Merge branch 'release/1.13.6'

Release 1.13.5

.codeclimate.yml

@@ -0,0 +1,29 @@
+---
+engines:
+  gofmt:
+    enabled: true
+  golint:
+    enabled: true
+  govet:
+    enabled: true
+  csslint:
+    enabled: true
+  duplication:
+    enabled: true
+    config:
+      languages:
+        javascript:
+          mass_threshold: 80
+  eslint:
+    enabled: true
+    config:
+      config: .eslintrc.yml
+  fixme:
+    enabled: true
+ratings:
+  paths:
+  - "**.css"
+  - "**.js"
+  - "**.go"
+exclude_paths:
+- test/

.dockerignore

@@ -1,2 +1,3 @@
 *
 !dist
+!build

.eslintrc.yml

@@ -0,0 +1,284 @@
+env:
+  browser: true
+  jquery: true
+
+# globals:
+#   angular: true
+#   $: true
+#   _: true
+#   moment: true
+#   filesize: true
+#   splitargs: true
+extends:
+  - 'eslint:recommended'
+
+# http://eslint.org/docs/rules/
+rules:
+  # Possible Errors
+  no-await-in-loop: off
+  no-cond-assign: error
+  no-console: off
+  no-constant-condition: error
+  no-control-regex: error
+  no-debugger: error
+  no-dupe-args: error
+  no-dupe-keys: error
+  no-duplicate-case: error
+  no-empty-character-class: error
+  no-empty: error
+  no-ex-assign: error
+  no-extra-boolean-cast: error
+  no-extra-parens: off
+  no-extra-semi: error
+  no-func-assign: error
+  no-inner-declarations:
+    - error
+    - functions
+  no-invalid-regexp: error
+  no-irregular-whitespace: error
+  no-negated-in-lhs: error
+  no-obj-calls: error
+  no-prototype-builtins: off
+  no-regex-spaces: error
+  no-sparse-arrays: error
+  no-template-curly-in-string: off
+  no-unexpected-multiline: error
+  no-unreachable: error
+  no-unsafe-finally: off
+  no-unsafe-negation: off
+  use-isnan: error
+  valid-jsdoc: off
+  valid-typeof: error
+
+  # Best Practices
+  accessor-pairs: error
+  array-callback-return: off
+  block-scoped-var: off
+  class-methods-use-this: off
+  complexity:
+    - error
+    - 6
+  consistent-return: off
+  curly: off
+  default-case: off
+  dot-location: off
+  dot-notation: off
+  eqeqeq: error
+  guard-for-in: error
+  no-alert: error
+  no-caller: error
+  no-case-declarations: error
+  no-div-regex: error
+  no-else-return: off
+  no-empty-function: off
+  no-empty-pattern: error
+  no-eq-null: error
+  no-eval: error
+  no-extend-native: error
+  no-extra-bind: error
+  no-extra-label: off
+  no-fallthrough: error
+  no-floating-decimal: off
+  no-global-assign: off
+  no-implicit-coercion: off
+  no-implied-eval: error
+  no-invalid-this: off
+  no-iterator: error
+  no-labels:
+    - error
+    - allowLoop: true
+      allowSwitch: true
+  no-lone-blocks: error
+  no-loop-func: error
+  no-magic-number: off
+  no-multi-spaces: off
+  no-multi-str: off
+  no-native-reassign: error
+  no-new-func: error
+  no-new-wrappers: error
+  no-new: error
+  no-octal-escape: error
+  no-octal: error
+  no-param-reassign: off
+  no-proto: error
+  no-redeclare: error
+  no-restricted-properties: off
+  no-return-assign: error
+  no-return-await: off
+  no-script-url: error
+  no-self-assign: off
+  no-self-compare: error
+  no-sequences: off
+  no-throw-literal: off
+  no-unmodified-loop-condition: off
+  no-unused-expressions: error
+  no-unused-labels: off
+  no-useless-call: error
+  no-useless-concat: error
+  no-useless-escape: off
+  no-useless-return: off
+  no-void: error
+  no-warning-comments: off
+  no-with: error
+  prefer-promise-reject-errors: off
+  radix: error
+  require-await: off
+  vars-on-top: off
+  wrap-iife: error
+  yoda: off
+
+  # Strict
+  strict: off
+
+  # Variables
+  init-declarations: off
+  no-catch-shadow: error
+  no-delete-var: error
+  no-label-var: error
+  no-restricted-globals: off
+  no-shadow-restricted-names: error
+  no-shadow: off
+  no-undef-init: error
+  no-undef: off
+  no-undefined: off
+  no-unused-vars: off
+  no-use-before-define: off
+
+  # Node.js and CommonJS
+  callback-return: error
+  global-require: error
+  handle-callback-err: error
+  no-mixed-requires: off
+  no-new-require: off
+  no-path-concat: error
+  no-process-env: off
+  no-process-exit: error
+  no-restricted-modules: off
+  no-sync: off
+
+  # Stylistic Issues
+  array-bracket-spacing: off
+  block-spacing: off
+  brace-style: off
+  camelcase: off
+  capitalized-comments: off
+  comma-dangle:
+    - error
+    - never
+  comma-spacing: off
+  comma-style: off
+  computed-property-spacing: off
+  consistent-this: off
+  eol-last: off
+  func-call-spacing: off
+  func-name-matching: off
+  func-names: off
+  func-style: off
+  id-length: off
+  id-match: off
+  indent: off
+  jsx-quotes: off
+  key-spacing: off
+  keyword-spacing: off
+  line-comment-position: off
+  linebreak-style:
+    - error
+    - unix
+  lines-around-comment: off
+  lines-around-directive: off
+  max-depth: off
+  max-len: off
+  max-nested-callbacks: off
+  max-params: off
+  max-statements-per-line: off
+  max-statements:
+    - error
+    - 30
+  multiline-ternary: off
+  new-cap: off
+  new-parens: off
+  newline-after-var: off
+  newline-before-return: off
+  newline-per-chained-call: off
+  no-array-constructor: off
+  no-bitwise: off
+  no-continue: off
+  no-inline-comments: off
+  no-lonely-if: off
+  no-mixed-operators: off
+  no-mixed-spaces-and-tabs: off
+  no-multi-assign: off
+  no-multiple-empty-lines: off
+  no-negated-condition: off
+  no-nested-ternary: off
+  no-new-object: off
+  no-plusplus: off
+  no-restricted-syntax: off
+  no-spaced-func: off
+  no-tabs: off
+  no-ternary: off
+  no-trailing-spaces: off
+  no-underscore-dangle: off
+  no-unneeded-ternary: off
+  object-curly-newline: off
+  object-curly-spacing: off
+  object-property-newline: off
+  one-var-declaration-per-line: off
+  one-var: off
+  operator-assignment: off
+  operator-linebreak: off
+  padded-blocks: off
+  quote-props: off
+  quotes:
+    - error
+    - single
+  require-jsdoc: off
+  semi-spacing: off
+  semi:
+    - error
+    - always
+  sort-keys: off
+  sort-vars: off
+  space-before-blocks: off
+  space-before-function-paren: off
+  space-in-parens: off
+  space-infix-ops: off
+  space-unary-ops: off
+  spaced-comment: off
+  template-tag-spacing: off
+  unicode-bom: off
+  wrap-regex: off
+
+  # ECMAScript 6
+  arrow-body-style: off
+  arrow-parens: off
+  arrow-spacing: off
+  constructor-super: off
+  generator-star-spacing: off
+  no-class-assign: off
+  no-confusing-arrow: off
+  no-const-assign: off
+  no-dupe-class-members: off
+  no-duplicate-imports: off
+  no-new-symbol: off
+  no-restricted-imports: off
+  no-this-before-super: off
+  no-useless-computed-key: off
+  no-useless-constructor: off
+  no-useless-rename: off
+  no-var: off
+  object-shorthand: off
+  prefer-arrow-callback: off
+  prefer-const: off
+  prefer-destructuring: off
+  prefer-numeric-literals: off
+  prefer-rest-params: off
+  prefer-reflect: off
+  prefer-spread: off
+  prefer-template: off
+  require-yield: off
+  rest-spread-spacing: off
+  sort-imports: off
+  symbol-description: off
+  template-curly-spacing: off
+  yield-star-spacing: off

.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,44 @@
+<!--
+
+Thanks for opening an issue on Portainer !
+
+Do you need help or have a question? Come chat with us on Slack http://portainer.io/slack/ or gitter https://gitter.im/portainer/Lobby.
+
+If you are reporting a new issue, make sure that we do not have any duplicates
+already open. You can ensure this by searching the issue list for this
+repository. If there is a duplicate, please close your issue and add a comment
+to the existing issue instead.
+
+Also, be sure to check our FAQ and documentation first: https://portainer.readthedocs.io
+
+If you suspect your issue is a bug, please edit your issue description to
+include the BUG REPORT INFORMATION shown below.
+
+---------------------------------------------------
+BUG REPORT INFORMATION
+---------------------------------------------------
+You do NOT have to include this information if this is a FEATURE REQUEST
+-->
+
+**Description**
+
+<!--
+Briefly describe the problem you are having in a few paragraphs.
+-->
+
+**Steps to reproduce the issue:**
+
+1.
+2.
+3.
+
+Any other info e.g. Why do you consider this to be a bug? What did you expect to happen instead?
+
+**Technical details:**
+
+* Portainer version:
+* Target Docker version (the host/cluster you manage):
+* Platform (windows/linux):
+* Command used to start Portainer (`docker run -p 9000:9000 portainer/portainer`):
+* Target Swarm version (if applicable):
+* Browser:

.gitignore

@@ -1,10 +1,6 @@
-logs/*
-!.gitkeep
-*.esproj/*
 node_modules
 bower_components
-.idea
-*.iml
 dist
-dist/*
-ui-for-docker-checksum.txt
+portainer-checksum.txt
+api/cmd/portainer/portainer*
+.tmp

.godir

@@ -1 +1 @@
-dockerui
+portainer

CODE_OF_CONDUCT.md

@@ -0,0 +1,46 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at anthony.lapenna@portainer.io. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [http://contributor-covenant.org/version/1/4][version]
+
+[homepage]: http://contributor-covenant.org
+[version]: http://contributor-covenant.org/version/1/4/

CONTRIBUTING.md

@@ -0,0 +1,79 @@
+# Contributing Guidelines
+
+Some basic conventions for contributing to this project.
+
+### General
+
+Please make sure that there aren't existing pull requests attempting to address the issue mentioned. Likewise, please check for issues related to update, as someone else may be working on the issue in a branch or fork.
+
+* Please open a discussion in a new issue / existing issue to talk about the changes you'd like to bring
+* Develop in a topic branch, not master/develop
+
+When creating a new branch, prefix it with the *type* of the change (see section **Commit Message Format** below), the associated opened issue number, a dash and some text describing the issue (using dash as a separator).
+
+For example, if you work on a bugfix for the issue #361, you could name the branch `fix361-template-selection`.
+
+### Issues open to contribution
+
+Want to contribute but don't know where to start?
+
+Some of the open issues are labeled with prefix `exp/`, this is used to mark them as available for contributors to work on. All of these have an attributed difficulty level:
+
+* **beginner**: a task that should be accessible with users not familiar with the codebase
+* **intermediate**: a task that require some understanding of the project codebase or some experience in
+either AngularJS or Golang
+* **advanced**: a task that require a deep understanding of the project codebase
+
+You can have a use Github filters to list these issues:
+
+* beginner labeled issues: https://github.com/portainer/portainer/labels/exp%2Fbeginner
+* intermediate labeled issues: https://github.com/portainer/portainer/labels/exp%2Fintermediate
+* advanced labeled issues: https://github.com/portainer/portainer/labels/exp%2Fadvanced
+
+### Linting
+
+Please check your code using `grunt lint` before submitting your pull requests.
+
+### Commit Message Format
+
+Each commit message should include a **type**, a **scope** and a **subject**:
+
+```
+ <type>(<scope>): <subject>
+```
+
+Lines should not exceed 100 characters. This allows the message to be easier to read on github as well as in various git tools and produces a nice, neat commit log ie:
+
+```
+ #271 feat(containers): add exposed ports in the containers view
+ #270 fix(templates): fix a display issue in the templates view
+ #269 style(dashboard): update dashboard with new layout
+```
+
+#### Type
+
+Must be one of the following:
+
+* **feat**: A new feature
+* **fix**: A bug fix
+* **docs**: Documentation only changes
+* **style**: Changes that do not affect the meaning of the code (white-space, formatting, missing
+  semi-colons, etc)
+* **refactor**: A code change that neither fixes a bug or adds a feature
+* **test**: Adding missing tests
+* **chore**: Changes to the build process or auxiliary tools and libraries such as documentation
+  generation
+
+#### Scope
+
+The scope could be anything specifying place of the commit change. For example `networks`,
+`containers`, `images` etc...
+You can use the **area** label tag associated on the issue here (for `area/containers` use `containers` as a scope...)
+
+#### Subject
+
+The subject contains succinct description of the change:
+
+* use the imperative, present tense: "change" not "changed" nor "changes"
+* don't capitalize first letter
+* no dot (.) at the end

Dockerfile

@@ -1,8 +0,0 @@
-FROM scratch
-
-COPY dist /
-
-VOLUME /data
-
-EXPOSE 9000
-ENTRYPOINT ["/ui-for-docker"]

LICENSE

@@ -1,24 +1,24 @@
-Cloudinovasi-ui: Copyright (c) 2016 Cloudinovasi
+Portainer: Copyright (c) 2016 Portainer.io
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+This software is provided 'as-is', without any express or implied
+warranty.  In no event will the authors be held liable for any damages
+arising from the use of this software.
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+Permission is granted to anyone to use this software for any purpose,
+including commercial applications, and to alter it and redistribute it
+freely, subject to the following restrictions:
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE. 
+1. The origin of this software must not be misrepresented; you must not
+   claim that you wrote the original software. If you use this software
+   in a product, an acknowledgment in the product documentation would be
+   appreciated but is not required.
+2. Altered source versions must be plainly marked as such, and must not be
+   misrepresented as being the original software.
+3. This notice may not be removed or altered from any source distribution.
 
-UI For Docker: Copyright (c) 2013-2016 Michael Crosby (crosbymichael.com), Kevan Ahlquist (kevanahlquist.com), Anthony Lapenna (anthonylapenna at cloudinovasi dot id)
+Portainer contains code which was originally under this license:
+
+UI For Docker: Copyright (c) 2013-2016 Michael Crosby (crosbymichael.com), Kevan Ahlquist (kevanahlquist.com), Anthony Lapenna (portainer.io)
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

Procfile

@@ -1 +0,0 @@
-web: dockerui -p ":$PORT" -e "$DOCKER_ENDPOINT"

README.md

@@ -1,82 +1,54 @@
-# Cloudinovasi UI for Docker
 
-A fork of the amazing UI for Docker by Michael Crosby and Kevan Ahlquist (https://github.com/kevana/ui-for-docker) using the rdash-angular theme (https://github.com/rdash/rdash-angular).
+<p align="center">
+  <img title="portainer" src='https://portainer.io/images/logo_alt.png' />
+</p>
 
-![Dashboard](/dashboard.png)
+[![Docker Pulls](https://img.shields.io/docker/pulls/portainer/portainer.svg)](https://hub.docker.com/r/portainer/portainer/)
+[![Microbadger](https://images.microbadger.com/badges/image/portainer/portainer.svg)](http://microbadger.com/images/portainer/portainer "Image size")
+[![Documentation Status](https://readthedocs.org/projects/portainer/badge/?version=stable)](http://portainer.readthedocs.io/en/stable/?badge=stable)
+[![Codefresh build status]( https://g.codefresh.io/api/badges/build?repoOwner=portainer&repoName=portainer&branch=develop&pipelineName=portainer-ci&accountName=deviantony&type=cf-1)]( https://g.codefresh.io/repositories/portainer/portainer/builds?filter=trigger:build;branch:develop;service:5922a08a3a1aab000116fcc6~portainer-ci)
+[![Slack](https://portainer.io/slack/badge.svg)](https://portainer.io/slack/)
+[![Gitter](https://badges.gitter.im/portainer/Lobby.svg)](https://gitter.im/portainer/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge)
+[![Donate](https://img.shields.io/badge/Donate-PayPal-green.svg)](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=YHXZJQNJQ36H6)
 
-UI For Docker is a web interface for the Docker Remote API.  The goal is to provide a pure client side implementation so it is effortless to connect and manage docker.
+**_Portainer_** is a lightweight management UI which allows you to **easily** manage your different Docker environments (Docker hosts or Swarm clusters).
 
-## Goals
-* Minimal dependencies - I really want to keep this project a pure html/js app.
-* Consistency - The web UI should be consistent with the commands found on the docker CLI.
+**_Portainer_** is meant to be as **simple** to deploy as it is to use. It consists of a single container that can run on any Docker engine (can be deployed as Linux container or a Windows native container).
 
-## Run
+**_Portainer_** allows you to manage your Docker containers, images, volumes, networks and more ! It is compatible with the *standalone Docker* engine and with *Docker Swarm mode*.
 
-### Quickstart
+## Demo
 
-1. Run: `docker run -d -p 9000:9000 --privileged -v /var/run/docker.sock:/var/run/docker.sock cloudinovasi/cloudinovasi-ui`
+<img src="https://portainer.io/images/screenshots/portainer.gif" width="77%"/>
 
-2. Open your browser to `http://<dockerd host ip>:9000`
+You can try out the public demo instance: http://demo.portainer.io/ (login with the username **admin** and the password **tryportainer**).
 
-Bind mounting the Unix socket into the UI For Docker container is much more secure than exposing your docker daemon over TCP.
+Please note that the public demo cluster is **reset every 15min**.
 
-The `--privileged` flag is required for hosts using SELinux.
+## Getting started
 
-### Specify socket to connect to Docker daemon
+* [Deploy Portainer](https://portainer.readthedocs.io/en/latest/deployment.html)
+* [Documentation](https://portainer.readthedocs.io)
 
-By default UI For Docker connects to the Docker daemon with`/var/run/docker.sock`. For this to work you need to bind mount the unix socket into the container with `-v /var/run/docker.sock:/var/run/docker.sock`.
+## Getting help
 
-You can use the `-e` flag to change this socket:
+* Issues: https://github.com/portainer/portainer/issues
+* FAQ: https://portainer.readthedocs.io/en/latest/faq.html
+* Slack (chat): https://portainer.io/slack/
+* Gitter (chat): https://gitter.im/portainer/Lobby
 
-```
-# Connect to a tcp socket:
-$ docker run -d -p 9000:9000 cloudinovasi/cloudinovasi-ui -e http://127.0.0.1:2375
-```
+## Reporting bugs and contributing
 
-### Swarm support
+* Want to report a bug or request a feature? Please open [an issue](https://github.com/portainer/portainer/issues/new).
+* Want to help us build **_portainer_**? Follow our [contribution guidelines](https://portainer.readthedocs.io/en/latest/contribute.html) to build it  locally and make a pull request. We need all the help we can get!
 
-**Supported Swarm version: 1.2.3**
+## Limitations
 
-You can access a specific view for you Swarm cluster by defining the `--swarm` flag:
+**_Portainer_** has full support for the following Docker versions:
 
-```
-# Connect to a tcp socket and enable Swarm:
-$ docker run -d -p 9000:9000 cloudinovasi/cloudinovasi-ui -e http://<SWARM_HOST>:<SWARM_PORT> --swarm
-```
+* Docker 1.10 to the latest version
+* Docker Swarm >= 1.2.3
 
-*NOTE*: Due to Swarm not exposing information in a machine readable way, the app is bound to a specific version of Swarm at the moment.
+Partial support for the following Docker versions (some features may not be available):
 
-### Change address/port UI For Docker is served on
-UI For Docker listens on port 9000 by default. If you run UI For Docker inside a container then you can bind the container's internal port to any external address and port:
-
-```
-# Expose UI For Docker on 10.20.30.1:80
-$ docker run -d -p 10.20.30.1:80:9000 --privileged -v /var/run/docker.sock:/var/run/docker.sock cloudinovasi/cloudinovasi-ui
-```
-
-### Hide containers with specific labels
-
-You can hide specific containers in the containers view by using the `-hide-label` or `-l` options and specifying a label.
-
-For example, take a container started with the label `owner=acme`:
-
-```
-$ docker run -d --label owner=acme nginx
-```
-
-You can hide it in the view by starting the ui with:
-
-```
-$ docker run -d -p 9000:9000 --privileged -v /var/run/docker.sock:/var/run/docker.sock cloudinovasi/cloudinovasi-ui -l owner=acme
-```
-
-### Available options
-
-The following options are available for the `ui-for-docker` binary:
-
-* `--endpoint`, `-e`: Docker deamon endpoint (default: *"/var/run/docker.sock"*)
-* `--bind`, `-p`: Address and port to serve UI For Docker (default: *":9000"*)
-* `--data`, `-d`: Path to the data folder (default: *"."*)
-* `--assets`, `-a`: Path to the assets (default: *"."*)
-* `--swarm`, `-s`: Swarm cluster support (default: *false*)
-* `--hide-label`, `-l`: Hide containers with a specific label in the UI
+* Docker 1.9

api/bolt/datastore.go

@@ -0,0 +1,144 @@
+package bolt
+
+import (
+	"log"
+	"os"
+	"time"
+
+	"github.com/boltdb/bolt"
+	"github.com/portainer/portainer"
+)
+
+// Store defines the implementation of portainer.DataStore using
+// BoltDB as the storage system.
+type Store struct {
+	// Path where is stored the BoltDB database.
+	Path string
+
+	// Services
+	UserService            *UserService
+	TeamService            *TeamService
+	TeamMembershipService  *TeamMembershipService
+	EndpointService        *EndpointService
+	ResourceControlService *ResourceControlService
+	VersionService         *VersionService
+	SettingsService        *SettingsService
+	RegistryService        *RegistryService
+	DockerHubService       *DockerHubService
+
+	db                    *bolt.DB
+	checkForDataMigration bool
+}
+
+const (
+	databaseFileName          = "portainer.db"
+	versionBucketName         = "version"
+	userBucketName            = "users"
+	teamBucketName            = "teams"
+	teamMembershipBucketName  = "team_membership"
+	endpointBucketName        = "endpoints"
+	resourceControlBucketName = "resource_control"
+	settingsBucketName        = "settings"
+	registryBucketName        = "registries"
+	dockerhubBucketName       = "dockerhub"
+)
+
+// NewStore initializes a new Store and the associated services
+func NewStore(storePath string) (*Store, error) {
+	store := &Store{
+		Path:                   storePath,
+		UserService:            &UserService{},
+		TeamService:            &TeamService{},
+		TeamMembershipService:  &TeamMembershipService{},
+		EndpointService:        &EndpointService{},
+		ResourceControlService: &ResourceControlService{},
+		VersionService:         &VersionService{},
+		SettingsService:        &SettingsService{},
+		RegistryService:        &RegistryService{},
+		DockerHubService:       &DockerHubService{},
+	}
+	store.UserService.store = store
+	store.TeamService.store = store
+	store.TeamMembershipService.store = store
+	store.EndpointService.store = store
+	store.ResourceControlService.store = store
+	store.VersionService.store = store
+	store.SettingsService.store = store
+	store.RegistryService.store = store
+	store.DockerHubService.store = store
+
+	_, err := os.Stat(storePath + "/" + databaseFileName)
+	if err != nil && os.IsNotExist(err) {
+		store.checkForDataMigration = false
+	} else if err != nil {
+		return nil, err
+	} else {
+		store.checkForDataMigration = true
+	}
+
+	return store, nil
+}
+
+// Open opens and initializes the BoltDB database.
+func (store *Store) Open() error {
+	path := store.Path + "/" + databaseFileName
+
+	db, err := bolt.Open(path, 0600, &bolt.Options{Timeout: 1 * time.Second})
+	if err != nil {
+		return err
+	}
+	store.db = db
+
+	bucketsToCreate := []string{versionBucketName, userBucketName, teamBucketName, endpointBucketName,
+		resourceControlBucketName, teamMembershipBucketName, settingsBucketName,
+		registryBucketName, dockerhubBucketName}
+
+	return db.Update(func(tx *bolt.Tx) error {
+
+		for _, bucket := range bucketsToCreate {
+			_, err := tx.CreateBucketIfNotExists([]byte(bucket))
+			if err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+}
+
+// Close closes the BoltDB database.
+func (store *Store) Close() error {
+	if store.db != nil {
+		return store.db.Close()
+	}
+	return nil
+}
+
+// MigrateData automatically migrate the data based on the DBVersion.
+func (store *Store) MigrateData() error {
+	if !store.checkForDataMigration {
+		err := store.VersionService.StoreDBVersion(portainer.DBVersion)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+
+	version, err := store.VersionService.DBVersion()
+	if err == portainer.ErrDBVersionNotFound {
+		version = 0
+	} else if err != nil {
+		return err
+	}
+
+	if version < portainer.DBVersion {
+		log.Printf("Migrating database from version %v to %v.\n", version, portainer.DBVersion)
+		migrator := NewMigrator(store, version)
+		err = migrator.Migrate()
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}

