues.Username;
+    var password = $scope.formValues.Password;
+
+    $scope.state.actionInProgress = true;
+    RegistryService.createRegistry(registryName, registryURL, authentication, username, password)
+    .then(function success(data) {
+      Notifications.success('Registry successfully created');
+      $state.go('registries');
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to create registry');
+    })
+    .finally(function final() {
+      $scope.state.actionInProgress = false;
+    });
+  };
+}]);

app/components/createRegistry/createregistry.html

@@ -0,0 +1,120 @@
+<rd-header>
+  <rd-header-title title="Create registry"></rd-header-title>
+  <rd-header-content>
+    <a ui-sref="registries">Registries</a> &gt; Add registry
+  </rd-header-content>
+</rd-header>
+
+<div class="row">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <div class="col-sm-12 form-section-title">
+            Registry provider
+          </div>
+          <div class="form-group"></div>
+          <div class="form-group" style="margin-bottom: 0">
+            <div class="boxselector_wrapper">
+              <div ng-click="selectQuayRegistry()">
+                <input type="radio" id="registry_quay" ng-model="state.RegistryType" value="quay">
+                <label for="registry_quay">
+                  <div class="boxselector_header">
+                    <i class="fa fa-database" aria-hidden="true" style="margin-right: 2px;"></i>
+                    Quay.io
+                  </div>
+                  <p>Quay container registry</p>
+                </label>
+              </div>
+              <div ng-click="selectCustomRegistry()">
+                <input type="radio" id="registry_custom" ng-model="state.RegistryType" value="custom">
+                <label for="registry_custom">
+                  <div class="boxselector_header">
+                    <i class="fa fa-database" aria-hidden="true" style="margin-right: 2px;"></i>
+                    Custom registry
+                  </div>
+                  <p>Define your own registry</p>
+                </label>
+              </div>
+            </div>
+          </div>
+          <div class="col-sm-12 form-section-title" ng-if="state.RegistryType === 'custom'">
+            Important notice
+          </div>
+          <div class="form-group" ng-if="state.RegistryType === 'custom'">
+            <span class="col-sm-12 text-muted small">
+              Docker requires you to connect to a <a href="https://docs.docker.com/registry/deploying/#running-a-domain-registry" target="_blank">secure registry</a>.
+              You can find more information about how to connect to an insecure registry <a href="https://docs.docker.com/registry/insecure/" target="_blank">in the Docker documentation</a>.
+            </span>
+          </div>
+          <div class="col-sm-12 form-section-title">
+            Registry details
+          </div>
+          <!-- name-input -->
+          <div class="form-group" ng-if="state.RegistryType === 'custom'">
+            <label for="registry_name" class="col-sm-3 col-lg-2 control-label text-left">Name</label>
+            <div class="col-sm-9 col-lg-10">
+              <input type="text" class="form-control" id="registry_name" ng-model="formValues.Name" placeholder="e.g. my-registry">
+            </div>
+          </div>
+          <!-- !name-input -->
+          <!-- registry-url-input -->
+          <div class="form-group" ng-if="state.RegistryType === 'custom'">
+            <label for="registry_url" class="col-sm-3 col-lg-2 control-label text-left">
+              Registry URL
+              <portainer-tooltip position="bottom" message="URL or IP address of a Docker registry. Any protocol will be stripped."></portainer-tooltip>
+            </label>
+            <div class="col-sm-9 col-lg-10">
+              <input type="text" class="form-control" id="registry_url" ng-model="formValues.URL" placeholder="e.g. 10.0.0.10:5000 or myregistry.domain.tld">
+            </div>
+          </div>
+          <!-- !registry-url-input -->
+          <!-- authentication-checkbox -->
+          <div class="form-group" ng-if="state.RegistryType === 'custom'">
+            <div class="col-sm-12">
+              <label for="registry_auth" class="control-label text-left">
+                Authentication
+                <portainer-tooltip position="bottom" message="Enable this option if you need to specify credentials to connect to this registry."></portainer-tooltip>
+              </label>
+              <label class="switch" style="margin-left: 20px;">
+                <input type="checkbox" ng-model="formValues.Authentication"><i></i>
+              </label>
+            </div>
+          </div>
+          <!-- !authentication-checkbox -->
+          <!-- authentication-credentials -->
+          <div ng-if="formValues.Authentication || state.RegistryType === 'quay'">
+            <!-- credentials-user -->
+            <div class="form-group">
+              <label for="credentials_username" class="col-sm-3 col-lg-2 control-label text-left">Username</label>
+              <div class="col-sm-9 col-lg-10">
+                <input type="text" class="form-control" id="credentials_username" ng-model="formValues.Username">
+              </div>
+            </div>
+            <!-- !credentials-user -->
+            <!-- credentials-password -->
+            <div class="form-group">
+              <label for="credentials_password" class="col-sm-3 col-lg-2 control-label text-left">Password</label>
+              <div class="col-sm-9 col-lg-10">
+                <input type="password" class="form-control" id="credentials_password" ng-model="formValues.Password">
+              </div>
+            </div>
+            <!-- !credentials-password -->
+          </div>
+          <!-- !authentication-credentials -->
+          <div class="col-sm-12 form-section-title">
+            Actions
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button type="button" class="btn btn-primary btn-sm" ng-disabled="state.actionInProgress || !formValues.Name || !formValues.URL || (formValues.Authentication && (!formValues.Username || !formValues.Password))" ng-click="addRegistry()" button-spinner="state.actionInProgress">
+                <span ng-hide="state.actionInProgress">Add registry</span>
+                <span ng-show="state.actionInProgress">Adding registry...</span>
+              </button>
+            </div>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>