api/bolt/dockerhub_service.go

@@ -0,0 +1,61 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// DockerHubService represents a service for managing registries.
+type DockerHubService struct {
+	store *Store
+}
+
+const (
+	dbDockerHubKey = "DOCKERHUB"
+)
+
+// DockerHub returns the DockerHub object.
+func (service *DockerHubService) DockerHub() (*portainer.DockerHub, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(dockerhubBucketName))
+		value := bucket.Get([]byte(dbDockerHubKey))
+		if value == nil {
+			return portainer.ErrDockerHubNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var dockerhub portainer.DockerHub
+	err = internal.UnmarshalDockerHub(data, &dockerhub)
+	if err != nil {
+		return nil, err
+	}
+	return &dockerhub, nil
+}
+
+// StoreDockerHub persists a DockerHub object.
+func (service *DockerHubService) StoreDockerHub(dockerhub *portainer.DockerHub) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(dockerhubBucketName))
+
+		data, err := internal.MarshalDockerHub(dockerhub)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put([]byte(dbDockerHubKey), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}

api/bolt/endpoint_service.go

@@ -0,0 +1,154 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// EndpointService represents a service for managing endpoints.
+type EndpointService struct {
+	store *Store
+}
+
+// Endpoint returns an endpoint by ID.
+func (service *EndpointService) Endpoint(ID portainer.EndpointID) (*portainer.Endpoint, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(endpointBucketName))
+		value := bucket.Get(internal.Itob(int(ID)))
+		if value == nil {
+			return portainer.ErrEndpointNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var endpoint portainer.Endpoint
+	err = internal.UnmarshalEndpoint(data, &endpoint)
+	if err != nil {
+		return nil, err
+	}
+	return &endpoint, nil
+}
+
+// Endpoints return an array containing all the endpoints.
+func (service *EndpointService) Endpoints() ([]portainer.Endpoint, error) {
+	var endpoints = make([]portainer.Endpoint, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(endpointBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var endpoint portainer.Endpoint
+			err := internal.UnmarshalEndpoint(v, &endpoint)
+			if err != nil {
+				return err
+			}
+			endpoints = append(endpoints, endpoint)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return endpoints, nil
+}
+
+// Synchronize creates, updates and deletes endpoints inside a single transaction.
+func (service *EndpointService) Synchronize(toCreate, toUpdate, toDelete []*portainer.Endpoint) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(endpointBucketName))
+
+		for _, endpoint := range toCreate {
+			err := storeNewEndpoint(endpoint, bucket)
+			if err != nil {
+				return err
+			}
+		}
+
+		for _, endpoint := range toUpdate {
+			err := marshalAndStoreEndpoint(endpoint, bucket)
+			if err != nil {
+				return err
+			}
+		}
+
+		for _, endpoint := range toDelete {
+			err := bucket.Delete(internal.Itob(int(endpoint.ID)))
+			if err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+}
+
+// CreateEndpoint assign an ID to a new endpoint and saves it.
+func (service *EndpointService) CreateEndpoint(endpoint *portainer.Endpoint) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(endpointBucketName))
+		err := storeNewEndpoint(endpoint, bucket)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// UpdateEndpoint updates an endpoint.
+func (service *EndpointService) UpdateEndpoint(ID portainer.EndpointID, endpoint *portainer.Endpoint) error {
+	data, err := internal.MarshalEndpoint(endpoint)
+	if err != nil {
+		return err
+	}
+
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(endpointBucketName))
+		err = bucket.Put(internal.Itob(int(ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteEndpoint deletes an endpoint.
+func (service *EndpointService) DeleteEndpoint(ID portainer.EndpointID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(endpointBucketName))
+		err := bucket.Delete(internal.Itob(int(ID)))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+func marshalAndStoreEndpoint(endpoint *portainer.Endpoint, bucket *bolt.Bucket) error {
+	data, err := internal.MarshalEndpoint(endpoint)
+	if err != nil {
+		return err
+	}
+
+	err = bucket.Put(internal.Itob(int(endpoint.ID)), data)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func storeNewEndpoint(endpoint *portainer.Endpoint, bucket *bolt.Bucket) error {
+	id, _ := bucket.NextSequence()
+	endpoint.ID = portainer.EndpointID(id)
+	return marshalAndStoreEndpoint(endpoint, bucket)
+}

api/bolt/internal/internal.go

@@ -0,0 +1,97 @@
+package internal
+
+import (
+	"github.com/portainer/portainer"
+
+	"encoding/binary"
+	"encoding/json"
+)
+
+// MarshalUser encodes a user to binary format.
+func MarshalUser(user *portainer.User) ([]byte, error) {
+	return json.Marshal(user)
+}
+
+// UnmarshalUser decodes a user from a binary data.
+func UnmarshalUser(data []byte, user *portainer.User) error {
+	return json.Unmarshal(data, user)
+}
+
+// MarshalTeam encodes a team to binary format.
+func MarshalTeam(team *portainer.Team) ([]byte, error) {
+	return json.Marshal(team)
+}
+
+// UnmarshalTeam decodes a team from a binary data.
+func UnmarshalTeam(data []byte, team *portainer.Team) error {
+	return json.Unmarshal(data, team)
+}
+
+// MarshalTeamMembership encodes a team membership to binary format.
+func MarshalTeamMembership(membership *portainer.TeamMembership) ([]byte, error) {
+	return json.Marshal(membership)
+}
+
+// UnmarshalTeamMembership decodes a team membership from a binary data.
+func UnmarshalTeamMembership(data []byte, membership *portainer.TeamMembership) error {
+	return json.Unmarshal(data, membership)
+}
+
+// MarshalEndpoint encodes an endpoint to binary format.
+func MarshalEndpoint(endpoint *portainer.Endpoint) ([]byte, error) {
+	return json.Marshal(endpoint)
+}
+
+// UnmarshalEndpoint decodes an endpoint from a binary data.
+func UnmarshalEndpoint(data []byte, endpoint *portainer.Endpoint) error {
+	return json.Unmarshal(data, endpoint)
+}
+
+// MarshalRegistry encodes a registry to binary format.
+func MarshalRegistry(registry *portainer.Registry) ([]byte, error) {
+	return json.Marshal(registry)
+}
+
+// UnmarshalRegistry decodes a registry from a binary data.
+func UnmarshalRegistry(data []byte, registry *portainer.Registry) error {
+	return json.Unmarshal(data, registry)
+}
+
+// MarshalResourceControl encodes a resource control object to binary format.
+func MarshalResourceControl(rc *portainer.ResourceControl) ([]byte, error) {
+	return json.Marshal(rc)
+}
+
+// UnmarshalResourceControl decodes a resource control object from a binary data.
+func UnmarshalResourceControl(data []byte, rc *portainer.ResourceControl) error {
+	return json.Unmarshal(data, rc)
+}
+
+// MarshalSettings encodes a settings object to binary format.
+func MarshalSettings(settings *portainer.Settings) ([]byte, error) {
+	return json.Marshal(settings)
+}
+
+// UnmarshalSettings decodes a settings object from a binary data.
+func UnmarshalSettings(data []byte, settings *portainer.Settings) error {
+	return json.Unmarshal(data, settings)
+}
+
+// MarshalDockerHub encodes a Dockerhub object to binary format.
+func MarshalDockerHub(settings *portainer.DockerHub) ([]byte, error) {
+	return json.Marshal(settings)
+}
+
+// UnmarshalDockerHub decodes a Dockerhub object from a binary data.
+func UnmarshalDockerHub(data []byte, settings *portainer.DockerHub) error {
+	return json.Unmarshal(data, settings)
+}
+
+// Itob returns an 8-byte big endian representation of v.
+// This function is typically used for encoding integer IDs to byte slices
+// so that they can be used as BoltDB keys.
+func Itob(v int) []byte {
+	b := make([]byte, 8)
+	binary.BigEndian.PutUint64(b, uint64(v))
+	return b
+}

api/bolt/migrate_dbversion0.go

@@ -0,0 +1,39 @@
+package bolt
+
+import (
+	"github.com/boltdb/bolt"
+	"github.com/portainer/portainer"
+)
+
+func (m *Migrator) updateAdminUserToDBVersion1() error {
+	u, err := m.UserService.UserByUsername("admin")
+	if err == nil {
+		admin := &portainer.User{
+			Username: "admin",
+			Password: u.Password,
+			Role:     portainer.AdministratorRole,
+		}
+		err = m.UserService.CreateUser(admin)
+		if err != nil {
+			return err
+		}
+		err = m.removeLegacyAdminUser()
+		if err != nil {
+			return err
+		}
+	} else if err != nil && err != portainer.ErrUserNotFound {
+		return err
+	}
+	return nil
+}
+
+func (m *Migrator) removeLegacyAdminUser() error {
+	return m.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(userBucketName))
+		err := bucket.Delete([]byte("admin"))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}

api/bolt/migrate_dbversion1.go

@@ -0,0 +1,103 @@
+package bolt
+
+import (
+	"github.com/boltdb/bolt"
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+)
+
+func (m *Migrator) updateResourceControlsToDBVersion2() error {
+	legacyResourceControls, err := m.retrieveLegacyResourceControls()
+	if err != nil {
+		return err
+	}
+
+	for _, resourceControl := range legacyResourceControls {
+		resourceControl.SubResourceIDs = []string{}
+		resourceControl.TeamAccesses = []portainer.TeamResourceAccess{}
+
+		owner, err := m.UserService.User(resourceControl.OwnerID)
+		if err != nil {
+			return err
+		}
+
+		if owner.Role == portainer.AdministratorRole {
+			resourceControl.AdministratorsOnly = true
+			resourceControl.UserAccesses = []portainer.UserResourceAccess{}
+		} else {
+			resourceControl.AdministratorsOnly = false
+			userAccess := portainer.UserResourceAccess{
+				UserID:      resourceControl.OwnerID,
+				AccessLevel: portainer.ReadWriteAccessLevel,
+			}
+			resourceControl.UserAccesses = []portainer.UserResourceAccess{userAccess}
+		}
+
+		err = m.ResourceControlService.CreateResourceControl(&resourceControl)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) updateEndpointsToDBVersion2() error {
+	legacyEndpoints, err := m.EndpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	for _, endpoint := range legacyEndpoints {
+		endpoint.AuthorizedTeams = []portainer.TeamID{}
+		err = m.EndpointService.UpdateEndpoint(endpoint.ID, &endpoint)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *Migrator) retrieveLegacyResourceControls() ([]portainer.ResourceControl, error) {
+	legacyResourceControls := make([]portainer.ResourceControl, 0)
+	err := m.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte("containerResourceControl"))
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var resourceControl portainer.ResourceControl
+			err := internal.UnmarshalResourceControl(v, &resourceControl)
+			if err != nil {
+				return err
+			}
+			resourceControl.Type = portainer.ContainerResourceControl
+			legacyResourceControls = append(legacyResourceControls, resourceControl)
+		}
+
+		bucket = tx.Bucket([]byte("serviceResourceControl"))
+		cursor = bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var resourceControl portainer.ResourceControl
+			err := internal.UnmarshalResourceControl(v, &resourceControl)
+			if err != nil {
+				return err
+			}
+			resourceControl.Type = portainer.ServiceResourceControl
+			legacyResourceControls = append(legacyResourceControls, resourceControl)
+		}
+
+		bucket = tx.Bucket([]byte("volumeResourceControl"))
+		cursor = bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var resourceControl portainer.ResourceControl
+			err := internal.UnmarshalResourceControl(v, &resourceControl)
+			if err != nil {
+				return err
+			}
+			resourceControl.Type = portainer.VolumeResourceControl
+			legacyResourceControls = append(legacyResourceControls, resourceControl)
+		}
+		return nil
+	})
+	return legacyResourceControls, err
+}

api/bolt/migrator.go

@@ -0,0 +1,55 @@
+package bolt
+
+import "github.com/portainer/portainer"
+
+// Migrator defines a service to migrate data after a Portainer version update.
+type Migrator struct {
+	UserService            *UserService
+	EndpointService        *EndpointService
+	ResourceControlService *ResourceControlService
+	VersionService         *VersionService
+	CurrentDBVersion       int
+	store                  *Store
+}
+
+// NewMigrator creates a new Migrator.
+func NewMigrator(store *Store, version int) *Migrator {
+	return &Migrator{
+		UserService:            store.UserService,
+		EndpointService:        store.EndpointService,
+		ResourceControlService: store.ResourceControlService,
+		VersionService:         store.VersionService,
+		CurrentDBVersion:       version,
+		store:                  store,
+	}
+}
+
+// Migrate checks the database version and migrate the existing data to the most recent data model.
+func (m *Migrator) Migrate() error {
+
+	// Portainer < 1.12
+	if m.CurrentDBVersion == 0 {
+		err := m.updateAdminUserToDBVersion1()
+		if err != nil {
+			return err
+		}
+	}
+
+	// Portainer 1.12.x
+	if m.CurrentDBVersion == 1 {
+		err := m.updateResourceControlsToDBVersion2()
+		if err != nil {
+			return err
+		}
+		err = m.updateEndpointsToDBVersion2()
+		if err != nil {
+			return err
+		}
+	}
+
+	err := m.VersionService.StoreDBVersion(portainer.DBVersion)
+	if err != nil {
+		return err
+	}
+	return nil
+}

api/bolt/registry_service.go

@@ -0,0 +1,114 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// RegistryService represents a service for managing registries.
+type RegistryService struct {
+	store *Store
+}
+
+// Registry returns an registry by ID.
+func (service *RegistryService) Registry(ID portainer.RegistryID) (*portainer.Registry, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(registryBucketName))
+		value := bucket.Get(internal.Itob(int(ID)))
+		if value == nil {
+			return portainer.ErrRegistryNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var registry portainer.Registry
+	err = internal.UnmarshalRegistry(data, &registry)
+	if err != nil {
+		return nil, err
+	}
+	return &registry, nil
+}
+
+// Registries returns an array containing all the registries.
+func (service *RegistryService) Registries() ([]portainer.Registry, error) {
+	var registries = make([]portainer.Registry, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(registryBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var registry portainer.Registry
+			err := internal.UnmarshalRegistry(v, &registry)
+			if err != nil {
+				return err
+			}
+			registries = append(registries, registry)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return registries, nil
+}
+
+// CreateRegistry creates a new registry.
+func (service *RegistryService) CreateRegistry(registry *portainer.Registry) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(registryBucketName))
+
+		id, _ := bucket.NextSequence()
+		registry.ID = portainer.RegistryID(id)
+
+		data, err := internal.MarshalRegistry(registry)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put(internal.Itob(int(registry.ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// UpdateRegistry updates an registry.
+func (service *RegistryService) UpdateRegistry(ID portainer.RegistryID, registry *portainer.Registry) error {
+	data, err := internal.MarshalRegistry(registry)
+	if err != nil {
+		return err
+	}
+
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(registryBucketName))
+		err = bucket.Put(internal.Itob(int(ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteRegistry deletes an registry.
+func (service *RegistryService) DeleteRegistry(ID portainer.RegistryID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(registryBucketName))
+		err := bucket.Delete(internal.Itob(int(ID)))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}

api/bolt/resource_control_service.go

@@ -0,0 +1,148 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// ResourceControlService represents a service for managing resource controls.
+type ResourceControlService struct {
+	store *Store
+}
+
+// ResourceControl returns a ResourceControl object by ID
+func (service *ResourceControlService) ResourceControl(ID portainer.ResourceControlID) (*portainer.ResourceControl, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+		value := bucket.Get(internal.Itob(int(ID)))
+		if value == nil {
+			return portainer.ErrResourceControlNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var resourceControl portainer.ResourceControl
+	err = internal.UnmarshalResourceControl(data, &resourceControl)
+	if err != nil {
+		return nil, err
+	}
+	return &resourceControl, nil
+}
+
+// ResourceControlByResourceID returns a ResourceControl object by checking if the resourceID is equal
+// to the main ResourceID or in SubResourceIDs
+func (service *ResourceControlService) ResourceControlByResourceID(resourceID string) (*portainer.ResourceControl, error) {
+	var resourceControl *portainer.ResourceControl
+
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var rc portainer.ResourceControl
+			err := internal.UnmarshalResourceControl(v, &rc)
+			if err != nil {
+				return err
+			}
+			if rc.ResourceID == resourceID {
+				resourceControl = &rc
+			}
+			for _, subResourceID := range rc.SubResourceIDs {
+				if subResourceID == resourceID {
+					resourceControl = &rc
+				}
+			}
+		}
+
+		if resourceControl == nil {
+			return portainer.ErrResourceControlNotFound
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return resourceControl, nil
+}
+
+// ResourceControls returns all the ResourceControl objects
+func (service *ResourceControlService) ResourceControls() ([]portainer.ResourceControl, error) {
+	var rcs = make([]portainer.ResourceControl, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var resourceControl portainer.ResourceControl
+			err := internal.UnmarshalResourceControl(v, &resourceControl)
+			if err != nil {
+				return err
+			}
+			rcs = append(rcs, resourceControl)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return rcs, nil
+}
+
+// CreateResourceControl creates a new ResourceControl object
+func (service *ResourceControlService) CreateResourceControl(resourceControl *portainer.ResourceControl) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+		id, _ := bucket.NextSequence()
+		resourceControl.ID = portainer.ResourceControlID(id)
+		data, err := internal.MarshalResourceControl(resourceControl)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put(internal.Itob(int(resourceControl.ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// UpdateResourceControl saves a ResourceControl object.
+func (service *ResourceControlService) UpdateResourceControl(ID portainer.ResourceControlID, resourceControl *portainer.ResourceControl) error {
+	data, err := internal.MarshalResourceControl(resourceControl)
+	if err != nil {
+		return err
+	}
+
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+		err = bucket.Put(internal.Itob(int(ID)), data)
+
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteResourceControl deletes a ResourceControl object by ID
+func (service *ResourceControlService) DeleteResourceControl(ID portainer.ResourceControlID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(resourceControlBucketName))
+		err := bucket.Delete(internal.Itob(int(ID)))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}

api/bolt/settings_service.go

@@ -0,0 +1,61 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// SettingsService represents a service to manage application settings.
+type SettingsService struct {
+	store *Store
+}
+
+const (
+	dbSettingsKey = "SETTINGS"
+)
+
+// Settings retrieve the settings object.
+func (service *SettingsService) Settings() (*portainer.Settings, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(settingsBucketName))
+		value := bucket.Get([]byte(dbSettingsKey))
+		if value == nil {
+			return portainer.ErrSettingsNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var settings portainer.Settings
+	err = internal.UnmarshalSettings(data, &settings)
+	if err != nil {
+		return nil, err
+	}
+	return &settings, nil
+}
+
+// StoreSettings persists a Settings object.
+func (service *SettingsService) StoreSettings(settings *portainer.Settings) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(settingsBucketName))
+
+		data, err := internal.MarshalSettings(settings)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put([]byte(dbSettingsKey), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}

api/bolt/team_membership_service.go

@@ -0,0 +1,217 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// TeamMembershipService represents a service for managing TeamMembership objects.
+type TeamMembershipService struct {
+	store *Store
+}
+
+// TeamMembership returns a TeamMembership object by ID
+func (service *TeamMembershipService) TeamMembership(ID portainer.TeamMembershipID) (*portainer.TeamMembership, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+		value := bucket.Get(internal.Itob(int(ID)))
+		if value == nil {
+			return portainer.ErrTeamMembershipNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var membership portainer.TeamMembership
+	err = internal.UnmarshalTeamMembership(data, &membership)
+	if err != nil {
+		return nil, err
+	}
+	return &membership, nil
+}
+
+// TeamMemberships return an array containing all the TeamMembership objects.
+func (service *TeamMembershipService) TeamMemberships() ([]portainer.TeamMembership, error) {
+	var memberships = make([]portainer.TeamMembership, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var membership portainer.TeamMembership
+			err := internal.UnmarshalTeamMembership(v, &membership)
+			if err != nil {
+				return err
+			}
+			memberships = append(memberships, membership)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return memberships, nil
+}
+
+// TeamMembershipsByUserID return an array containing all the TeamMembership objects where the specified userID is present.
+func (service *TeamMembershipService) TeamMembershipsByUserID(userID portainer.UserID) ([]portainer.TeamMembership, error) {
+	var memberships = make([]portainer.TeamMembership, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var membership portainer.TeamMembership
+			err := internal.UnmarshalTeamMembership(v, &membership)
+			if err != nil {
+				return err
+			}
+			if membership.UserID == userID {
+				memberships = append(memberships, membership)
+			}
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return memberships, nil
+}
+
+// TeamMembershipsByTeamID return an array containing all the TeamMembership objects where the specified teamID is present.
+func (service *TeamMembershipService) TeamMembershipsByTeamID(teamID portainer.TeamID) ([]portainer.TeamMembership, error) {
+	var memberships = make([]portainer.TeamMembership, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var membership portainer.TeamMembership
+			err := internal.UnmarshalTeamMembership(v, &membership)
+			if err != nil {
+				return err
+			}
+			if membership.TeamID == teamID {
+				memberships = append(memberships, membership)
+			}
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return memberships, nil
+}
+
+// UpdateTeamMembership saves a TeamMembership object.
+func (service *TeamMembershipService) UpdateTeamMembership(ID portainer.TeamMembershipID, membership *portainer.TeamMembership) error {
+	data, err := internal.MarshalTeamMembership(membership)
+	if err != nil {
+		return err
+	}
+
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+		err = bucket.Put(internal.Itob(int(ID)), data)
+
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// CreateTeamMembership creates a new TeamMembership object.
+func (service *TeamMembershipService) CreateTeamMembership(membership *portainer.TeamMembership) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		id, _ := bucket.NextSequence()
+		membership.ID = portainer.TeamMembershipID(id)
+
+		data, err := internal.MarshalTeamMembership(membership)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put(internal.Itob(int(membership.ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteTeamMembership deletes a TeamMembership object.
+func (service *TeamMembershipService) DeleteTeamMembership(ID portainer.TeamMembershipID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+		err := bucket.Delete(internal.Itob(int(ID)))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteTeamMembershipByUserID deletes all the TeamMembership object associated to a UserID.
+func (service *TeamMembershipService) DeleteTeamMembershipByUserID(userID portainer.UserID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var membership portainer.TeamMembership
+			err := internal.UnmarshalTeamMembership(v, &membership)
+			if err != nil {
+				return err
+			}
+			if membership.UserID == userID {
+				err := bucket.Delete(internal.Itob(int(membership.ID)))
+				if err != nil {
+					return err
+				}
+			}
+		}
+
+		return nil
+	})
+}
+
+// DeleteTeamMembershipByTeamID deletes all the TeamMembership object associated to a TeamID.
+func (service *TeamMembershipService) DeleteTeamMembershipByTeamID(teamID portainer.TeamID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamMembershipBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var membership portainer.TeamMembership
+			err := internal.UnmarshalTeamMembership(v, &membership)
+			if err != nil {
+				return err
+			}
+			if membership.TeamID == teamID {
+				err := bucket.Delete(internal.Itob(int(membership.ID)))
+				if err != nil {
+					return err
+				}
+			}
+		}
+
+		return nil
+	})
+}

api/bolt/team_service.go

@@ -0,0 +1,144 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// TeamService represents a service for managing teams.
+type TeamService struct {
+	store *Store
+}
+
+// Team returns a Team by ID
+func (service *TeamService) Team(ID portainer.TeamID) (*portainer.Team, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+		value := bucket.Get(internal.Itob(int(ID)))
+		if value == nil {
+			return portainer.ErrTeamNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var team portainer.Team
+	err = internal.UnmarshalTeam(data, &team)
+	if err != nil {
+		return nil, err
+	}
+	return &team, nil
+}
+
+// TeamByName returns a team by name.
+func (service *TeamService) TeamByName(name string) (*portainer.Team, error) {
+	var team *portainer.Team
+
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var t portainer.Team
+			err := internal.UnmarshalTeam(v, &t)
+			if err != nil {
+				return err
+			}
+			if t.Name == name {
+				team = &t
+			}
+		}
+
+		if team == nil {
+			return portainer.ErrTeamNotFound
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return team, nil
+}
+
+// Teams return an array containing all the teams.
+func (service *TeamService) Teams() ([]portainer.Team, error) {
+	var teams = make([]portainer.Team, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var team portainer.Team
+			err := internal.UnmarshalTeam(v, &team)
+			if err != nil {
+				return err
+			}
+			teams = append(teams, team)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return teams, nil
+}
+
+// UpdateTeam saves a Team.
+func (service *TeamService) UpdateTeam(ID portainer.TeamID, team *portainer.Team) error {
+	data, err := internal.MarshalTeam(team)
+	if err != nil {
+		return err
+	}
+
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+		err = bucket.Put(internal.Itob(int(ID)), data)
+
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// CreateTeam creates a new Team.
+func (service *TeamService) CreateTeam(team *portainer.Team) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+
+		id, _ := bucket.NextSequence()
+		team.ID = portainer.TeamID(id)
+
+		data, err := internal.MarshalTeam(team)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put(internal.Itob(int(team.ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteTeam deletes a Team.
+func (service *TeamService) DeleteTeam(ID portainer.TeamID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(teamBucketName))
+		err := bucket.Delete(internal.Itob(int(ID)))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}

api/bolt/user_service.go

@@ -0,0 +1,170 @@
+package bolt
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt/internal"
+
+	"github.com/boltdb/bolt"
+)
+
+// UserService represents a service for managing users.
+type UserService struct {
+	store *Store
+}
+
+// User returns a user by ID
+func (service *UserService) User(ID portainer.UserID) (*portainer.User, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(userBucketName))
+		value := bucket.Get(internal.Itob(int(ID)))
+		if value == nil {
+			return portainer.ErrUserNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var user portainer.User
+	err = internal.UnmarshalUser(data, &user)
+	if err != nil {
+		return nil, err
+	}
+	return &user, nil
+}
+
+// UserByUsername returns a user by username.
+func (service *UserService) UserByUsername(username string) (*portainer.User, error) {
+	var user *portainer.User
+
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(userBucketName))
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var u portainer.User
+			err := internal.UnmarshalUser(v, &u)
+			if err != nil {
+				return err
+			}
+			if u.Username == username {
+				user = &u
+			}
+		}
+
+		if user == nil {
+			return portainer.ErrUserNotFound
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return user, nil
+}
+
+// Users return an array containing all the users.
+func (service *UserService) Users() ([]portainer.User, error) {
+	var users = make([]portainer.User, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(userBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var user portainer.User
+			err := internal.UnmarshalUser(v, &user)
+			if err != nil {
+				return err
+			}
+			users = append(users, user)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return users, nil
+}
+
+// UsersByRole return an array containing all the users with the specified role.
+func (service *UserService) UsersByRole(role portainer.UserRole) ([]portainer.User, error) {
+	var users = make([]portainer.User, 0)
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(userBucketName))
+
+		cursor := bucket.Cursor()
+		for k, v := cursor.First(); k != nil; k, v = cursor.Next() {
+			var user portainer.User
+			err := internal.UnmarshalUser(v, &user)
+			if err != nil {
+				return err
+			}
+			if user.Role == role {
+				users = append(users, user)
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return users, nil
+}
+
+// UpdateUser saves a user.
+func (service *UserService) UpdateUser(ID portainer.UserID, user *portainer.User) error {
+	data, err := internal.MarshalUser(user)
+	if err != nil {
+		return err
+	}
+
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(userBucketName))
+		err = bucket.Put(internal.Itob(int(ID)), data)
+
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// CreateUser creates a new user.
+func (service *UserService) CreateUser(user *portainer.User) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(userBucketName))
+
+		id, _ := bucket.NextSequence()
+		user.ID = portainer.UserID(id)
+
+		data, err := internal.MarshalUser(user)
+		if err != nil {
+			return err
+		}
+
+		err = bucket.Put(internal.Itob(int(user.ID)), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// DeleteUser deletes a user.
+func (service *UserService) DeleteUser(ID portainer.UserID) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(userBucketName))
+		err := bucket.Delete(internal.Itob(int(ID)))
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}

api/bolt/version_service.go

@@ -0,0 +1,58 @@
+package bolt
+
+import (
+	"strconv"
+
+	"github.com/portainer/portainer"
+
+	"github.com/boltdb/bolt"
+)
+
+// VersionService represents a service to manage stored versions.
+type VersionService struct {
+	store *Store
+}
+
+const (
+	dBVersionKey = "DB_VERSION"
+)
+
+// DBVersion retrieves the stored database version.
+func (service *VersionService) DBVersion() (int, error) {
+	var data []byte
+	err := service.store.db.View(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(versionBucketName))
+		value := bucket.Get([]byte(dBVersionKey))
+		if value == nil {
+			return portainer.ErrDBVersionNotFound
+		}
+
+		data = make([]byte, len(value))
+		copy(data, value)
+		return nil
+	})
+	if err != nil {
+		return 0, err
+	}
+
+	dbVersion, err := strconv.Atoi(string(data))
+	if err != nil {
+		return 0, err
+	}
+
+	return dbVersion, nil
+}
+
+// StoreDBVersion store the database version.
+func (service *VersionService) StoreDBVersion(version int) error {
+	return service.store.db.Update(func(tx *bolt.Tx) error {
+		bucket := tx.Bucket([]byte(versionBucketName))
+
+		data := []byte(strconv.Itoa(version))
+		err := bucket.Put([]byte(dBVersionKey), data)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}

api/cli/cli.go

@@ -0,0 +1,140 @@
+package cli
+
+import (
+	"log"
+	"time"
+
+	"github.com/portainer/portainer"
+
+	"os"
+	"strings"
+
+	"gopkg.in/alecthomas/kingpin.v2"
+)
+
+// Service implements the CLIService interface
+type Service struct{}
+
+const (
+	errInvalidEndpointProtocol    = portainer.Error("Invalid endpoint protocol: Portainer only supports unix:// or tcp://")
+	errSocketNotFound             = portainer.Error("Unable to locate Unix socket")
+	errEndpointsFileNotFound      = portainer.Error("Unable to locate external endpoints file")
+	errInvalidSyncInterval        = portainer.Error("Invalid synchronization interval")
+	errEndpointExcludeExternal    = portainer.Error("Cannot use the -H flag mutually with --external-endpoints")
+	errNoAuthExcludeAdminPassword = portainer.Error("Cannot use --no-auth with --admin-password")
+)
+
+// ParseFlags parse the CLI flags and return a portainer.Flags struct
+func (*Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
+	kingpin.Version(version)
+
+	flags := &portainer.CLIFlags{
+		Endpoint:          kingpin.Flag("host", "Dockerd endpoint").Short('H').String(),
+		ExternalEndpoints: kingpin.Flag("external-endpoints", "Path to a file defining available endpoints").String(),
+		SyncInterval:      kingpin.Flag("sync-interval", "Duration between each synchronization via the external endpoints source").Default(defaultSyncInterval).String(),
+		Addr:              kingpin.Flag("bind", "Address and port to serve Portainer").Default(defaultBindAddress).Short('p').String(),
+		Assets:            kingpin.Flag("assets", "Path to the assets").Default(defaultAssetsDirectory).Short('a').String(),
+		Data:              kingpin.Flag("data", "Path to the folder where the data is stored").Default(defaultDataDirectory).Short('d').String(),
+		NoAuth:            kingpin.Flag("no-auth", "Disable authentication").Default(defaultNoAuth).Bool(),
+		NoAnalytics:       kingpin.Flag("no-analytics", "Disable Analytics in app").Default(defaultNoAuth).Bool(),
+		TLSVerify:         kingpin.Flag("tlsverify", "TLS support").Default(defaultTLSVerify).Bool(),
+		TLSCacert:         kingpin.Flag("tlscacert", "Path to the CA").Default(defaultTLSCACertPath).String(),
+		TLSCert:           kingpin.Flag("tlscert", "Path to the TLS certificate file").Default(defaultTLSCertPath).String(),
+		TLSKey:            kingpin.Flag("tlskey", "Path to the TLS key").Default(defaultTLSKeyPath).String(),
+		SSL:               kingpin.Flag("ssl", "Secure Portainer instance using SSL").Default(defaultSSL).Bool(),
+		SSLCert:           kingpin.Flag("sslcert", "Path to the SSL certificate used to secure the Portainer instance").Default(defaultSSLCertPath).String(),
+		SSLKey:            kingpin.Flag("sslkey", "Path to the SSL key used to secure the Portainer instance").Default(defaultSSLKeyPath).String(),
+		AdminPassword:     kingpin.Flag("admin-password", "Hashed admin password").String(),
+		// Deprecated flags
+		Labels:    pairs(kingpin.Flag("hide-label", "Hide containers with a specific label in the UI").Short('l')),
+		Logo:      kingpin.Flag("logo", "URL for the logo displayed in the UI").String(),
+		Templates: kingpin.Flag("templates", "URL to the templates (apps) definitions").Short('t').String(),
+	}
+
+	kingpin.Parse()
+	return flags, nil
+}
+
+// ValidateFlags validates the values of the flags.
+func (*Service) ValidateFlags(flags *portainer.CLIFlags) error {
+
+	if *flags.Endpoint != "" && *flags.ExternalEndpoints != "" {
+		return errEndpointExcludeExternal
+	}
+
+	err := validateEndpoint(*flags.Endpoint)
+	if err != nil {
+		return err
+	}
+
+	err = validateExternalEndpoints(*flags.ExternalEndpoints)
+	if err != nil {
+		return err
+	}
+
+	err = validateSyncInterval(*flags.SyncInterval)
+	if err != nil {
+		return err
+	}
+
+	if *flags.NoAuth && (*flags.AdminPassword != "") {
+		return errNoAuthExcludeAdminPassword
+	}
+
+	displayDeprecationWarnings(*flags.Templates, *flags.Logo, *flags.Labels)
+
+	return nil
+}
+
+func validateEndpoint(endpoint string) error {
+	if endpoint != "" {
+		if !strings.HasPrefix(endpoint, "unix://") && !strings.HasPrefix(endpoint, "tcp://") {
+			return errInvalidEndpointProtocol
+		}
+
+		if strings.HasPrefix(endpoint, "unix://") {
+			socketPath := strings.TrimPrefix(endpoint, "unix://")
+			if _, err := os.Stat(socketPath); err != nil {
+				if os.IsNotExist(err) {
+					return errSocketNotFound
+				}
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func validateExternalEndpoints(externalEndpoints string) error {
+	if externalEndpoints != "" {
+		if _, err := os.Stat(externalEndpoints); err != nil {
+			if os.IsNotExist(err) {
+				return errEndpointsFileNotFound
+			}
+			return err
+		}
+	}
+	return nil
+}
+
+func validateSyncInterval(syncInterval string) error {
+	if syncInterval != defaultSyncInterval {
+		_, err := time.ParseDuration(syncInterval)
+		if err != nil {
+			return errInvalidSyncInterval
+		}
+	}
+	return nil
+}
+
+func displayDeprecationWarnings(templates, logo string, labels []portainer.Pair) {
+	if templates != "" {
+		log.Println("Warning: the --templates / -t flag is deprecated and will be removed in future versions.")
+	}
+	if logo != "" {
+		log.Println("Warning: the --logo flag is deprecated and will be removed in future versions.")
+	}
+	if labels != nil {
+		log.Println("Warning: the --hide-label / -l flag is deprecated and will be removed in future versions.")
+	}
+}

api/cli/defaults.go

@@ -0,0 +1,19 @@
+// +build !windows
+
+package cli
+
+const (
+	defaultBindAddress     = ":9000"
+	defaultDataDirectory   = "/data"
+	defaultAssetsDirectory = "."
+	defaultNoAuth          = "false"
+	defaultNoAnalytics     = "false"
+	defaultTLSVerify       = "false"
+	defaultTLSCACertPath   = "/certs/ca.pem"
+	defaultTLSCertPath     = "/certs/cert.pem"
+	defaultTLSKeyPath      = "/certs/key.pem"
+	defaultSSL             = "false"
+	defaultSSLCertPath     = "/certs/portainer.crt"
+	defaultSSLKeyPath      = "/certs/portainer.key"
+	defaultSyncInterval    = "60s"
+)

api/cli/defaults_windows.go

@@ -0,0 +1,17 @@
+package cli
+
+const (
+	defaultBindAddress     = ":9000"
+	defaultDataDirectory   = "C:\\data"
+	defaultAssetsDirectory = "."
+	defaultNoAuth          = "false"
+	defaultNoAnalytics     = "false"
+	defaultTLSVerify       = "false"
+	defaultTLSCACertPath   = "C:\\certs\\ca.pem"
+	defaultTLSCertPath     = "C:\\certs\\cert.pem"
+	defaultTLSKeyPath      = "C:\\certs\\key.pem"
+	defaultSSL             = "false"
+	defaultSSLCertPath     = "C:\\certs\\portainer.crt"
+	defaultSSLKeyPath      = "C:\\certs\\portainer.key"
+	defaultSyncInterval    = "60s"
+)

api/cli/pairlist.go

@@ -0,0 +1,40 @@
+package cli
+
+import (
+	"github.com/portainer/portainer"
+
+	"fmt"
+	"gopkg.in/alecthomas/kingpin.v2"
+	"strings"
+)
+
+type pairList []portainer.Pair
+
+// Set implementation for a list of portainer.Pair
+func (l *pairList) Set(value string) error {
+	parts := strings.SplitN(value, "=", 2)
+	if len(parts) != 2 {
+		return fmt.Errorf("expected NAME=VALUE got '%s'", value)
+	}
+	p := new(portainer.Pair)
+	p.Name = parts[0]
+	p.Value = parts[1]
+	*l = append(*l, *p)
+	return nil
+}
+
+// String implementation for a list of pair
+func (l *pairList) String() string {
+	return ""
+}
+
+// IsCumulative implementation for a list of pair
+func (l *pairList) IsCumulative() bool {
+	return true
+}
+
+func pairs(s kingpin.Settings) (target *[]portainer.Pair) {
+	target = new([]portainer.Pair)
+	s.SetValue((*pairList)(target))
+	return
+}

api/cmd/portainer/main.go

@@ -0,0 +1,238 @@
+package main // import "github.com/portainer/portainer"
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/bolt"
+	"github.com/portainer/portainer/cli"
+	"github.com/portainer/portainer/cron"
+	"github.com/portainer/portainer/crypto"
+	"github.com/portainer/portainer/file"
+	"github.com/portainer/portainer/http"
+	"github.com/portainer/portainer/jwt"
+
+	"log"
+)
+
+func initCLI() *portainer.CLIFlags {
+	var cli portainer.CLIService = &cli.Service{}
+	flags, err := cli.ParseFlags(portainer.APIVersion)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	err = cli.ValidateFlags(flags)
+	if err != nil {
+		log.Fatal(err)
+	}
+	return flags
+}
+
+func initFileService(dataStorePath string) portainer.FileService {
+	fileService, err := file.NewService(dataStorePath, "")
+	if err != nil {
+		log.Fatal(err)
+	}
+	return fileService
+}
+
+func initStore(dataStorePath string) *bolt.Store {
+	store, err := bolt.NewStore(dataStorePath)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	err = store.Open()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	err = store.MigrateData()
+	if err != nil {
+		log.Fatal(err)
+	}
+	return store
+}
+
+func initJWTService(authenticationEnabled bool) portainer.JWTService {
+	if authenticationEnabled {
+		jwtService, err := jwt.NewService()
+		if err != nil {
+			log.Fatal(err)
+		}
+		return jwtService
+	}
+	return nil
+}
+
+func initCryptoService() portainer.CryptoService {
+	return &crypto.Service{}
+}
+
+func initEndpointWatcher(endpointService portainer.EndpointService, externalEnpointFile string, syncInterval string) bool {
+	authorizeEndpointMgmt := true
+	if externalEnpointFile != "" {
+		authorizeEndpointMgmt = false
+		log.Println("Using external endpoint definition. Endpoint management via the API will be disabled.")
+		endpointWatcher := cron.NewWatcher(endpointService, syncInterval)
+		err := endpointWatcher.WatchEndpointFile(externalEnpointFile)
+		if err != nil {
+			log.Fatal(err)
+		}
+	}
+	return authorizeEndpointMgmt
+}
+
+func initStatus(authorizeEndpointMgmt bool, flags *portainer.CLIFlags) *portainer.Status {
+	return &portainer.Status{
+		Analytics:          !*flags.NoAnalytics,
+		Authentication:     !*flags.NoAuth,
+		EndpointManagement: authorizeEndpointMgmt,
+		Version:            portainer.APIVersion,
+	}
+}
+
+func initDockerHub(dockerHubService portainer.DockerHubService) error {
+	_, err := dockerHubService.DockerHub()
+	if err == portainer.ErrDockerHubNotFound {
+		dockerhub := &portainer.DockerHub{
+			Authentication: false,
+			Username:       "",
+			Password:       "",
+		}
+		return dockerHubService.StoreDockerHub(dockerhub)
+	} else if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func initSettings(settingsService portainer.SettingsService, flags *portainer.CLIFlags) error {
+	_, err := settingsService.Settings()
+	if err == portainer.ErrSettingsNotFound {
+		settings := &portainer.Settings{
+			LogoURL:                     *flags.Logo,
+			DisplayExternalContributors: true,
+		}
+
+		if *flags.Templates != "" {
+			settings.TemplatesURL = *flags.Templates
+		} else {
+			settings.TemplatesURL = portainer.DefaultTemplatesURL
+		}
+
+		if *flags.Labels != nil {
+			settings.BlackListedLabels = *flags.Labels
+		} else {
+			settings.BlackListedLabels = make([]portainer.Pair, 0)
+		}
+
+		return settingsService.StoreSettings(settings)
+	} else if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func retrieveFirstEndpointFromDatabase(endpointService portainer.EndpointService) *portainer.Endpoint {
+	endpoints, err := endpointService.Endpoints()
+	if err != nil {
+		log.Fatal(err)
+	}
+	return &endpoints[0]
+}
+
+func main() {
+	flags := initCLI()
+
+	fileService := initFileService(*flags.Data)
+
+	store := initStore(*flags.Data)
+	defer store.Close()
+
+	jwtService := initJWTService(!*flags.NoAuth)
+
+	cryptoService := initCryptoService()
+
+	authorizeEndpointMgmt := initEndpointWatcher(store.EndpointService, *flags.ExternalEndpoints, *flags.SyncInterval)
+
+	err := initSettings(store.SettingsService, flags)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	err = initDockerHub(store.DockerHubService)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	applicationStatus := initStatus(authorizeEndpointMgmt, flags)
+
+	if *flags.Endpoint != "" {
+		var endpoints []portainer.Endpoint
+		endpoints, err := store.EndpointService.Endpoints()
+		if err != nil {
+			log.Fatal(err)
+		}
+		if len(endpoints) == 0 {
+			endpoint := &portainer.Endpoint{
+				Name:            "primary",
+				URL:             *flags.Endpoint,
+				TLS:             *flags.TLSVerify,
+				TLSCACertPath:   *flags.TLSCacert,
+				TLSCertPath:     *flags.TLSCert,
+				TLSKeyPath:      *flags.TLSKey,
+				AuthorizedUsers: []portainer.UserID{},
+				AuthorizedTeams: []portainer.TeamID{},
+			}
+			err = store.EndpointService.CreateEndpoint(endpoint)
+			if err != nil {
+				log.Fatal(err)
+			}
+		} else {
+			log.Println("Instance already has defined endpoints. Skipping the endpoint defined via CLI.")
+		}
+	}
+
+	if *flags.AdminPassword != "" {
+		log.Printf("Creating admin user with password hash %s", *flags.AdminPassword)
+		user := &portainer.User{
+			Username: "admin",
+			Role:     portainer.AdministratorRole,
+			Password: *flags.AdminPassword,
+		}
+		err := store.UserService.CreateUser(user)
+		if err != nil {
+			log.Fatal(err)
+		}
+	}
+
+	var server portainer.Server = &http.Server{
+		Status:                 applicationStatus,
+		BindAddress:            *flags.Addr,
+		AssetsPath:             *flags.Assets,
+		AuthDisabled:           *flags.NoAuth,
+		EndpointManagement:     authorizeEndpointMgmt,
+		UserService:            store.UserService,
+		TeamService:            store.TeamService,
+		TeamMembershipService:  store.TeamMembershipService,
+		EndpointService:        store.EndpointService,
+		ResourceControlService: store.ResourceControlService,
+		SettingsService:        store.SettingsService,
+		RegistryService:        store.RegistryService,
+		DockerHubService:       store.DockerHubService,
+		CryptoService:          cryptoService,
+		JWTService:             jwtService,
+		FileService:            fileService,
+		SSL:                    *flags.SSL,
+		SSLCert:                *flags.SSLCert,
+		SSLKey:                 *flags.SSLKey,
+	}
+
+	log.Printf("Starting Portainer on %s", *flags.Addr)
+	err = server.Start()
+	if err != nil {
+		log.Fatal(err)
+	}
+}

api/cron/endpoint_sync.go

@@ -0,0 +1,174 @@
+package cron
+
+import (
+	"encoding/json"
+	"io/ioutil"
+	"log"
+	"os"
+	"strings"
+
+	"github.com/portainer/portainer"
+)
+
+type (
+	endpointSyncJob struct {
+		logger           *log.Logger
+		endpointService  portainer.EndpointService
+		endpointFilePath string
+	}
+
+	synchronization struct {
+		endpointsToCreate []*portainer.Endpoint
+		endpointsToUpdate []*portainer.Endpoint
+		endpointsToDelete []*portainer.Endpoint
+	}
+)
+
+const (
+	// ErrEmptyEndpointArray is an error raised when the external endpoint source array is empty.
+	ErrEmptyEndpointArray = portainer.Error("External endpoint source is empty")
+)
+
+func newEndpointSyncJob(endpointFilePath string, endpointService portainer.EndpointService) endpointSyncJob {
+	return endpointSyncJob{
+		logger:           log.New(os.Stderr, "", log.LstdFlags),
+		endpointService:  endpointService,
+		endpointFilePath: endpointFilePath,
+	}
+}
+
+func endpointSyncError(err error, logger *log.Logger) bool {
+	if err != nil {
+		logger.Printf("Endpoint synchronization error: %s", err)
+		return true
+	}
+	return false
+}
+
+func isValidEndpoint(endpoint *portainer.Endpoint) bool {
+	if endpoint.Name != "" && endpoint.URL != "" {
+		if !strings.HasPrefix(endpoint.URL, "unix://") && !strings.HasPrefix(endpoint.URL, "tcp://") {
+			return false
+		}
+		return true
+	}
+	return false
+}
+
+func endpointExists(endpoint *portainer.Endpoint, endpoints []portainer.Endpoint) int {
+	for idx, v := range endpoints {
+		if endpoint.Name == v.Name && isValidEndpoint(&v) {
+			return idx
+		}
+	}
+	return -1
+}
+
+func mergeEndpointIfRequired(original, updated *portainer.Endpoint) *portainer.Endpoint {
+	var endpoint *portainer.Endpoint
+	if original.URL != updated.URL || original.TLS != updated.TLS ||
+		(updated.TLS && original.TLSCACertPath != updated.TLSCACertPath) ||
+		(updated.TLS && original.TLSCertPath != updated.TLSCertPath) ||
+		(updated.TLS && original.TLSKeyPath != updated.TLSKeyPath) {
+		endpoint = original
+		endpoint.URL = updated.URL
+		if updated.TLS {
+			endpoint.TLS = true
+			endpoint.TLSCACertPath = updated.TLSCACertPath
+			endpoint.TLSCertPath = updated.TLSCertPath
+			endpoint.TLSKeyPath = updated.TLSKeyPath
+		} else {
+			endpoint.TLS = false
+			endpoint.TLSCACertPath = ""
+			endpoint.TLSCertPath = ""
+			endpoint.TLSKeyPath = ""
+		}
+	}
+	return endpoint
+}
+
+func (sync synchronization) requireSync() bool {
+	if len(sync.endpointsToCreate) != 0 || len(sync.endpointsToUpdate) != 0 || len(sync.endpointsToDelete) != 0 {
+		return true
+	}
+	return false
+}
+
+// TMP: endpointSyncJob method to access logger, should be generic
+func (job endpointSyncJob) prepareSyncData(storedEndpoints, fileEndpoints []portainer.Endpoint) *synchronization {
+	endpointsToCreate := make([]*portainer.Endpoint, 0)
+	endpointsToUpdate := make([]*portainer.Endpoint, 0)
+	endpointsToDelete := make([]*portainer.Endpoint, 0)
+
+	for idx := range storedEndpoints {
+		fidx := endpointExists(&storedEndpoints[idx], fileEndpoints)
+		if fidx != -1 {
+			endpoint := mergeEndpointIfRequired(&storedEndpoints[idx], &fileEndpoints[fidx])
+			if endpoint != nil {
+				job.logger.Printf("New definition for a stored endpoint found in file, updating database. [name: %v] [url: %v]\n", endpoint.Name, endpoint.URL)
+				endpointsToUpdate = append(endpointsToUpdate, endpoint)
+			} else {
+				job.logger.Printf("No change detected for a stored endpoint. [name: %v] [url: %v]\n", storedEndpoints[idx].Name, storedEndpoints[idx].URL)
+			}
+		} else {
+			job.logger.Printf("Stored endpoint not found in file (definition might be invalid), removing from database. [name: %v] [url: %v]", storedEndpoints[idx].Name, storedEndpoints[idx].URL)
+			endpointsToDelete = append(endpointsToDelete, &storedEndpoints[idx])
+		}
+	}
+
+	for idx, endpoint := range fileEndpoints {
+		if !isValidEndpoint(&endpoint) {
+			job.logger.Printf("Invalid file endpoint definition, skipping. [name: %v] [url: %v]", endpoint.Name, endpoint.URL)
+			continue
+		}
+		sidx := endpointExists(&fileEndpoints[idx], storedEndpoints)
+		if sidx == -1 {
+			job.logger.Printf("File endpoint not found in database, adding to database. [name: %v] [url: %v]", fileEndpoints[idx].Name, fileEndpoints[idx].URL)
+			endpointsToCreate = append(endpointsToCreate, &fileEndpoints[idx])
+		}
+	}
+
+	return &synchronization{
+		endpointsToCreate: endpointsToCreate,
+		endpointsToUpdate: endpointsToUpdate,
+		endpointsToDelete: endpointsToDelete,
+	}
+}
+
+func (job endpointSyncJob) Sync() error {
+	data, err := ioutil.ReadFile(job.endpointFilePath)
+	if endpointSyncError(err, job.logger) {
+		return err
+	}
+
+	var fileEndpoints []portainer.Endpoint
+	err = json.Unmarshal(data, &fileEndpoints)
+	if endpointSyncError(err, job.logger) {
+		return err
+	}
+
+	if len(fileEndpoints) == 0 {
+		return ErrEmptyEndpointArray
+	}
+
+	storedEndpoints, err := job.endpointService.Endpoints()
+	if endpointSyncError(err, job.logger) {
+		return err
+	}
+
+	sync := job.prepareSyncData(storedEndpoints, fileEndpoints)
+	if sync.requireSync() {
+		err = job.endpointService.Synchronize(sync.endpointsToCreate, sync.endpointsToUpdate, sync.endpointsToDelete)
+		if endpointSyncError(err, job.logger) {
+			return err
+		}
+		job.logger.Printf("Endpoint synchronization ended. [created: %v] [updated: %v] [deleted: %v]", len(sync.endpointsToCreate), len(sync.endpointsToUpdate), len(sync.endpointsToDelete))
+	}
+	return nil
+}
+
+func (job endpointSyncJob) Run() {
+	job.logger.Println("Endpoint synchronization job started.")
+	err := job.Sync()
+	endpointSyncError(err, job.logger)
+}

api/cron/watcher.go

@@ -0,0 +1,40 @@
+package cron
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/robfig/cron"
+)
+
+// Watcher represents a service for managing crons.
+type Watcher struct {
+	Cron            *cron.Cron
+	EndpointService portainer.EndpointService
+	syncInterval    string
+}
+
+// NewWatcher initializes a new service.
+func NewWatcher(endpointService portainer.EndpointService, syncInterval string) *Watcher {
+	return &Watcher{
+		Cron:            cron.New(),
+		EndpointService: endpointService,
+		syncInterval:    syncInterval,
+	}
+}
+
+// WatchEndpointFile starts a cron job to synchronize the endpoints from a file
+func (watcher *Watcher) WatchEndpointFile(endpointFilePath string) error {
+	job := newEndpointSyncJob(endpointFilePath, watcher.EndpointService)
+
+	err := job.Sync()
+	if err != nil {
+		return err
+	}
+
+	err = watcher.Cron.AddJob("@every "+watcher.syncInterval, job)
+	if err != nil {
+		return err
+	}
+
+	watcher.Cron.Start()
+	return nil
+}

api/crypto/crypto.go

@@ -0,0 +1,22 @@
+package crypto
+
+import (
+	"golang.org/x/crypto/bcrypt"
+)
+
+// Service represents a service for encrypting/hashing data.
+type Service struct{}
+
+// Hash hashes a string using the bcrypt algorithm
+func (*Service) Hash(data string) (string, error) {
+	hash, err := bcrypt.GenerateFromPassword([]byte(data), bcrypt.DefaultCost)
+	if err != nil {
+		return "", nil
+	}
+	return string(hash), nil
+}
+
+// CompareHashAndData compares a hash to clear data and returns an error if the comparison fails.
+func (*Service) CompareHashAndData(hash string, data string) error {
+	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(data))
+}

api/crypto/tls.go

@@ -0,0 +1,26 @@
+package crypto
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"io/ioutil"
+)
+
+// CreateTLSConfiguration initializes a tls.Config using a CA certificate, a certificate and a key
+func CreateTLSConfiguration(caCertPath, certPath, keyPath string) (*tls.Config, error) {
+	cert, err := tls.LoadX509KeyPair(certPath, keyPath)
+	if err != nil {
+		return nil, err
+	}
+	caCert, err := ioutil.ReadFile(caCertPath)
+	if err != nil {
+		return nil, err
+	}
+	caCertPool := x509.NewCertPool()
+	caCertPool.AppendCertsFromPEM(caCert)
+	config := &tls.Config{
+		Certificates: []tls.Certificate{cert},
+		RootCAs:      caCertPool,
+	}
+	return config, nil
+}

api/errors.go

@@ -0,0 +1,87 @@
+package portainer
+
+// General errors.
+const (
+	ErrUnauthorized           = Error("Unauthorized")
+	ErrResourceAccessDenied   = Error("Access denied to resource")
+	ErrResourceNotFound       = Error("Unable to find resource")
+	ErrUnsupportedDockerAPI   = Error("Unsupported Docker API response")
+	ErrMissingSecurityContext = Error("Unable to find security details in request context")
+)
+
+// User errors.
+const (
+	ErrUserNotFound            = Error("User not found")
+	ErrUserAlreadyExists       = Error("User already exists")
+	ErrInvalidUsername         = Error("Invalid username. White spaces are not allowed.")
+	ErrAdminAlreadyInitialized = Error("Admin user already initialized")
+)
+
+// Team errors.
+const (
+	ErrTeamNotFound      = Error("Team not found")
+	ErrTeamAlreadyExists = Error("Team already exists")
+)
+
+// TeamMembership errors.
+const (
+	ErrTeamMembershipNotFound      = Error("Team membership not found")
+	ErrTeamMembershipAlreadyExists = Error("Team membership already exists for this user and team.")
+)
+
+// ResourceControl errors.
+const (
+	ErrResourceControlNotFound      = Error("Resource control not found")
+	ErrResourceControlAlreadyExists = Error("A resource control is already applied on this resource")
+	ErrInvalidResourceControlType   = Error("Unsupported resource control type")
+)
+
+// Endpoint errors.
+const (
+	ErrEndpointNotFound     = Error("Endpoint not found")
+	ErrEndpointAccessDenied = Error("Access denied to endpoint")
+)
+
+// Registry errors.
+const (
+	ErrRegistryNotFound      = Error("Registry not found")
+	ErrRegistryAlreadyExists = Error("A registry is already defined for this URL")
+)
+
+// Version errors.
+const (
+	ErrDBVersionNotFound = Error("DB version not found")
+)
+
+// Settings errors.
+const (
+	ErrSettingsNotFound = Error("Settings not found")
+)
+
+// DockerHub errors.
+const (
+	ErrDockerHubNotFound = Error("Dockerhub not found")
+)
+
+// Crypto errors.
+const (
+	ErrCryptoHashFailure = Error("Unable to hash data")
+)
+
+// JWT errors.
+const (
+	ErrSecretGeneration   = Error("Unable to generate secret key")
+	ErrInvalidJWTToken    = Error("Invalid JWT token")
+	ErrMissingContextData = Error("Unable to find JWT data in request context")
+)
+
+// File errors.
+const (
+	ErrUndefinedTLSFileType = Error("Undefined TLS file type")
+)
+
+// Error represents an application error.
+type Error string
+
+// Error returns the error message.
+func (e Error) Error() string { return string(e) }

api/file/file.go

@@ -0,0 +1,143 @@
+package file
+
+import (
+	"github.com/portainer/portainer"
+
+	"io"
+	"os"
+	"path"
+	"strconv"
+)
+
+const (
+	// TLSStorePath represents the subfolder where TLS files are stored in the file store folder.
+	TLSStorePath = "tls"
+	// TLSCACertFile represents the name on disk for a TLS CA file.
+	TLSCACertFile = "ca.pem"
+	// TLSCertFile represents the name on disk for a TLS certificate file.
+	TLSCertFile = "cert.pem"
+	// TLSKeyFile represents the name on disk for a TLS key file.
+	TLSKeyFile = "key.pem"
+)
+
+// Service represents a service for managing files and directories.
+type Service struct {
+	dataStorePath string
+	fileStorePath string
+}
+
+// NewService initializes a new service. It creates a data directory and a directory to store files
+// inside this directory if they don't exist.
+func NewService(dataStorePath, fileStorePath string) (*Service, error) {
+	service := &Service{
+		dataStorePath: dataStorePath,
+		fileStorePath: path.Join(dataStorePath, fileStorePath),
+	}
+
+	// Checking if a mount directory exists is broken with Go on Windows.
+	// This will need to be reviewed after the issue has been fixed in Go.
+	// See: https://github.com/portainer/portainer/issues/474
+	// err := createDirectoryIfNotExist(dataStorePath, 0755)
+	// if err != nil {
+	// 	return nil, err
+	// }
+
+	err := service.createDirectoryInStoreIfNotExist(TLSStorePath)
+	if err != nil {
+		return nil, err
+	}
+
+	return service, nil
+}
+
+// StoreTLSFile creates a subfolder in the TLSStorePath and stores a new file with the content from r.
+func (service *Service) StoreTLSFile(endpointID portainer.EndpointID, fileType portainer.TLSFileType, r io.Reader) error {
+	ID := strconv.Itoa(int(endpointID))
+	endpointStorePath := path.Join(TLSStorePath, ID)
+	err := service.createDirectoryInStoreIfNotExist(endpointStorePath)
+	if err != nil {
+		return err
+	}
+
+	var fileName string
+	switch fileType {
+	case portainer.TLSFileCA:
+		fileName = TLSCACertFile
+	case portainer.TLSFileCert:
+		fileName = TLSCertFile
+	case portainer.TLSFileKey:
+		fileName = TLSKeyFile
+	default:
+		return portainer.ErrUndefinedTLSFileType
+	}
+
+	tlsFilePath := path.Join(endpointStorePath, fileName)
+	err = service.createFileInStore(tlsFilePath, r)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// GetPathForTLSFile returns the absolute path to a specific TLS file for an endpoint.
+func (service *Service) GetPathForTLSFile(endpointID portainer.EndpointID, fileType portainer.TLSFileType) (string, error) {
+	var fileName string
+	switch fileType {
+	case portainer.TLSFileCA:
+		fileName = TLSCACertFile
+	case portainer.TLSFileCert:
+		fileName = TLSCertFile
+	case portainer.TLSFileKey:
+		fileName = TLSKeyFile
+	default:
+		return "", portainer.ErrUndefinedTLSFileType
+	}
+	ID := strconv.Itoa(int(endpointID))
+	return path.Join(service.fileStorePath, TLSStorePath, ID, fileName), nil
+}
+
+// DeleteTLSFiles deletes a folder containing the TLS files for an endpoint.
+func (service *Service) DeleteTLSFiles(endpointID portainer.EndpointID) error {
+	ID := strconv.Itoa(int(endpointID))
+	endpointPath := path.Join(service.fileStorePath, TLSStorePath, ID)
+	err := os.RemoveAll(endpointPath)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// createDirectoryInStoreIfNotExist creates a new directory in the file store if it doesn't exists on the file system.
+func (service *Service) createDirectoryInStoreIfNotExist(name string) error {
+	path := path.Join(service.fileStorePath, name)
+	return createDirectoryIfNotExist(path, 0700)
+}
+
+// createDirectoryIfNotExist creates a directory if it doesn't exists on the file system.
+func createDirectoryIfNotExist(path string, mode uint32) error {
+	_, err := os.Stat(path)
+	if os.IsNotExist(err) {
+		err = os.Mkdir(path, os.FileMode(mode))
+		if err != nil {
+			return err
+		}
+	} else if err != nil {
+		return err
+	}
+	return nil
+}
+
+// createFile creates a new file in the file store with the content from r.
+func (service *Service) createFileInStore(filePath string, r io.Reader) error {
+	path := path.Join(service.fileStorePath, filePath)
+	out, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
+	if err != nil {
+		return err
+	}
+	defer out.Close()
+	_, err = io.Copy(out, r)
+	if err != nil {
+		return err
+	}
+	return nil
+}

api/http/error/error.go

@@ -0,0 +1,30 @@
+package error
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"strings"
+)
+
+// errorResponse is a generic response for sending a error.
+type errorResponse struct {
+	Err string `json:"err,omitempty"`
+}
+
+// WriteErrorResponse writes an error message to the response and logger.
+func WriteErrorResponse(w http.ResponseWriter, err error, code int, logger *log.Logger) {
+	if logger != nil {
+		logger.Printf("http error: %s (code=%d)", err, code)
+	}
+
+	w.WriteHeader(code)
+	json.NewEncoder(w).Encode(&errorResponse{Err: err.Error()})
+}
+
+// WriteMethodNotAllowedResponse writes an error message to the response and sets the Allow header.
+func WriteMethodNotAllowedResponse(w http.ResponseWriter, allowedMethods []string) {
+	w.Header().Set("Allow", strings.Join(allowedMethods, ", "))
+	w.WriteHeader(http.StatusMethodNotAllowed)
+	json.NewEncoder(w).Encode(&errorResponse{Err: http.StatusText(http.StatusMethodNotAllowed)})
+}

api/http/handler/auth.go

@@ -0,0 +1,112 @@
+package handler
+
+import (
+	"github.com/portainer/portainer"
+
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/mux"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+)
+
+// AuthHandler represents an HTTP API handler for managing authentication.
+type AuthHandler struct {
+	*mux.Router
+	Logger        *log.Logger
+	authDisabled  bool
+	UserService   portainer.UserService
+	CryptoService portainer.CryptoService
+	JWTService    portainer.JWTService
+}
+
+const (
+	// ErrInvalidCredentialsFormat is an error raised when credentials format is not valid
+	ErrInvalidCredentialsFormat = portainer.Error("Invalid credentials format")
+	// ErrInvalidCredentials is an error raised when credentials for a user are invalid
+	ErrInvalidCredentials = portainer.Error("Invalid credentials")
+	// ErrAuthDisabled is an error raised when trying to access the authentication endpoints
+	// when the server has been started with the --no-auth flag
+	ErrAuthDisabled = portainer.Error("Authentication is disabled")
+)
+
+// NewAuthHandler returns a new instance of AuthHandler.
+func NewAuthHandler(bouncer *security.RequestBouncer, authDisabled bool) *AuthHandler {
+	h := &AuthHandler{
+		Router:       mux.NewRouter(),
+		Logger:       log.New(os.Stderr, "", log.LstdFlags),
+		authDisabled: authDisabled,
+	}
+	h.Handle("/auth",
+		bouncer.PublicAccess(http.HandlerFunc(h.handlePostAuth)))
+
+	return h
+}
+
+func (handler *AuthHandler) handlePostAuth(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodPost})
+		return
+	}
+
+	if handler.authDisabled {
+		httperror.WriteErrorResponse(w, ErrAuthDisabled, http.StatusServiceUnavailable, handler.Logger)
+		return
+	}
+
+	var req postAuthRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidCredentialsFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var username = req.Username
+	var password = req.Password
+
+	u, err := handler.UserService.UserByUsername(username)
+	if err == portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, ErrInvalidCredentials, http.StatusBadRequest, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.CryptoService.CompareHashAndData(u.Password, password)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidCredentials, http.StatusUnprocessableEntity, handler.Logger)
+		return
+	}
+
+	tokenData := &portainer.TokenData{
+		ID:       u.ID,
+		Username: u.Username,
+		Role:     u.Role,
+	}
+	token, err := handler.JWTService.GenerateToken(tokenData)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &postAuthResponse{JWT: token}, handler.Logger)
+}
+
+type postAuthRequest struct {
+	Username string `valid:"required"`
+	Password string `valid:"required"`
+}
+
+type postAuthResponse struct {
+	JWT string `json:"jwt"`
+}

api/http/handler/docker.go

@@ -0,0 +1,94 @@
+package handler
+
+import (
+	"strconv"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/proxy"
+	"github.com/portainer/portainer/http/security"
+
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+)
+
+// DockerHandler represents an HTTP API handler for proxying requests to the Docker API.
+type DockerHandler struct {
+	*mux.Router
+	Logger                *log.Logger
+	EndpointService       portainer.EndpointService
+	TeamMembershipService portainer.TeamMembershipService
+	ProxyManager          *proxy.Manager
+}
+
+// NewDockerHandler returns a new instance of DockerHandler.
+func NewDockerHandler(bouncer *security.RequestBouncer) *DockerHandler {
+	h := &DockerHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.PathPrefix("/{id}/").Handler(
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.proxyRequestsToDockerAPI)))
+	return h
+}
+
+func (handler *DockerHandler) checkEndpointAccessControl(endpoint *portainer.Endpoint, userID portainer.UserID) bool {
+	for _, authorizedUserID := range endpoint.AuthorizedUsers {
+		if authorizedUserID == userID {
+			return true
+		}
+	}
+
+	memberships, _ := handler.TeamMembershipService.TeamMembershipsByUserID(userID)
+	for _, authorizedTeamID := range endpoint.AuthorizedTeams {
+		for _, membership := range memberships {
+			if membership.TeamID == authorizedTeamID {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func (handler *DockerHandler) proxyRequestsToDockerAPI(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	parsedID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpointID := portainer.EndpointID(parsedID)
+	endpoint, err := handler.EndpointService.Endpoint(endpointID)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if tokenData.Role != portainer.AdministratorRole && !handler.checkEndpointAccessControl(endpoint, tokenData.ID) {
+		httperror.WriteErrorResponse(w, portainer.ErrEndpointAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	var proxy http.Handler
+	proxy = handler.ProxyManager.GetProxy(string(endpointID))
+	if proxy == nil {
+		proxy, err = handler.ProxyManager.CreateAndRegisterProxy(endpoint)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+			return
+		}
+	}
+
+	http.StripPrefix("/"+id, proxy).ServeHTTP(w, r)
+}

api/http/handler/dockerhub.go

@@ -0,0 +1,87 @@
+package handler
+
+import (
+	"encoding/json"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+)
+
+// DockerHubHandler represents an HTTP API handler for managing DockerHub.
+type DockerHubHandler struct {
+	*mux.Router
+	Logger           *log.Logger
+	DockerHubService portainer.DockerHubService
+}
+
+// NewDockerHubHandler returns a new instance of OldDockerHubHandler.
+func NewDockerHubHandler(bouncer *security.RequestBouncer) *DockerHubHandler {
+	h := &DockerHubHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/dockerhub",
+		bouncer.PublicAccess(http.HandlerFunc(h.handleGetDockerHub))).Methods(http.MethodGet)
+	h.Handle("/dockerhub",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutDockerHub))).Methods(http.MethodPut)
+
+	return h
+}
+
+// handleGetDockerHub handles GET requests on /dockerhub
+func (handler *DockerHubHandler) handleGetDockerHub(w http.ResponseWriter, r *http.Request) {
+	dockerhub, err := handler.DockerHubService.DockerHub()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, dockerhub, handler.Logger)
+	return
+}
+
+// handlePutDockerHub handles PUT requests on /dockerhub
+func (handler *DockerHubHandler) handlePutDockerHub(w http.ResponseWriter, r *http.Request) {
+	var req putDockerHubRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	dockerhub := &portainer.DockerHub{
+		Authentication: false,
+		Username:       "",
+		Password:       "",
+	}
+
+	if req.Authentication {
+		dockerhub.Authentication = true
+		dockerhub.Username = req.Username
+		dockerhub.Password = req.Password
+	}
+
+	err = handler.DockerHubService.StoreDockerHub(dockerhub)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+	}
+}
+
+type putDockerHubRequest struct {
+	Authentication bool   `valid:""`
+	Username       string `valid:""`
+	Password       string `valid:""`
+}

api/http/handler/endpoint.go

@@ -0,0 +1,356 @@
+package handler
+
+import (
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/proxy"
+	"github.com/portainer/portainer/http/security"
+
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+	"strconv"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/mux"
+)
+
+// EndpointHandler represents an HTTP API handler for managing Docker endpoints.
+type EndpointHandler struct {
+	*mux.Router
+	Logger                      *log.Logger
+	authorizeEndpointManagement bool
+	EndpointService             portainer.EndpointService
+	FileService                 portainer.FileService
+	ProxyManager                *proxy.Manager
+}
+
+const (
+	// ErrEndpointManagementDisabled is an error raised when trying to access the endpoints management endpoints
+	// when the server has been started with the --external-endpoints flag
+	ErrEndpointManagementDisabled = portainer.Error("Endpoint management is disabled")
+)
+
+// NewEndpointHandler returns a new instance of EndpointHandler.
+func NewEndpointHandler(bouncer *security.RequestBouncer, authorizeEndpointManagement bool) *EndpointHandler {
+	h := &EndpointHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+		authorizeEndpointManagement: authorizeEndpointManagement,
+	}
+	h.Handle("/endpoints",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePostEndpoints))).Methods(http.MethodPost)
+	h.Handle("/endpoints",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetEndpoints))).Methods(http.MethodGet)
+	h.Handle("/endpoints/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleGetEndpoint))).Methods(http.MethodGet)
+	h.Handle("/endpoints/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutEndpoint))).Methods(http.MethodPut)
+	h.Handle("/endpoints/{id}/access",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutEndpointAccess))).Methods(http.MethodPut)
+	h.Handle("/endpoints/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleDeleteEndpoint))).Methods(http.MethodDelete)
+
+	return h
+}
+
+// handleGetEndpoints handles GET requests on /endpoints
+func (handler *EndpointHandler) handleGetEndpoints(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	endpoints, err := handler.EndpointService.Endpoints()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	filteredEndpoints, err := security.FilterEndpoints(endpoints, securityContext)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, filteredEndpoints, handler.Logger)
+}
+
+// handlePostEndpoints handles POST requests on /endpoints
+func (handler *EndpointHandler) handlePostEndpoints(w http.ResponseWriter, r *http.Request) {
+	if !handler.authorizeEndpointManagement {
+		httperror.WriteErrorResponse(w, ErrEndpointManagementDisabled, http.StatusServiceUnavailable, handler.Logger)
+		return
+	}
+
+	var req postEndpointsRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpoint := &portainer.Endpoint{
+		Name:            req.Name,
+		URL:             req.URL,
+		PublicURL:       req.PublicURL,
+		TLS:             req.TLS,
+		AuthorizedUsers: []portainer.UserID{},
+		AuthorizedTeams: []portainer.TeamID{},
+	}
+
+	err = handler.EndpointService.CreateEndpoint(endpoint)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if req.TLS {
+		caCertPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCA)
+		endpoint.TLSCACertPath = caCertPath
+		certPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCert)
+		endpoint.TLSCertPath = certPath
+		keyPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileKey)
+		endpoint.TLSKeyPath = keyPath
+		err = handler.EndpointService.UpdateEndpoint(endpoint.ID, endpoint)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+			return
+		}
+	}
+
+	encodeJSON(w, &postEndpointsResponse{ID: int(endpoint.ID)}, handler.Logger)
+}
+
+type postEndpointsRequest struct {
+	Name      string `valid:"required"`
+	URL       string `valid:"required"`
+	PublicURL string `valid:"-"`
+	TLS       bool
+}
+
+type postEndpointsResponse struct {
+	ID int `json:"Id"`
+}
+
+// handleGetEndpoint handles GET requests on /endpoints/:id
+func (handler *EndpointHandler) handleGetEndpoint(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	endpointID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
+	if err == portainer.ErrEndpointNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, endpoint, handler.Logger)
+}
+
+// handlePutEndpointAccess handles PUT requests on /endpoints/:id/access
+func (handler *EndpointHandler) handlePutEndpointAccess(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	endpointID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putEndpointAccessRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
+	if err == portainer.ErrEndpointNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if req.AuthorizedUsers != nil {
+		authorizedUserIDs := []portainer.UserID{}
+		for _, value := range req.AuthorizedUsers {
+			authorizedUserIDs = append(authorizedUserIDs, portainer.UserID(value))
+		}
+		endpoint.AuthorizedUsers = authorizedUserIDs
+	}
+
+	if req.AuthorizedTeams != nil {
+		authorizedTeamIDs := []portainer.TeamID{}
+		for _, value := range req.AuthorizedTeams {
+			authorizedTeamIDs = append(authorizedTeamIDs, portainer.TeamID(value))
+		}
+		endpoint.AuthorizedTeams = authorizedTeamIDs
+	}
+
+	err = handler.EndpointService.UpdateEndpoint(endpoint.ID, endpoint)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+type putEndpointAccessRequest struct {
+	AuthorizedUsers []int `valid:"-"`
+	AuthorizedTeams []int `valid:"-"`
+}
+
+// handlePutEndpoint handles PUT requests on /endpoints/:id
+func (handler *EndpointHandler) handlePutEndpoint(w http.ResponseWriter, r *http.Request) {
+	if !handler.authorizeEndpointManagement {
+		httperror.WriteErrorResponse(w, ErrEndpointManagementDisabled, http.StatusServiceUnavailable, handler.Logger)
+		return
+	}
+
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	endpointID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putEndpointsRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
+	if err == portainer.ErrEndpointNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if req.Name != "" {
+		endpoint.Name = req.Name
+	}
+
+	if req.URL != "" {
+		endpoint.URL = req.URL
+	}
+
+	if req.PublicURL != "" {
+		endpoint.PublicURL = req.PublicURL
+	}
+
+	if req.TLS {
+		endpoint.TLS = true
+		caCertPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCA)
+		endpoint.TLSCACertPath = caCertPath
+		certPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileCert)
+		endpoint.TLSCertPath = certPath
+		keyPath, _ := handler.FileService.GetPathForTLSFile(endpoint.ID, portainer.TLSFileKey)
+		endpoint.TLSKeyPath = keyPath
+	} else {
+		endpoint.TLS = false
+		endpoint.TLSCACertPath = ""
+		endpoint.TLSCertPath = ""
+		endpoint.TLSKeyPath = ""
+		err = handler.FileService.DeleteTLSFiles(endpoint.ID)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+			return
+		}
+	}
+
+	_, err = handler.ProxyManager.CreateAndRegisterProxy(endpoint)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.EndpointService.UpdateEndpoint(endpoint.ID, endpoint)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+type putEndpointsRequest struct {
+	Name      string `valid:"-"`
+	URL       string `valid:"-"`
+	PublicURL string `valid:"-"`
+	TLS       bool   `valid:"-"`
+}
+
+// handleDeleteEndpoint handles DELETE requests on /endpoints/:id
+func (handler *EndpointHandler) handleDeleteEndpoint(w http.ResponseWriter, r *http.Request) {
+	if !handler.authorizeEndpointManagement {
+		httperror.WriteErrorResponse(w, ErrEndpointManagementDisabled, http.StatusServiceUnavailable, handler.Logger)
+		return
+	}
+
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	endpointID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	endpoint, err := handler.EndpointService.Endpoint(portainer.EndpointID(endpointID))
+
+	if err == portainer.ErrEndpointNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	handler.ProxyManager.DeleteProxy(string(endpointID))
+
+	err = handler.EndpointService.DeleteEndpoint(portainer.EndpointID(endpointID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if endpoint.TLS {
+		err = handler.FileService.DeleteTLSFiles(portainer.EndpointID(endpointID))
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+			return
+		}
+	}
+}

api/http/handler/file.go

@@ -0,0 +1,61 @@
+package handler
+
+import (
+	"os"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+
+	"log"
+	"net/http"
+	"path"
+	"strings"
+)
+
+// FileHandler represents an HTTP API handler for managing static files.
+type FileHandler struct {
+	http.Handler
+	Logger             *log.Logger
+	allowedDirectories map[string]bool
+}
+
+// NewFileHandler returns a new instance of FileHandler.
+func NewFileHandler(assetPath string) *FileHandler {
+	h := &FileHandler{
+		Handler: http.FileServer(http.Dir(assetPath)),
+		Logger:  log.New(os.Stderr, "", log.LstdFlags),
+		allowedDirectories: map[string]bool{
+			"/":       true,
+			"/css":    true,
+			"/js":     true,
+			"/images": true,
+			"/fonts":  true,
+		},
+	}
+	return h
+}
+
+func isHTML(acceptContent []string) bool {
+	for _, accept := range acceptContent {
+		if strings.Contains(accept, "text/html") {
+			return true
+		}
+	}
+	return false
+}
+
+func (handler *FileHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	requestDirectory := path.Dir(r.URL.Path)
+	if !handler.allowedDirectories[requestDirectory] {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceNotFound, http.StatusNotFound, handler.Logger)
+		return
+	}
+
+	if !isHTML(r.Header["Accept"]) {
+		w.Header().Set("Cache-Control", "max-age=31536000")
+	} else {
+		w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
+	}
+
+	handler.Handler.ServeHTTP(w, r)
+}

api/http/handler/handler.go

@@ -0,0 +1,83 @@
+package handler
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"strings"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+)
+
+// Handler is a collection of all the service handlers.
+type Handler struct {
+	AuthHandler           *AuthHandler
+	UserHandler           *UserHandler
+	TeamHandler           *TeamHandler
+	TeamMembershipHandler *TeamMembershipHandler
+	EndpointHandler       *EndpointHandler
+	RegistryHandler       *RegistryHandler
+	DockerHubHandler      *DockerHubHandler
+	ResourceHandler       *ResourceHandler
+	StatusHandler         *StatusHandler
+	SettingsHandler       *SettingsHandler
+	TemplatesHandler      *TemplatesHandler
+	DockerHandler         *DockerHandler
+	WebSocketHandler      *WebSocketHandler
+	UploadHandler         *UploadHandler
+	FileHandler           *FileHandler
+}
+
+const (
+	// ErrInvalidJSON defines an error raised the app is unable to parse request data
+	ErrInvalidJSON = portainer.Error("Invalid JSON")
+	// ErrInvalidRequestFormat defines an error raised when the format of the data sent in a request is not valid
+	ErrInvalidRequestFormat = portainer.Error("Invalid request data format")
+	// ErrInvalidQueryFormat defines an error raised when the data sent in the query or the URL is invalid
+	ErrInvalidQueryFormat = portainer.Error("Invalid query format")
+	// ErrEmptyResponseBody defines an error raised when portainer excepts to parse the body of a HTTP response and there is nothing to parse
+	// ErrEmptyResponseBody = portainer.Error("Empty response body")
+)
+
+// ServeHTTP delegates a request to the appropriate subhandler.
+func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if strings.HasPrefix(r.URL.Path, "/api/auth") {
+		http.StripPrefix("/api", h.AuthHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/api/users") {
+		http.StripPrefix("/api", h.UserHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/api/teams") {
+		http.StripPrefix("/api", h.TeamHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/api/team_memberships") {
+		http.StripPrefix("/api", h.TeamMembershipHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/api/endpoints") {
+		http.StripPrefix("/api", h.EndpointHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/api/registries") {
+		http.StripPrefix("/api", h.RegistryHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/api/dockerhub") {
+		http.StripPrefix("/api", h.DockerHubHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/api/resource_controls") {
+		http.StripPrefix("/api", h.ResourceHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/api/settings") {
+		http.StripPrefix("/api", h.SettingsHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/api/status") {
+		http.StripPrefix("/api", h.StatusHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/api/templates") {
+		http.StripPrefix("/api", h.TemplatesHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/api/upload") {
+		http.StripPrefix("/api", h.UploadHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/api/websocket") {
+		http.StripPrefix("/api", h.WebSocketHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/api/docker") {
+		http.StripPrefix("/api/docker", h.DockerHandler).ServeHTTP(w, r)
+	} else if strings.HasPrefix(r.URL.Path, "/") {
+		h.FileHandler.ServeHTTP(w, r)
+	}
+}
+
+// encodeJSON encodes v to w in JSON format. Error() is called if encoding fails.
+func encodeJSON(w http.ResponseWriter, v interface{}, logger *log.Logger) {
+	if err := json.NewEncoder(w).Encode(v); err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, logger)
+	}
+}

api/http/handler/registry.go

@@ -0,0 +1,312 @@
+package handler
+
+import (
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+	"strconv"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/mux"
+)
+
+// RegistryHandler represents an HTTP API handler for managing Docker registries.
+type RegistryHandler struct {
+	*mux.Router
+	Logger          *log.Logger
+	RegistryService portainer.RegistryService
+}
+
+// NewRegistryHandler returns a new instance of RegistryHandler.
+func NewRegistryHandler(bouncer *security.RequestBouncer) *RegistryHandler {
+	h := &RegistryHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/registries",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePostRegistries))).Methods(http.MethodPost)
+	h.Handle("/registries",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetRegistries))).Methods(http.MethodGet)
+	h.Handle("/registries/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleGetRegistry))).Methods(http.MethodGet)
+	h.Handle("/registries/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutRegistry))).Methods(http.MethodPut)
+	h.Handle("/registries/{id}/access",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutRegistryAccess))).Methods(http.MethodPut)
+	h.Handle("/registries/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleDeleteRegistry))).Methods(http.MethodDelete)
+
+	return h
+}
+
+// handleGetRegistries handles GET requests on /registries
+func (handler *RegistryHandler) handleGetRegistries(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	registries, err := handler.RegistryService.Registries()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	filteredRegistries, err := security.FilterRegistries(registries, securityContext)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, filteredRegistries, handler.Logger)
+}
+
+// handlePostRegistries handles POST requests on /registries
+func (handler *RegistryHandler) handlePostRegistries(w http.ResponseWriter, r *http.Request) {
+	var req postRegistriesRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	registries, err := handler.RegistryService.Registries()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	for _, r := range registries {
+		if r.URL == req.URL {
+			httperror.WriteErrorResponse(w, portainer.ErrRegistryAlreadyExists, http.StatusConflict, handler.Logger)
+			return
+		}
+	}
+
+	registry := &portainer.Registry{
+		Name:            req.Name,
+		URL:             req.URL,
+		Authentication:  req.Authentication,
+		Username:        req.Username,
+		Password:        req.Password,
+		AuthorizedUsers: []portainer.UserID{},
+		AuthorizedTeams: []portainer.TeamID{},
+	}
+
+	err = handler.RegistryService.CreateRegistry(registry)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &postRegistriesResponse{ID: int(registry.ID)}, handler.Logger)
+}
+
+type postRegistriesRequest struct {
+	Name           string `valid:"required"`
+	URL            string `valid:"required"`
+	Authentication bool   `valid:""`
+	Username       string `valid:""`
+	Password       string `valid:""`
+}
+
+type postRegistriesResponse struct {
+	ID int `json:"Id"`
+}
+
+// handleGetRegistry handles GET requests on /registries/:id
+func (handler *RegistryHandler) handleGetRegistry(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	registryID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	registry, err := handler.RegistryService.Registry(portainer.RegistryID(registryID))
+	if err == portainer.ErrRegistryNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, registry, handler.Logger)
+}
+
+// handlePutRegistryAccess handles PUT requests on /registries/:id/access
+func (handler *RegistryHandler) handlePutRegistryAccess(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	registryID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putRegistryAccessRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	registry, err := handler.RegistryService.Registry(portainer.RegistryID(registryID))
+	if err == portainer.ErrRegistryNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if req.AuthorizedUsers != nil {
+		authorizedUserIDs := []portainer.UserID{}
+		for _, value := range req.AuthorizedUsers {
+			authorizedUserIDs = append(authorizedUserIDs, portainer.UserID(value))
+		}
+		registry.AuthorizedUsers = authorizedUserIDs
+	}
+
+	if req.AuthorizedTeams != nil {
+		authorizedTeamIDs := []portainer.TeamID{}
+		for _, value := range req.AuthorizedTeams {
+			authorizedTeamIDs = append(authorizedTeamIDs, portainer.TeamID(value))
+		}
+		registry.AuthorizedTeams = authorizedTeamIDs
+	}
+
+	err = handler.RegistryService.UpdateRegistry(registry.ID, registry)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+type putRegistryAccessRequest struct {
+	AuthorizedUsers []int `valid:"-"`
+	AuthorizedTeams []int `valid:"-"`
+}
+
+// handlePutRegistry handles PUT requests on /registries/:id
+func (handler *RegistryHandler) handlePutRegistry(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	registryID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putRegistriesRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	registry, err := handler.RegistryService.Registry(portainer.RegistryID(registryID))
+	if err == portainer.ErrRegistryNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	registries, err := handler.RegistryService.Registries()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	for _, r := range registries {
+		if r.URL == req.URL && r.ID != registry.ID {
+			httperror.WriteErrorResponse(w, portainer.ErrRegistryAlreadyExists, http.StatusConflict, handler.Logger)
+			return
+		}
+	}
+
+	if req.Name != "" {
+		registry.Name = req.Name
+	}
+
+	if req.URL != "" {
+		registry.URL = req.URL
+	}
+
+	if req.Authentication {
+		registry.Authentication = true
+		registry.Username = req.Username
+		registry.Password = req.Password
+	} else {
+		registry.Authentication = false
+		registry.Username = ""
+		registry.Password = ""
+	}
+
+	err = handler.RegistryService.UpdateRegistry(registry.ID, registry)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+type putRegistriesRequest struct {
+	Name           string `valid:"required"`
+	URL            string `valid:"required"`
+	Authentication bool   `valid:""`
+	Username       string `valid:""`
+	Password       string `valid:""`
+}
+
+// handleDeleteRegistry handles DELETE requests on /registries/:id
+func (handler *RegistryHandler) handleDeleteRegistry(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	registryID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = handler.RegistryService.Registry(portainer.RegistryID(registryID))
+	if err == portainer.ErrRegistryNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.RegistryService.DeleteRegistry(portainer.RegistryID(registryID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}

api/http/handler/resource_control.go

@@ -0,0 +1,256 @@
+package handler
+
+import (
+	"encoding/json"
+	"strconv"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+)
+
+// ResourceHandler represents an HTTP API handler for managing resource controls.
+type ResourceHandler struct {
+	*mux.Router
+	Logger                 *log.Logger
+	ResourceControlService portainer.ResourceControlService
+}
+
+// NewResourceHandler returns a new instance of ResourceHandler.
+func NewResourceHandler(bouncer *security.RequestBouncer) *ResourceHandler {
+	h := &ResourceHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/resource_controls",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePostResources))).Methods(http.MethodPost)
+	h.Handle("/resource_controls/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePutResources))).Methods(http.MethodPut)
+	h.Handle("/resource_controls/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleDeleteResources))).Methods(http.MethodDelete)
+
+	return h
+}
+
+// handlePostResources handles POST requests on /resources
+func (handler *ResourceHandler) handlePostResources(w http.ResponseWriter, r *http.Request) {
+	var req postResourcesRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var resourceControlType portainer.ResourceControlType
+	switch req.Type {
+	case "container":
+		resourceControlType = portainer.ContainerResourceControl
+	case "service":
+		resourceControlType = portainer.ServiceResourceControl
+	case "volume":
+		resourceControlType = portainer.VolumeResourceControl
+	default:
+		httperror.WriteErrorResponse(w, portainer.ErrInvalidResourceControlType, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	if len(req.Users) == 0 && len(req.Teams) == 0 && !req.AdministratorsOnly {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	rc, err := handler.ResourceControlService.ResourceControlByResourceID(req.ResourceID)
+	if err != nil && err != portainer.ErrResourceControlNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if rc != nil {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceControlAlreadyExists, http.StatusConflict, handler.Logger)
+		return
+	}
+
+	var userAccesses = make([]portainer.UserResourceAccess, 0)
+	for _, v := range req.Users {
+		userAccess := portainer.UserResourceAccess{
+			UserID:      portainer.UserID(v),
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+		userAccesses = append(userAccesses, userAccess)
+	}
+
+	var teamAccesses = make([]portainer.TeamResourceAccess, 0)
+	for _, v := range req.Teams {
+		teamAccess := portainer.TeamResourceAccess{
+			TeamID:      portainer.TeamID(v),
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+		teamAccesses = append(teamAccesses, teamAccess)
+	}
+
+	resourceControl := portainer.ResourceControl{
+		ResourceID:         req.ResourceID,
+		SubResourceIDs:     req.SubResourceIDs,
+		Type:               resourceControlType,
+		AdministratorsOnly: req.AdministratorsOnly,
+		UserAccesses:       userAccesses,
+		TeamAccesses:       teamAccesses,
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedResourceControlCreation(&resourceControl, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	err = handler.ResourceControlService.CreateResourceControl(&resourceControl)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	return
+}
+
+type postResourcesRequest struct {
+	ResourceID         string   `valid:"required"`
+	Type               string   `valid:"required"`
+	AdministratorsOnly bool     `valid:"-"`
+	Users              []int    `valid:"-"`
+	Teams              []int    `valid:"-"`
+	SubResourceIDs     []string `valid:"-"`
+}
+
+// handlePutResources handles PUT requests on /resources/:id
+func (handler *ResourceHandler) handlePutResources(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	resourceControlID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putResourcesRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	resourceControl, err := handler.ResourceControlService.ResourceControl(portainer.ResourceControlID(resourceControlID))
+
+	if err == portainer.ErrResourceControlNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	resourceControl.AdministratorsOnly = req.AdministratorsOnly
+
+	var userAccesses = make([]portainer.UserResourceAccess, 0)
+	for _, v := range req.Users {
+		userAccess := portainer.UserResourceAccess{
+			UserID:      portainer.UserID(v),
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+		userAccesses = append(userAccesses, userAccess)
+	}
+	resourceControl.UserAccesses = userAccesses
+
+	var teamAccesses = make([]portainer.TeamResourceAccess, 0)
+	for _, v := range req.Teams {
+		teamAccess := portainer.TeamResourceAccess{
+			TeamID:      portainer.TeamID(v),
+			AccessLevel: portainer.ReadWriteAccessLevel,
+		}
+		teamAccesses = append(teamAccesses, teamAccess)
+	}
+	resourceControl.TeamAccesses = teamAccesses
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedResourceControlUpdate(resourceControl, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	err = handler.ResourceControlService.UpdateResourceControl(resourceControl.ID, resourceControl)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+type putResourcesRequest struct {
+	AdministratorsOnly bool  `valid:"-"`
+	Users              []int `valid:"-"`
+	Teams              []int `valid:"-"`
+}
+
+// handleDeleteResources handles DELETE requests on /resources/:id
+func (handler *ResourceHandler) handleDeleteResources(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	resourceControlID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	resourceControl, err := handler.ResourceControlService.ResourceControl(portainer.ResourceControlID(resourceControlID))
+
+	if err == portainer.ErrResourceControlNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedResourceControlDeletion(resourceControl, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	err = handler.ResourceControlService.DeleteResourceControl(portainer.ResourceControlID(resourceControlID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}

api/http/handler/settings.go

@@ -0,0 +1,83 @@
+package handler
+
+import (
+	"encoding/json"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+)
+
+// SettingsHandler represents an HTTP API handler for managing Settings.
+type SettingsHandler struct {
+	*mux.Router
+	Logger          *log.Logger
+	SettingsService portainer.SettingsService
+}
+
+// NewSettingsHandler returns a new instance of OldSettingsHandler.
+func NewSettingsHandler(bouncer *security.RequestBouncer) *SettingsHandler {
+	h := &SettingsHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/settings",
+		bouncer.PublicAccess(http.HandlerFunc(h.handleGetSettings))).Methods(http.MethodGet)
+	h.Handle("/settings",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutSettings))).Methods(http.MethodPut)
+
+	return h
+}
+
+// handleGetSettings handles GET requests on /settings
+func (handler *SettingsHandler) handleGetSettings(w http.ResponseWriter, r *http.Request) {
+	settings, err := handler.SettingsService.Settings()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, settings, handler.Logger)
+	return
+}
+
+// handlePutSettings handles PUT requests on /settings
+func (handler *SettingsHandler) handlePutSettings(w http.ResponseWriter, r *http.Request) {
+	var req putSettingsRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	settings := &portainer.Settings{
+		TemplatesURL:                req.TemplatesURL,
+		LogoURL:                     req.LogoURL,
+		BlackListedLabels:           req.BlackListedLabels,
+		DisplayExternalContributors: req.DisplayExternalContributors,
+	}
+
+	err = handler.SettingsService.StoreSettings(settings)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+	}
+}
+
+type putSettingsRequest struct {
+	TemplatesURL                string           `valid:"required"`
+	LogoURL                     string           `valid:""`
+	BlackListedLabels           []portainer.Pair `valid:""`
+	DisplayExternalContributors bool             `valid:""`
+}

api/http/handler/status.go

@@ -0,0 +1,38 @@
+package handler
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/http/security"
+
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+)
+
+// StatusHandler represents an HTTP API handler for managing Status.
+type StatusHandler struct {
+	*mux.Router
+	Logger *log.Logger
+	Status *portainer.Status
+}
+
+// NewStatusHandler returns a new instance of StatusHandler.
+func NewStatusHandler(bouncer *security.RequestBouncer, status *portainer.Status) *StatusHandler {
+	h := &StatusHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+		Status: status,
+	}
+	h.Handle("/status",
+		bouncer.PublicAccess(http.HandlerFunc(h.handleGetStatus))).Methods(http.MethodGet)
+
+	return h
+}
+
+// handleGetStatus handles GET requests on /status
+func (handler *StatusHandler) handleGetStatus(w http.ResponseWriter, r *http.Request) {
+	encodeJSON(w, handler.Status, handler.Logger)
+	return
+}

api/http/handler/team.go

@@ -0,0 +1,252 @@
+package handler
+
+import (
+	"strconv"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/mux"
+)
+
+// TeamHandler represents an HTTP API handler for managing teams.
+type TeamHandler struct {
+	*mux.Router
+	Logger                 *log.Logger
+	TeamService            portainer.TeamService
+	TeamMembershipService  portainer.TeamMembershipService
+	ResourceControlService portainer.ResourceControlService
+}
+
+// NewTeamHandler returns a new instance of TeamHandler.
+func NewTeamHandler(bouncer *security.RequestBouncer) *TeamHandler {
+	h := &TeamHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/teams",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePostTeams))).Methods(http.MethodPost)
+	h.Handle("/teams",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handleGetTeams))).Methods(http.MethodGet)
+	h.Handle("/teams/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetTeam))).Methods(http.MethodGet)
+	h.Handle("/teams/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handlePutTeam))).Methods(http.MethodPut)
+	h.Handle("/teams/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleDeleteTeam))).Methods(http.MethodDelete)
+	h.Handle("/teams/{id}/memberships",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetMemberships))).Methods(http.MethodGet)
+
+	return h
+}
+
+// handlePostTeams handles POST requests on /teams
+func (handler *TeamHandler) handlePostTeams(w http.ResponseWriter, r *http.Request) {
+	var req postTeamsRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	team, err := handler.TeamService.TeamByName(req.Name)
+	if err != nil && err != portainer.ErrTeamNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if team != nil {
+		httperror.WriteErrorResponse(w, portainer.ErrTeamAlreadyExists, http.StatusConflict, handler.Logger)
+		return
+	}
+
+	team = &portainer.Team{
+		Name: req.Name,
+	}
+
+	err = handler.TeamService.CreateTeam(team)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &postTeamsResponse{ID: int(team.ID)}, handler.Logger)
+}
+
+type postTeamsResponse struct {
+	ID int `json:"Id"`
+}
+
+type postTeamsRequest struct {
+	Name string `valid:"required"`
+}
+
+// handleGetTeams handles GET requests on /teams
+func (handler *TeamHandler) handleGetTeams(w http.ResponseWriter, r *http.Request) {
+	teams, err := handler.TeamService.Teams()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, teams, handler.Logger)
+}
+
+// handleGetTeam handles GET requests on /teams/:id
+func (handler *TeamHandler) handleGetTeam(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	tid, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+	teamID := portainer.TeamID(tid)
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedTeamManagement(teamID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	team, err := handler.TeamService.Team(teamID)
+	if err == portainer.ErrTeamNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &team, handler.Logger)
+}
+
+// handlePutTeam handles PUT requests on /teams/:id
+func (handler *TeamHandler) handlePutTeam(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	teamID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putTeamRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	team, err := handler.TeamService.Team(portainer.TeamID(teamID))
+	if err == portainer.ErrTeamNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if req.Name != "" {
+		team.Name = req.Name
+	}
+
+	err = handler.TeamService.UpdateTeam(team.ID, team)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+type putTeamRequest struct {
+	Name string `valid:"-"`
+}
+
+// handleDeleteTeam handles DELETE requests on /teams/:id
+func (handler *TeamHandler) handleDeleteTeam(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	teamID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = handler.TeamService.Team(portainer.TeamID(teamID))
+
+	if err == portainer.ErrTeamNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.TeamService.DeleteTeam(portainer.TeamID(teamID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.TeamMembershipService.DeleteTeamMembershipByTeamID(portainer.TeamID(teamID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+// handleGetMemberships handles GET requests on /teams/:id/memberships
+func (handler *TeamHandler) handleGetMemberships(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	tid, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+	teamID := portainer.TeamID(tid)
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedTeamManagement(teamID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	memberships, err := handler.TeamMembershipService.TeamMembershipsByTeamID(teamID)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, memberships, handler.Logger)
+}

api/http/handler/team_membership.go

@@ -0,0 +1,240 @@
+package handler
+
+import (
+	"strconv"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/mux"
+)
+
+// TeamMembershipHandler represents an HTTP API handler for managing teams.
+type TeamMembershipHandler struct {
+	*mux.Router
+	Logger                 *log.Logger
+	TeamMembershipService  portainer.TeamMembershipService
+	ResourceControlService portainer.ResourceControlService
+}
+
+// NewTeamMembershipHandler returns a new instance of TeamMembershipHandler.
+func NewTeamMembershipHandler(bouncer *security.RequestBouncer) *TeamMembershipHandler {
+	h := &TeamMembershipHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/team_memberships",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePostTeamMemberships))).Methods(http.MethodPost)
+	h.Handle("/team_memberships",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetTeamsMemberships))).Methods(http.MethodGet)
+	h.Handle("/team_memberships/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePutTeamMembership))).Methods(http.MethodPut)
+	h.Handle("/team_memberships/{id}",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleDeleteTeamMembership))).Methods(http.MethodDelete)
+
+	return h
+}
+
+// handlePostTeamMemberships handles POST requests on /team_memberships
+func (handler *TeamMembershipHandler) handlePostTeamMemberships(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	var req postTeamMembershipsRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	userID := portainer.UserID(req.UserID)
+	teamID := portainer.TeamID(req.TeamID)
+	role := portainer.MembershipRole(req.Role)
+
+	if !security.AuthorizedTeamManagement(teamID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	memberships, err := handler.TeamMembershipService.TeamMembershipsByUserID(userID)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if len(memberships) > 0 {
+		for _, membership := range memberships {
+			if membership.UserID == userID && membership.TeamID == teamID {
+				httperror.WriteErrorResponse(w, portainer.ErrTeamMembershipAlreadyExists, http.StatusConflict, handler.Logger)
+				return
+			}
+		}
+	}
+
+	membership := &portainer.TeamMembership{
+		UserID: userID,
+		TeamID: teamID,
+		Role:   role,
+	}
+
+	err = handler.TeamMembershipService.CreateTeamMembership(membership)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &postTeamMembershipsResponse{ID: int(membership.ID)}, handler.Logger)
+}
+
+type postTeamMembershipsResponse struct {
+	ID int `json:"Id"`
+}
+
+type postTeamMembershipsRequest struct {
+	UserID int `valid:"required"`
+	TeamID int `valid:"required"`
+	Role   int `valid:"required"`
+}
+
+// handleGetTeamsMemberships handles GET requests on /team_memberships
+func (handler *TeamMembershipHandler) handleGetTeamsMemberships(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !securityContext.IsAdmin && !securityContext.IsTeamLeader {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	memberships, err := handler.TeamMembershipService.TeamMemberships()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, memberships, handler.Logger)
+}
+
+// handlePutTeamMembership handles PUT requests on /team_memberships/:id
+func (handler *TeamMembershipHandler) handlePutTeamMembership(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	membershipID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req putTeamMembershipRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	userID := portainer.UserID(req.UserID)
+	teamID := portainer.TeamID(req.TeamID)
+	role := portainer.MembershipRole(req.Role)
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedTeamManagement(teamID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	membership, err := handler.TeamMembershipService.TeamMembership(portainer.TeamMembershipID(membershipID))
+	if err == portainer.ErrTeamMembershipNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if securityContext.IsTeamLeader && membership.Role != role {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	membership.UserID = userID
+	membership.TeamID = teamID
+	membership.Role = role
+
+	err = handler.TeamMembershipService.UpdateTeamMembership(membership.ID, membership)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+type putTeamMembershipRequest struct {
+	UserID int `valid:"required"`
+	TeamID int `valid:"required"`
+	Role   int `valid:"required"`
+}
+
+// handleDeleteTeamMembership handles DELETE requests on /team_memberships/:id
+func (handler *TeamMembershipHandler) handleDeleteTeamMembership(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	membershipID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	membership, err := handler.TeamMembershipService.TeamMembership(portainer.TeamMembershipID(membershipID))
+	if err == portainer.ErrTeamMembershipNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedTeamManagement(membership.TeamID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	err = handler.TeamMembershipService.DeleteTeamMembership(portainer.TeamMembershipID(membershipID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}

api/http/handler/templates.go

@@ -0,0 +1,78 @@
+package handler
+
+import (
+	"io/ioutil"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/gorilla/mux"
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+)
+
+// TemplatesHandler represents an HTTP API handler for managing templates.
+type TemplatesHandler struct {
+	*mux.Router
+	Logger          *log.Logger
+	SettingsService portainer.SettingsService
+}
+
+const (
+	containerTemplatesURLLinuxServerIo = "http://tools.linuxserver.io/portainer.json"
+)
+
+// NewTemplatesHandler returns a new instance of TemplatesHandler.
+func NewTemplatesHandler(bouncer *security.RequestBouncer) *TemplatesHandler {
+	h := &TemplatesHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/templates",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handleGetTemplates)))
+	return h
+}
+
+// handleGetTemplates handles GET requests on /templates?key=<key>
+func (handler *TemplatesHandler) handleGetTemplates(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodGet})
+		return
+	}
+
+	key := r.FormValue("key")
+	if key == "" {
+		httperror.WriteErrorResponse(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var templatesURL string
+	if key == "containers" {
+		settings, err := handler.SettingsService.Settings()
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+			return
+		}
+		templatesURL = settings.TemplatesURL
+	} else if key == "linuxserver.io" {
+		templatesURL = containerTemplatesURLLinuxServerIo
+	} else {
+		httperror.WriteErrorResponse(w, ErrInvalidQueryFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	resp, err := http.Get(templatesURL)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	defer resp.Body.Close()
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	w.Header().Set("Content-Type", "application/json")
+	w.Write(body)
+}

api/http/handler/upload.go

@@ -0,0 +1,74 @@
+package handler
+
+import (
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"log"
+	"net/http"
+	"os"
+	"strconv"
+
+	"github.com/gorilla/mux"
+)
+
+// UploadHandler represents an HTTP API handler for managing file uploads.
+type UploadHandler struct {
+	*mux.Router
+	Logger      *log.Logger
+	FileService portainer.FileService
+}
+
+// NewUploadHandler returns a new instance of UploadHandler.
+func NewUploadHandler(bouncer *security.RequestBouncer) *UploadHandler {
+	h := &UploadHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/upload/tls/{endpointID}/{certificate:(?:ca|cert|key)}",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handlePostUploadTLS)))
+	return h
+}
+
+func (handler *UploadHandler) handlePostUploadTLS(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodPost})
+		return
+	}
+
+	vars := mux.Vars(r)
+	endpointID := vars["endpointID"]
+	certificate := vars["certificate"]
+	ID, err := strconv.Atoi(endpointID)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	file, _, err := r.FormFile("file")
+	defer file.Close()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	var fileType portainer.TLSFileType
+	switch certificate {
+	case "ca":
+		fileType = portainer.TLSFileCA
+	case "cert":
+		fileType = portainer.TLSFileCert
+	case "key":
+		fileType = portainer.TLSFileKey
+	default:
+		httperror.WriteErrorResponse(w, portainer.ErrUndefinedTLSFileType, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.FileService.StoreTLSFile(portainer.EndpointID(ID), fileType, file)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}

api/http/handler/user.go

@@ -0,0 +1,490 @@
+package handler
+
+import (
+	"strconv"
+	"strings"
+
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+	"github.com/portainer/portainer/http/security"
+
+	"encoding/json"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/asaskevich/govalidator"
+	"github.com/gorilla/mux"
+)
+
+// UserHandler represents an HTTP API handler for managing users.
+type UserHandler struct {
+	*mux.Router
+	Logger                 *log.Logger
+	UserService            portainer.UserService
+	TeamService            portainer.TeamService
+	TeamMembershipService  portainer.TeamMembershipService
+	ResourceControlService portainer.ResourceControlService
+	CryptoService          portainer.CryptoService
+}
+
+// NewUserHandler returns a new instance of UserHandler.
+func NewUserHandler(bouncer *security.RequestBouncer) *UserHandler {
+	h := &UserHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/users",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handlePostUsers))).Methods(http.MethodPost)
+	h.Handle("/users",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetUsers))).Methods(http.MethodGet)
+	h.Handle("/users/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleGetUser))).Methods(http.MethodGet)
+	h.Handle("/users/{id}",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handlePutUser))).Methods(http.MethodPut)
+	h.Handle("/users/{id}",
+		bouncer.AdministratorAccess(http.HandlerFunc(h.handleDeleteUser))).Methods(http.MethodDelete)
+	h.Handle("/users/{id}/memberships",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handleGetMemberships))).Methods(http.MethodGet)
+	h.Handle("/users/{id}/teams",
+		bouncer.RestrictedAccess(http.HandlerFunc(h.handleGetTeams))).Methods(http.MethodGet)
+	h.Handle("/users/{id}/passwd",
+		bouncer.AuthenticatedAccess(http.HandlerFunc(h.handlePostUserPasswd)))
+	h.Handle("/users/admin/check",
+		bouncer.PublicAccess(http.HandlerFunc(h.handleGetAdminCheck)))
+	h.Handle("/users/admin/init",
+		bouncer.PublicAccess(http.HandlerFunc(h.handlePostAdminInit)))
+
+	return h
+}
+
+// handlePostUsers handles POST requests on /users
+func (handler *UserHandler) handlePostUsers(w http.ResponseWriter, r *http.Request) {
+	var req postUsersRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !securityContext.IsAdmin && !securityContext.IsTeamLeader {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, nil)
+		return
+	}
+
+	if securityContext.IsTeamLeader && req.Role == 1 {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, nil)
+		return
+	}
+
+	if strings.ContainsAny(req.Username, " ") {
+		httperror.WriteErrorResponse(w, portainer.ErrInvalidUsername, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var role portainer.UserRole
+	if req.Role == 1 {
+		role = portainer.AdministratorRole
+	} else {
+		role = portainer.StandardUserRole
+	}
+
+	user, err := handler.UserService.UserByUsername(req.Username)
+	if err != nil && err != portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if user != nil {
+		httperror.WriteErrorResponse(w, portainer.ErrUserAlreadyExists, http.StatusConflict, handler.Logger)
+		return
+	}
+
+	user = &portainer.User{
+		Username: req.Username,
+		Role:     role,
+	}
+	user.Password, err = handler.CryptoService.Hash(req.Password)
+	if err != nil {
+		httperror.WriteErrorResponse(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	err = handler.UserService.CreateUser(user)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, &postUsersResponse{ID: int(user.ID)}, handler.Logger)
+}
+
+type postUsersResponse struct {
+	ID int `json:"Id"`
+}
+
+type postUsersRequest struct {
+	Username string `valid:"required"`
+	Password string `valid:"required"`
+	Role     int    `valid:"required"`
+}
+
+// handleGetUsers handles GET requests on /users
+func (handler *UserHandler) handleGetUsers(w http.ResponseWriter, r *http.Request) {
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	users, err := handler.UserService.Users()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	filteredUsers := security.FilterUsers(users, securityContext)
+
+	for i := range filteredUsers {
+		filteredUsers[i].Password = ""
+	}
+
+	encodeJSON(w, filteredUsers, handler.Logger)
+}
+
+// handlePostUserPasswd handles POST requests on /users/:id/passwd
+func (handler *UserHandler) handlePostUserPasswd(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodPost})
+		return
+	}
+
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	userID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var req postUserPasswdRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	var password = req.Password
+
+	u, err := handler.UserService.User(portainer.UserID(userID))
+	if err == portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	valid := true
+	err = handler.CryptoService.CompareHashAndData(u.Password, password)
+	if err != nil {
+		valid = false
+	}
+
+	encodeJSON(w, &postUserPasswdResponse{Valid: valid}, handler.Logger)
+}
+
+type postUserPasswdRequest struct {
+	Password string `valid:"required"`
+}
+
+type postUserPasswdResponse struct {
+	Valid bool `json:"valid"`
+}
+
+// handleGetUser handles GET requests on /users/:id
+func (handler *UserHandler) handleGetUser(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	userID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	user, err := handler.UserService.User(portainer.UserID(userID))
+	if err == portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	user.Password = ""
+	encodeJSON(w, &user, handler.Logger)
+}
+
+// handlePutUser handles PUT requests on /users/:id
+func (handler *UserHandler) handlePutUser(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	userID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if tokenData.Role != portainer.AdministratorRole && tokenData.ID != portainer.UserID(userID) {
+		httperror.WriteErrorResponse(w, portainer.ErrUnauthorized, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	var req putUserRequest
+	if err = json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	if req.Password == "" && req.Role == 0 {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	user, err := handler.UserService.User(portainer.UserID(userID))
+	if err == portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if req.Password != "" {
+		user.Password, err = handler.CryptoService.Hash(req.Password)
+		if err != nil {
+			httperror.WriteErrorResponse(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
+			return
+		}
+	}
+
+	if req.Role != 0 {
+		if tokenData.Role != portainer.AdministratorRole {
+			httperror.WriteErrorResponse(w, portainer.ErrUnauthorized, http.StatusForbidden, handler.Logger)
+			return
+		}
+		if req.Role == 1 {
+			user.Role = portainer.AdministratorRole
+		} else {
+			user.Role = portainer.StandardUserRole
+		}
+	}
+
+	err = handler.UserService.UpdateUser(user.ID, user)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+type putUserRequest struct {
+	Password string `valid:"-"`
+	Role     int    `valid:"-"`
+}
+
+// handlePostAdminInit handles GET requests on /users/admin/check
+func (handler *UserHandler) handleGetAdminCheck(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodGet})
+		return
+	}
+
+	users, err := handler.UserService.UsersByRole(portainer.AdministratorRole)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if len(users) == 0 {
+		httperror.WriteErrorResponse(w, portainer.ErrUserNotFound, http.StatusNotFound, handler.Logger)
+		return
+	}
+}
+
+// handlePostAdminInit handles POST requests on /users/admin/init
+func (handler *UserHandler) handlePostAdminInit(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		httperror.WriteMethodNotAllowedResponse(w, []string{http.MethodPost})
+		return
+	}
+
+	var req postAdminInitRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidJSON, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err := govalidator.ValidateStruct(req)
+	if err != nil {
+		httperror.WriteErrorResponse(w, ErrInvalidRequestFormat, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	user, err := handler.UserService.UserByUsername("admin")
+	if err == portainer.ErrUserNotFound {
+		user := &portainer.User{
+			Username: "admin",
+			Role:     portainer.AdministratorRole,
+		}
+		user.Password, err = handler.CryptoService.Hash(req.Password)
+		if err != nil {
+			httperror.WriteErrorResponse(w, portainer.ErrCryptoHashFailure, http.StatusBadRequest, handler.Logger)
+			return
+		}
+
+		err = handler.UserService.CreateUser(user)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+			return
+		}
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+	if user != nil {
+		httperror.WriteErrorResponse(w, portainer.ErrAdminAlreadyInitialized, http.StatusForbidden, handler.Logger)
+		return
+	}
+}
+
+type postAdminInitRequest struct {
+	Password string `valid:"required"`
+}
+
+// handleDeleteUser handles DELETE requests on /users/:id
+func (handler *UserHandler) handleDeleteUser(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	userID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	_, err = handler.UserService.User(portainer.UserID(userID))
+
+	if err == portainer.ErrUserNotFound {
+		httperror.WriteErrorResponse(w, err, http.StatusNotFound, handler.Logger)
+		return
+	} else if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.UserService.DeleteUser(portainer.UserID(userID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	err = handler.TeamMembershipService.DeleteTeamMembershipByUserID(portainer.UserID(userID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+}
+
+// handleGetMemberships handles GET requests on /users/:id/memberships
+func (handler *UserHandler) handleGetMemberships(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	userID, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+
+	tokenData, err := security.RetrieveTokenData(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if tokenData.Role != portainer.AdministratorRole && tokenData.ID != portainer.UserID(userID) {
+		httperror.WriteErrorResponse(w, portainer.ErrUnauthorized, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	memberships, err := handler.TeamMembershipService.TeamMembershipsByUserID(portainer.UserID(userID))
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	encodeJSON(w, memberships, handler.Logger)
+}
+
+// handleGetTeams handles GET requests on /users/:id/teams
+func (handler *UserHandler) handleGetTeams(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	id := vars["id"]
+
+	uid, err := strconv.Atoi(id)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusBadRequest, handler.Logger)
+		return
+	}
+	userID := portainer.UserID(uid)
+
+	securityContext, err := security.RetrieveRestrictedRequestContext(r)
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	if !security.AuthorizedUserManagement(userID, securityContext) {
+		httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, handler.Logger)
+		return
+	}
+
+	teams, err := handler.TeamService.Teams()
+	if err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, handler.Logger)
+		return
+	}
+
+	filteredTeams := security.FilterUserTeams(teams, securityContext)
+
+	encodeJSON(w, filteredTeams, handler.Logger)
+}

api/http/handler/websocket.go

@@ -0,0 +1,198 @@
+package handler
+
+import (
+	"bytes"
+	"crypto/tls"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"os"
+	"strconv"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/crypto"
+	"golang.org/x/net/websocket"
+)
+
+// WebSocketHandler represents an HTTP API handler for proxying requests to a web socket.
+type WebSocketHandler struct {
+	*mux.Router
+	Logger          *log.Logger
+	EndpointService portainer.EndpointService
+}
+
+// NewWebSocketHandler returns a new instance of WebSocketHandler.
+func NewWebSocketHandler() *WebSocketHandler {
+	h := &WebSocketHandler{
+		Router: mux.NewRouter(),
+		Logger: log.New(os.Stderr, "", log.LstdFlags),
+	}
+	h.Handle("/websocket/exec", websocket.Handler(h.webSocketDockerExec))
+	return h
+}
+
+func (handler *WebSocketHandler) webSocketDockerExec(ws *websocket.Conn) {
+	qry := ws.Request().URL.Query()
+	execID := qry.Get("id")
+	edpID := qry.Get("endpointId")
+
+	parsedID, err := strconv.Atoi(edpID)
+	if err != nil {
+		log.Printf("Unable to parse endpoint ID: %s", err)
+		return
+	}
+
+	endpointID := portainer.EndpointID(parsedID)
+	endpoint, err := handler.EndpointService.Endpoint(endpointID)
+	if err != nil {
+		log.Printf("Unable to retrieve endpoint: %s", err)
+		return
+	}
+
+	endpointURL, err := url.Parse(endpoint.URL)
+	if err != nil {
+		log.Printf("Unable to parse endpoint URL: %s", err)
+		return
+	}
+
+	var host string
+	if endpointURL.Scheme == "tcp" {
+		host = endpointURL.Host
+	} else if endpointURL.Scheme == "unix" {
+		host = endpointURL.Path
+	}
+
+	// Should not be managed here
+	var tlsConfig *tls.Config
+	if endpoint.TLS {
+		tlsConfig, err = crypto.CreateTLSConfiguration(endpoint.TLSCACertPath,
+			endpoint.TLSCertPath,
+			endpoint.TLSKeyPath)
+		if err != nil {
+			log.Fatalf("Unable to create TLS configuration: %s", err)
+			return
+		}
+	}
+
+	if err := hijack(host, endpointURL.Scheme, "POST", "/exec/"+execID+"/start", tlsConfig, true, ws, ws, ws, nil, nil); err != nil {
+		log.Fatalf("error during hijack: %s", err)
+		return
+	}
+}
+
+type execConfig struct {
+	Tty    bool
+	Detach bool
+}
+
+// hijack allows to upgrade an HTTP connection to a TCP connection
+// It redirects IO streams for stdin, stdout and stderr to a websocket
+func hijack(addr, scheme, method, path string, tlsConfig *tls.Config, setRawTerminal bool, in io.ReadCloser, stdout, stderr io.Writer, started chan io.Closer, data interface{}) error {
+	execConfig := &execConfig{
+		Tty:    true,
+		Detach: false,
+	}
+
+	buf, err := json.Marshal(execConfig)
+	if err != nil {
+		return fmt.Errorf("error marshaling exec config: %s", err)
+	}
+
+	rdr := bytes.NewReader(buf)
+
+	req, err := http.NewRequest(method, path, rdr)
+	if err != nil {
+		return fmt.Errorf("error during hijack request: %s", err)
+	}
+
+	req.Header.Set("User-Agent", "Docker-Client")
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Connection", "Upgrade")
+	req.Header.Set("Upgrade", "tcp")
+	req.Host = addr
+
+	var (
+		dial    net.Conn
+		dialErr error
+	)
+
+	if tlsConfig == nil {
+		dial, dialErr = net.Dial(scheme, addr)
+	} else {
+		dial, dialErr = tls.Dial(scheme, addr, tlsConfig)
+	}
+
+	if dialErr != nil {
+		return dialErr
+	}
+
+	// When we set up a TCP connection for hijack, there could be long periods
+	// of inactivity (a long running command with no output) that in certain
+	// network setups may cause ECONNTIMEOUT, leaving the client in an unknown
+	// state. Setting TCP KeepAlive on the socket connection will prohibit
+	// ECONNTIMEOUT unless the socket connection truly is broken
+	if tcpConn, ok := dial.(*net.TCPConn); ok {
+		tcpConn.SetKeepAlive(true)
+		tcpConn.SetKeepAlivePeriod(30 * time.Second)
+	}
+	if err != nil {
+		return err
+	}
+	clientconn := httputil.NewClientConn(dial, nil)
+	defer clientconn.Close()
+
+	// Server hijacks the connection, error 'connection closed' expected
+	clientconn.Do(req)
+
+	rwc, br := clientconn.Hijack()
+	defer rwc.Close()
+
+	if started != nil {
+		started <- rwc
+	}
+
+	var receiveStdout chan error
+
+	if stdout != nil || stderr != nil {
+		go func() (err error) {
+			if setRawTerminal && stdout != nil {
+				_, err = io.Copy(stdout, br)
+			}
+			return err
+		}()
+	}
+
+	go func() error {
+		if in != nil {
+			io.Copy(rwc, in)
+		}
+
+		if conn, ok := rwc.(interface {
+			CloseWrite() error
+		}); ok {
+			if err := conn.CloseWrite(); err != nil {
+			}
+		}
+		return nil
+	}()
+
+	if stdout != nil || stderr != nil {
+		if err := <-receiveStdout; err != nil {
+			return err
+		}
+	}
+	go func() {
+		for {
+			fmt.Println(br)
+		}
+	}()
+
+	return nil
+}

api/http/proxy/access_control.go

@@ -0,0 +1,21 @@
+package proxy
+
+import "github.com/portainer/portainer"
+
+func canUserAccessResource(userID portainer.UserID, userTeamIDs []portainer.TeamID, resourceControl *portainer.ResourceControl) bool {
+	for _, authorizedUserAccess := range resourceControl.UserAccesses {
+		if userID == authorizedUserAccess.UserID {
+			return true
+		}
+	}
+
+	for _, authorizedTeamAccess := range resourceControl.TeamAccesses {
+		for _, userTeamID := range userTeamIDs {
+			if userTeamID == authorizedTeamAccess.TeamID {
+				return true
+			}
+		}
+	}
+
+	return false
+}

api/http/proxy/containers.go

@@ -0,0 +1,108 @@
+package proxy
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrDockerContainerIdentifierNotFound defines an error raised when Portainer is unable to find a container identifier
+	ErrDockerContainerIdentifierNotFound = portainer.Error("Docker container identifier not found")
+	containerIdentifier                  = "Id"
+	containerLabelForServiceIdentifier   = "com.docker.swarm.service.id"
+)
+
+// containerListOperation extracts the response as a JSON object, loop through the containers array
+// decorate and/or filter the containers based on resource controls before rewriting the response
+func containerListOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	var err error
+	// ContainerList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
+	responseArray, err := getResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	if executor.operationContext.isAdmin {
+		responseArray, err = decorateContainerList(responseArray, executor.operationContext.resourceControls)
+	} else {
+		responseArray, err = filterContainerList(responseArray, executor.operationContext.resourceControls,
+			executor.operationContext.userID, executor.operationContext.userTeamIDs)
+	}
+	if err != nil {
+		return err
+	}
+
+	if executor.labelBlackList != nil {
+		responseArray, err = filterContainersWithBlackListedLabels(responseArray, executor.labelBlackList)
+		if err != nil {
+			return err
+		}
+	}
+
+	return rewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// containerInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the container based on resource control (check are done based on the containerID and optional Swarm service ID)
+// and either rewrite an access denied response or a decorated container.
+func containerInspectOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	// ContainerInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/ContainerInspect
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	if responseObject[containerIdentifier] == nil {
+		return ErrDockerContainerIdentifierNotFound
+	}
+	containerID := responseObject[containerIdentifier].(string)
+
+	resourceControl := getResourceControlByResourceID(containerID, executor.operationContext.resourceControls)
+	if resourceControl != nil {
+		if executor.operationContext.isAdmin || canUserAccessResource(executor.operationContext.userID,
+			executor.operationContext.userTeamIDs, resourceControl) {
+			responseObject = decorateObject(responseObject, resourceControl)
+		} else {
+			return rewriteAccessDeniedResponse(response)
+		}
+	}
+
+	containerLabels := extractContainerLabelsFromContainerInspectObject(responseObject)
+	if containerLabels != nil && containerLabels[containerLabelForServiceIdentifier] != nil {
+		serviceID := containerLabels[containerLabelForServiceIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(serviceID, executor.operationContext.resourceControls)
+		if resourceControl != nil {
+			if executor.operationContext.isAdmin || canUserAccessResource(executor.operationContext.userID,
+				executor.operationContext.userTeamIDs, resourceControl) {
+				responseObject = decorateObject(responseObject, resourceControl)
+			} else {
+				return rewriteAccessDeniedResponse(response)
+			}
+		}
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}
+
+// extractContainerLabelsFromContainerInspectObject retrieve the Labels of the container if present.
+// Container schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerInspect
+func extractContainerLabelsFromContainerInspectObject(responseObject map[string]interface{}) map[string]interface{} {
+	// Labels are stored under Config.Labels
+	containerConfigObject := extractJSONField(responseObject, "Config")
+	if containerConfigObject != nil {
+		containerLabelsObject := extractJSONField(containerConfigObject, "Labels")
+		return containerLabelsObject
+	}
+	return nil
+}
+
+// extractContainerLabelsFromContainerListObject retrieve the Labels of the container if present.
+// Container schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
+func extractContainerLabelsFromContainerListObject(responseObject map[string]interface{}) map[string]interface{} {
+	// Labels are stored under Labels
+	containerLabelsObject := extractJSONField(responseObject, "Labels")
+	return containerLabelsObject
+}

api/http/proxy/decorator.go

@@ -0,0 +1,90 @@
+package proxy
+
+import "github.com/portainer/portainer"
+
+// decorateVolumeList loops through all volumes and will decorate any volume with an existing resource control.
+// Volume object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+func decorateVolumeList(volumeData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
+	decoratedVolumeData := make([]interface{}, 0)
+
+	for _, volume := range volumeData {
+
+		volumeObject := volume.(map[string]interface{})
+		if volumeObject[volumeIdentifier] == nil {
+			return nil, ErrDockerVolumeIdentifierNotFound
+		}
+
+		volumeID := volumeObject[volumeIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(volumeID, resourceControls)
+		if resourceControl != nil {
+			volumeObject = decorateObject(volumeObject, resourceControl)
+		}
+		decoratedVolumeData = append(decoratedVolumeData, volumeObject)
+	}
+
+	return decoratedVolumeData, nil
+}
+
+// decorateContainerList loops through all containers and will decorate any container with an existing resource control.
+// Check is based on the container ID and optional Swarm service ID.
+// Container object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
+func decorateContainerList(containerData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
+	decoratedContainerData := make([]interface{}, 0)
+
+	for _, container := range containerData {
+
+		containerObject := container.(map[string]interface{})
+		if containerObject[containerIdentifier] == nil {
+			return nil, ErrDockerContainerIdentifierNotFound
+		}
+
+		containerID := containerObject[containerIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(containerID, resourceControls)
+		if resourceControl != nil {
+			containerObject = decorateObject(containerObject, resourceControl)
+		}
+
+		containerLabels := extractContainerLabelsFromContainerListObject(containerObject)
+		if containerLabels != nil && containerLabels[containerLabelForServiceIdentifier] != nil {
+			serviceID := containerLabels[containerLabelForServiceIdentifier].(string)
+			resourceControl := getResourceControlByResourceID(serviceID, resourceControls)
+			if resourceControl != nil {
+				containerObject = decorateObject(containerObject, resourceControl)
+			}
+		}
+
+		decoratedContainerData = append(decoratedContainerData, containerObject)
+	}
+
+	return decoratedContainerData, nil
+}
+
+// decorateServiceList loops through all services and will decorate any service with an existing resource control.
+// Service object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
+func decorateServiceList(serviceData []interface{}, resourceControls []portainer.ResourceControl) ([]interface{}, error) {
+	decoratedServiceData := make([]interface{}, 0)
+
+	for _, service := range serviceData {
+
+		serviceObject := service.(map[string]interface{})
+		if serviceObject[serviceIdentifier] == nil {
+			return nil, ErrDockerServiceIdentifierNotFound
+		}
+
+		serviceID := serviceObject[serviceIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(serviceID, resourceControls)
+		if resourceControl != nil {
+			serviceObject = decorateObject(serviceObject, resourceControl)
+		}
+		decoratedServiceData = append(decoratedServiceData, serviceObject)
+	}
+
+	return decoratedServiceData, nil
+}
+
+func decorateObject(object map[string]interface{}, resourceControl *portainer.ResourceControl) map[string]interface{} {
+	metadata := make(map[string]interface{})
+	metadata["ResourceControl"] = resourceControl
+	object["Portainer"] = metadata
+	return object
+}

api/http/proxy/factory.go

@@ -0,0 +1,58 @@
+package proxy
+
+import (
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/crypto"
+)
+
+// proxyFactory is a factory to create reverse proxies to Docker endpoints
+type proxyFactory struct {
+	ResourceControlService portainer.ResourceControlService
+	TeamMembershipService  portainer.TeamMembershipService
+	SettingsService        portainer.SettingsService
+}
+
+func (factory *proxyFactory) newHTTPProxy(u *url.URL) http.Handler {
+	u.Scheme = "http"
+	return factory.createReverseProxy(u)
+}
+
+func (factory *proxyFactory) newHTTPSProxy(u *url.URL, endpoint *portainer.Endpoint) (http.Handler, error) {
+	u.Scheme = "https"
+	proxy := factory.createReverseProxy(u)
+	config, err := crypto.CreateTLSConfiguration(endpoint.TLSCACertPath, endpoint.TLSCertPath, endpoint.TLSKeyPath)
+	if err != nil {
+		return nil, err
+	}
+
+	proxy.Transport.(*proxyTransport).dockerTransport.TLSClientConfig = config
+	return proxy, nil
+}
+
+func (factory *proxyFactory) newSocketProxy(path string) http.Handler {
+	proxy := &socketProxy{}
+	transport := &proxyTransport{
+		ResourceControlService: factory.ResourceControlService,
+		TeamMembershipService:  factory.TeamMembershipService,
+		SettingsService:        factory.SettingsService,
+		dockerTransport:        newSocketTransport(path),
+	}
+	proxy.Transport = transport
+	return proxy
+}
+
+func (factory *proxyFactory) createReverseProxy(u *url.URL) *httputil.ReverseProxy {
+	proxy := newSingleHostReverseProxyWithHostHeader(u)
+	transport := &proxyTransport{
+		ResourceControlService: factory.ResourceControlService,
+		TeamMembershipService:  factory.TeamMembershipService,
+		SettingsService:        factory.SettingsService,
+		dockerTransport:        newHTTPTransport(),
+	}
+	proxy.Transport = transport
+	return proxy
+}

api/http/proxy/filter.go

@@ -0,0 +1,112 @@
+package proxy
+
+import "github.com/portainer/portainer"
+
+// filterVolumeList loops through all volumes, filters volumes without any resource control (public resources) or with
+// any resource control giving access to the user (these volumes will be decorated).
+// Volume object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+func filterVolumeList(volumeData []interface{}, resourceControls []portainer.ResourceControl, userID portainer.UserID, userTeamIDs []portainer.TeamID) ([]interface{}, error) {
+	filteredVolumeData := make([]interface{}, 0)
+
+	for _, volume := range volumeData {
+		volumeObject := volume.(map[string]interface{})
+		if volumeObject[volumeIdentifier] == nil {
+			return nil, ErrDockerVolumeIdentifierNotFound
+		}
+
+		volumeID := volumeObject[volumeIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(volumeID, resourceControls)
+		if resourceControl == nil {
+			filteredVolumeData = append(filteredVolumeData, volumeObject)
+		} else if resourceControl != nil && canUserAccessResource(userID, userTeamIDs, resourceControl) {
+			volumeObject = decorateObject(volumeObject, resourceControl)
+			filteredVolumeData = append(filteredVolumeData, volumeObject)
+		}
+	}
+
+	return filteredVolumeData, nil
+}
+
+// filterContainerList loops through all containers, filters containers without any resource control (public resources) or with
+// any resource control giving access to the user (check on container ID and optional Swarm service ID, these containers will be decorated).
+// Container object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ContainerList
+func filterContainerList(containerData []interface{}, resourceControls []portainer.ResourceControl, userID portainer.UserID, userTeamIDs []portainer.TeamID) ([]interface{}, error) {
+	filteredContainerData := make([]interface{}, 0)
+
+	for _, container := range containerData {
+		containerObject := container.(map[string]interface{})
+		if containerObject[containerIdentifier] == nil {
+			return nil, ErrDockerContainerIdentifierNotFound
+		}
+
+		containerID := containerObject[containerIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(containerID, resourceControls)
+		if resourceControl == nil {
+			// check if container is part of a Swarm service
+			containerLabels := extractContainerLabelsFromContainerListObject(containerObject)
+			if containerLabels != nil && containerLabels[containerLabelForServiceIdentifier] != nil {
+				serviceID := containerLabels[containerLabelForServiceIdentifier].(string)
+				serviceResourceControl := getResourceControlByResourceID(serviceID, resourceControls)
+				if serviceResourceControl == nil {
+					filteredContainerData = append(filteredContainerData, containerObject)
+				} else if serviceResourceControl != nil && canUserAccessResource(userID, userTeamIDs, serviceResourceControl) {
+					containerObject = decorateObject(containerObject, serviceResourceControl)
+					filteredContainerData = append(filteredContainerData, containerObject)
+				}
+			} else {
+				filteredContainerData = append(filteredContainerData, containerObject)
+			}
+		} else if resourceControl != nil && canUserAccessResource(userID, userTeamIDs, resourceControl) {
+			containerObject = decorateObject(containerObject, resourceControl)
+			filteredContainerData = append(filteredContainerData, containerObject)
+		}
+	}
+
+	return filteredContainerData, nil
+}
+
+// filterContainersWithLabels loops through a list of containers, and filters containers that do not contains
+// any labels in the labels black list.
+func filterContainersWithBlackListedLabels(containerData []interface{}, labelBlackList []portainer.Pair) ([]interface{}, error) {
+	filteredContainerData := make([]interface{}, 0)
+
+	for _, container := range containerData {
+		containerObject := container.(map[string]interface{})
+
+		containerLabels := extractContainerLabelsFromContainerListObject(containerObject)
+		if containerLabels != nil {
+			if !containerHasBlackListedLabel(containerLabels, labelBlackList) {
+				filteredContainerData = append(filteredContainerData, containerObject)
+			}
+		} else {
+			filteredContainerData = append(filteredContainerData, containerObject)
+		}
+	}
+
+	return filteredContainerData, nil
+}
+
+// filterServiceList loops through all services, filters services without any resource control (public resources) or with
+// any resource control giving access to the user (these services will be decorated).
+// Service object schema reference: https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
+func filterServiceList(serviceData []interface{}, resourceControls []portainer.ResourceControl, userID portainer.UserID, userTeamIDs []portainer.TeamID) ([]interface{}, error) {
+	filteredServiceData := make([]interface{}, 0)
+
+	for _, service := range serviceData {
+		serviceObject := service.(map[string]interface{})
+		if serviceObject[serviceIdentifier] == nil {
+			return nil, ErrDockerServiceIdentifierNotFound
+		}
+
+		serviceID := serviceObject[serviceIdentifier].(string)
+		resourceControl := getResourceControlByResourceID(serviceID, resourceControls)
+		if resourceControl == nil {
+			filteredServiceData = append(filteredServiceData, serviceObject)
+		} else if resourceControl != nil && canUserAccessResource(userID, userTeamIDs, resourceControl) {
+			serviceObject = decorateObject(serviceObject, resourceControl)
+			filteredServiceData = append(filteredServiceData, serviceObject)
+		}
+	}
+
+	return filteredServiceData, nil
+}

api/http/proxy/manager.go

@@ -0,0 +1,69 @@
+package proxy
+
+import (
+	"net/http"
+	"net/url"
+
+	"github.com/orcaman/concurrent-map"
+	"github.com/portainer/portainer"
+)
+
+// Manager represents a service used to manage Docker proxies.
+type Manager struct {
+	proxyFactory *proxyFactory
+	proxies      cmap.ConcurrentMap
+}
+
+// NewManager initializes a new proxy Service
+func NewManager(resourceControlService portainer.ResourceControlService, teamMembershipService portainer.TeamMembershipService, settingsService portainer.SettingsService) *Manager {
+	return &Manager{
+		proxies: cmap.New(),
+		proxyFactory: &proxyFactory{
+			ResourceControlService: resourceControlService,
+			TeamMembershipService:  teamMembershipService,
+			SettingsService:        settingsService,
+		},
+	}
+}
+
+// CreateAndRegisterProxy creates a new HTTP reverse proxy and adds it to the registered proxies.
+// It can also be used to create a new HTTP reverse proxy and replace an already registered proxy.
+func (manager *Manager) CreateAndRegisterProxy(endpoint *portainer.Endpoint) (http.Handler, error) {
+	var proxy http.Handler
+
+	endpointURL, err := url.Parse(endpoint.URL)
+	if err != nil {
+		return nil, err
+	}
+
+	if endpointURL.Scheme == "tcp" {
+		if endpoint.TLS {
+			proxy, err = manager.proxyFactory.newHTTPSProxy(endpointURL, endpoint)
+			if err != nil {
+				return nil, err
+			}
+		} else {
+			proxy = manager.proxyFactory.newHTTPProxy(endpointURL)
+		}
+	} else {
+		// Assume unix:// scheme
+		proxy = manager.proxyFactory.newSocketProxy(endpointURL.Path)
+	}
+
+	manager.proxies.Set(string(endpoint.ID), proxy)
+	return proxy, nil
+}
+
+// GetProxy returns the proxy associated to a key
+func (manager *Manager) GetProxy(key string) http.Handler {
+	proxy, ok := manager.proxies.Get(key)
+	if !ok {
+		return nil
+	}
+	return proxy.(http.Handler)
+}
+
+// DeleteProxy deletes the proxy associated to a key
+func (manager *Manager) DeleteProxy(key string) {
+	manager.proxies.Remove(key)
+}

api/http/proxy/response.go

@@ -0,0 +1,95 @@
+package proxy
+
+import (
+	"bytes"
+	"encoding/json"
+	"io/ioutil"
+	"net/http"
+	"strconv"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrEmptyResponseBody defines an error raised when portainer excepts to parse the body of a HTTP response and there is nothing to parse
+	ErrEmptyResponseBody = portainer.Error("Empty response body")
+)
+
+func extractJSONField(jsonObject map[string]interface{}, key string) map[string]interface{} {
+	object := jsonObject[key]
+	if object != nil {
+		return object.(map[string]interface{})
+	}
+	return nil
+}
+
+func getResponseAsJSONOBject(response *http.Response) (map[string]interface{}, error) {
+	responseData, err := getResponseBodyAsGenericJSON(response)
+	if err != nil {
+		return nil, err
+	}
+
+	responseObject := responseData.(map[string]interface{})
+	return responseObject, nil
+}
+
+func getResponseAsJSONArray(response *http.Response) ([]interface{}, error) {
+	responseData, err := getResponseBodyAsGenericJSON(response)
+	if err != nil {
+		return nil, err
+	}
+
+	responseObject := responseData.([]interface{})
+	return responseObject, nil
+}
+
+func getResponseBodyAsGenericJSON(response *http.Response) (interface{}, error) {
+	var data interface{}
+	if response.Body != nil {
+		body, err := ioutil.ReadAll(response.Body)
+		if err != nil {
+			return nil, err
+		}
+
+		err = response.Body.Close()
+		if err != nil {
+			return nil, err
+		}
+
+		err = json.Unmarshal(body, &data)
+		if err != nil {
+			return nil, err
+		}
+
+		return data, nil
+	}
+	return nil, ErrEmptyResponseBody
+}
+
+func writeAccessDeniedResponse() (*http.Response, error) {
+	response := &http.Response{}
+	err := rewriteResponse(response, portainer.ErrResourceAccessDenied, http.StatusForbidden)
+	return response, err
+}
+
+func rewriteAccessDeniedResponse(response *http.Response) error {
+	return rewriteResponse(response, portainer.ErrResourceAccessDenied, http.StatusForbidden)
+}
+
+func rewriteResponse(response *http.Response, newResponseData interface{}, statusCode int) error {
+	jsonData, err := json.Marshal(newResponseData)
+	if err != nil {
+		return err
+	}
+	body := ioutil.NopCloser(bytes.NewReader(jsonData))
+	response.StatusCode = statusCode
+	response.Body = body
+	response.ContentLength = int64(len(jsonData))
+
+	if response.Header == nil {
+		response.Header = make(http.Header)
+	}
+	response.Header.Set("Content-Length", strconv.Itoa(len(jsonData)))
+
+	return nil
+}

api/http/proxy/reverse_proxy.go

@@ -0,0 +1,46 @@
+package proxy
+
+import (
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"strings"
+)
+
+// NewSingleHostReverseProxyWithHostHeader is based on NewSingleHostReverseProxy
+// from golang.org/src/net/http/httputil/reverseproxy.go and merely sets the Host
+// HTTP header, which NewSingleHostReverseProxy deliberately preserves.
+func newSingleHostReverseProxyWithHostHeader(target *url.URL) *httputil.ReverseProxy {
+	targetQuery := target.RawQuery
+	director := func(req *http.Request) {
+		req.URL.Scheme = target.Scheme
+		req.URL.Host = target.Host
+		req.URL.Path = singleJoiningSlash(target.Path, req.URL.Path)
+		req.Host = req.URL.Host
+		if targetQuery == "" || req.URL.RawQuery == "" {
+			req.URL.RawQuery = targetQuery + req.URL.RawQuery
+		} else {
+			req.URL.RawQuery = targetQuery + "&" + req.URL.RawQuery
+		}
+		if _, ok := req.Header["User-Agent"]; !ok {
+			// explicitly disable User-Agent so it's not set to default value
+			req.Header.Set("User-Agent", "")
+		}
+	}
+	return &httputil.ReverseProxy{Director: director}
+}
+
+// singleJoiningSlash from golang.org/src/net/http/httputil/reverseproxy.go
+// included here for use in NewSingleHostReverseProxyWithHostHeader
+// because its used in NewSingleHostReverseProxy from golang.org/src/net/http/httputil/reverseproxy.go
+func singleJoiningSlash(a, b string) string {
+	aslash := strings.HasSuffix(a, "/")
+	bslash := strings.HasPrefix(b, "/")
+	switch {
+	case aslash && bslash:
+		return a + b[1:]
+	case !aslash && !bslash:
+		return a + "/" + b
+	}
+	return a + b
+}

api/http/proxy/service.go

@@ -0,0 +1,64 @@
+package proxy
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrDockerServiceIdentifierNotFound defines an error raised when Portainer is unable to find a service identifier
+	ErrDockerServiceIdentifierNotFound = portainer.Error("Docker service identifier not found")
+	serviceIdentifier                  = "ID"
+)
+
+// serviceListOperation extracts the response as a JSON array, loop through the service array
+// decorate and/or filter the services based on resource controls before rewriting the response
+func serviceListOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	var err error
+	// ServiceList response is a JSON array
+	// https://docs.docker.com/engine/api/v1.28/#operation/ServiceList
+	responseArray, err := getResponseAsJSONArray(response)
+	if err != nil {
+		return err
+	}
+
+	if executor.operationContext.isAdmin {
+		responseArray, err = decorateServiceList(responseArray, executor.operationContext.resourceControls)
+	} else {
+		responseArray, err = filterServiceList(responseArray, executor.operationContext.resourceControls, executor.operationContext.userID, executor.operationContext.userTeamIDs)
+	}
+	if err != nil {
+		return err
+	}
+
+	return rewriteResponse(response, responseArray, http.StatusOK)
+}
+
+// serviceInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the service based on resource control and either rewrite an access denied response
+// or a decorated service.
+func serviceInspectOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	// ServiceInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/ServiceInspect
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	if responseObject[serviceIdentifier] == nil {
+		return ErrDockerServiceIdentifierNotFound
+	}
+	serviceID := responseObject[serviceIdentifier].(string)
+
+	resourceControl := getResourceControlByResourceID(serviceID, executor.operationContext.resourceControls)
+	if resourceControl != nil {
+		if executor.operationContext.isAdmin || canUserAccessResource(executor.operationContext.userID, executor.operationContext.userTeamIDs, resourceControl) {
+			responseObject = decorateObject(responseObject, resourceControl)
+		} else {
+			return rewriteAccessDeniedResponse(response)
+		}
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}

api/http/proxy/socket.go

@@ -0,0 +1,40 @@
+package proxy
+
+// unixSocketHandler represents a handler to proxy HTTP requests via a unix:// socket
+import (
+	"io"
+	"net/http"
+
+	httperror "github.com/portainer/portainer/http/error"
+)
+
+type socketProxy struct {
+	Transport *proxyTransport
+}
+
+func (proxy *socketProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	// Force URL/domain to http/unixsocket to be able to
+	// use http.Transport RoundTrip to do the requests via the socket
+	r.URL.Scheme = "http"
+	r.URL.Host = "unixsocket"
+
+	res, err := proxy.Transport.proxyDockerRequest(r)
+	if err != nil {
+		code := http.StatusInternalServerError
+		if res != nil && res.StatusCode != 0 {
+			code = res.StatusCode
+		}
+		httperror.WriteErrorResponse(w, err, code, nil)
+		return
+	}
+	defer res.Body.Close()
+
+	for k, vv := range res.Header {
+		for _, v := range vv {
+			w.Header().Add(k, v)
+		}
+	}
+	if _, err := io.Copy(w, res.Body); err != nil {
+		httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, nil)
+	}
+}

api/http/proxy/transport.go

@@ -0,0 +1,283 @@
+package proxy
+
+import (
+	"net"
+	"net/http"
+	"path"
+	"strings"
+
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/http/security"
+)
+
+type (
+	proxyTransport struct {
+		dockerTransport        *http.Transport
+		ResourceControlService portainer.ResourceControlService
+		TeamMembershipService  portainer.TeamMembershipService
+		SettingsService        portainer.SettingsService
+	}
+	restrictedOperationContext struct {
+		isAdmin          bool
+		userID           portainer.UserID
+		userTeamIDs      []portainer.TeamID
+		resourceControls []portainer.ResourceControl
+	}
+	operationExecutor struct {
+		operationContext *restrictedOperationContext
+		labelBlackList   []portainer.Pair
+	}
+	restrictedOperationRequest func(*http.Request, *http.Response, *operationExecutor) error
+)
+
+func newSocketTransport(socketPath string) *http.Transport {
+	return &http.Transport{
+		Dial: func(proto, addr string) (conn net.Conn, err error) {
+			return net.Dial("unix", socketPath)
+		},
+	}
+}
+
+func newHTTPTransport() *http.Transport {
+	return &http.Transport{}
+}
+
+func (p *proxyTransport) RoundTrip(request *http.Request) (*http.Response, error) {
+	return p.proxyDockerRequest(request)
+}
+
+func (p *proxyTransport) executeDockerRequest(request *http.Request) (*http.Response, error) {
+	return p.dockerTransport.RoundTrip(request)
+}
+
+func (p *proxyTransport) proxyDockerRequest(request *http.Request) (*http.Response, error) {
+	path := request.URL.Path
+
+	if strings.HasPrefix(path, "/containers") {
+		return p.proxyContainerRequest(request)
+	} else if strings.HasPrefix(path, "/services") {
+		return p.proxyServiceRequest(request)
+	} else if strings.HasPrefix(path, "/volumes") {
+		return p.proxyVolumeRequest(request)
+	} else if strings.HasPrefix(path, "/swarm") {
+		return p.proxySwarmRequest(request)
+	}
+
+	return p.executeDockerRequest(request)
+}
+
+func (p *proxyTransport) proxyContainerRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
+	case "/containers/create":
+		return p.executeDockerRequest(request)
+
+	case "/containers/prune":
+		return p.administratorOperation(request)
+
+	case "/containers/json":
+		return p.rewriteOperationWithLabelFiltering(request, containerListOperation)
+
+	default:
+		// This section assumes /containers/**
+		if match, _ := path.Match("/containers/*/*", requestPath); match {
+			// Handle /containers/{id}/{action} requests
+			containerID := path.Base(path.Dir(requestPath))
+			action := path.Base(requestPath)
+
+			if action == "json" {
+				return p.rewriteOperation(request, containerInspectOperation)
+			}
+			return p.restrictedOperation(request, containerID)
+		} else if match, _ := path.Match("/containers/*", requestPath); match {
+			// Handle /containers/{id} requests
+			containerID := path.Base(requestPath)
+			return p.restrictedOperation(request, containerID)
+		}
+		return p.executeDockerRequest(request)
+	}
+}
+
+func (p *proxyTransport) proxyServiceRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
+	case "/services/create":
+		return p.executeDockerRequest(request)
+
+	case "/services":
+		return p.rewriteOperation(request, serviceListOperation)
+
+	default:
+		// This section assumes /services/**
+		if match, _ := path.Match("/services/*/*", requestPath); match {
+			// Handle /services/{id}/{action} requests
+			serviceID := path.Base(path.Dir(requestPath))
+			return p.restrictedOperation(request, serviceID)
+		} else if match, _ := path.Match("/services/*", requestPath); match {
+			// Handle /services/{id} requests
+			serviceID := path.Base(requestPath)
+
+			if request.Method == http.MethodGet {
+				return p.rewriteOperation(request, serviceInspectOperation)
+			}
+			return p.restrictedOperation(request, serviceID)
+		}
+		return p.executeDockerRequest(request)
+	}
+}
+
+func (p *proxyTransport) proxyVolumeRequest(request *http.Request) (*http.Response, error) {
+	switch requestPath := request.URL.Path; requestPath {
+	case "/volumes/create":
+		return p.executeDockerRequest(request)
+
+	case "/volumes/prune":
+		return p.administratorOperation(request)
+
+	case "/volumes":
+		return p.rewriteOperation(request, volumeListOperation)
+
+	default:
+		// assume /volumes/{name}
+		if request.Method == http.MethodGet {
+			return p.rewriteOperation(request, volumeInspectOperation)
+		}
+		volumeID := path.Base(requestPath)
+		return p.restrictedOperation(request, volumeID)
+	}
+}
+
+func (p *proxyTransport) proxySwarmRequest(request *http.Request) (*http.Response, error) {
+	return p.administratorOperation(request)
+}
+
+// restrictedOperation ensures that the current user has the required authorizations
+// before executing the original request.
+func (p *proxyTransport) restrictedOperation(request *http.Request, resourceID string) (*http.Response, error) {
+	var err error
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, err
+	}
+
+	if tokenData.Role != portainer.AdministratorRole {
+
+		teamMemberships, err := p.TeamMembershipService.TeamMembershipsByUserID(tokenData.ID)
+		if err != nil {
+			return nil, err
+		}
+
+		userTeamIDs := make([]portainer.TeamID, 0)
+		for _, membership := range teamMemberships {
+			userTeamIDs = append(userTeamIDs, membership.TeamID)
+		}
+
+		resourceControls, err := p.ResourceControlService.ResourceControls()
+		if err != nil {
+			return nil, err
+		}
+
+		resourceControl := getResourceControlByResourceID(resourceID, resourceControls)
+		if resourceControl != nil && !canUserAccessResource(tokenData.ID, userTeamIDs, resourceControl) {
+			return writeAccessDeniedResponse()
+		}
+	}
+
+	return p.executeDockerRequest(request)
+}
+
+// rewriteOperation will create a new operation context with data that will be used
+// to decorate the original request's response as well as retrieve all the black listed labels
+// to filter the resources.
+func (p *proxyTransport) rewriteOperationWithLabelFiltering(request *http.Request, operation restrictedOperationRequest) (*http.Response, error) {
+	operationContext, err := p.createOperationContext(request)
+	if err != nil {
+		return nil, err
+	}
+
+	settings, err := p.SettingsService.Settings()
+	if err != nil {
+		return nil, err
+	}
+
+	executor := &operationExecutor{
+		operationContext: operationContext,
+		labelBlackList:   settings.BlackListedLabels,
+	}
+
+	return p.executeRequestAndRewriteResponse(request, operation, executor)
+}
+
+// rewriteOperation will create a new operation context with data that will be used
+// to decorate the original request's response.
+func (p *proxyTransport) rewriteOperation(request *http.Request, operation restrictedOperationRequest) (*http.Response, error) {
+	operationContext, err := p.createOperationContext(request)
+	if err != nil {
+		return nil, err
+	}
+
+	executor := &operationExecutor{
+		operationContext: operationContext,
+	}
+
+	return p.executeRequestAndRewriteResponse(request, operation, executor)
+}
+
+func (p *proxyTransport) executeRequestAndRewriteResponse(request *http.Request, operation restrictedOperationRequest, executor *operationExecutor) (*http.Response, error) {
+	response, err := p.executeDockerRequest(request)
+	if err != nil {
+		return response, err
+	}
+
+	err = operation(request, response, executor)
+	return response, err
+}
+
+// administratorOperation ensures that the user has administrator privileges
+// before executing the original request.
+func (p *proxyTransport) administratorOperation(request *http.Request) (*http.Response, error) {
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, err
+	}
+
+	if tokenData.Role != portainer.AdministratorRole {
+		return writeAccessDeniedResponse()
+	}
+
+	return p.executeDockerRequest(request)
+}
+
+func (p *proxyTransport) createOperationContext(request *http.Request) (*restrictedOperationContext, error) {
+	var err error
+	tokenData, err := security.RetrieveTokenData(request)
+	if err != nil {
+		return nil, err
+	}
+
+	resourceControls, err := p.ResourceControlService.ResourceControls()
+	if err != nil {
+		return nil, err
+	}
+
+	operationContext := &restrictedOperationContext{
+		isAdmin:          true,
+		userID:           tokenData.ID,
+		resourceControls: resourceControls,
+	}
+
+	if tokenData.Role != portainer.AdministratorRole {
+		operationContext.isAdmin = false
+
+		teamMemberships, err := p.TeamMembershipService.TeamMembershipsByUserID(tokenData.ID)
+		if err != nil {
+			return nil, err
+		}
+
+		userTeamIDs := make([]portainer.TeamID, 0)
+		for _, membership := range teamMemberships {
+			userTeamIDs = append(userTeamIDs, membership.TeamID)
+		}
+		operationContext.userTeamIDs = userTeamIDs
+	}
+
+	return operationContext, nil
+}

api/http/proxy/utils.go

@@ -0,0 +1,32 @@
+package proxy
+
+import "github.com/portainer/portainer"
+
+func getResourceControlByResourceID(resourceID string, resourceControls []portainer.ResourceControl) *portainer.ResourceControl {
+	for _, resourceControl := range resourceControls {
+		if resourceID == resourceControl.ResourceID {
+			return &resourceControl
+		}
+		for _, subResourceID := range resourceControl.SubResourceIDs {
+			if resourceID == subResourceID {
+				return &resourceControl
+			}
+		}
+	}
+	return nil
+}
+
+func containerHasBlackListedLabel(containerLabels map[string]interface{}, labelBlackList []portainer.Pair) bool {
+	for key, value := range containerLabels {
+		labelName := key
+		labelValue := value.(string)
+
+		for _, blackListedLabel := range labelBlackList {
+			if blackListedLabel.Name == labelName && blackListedLabel.Value == labelValue {
+				return true
+			}
+		}
+	}
+
+	return false
+}

api/http/proxy/volumes.go

@@ -0,0 +1,73 @@
+package proxy
+
+import (
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+const (
+	// ErrDockerVolumeIdentifierNotFound defines an error raised when Portainer is unable to find a volume identifier
+	ErrDockerVolumeIdentifierNotFound = portainer.Error("Docker volume identifier not found")
+	volumeIdentifier                  = "Name"
+)
+
+// volumeListOperation extracts the response as a JSON object, loop through the volume array
+// decorate and/or filter the volumes based on resource controls before rewriting the response
+func volumeListOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	var err error
+	// VolumeList response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	// The "Volumes" field contains the list of volumes as an array of JSON objects
+	// Response schema reference: https://docs.docker.com/engine/api/v1.28/#operation/VolumeList
+	if responseObject["Volumes"] != nil {
+		volumeData := responseObject["Volumes"].([]interface{})
+
+		if executor.operationContext.isAdmin {
+			volumeData, err = decorateVolumeList(volumeData, executor.operationContext.resourceControls)
+		} else {
+			volumeData, err = filterVolumeList(volumeData, executor.operationContext.resourceControls, executor.operationContext.userID, executor.operationContext.userTeamIDs)
+		}
+		if err != nil {
+			return err
+		}
+
+		// Overwrite the original volume list
+		responseObject["Volumes"] = volumeData
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}
+
+// volumeInspectOperation extracts the response as a JSON object, verify that the user
+// has access to the volume based on resource control and either rewrite an access denied response
+// or a decorated volume.
+func volumeInspectOperation(request *http.Request, response *http.Response, executor *operationExecutor) error {
+	// VolumeInspect response is a JSON object
+	// https://docs.docker.com/engine/api/v1.28/#operation/VolumeInspect
+	responseObject, err := getResponseAsJSONOBject(response)
+	if err != nil {
+		return err
+	}
+
+	if responseObject[volumeIdentifier] == nil {
+		return ErrDockerVolumeIdentifierNotFound
+	}
+	volumeID := responseObject[volumeIdentifier].(string)
+
+	resourceControl := getResourceControlByResourceID(volumeID, executor.operationContext.resourceControls)
+	if resourceControl != nil {
+		if executor.operationContext.isAdmin || canUserAccessResource(executor.operationContext.userID, executor.operationContext.userTeamIDs, resourceControl) {
+			responseObject = decorateObject(responseObject, resourceControl)
+		} else {
+			return rewriteAccessDeniedResponse(response)
+		}
+	}
+
+	return rewriteResponse(response, responseObject, http.StatusOK)
+}

api/http/security/authorization.go

@@ -0,0 +1,123 @@
+package security
+
+import "github.com/portainer/portainer"
+
+// AuthorizedResourceControlDeletion ensure that the user can delete a resource control object.
+// A non-administrator user cannot delete a resource control where:
+// * the AdministratorsOnly flag is set
+// * he is not one of the users in the user accesses
+// * he is not a member of any team within the team accesses
+func AuthorizedResourceControlDeletion(resourceControl *portainer.ResourceControl, context *RestrictedRequestContext) bool {
+	if context.IsAdmin {
+		return true
+	}
+
+	if resourceControl.AdministratorsOnly {
+		return false
+	}
+
+	userAccessesCount := len(resourceControl.UserAccesses)
+	teamAccessesCount := len(resourceControl.TeamAccesses)
+
+	if teamAccessesCount > 0 {
+		for _, access := range resourceControl.TeamAccesses {
+			for _, membership := range context.UserMemberships {
+				if membership.TeamID == access.TeamID {
+					return true
+				}
+			}
+		}
+	}
+
+	if userAccessesCount > 0 {
+		for _, access := range resourceControl.UserAccesses {
+			if access.UserID == context.UserID {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
+// AuthorizedResourceControlUpdate ensure that the user can update a resource control object.
+// It reuses the creation restrictions and adds extra checks.
+// A non-administrator user cannot update a resource control where:
+// * he wants to put one or more user in the user accesses
+func AuthorizedResourceControlUpdate(resourceControl *portainer.ResourceControl, context *RestrictedRequestContext) bool {
+	userAccessesCount := len(resourceControl.UserAccesses)
+	if !context.IsAdmin && userAccessesCount > 0 {
+		return false
+	}
+
+	return AuthorizedResourceControlCreation(resourceControl, context)
+}
+
+// AuthorizedResourceControlCreation ensure that the user can create a resource control object.
+// A non-administrator user cannot create a resource control where:
+// * the AdministratorsOnly flag is set
+// * he wants to add more than one user in the user accesses
+// * he wants to add a team he is not a member of
+func AuthorizedResourceControlCreation(resourceControl *portainer.ResourceControl, context *RestrictedRequestContext) bool {
+	if context.IsAdmin {
+		return true
+	}
+
+	if resourceControl.AdministratorsOnly {
+		return false
+	}
+
+	userAccessesCount := len(resourceControl.UserAccesses)
+	teamAccessesCount := len(resourceControl.TeamAccesses)
+	if userAccessesCount > 1 || (userAccessesCount == 1 && teamAccessesCount == 1) {
+		return false
+	}
+
+	if userAccessesCount == 1 {
+		access := resourceControl.UserAccesses[0]
+		if access.UserID == context.UserID {
+			return true
+		}
+	}
+
+	if teamAccessesCount > 0 {
+		for _, access := range resourceControl.TeamAccesses {
+			isMember := false
+			for _, membership := range context.UserMemberships {
+				if membership.TeamID == access.TeamID {
+					isMember = true
+				}
+			}
+			if !isMember {
+				return false
+			}
+		}
+	}
+
+	return true
+}
+
+// AuthorizedTeamManagement ensure that access to the management of the specified team is granted.
+// It will check if the user is either administrator or leader of that team.
+func AuthorizedTeamManagement(teamID portainer.TeamID, context *RestrictedRequestContext) bool {
+	if context.IsAdmin {
+		return true
+	}
+
+	for _, membership := range context.UserMemberships {
+		if membership.TeamID == teamID && membership.Role == portainer.TeamLeader {
+			return true
+		}
+	}
+
+	return false
+}
+
+// AuthorizedUserManagement ensure that access to the management of the specified user is granted.
+// It will check if the user is either administrator or the owner of the user account.
+func AuthorizedUserManagement(userID portainer.UserID, context *RestrictedRequestContext) bool {
+	if context.IsAdmin || context.UserID == userID {
+		return true
+	}
+	return false
+}

api/http/security/bouncer.go

@@ -0,0 +1,176 @@
+package security
+
+import (
+	"github.com/portainer/portainer"
+	httperror "github.com/portainer/portainer/http/error"
+
+	"net/http"
+	"strings"
+)
+
+type (
+	// RequestBouncer represents an entity that manages API request accesses
+	RequestBouncer struct {
+		jwtService            portainer.JWTService
+		teamMembershipService portainer.TeamMembershipService
+		authDisabled          bool
+	}
+
+	// RestrictedRequestContext is a data structure containing information
+	// used in RestrictedAccess
+	RestrictedRequestContext struct {
+		IsAdmin         bool
+		IsTeamLeader    bool
+		UserID          portainer.UserID
+		UserMemberships []portainer.TeamMembership
+	}
+)
+
+// NewRequestBouncer initializes a new RequestBouncer
+func NewRequestBouncer(jwtService portainer.JWTService, teamMembershipService portainer.TeamMembershipService, authDisabled bool) *RequestBouncer {
+	return &RequestBouncer{
+		jwtService:            jwtService,
+		teamMembershipService: teamMembershipService,
+		authDisabled:          authDisabled,
+	}
+}
+
+// PublicAccess defines a security check for public endpoints.
+// No authentication is required to access these endpoints.
+func (bouncer *RequestBouncer) PublicAccess(h http.Handler) http.Handler {
+	h = mwSecureHeaders(h)
+	return h
+}
+
+// AuthenticatedAccess defines a security check for private endpoints.
+// Authentication is required to access these endpoints.
+func (bouncer *RequestBouncer) AuthenticatedAccess(h http.Handler) http.Handler {
+	h = bouncer.mwCheckAuthentication(h)
+	h = mwSecureHeaders(h)
+	return h
+}
+
+// RestrictedAccess defines defines a security check for restricted endpoints.
+// Authentication is required to access these endpoints.
+// The request context will be enhanced with a RestrictedRequestContext object
+// that might be used later to authorize/filter access to resources.
+func (bouncer *RequestBouncer) RestrictedAccess(h http.Handler) http.Handler {
+	h = bouncer.mwUpgradeToRestrictedRequest(h)
+	h = bouncer.AuthenticatedAccess(h)
+	return h
+}
+
+// AdministratorAccess defines a chain of middleware for restricted endpoints.
+// Authentication as well as administrator role are required to access these endpoints.
+func (bouncer *RequestBouncer) AdministratorAccess(h http.Handler) http.Handler {
+	h = mwCheckAdministratorRole(h)
+	h = bouncer.AuthenticatedAccess(h)
+	return h
+}
+
+// mwSecureHeaders provides secure headers middleware for handlers.
+func mwSecureHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Add("X-Content-Type-Options", "nosniff")
+		w.Header().Add("X-Frame-Options", "DENY")
+		next.ServeHTTP(w, r)
+	})
+}
+
+// mwUpgradeToRestrictedRequest will enhance the current request with
+// a new RestrictedRequestContext object.
+func (bouncer *RequestBouncer) mwUpgradeToRestrictedRequest(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		tokenData, err := RetrieveTokenData(r)
+		if err != nil {
+			httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, nil)
+			return
+		}
+
+		requestContext, err := bouncer.newRestrictedContextRequest(tokenData.ID, tokenData.Role)
+		if err != nil {
+			httperror.WriteErrorResponse(w, err, http.StatusInternalServerError, nil)
+			return
+		}
+
+		ctx := storeRestrictedRequestContext(r, requestContext)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+// mwCheckAdministratorRole check the role of the user associated to the request
+func mwCheckAdministratorRole(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		tokenData, err := RetrieveTokenData(r)
+		if err != nil || tokenData.Role != portainer.AdministratorRole {
+			httperror.WriteErrorResponse(w, portainer.ErrResourceAccessDenied, http.StatusForbidden, nil)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
+
+// mwCheckAuthentication provides Authentication middleware for handlers
+func (bouncer *RequestBouncer) mwCheckAuthentication(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var tokenData *portainer.TokenData
+		if !bouncer.authDisabled {
+			var token string
+
+			// Get token from the Authorization header
+			tokens, ok := r.Header["Authorization"]
+			if ok && len(tokens) >= 1 {
+				token = tokens[0]
+				token = strings.TrimPrefix(token, "Bearer ")
+			}
+
+			if token == "" {
+				httperror.WriteErrorResponse(w, portainer.ErrUnauthorized, http.StatusUnauthorized, nil)
+				return
+			}
+
+			var err error
+			tokenData, err = bouncer.jwtService.ParseAndVerifyToken(token)
+			if err != nil {
+				httperror.WriteErrorResponse(w, err, http.StatusUnauthorized, nil)
+				return
+			}
+		} else {
+			tokenData = &portainer.TokenData{
+				Role: portainer.AdministratorRole,
+			}
+		}
+
+		ctx := storeTokenData(r, tokenData)
+		next.ServeHTTP(w, r.WithContext(ctx))
+		return
+	})
+}
+
+func (bouncer *RequestBouncer) newRestrictedContextRequest(userID portainer.UserID, userRole portainer.UserRole) (*RestrictedRequestContext, error) {
+	requestContext := &RestrictedRequestContext{
+		IsAdmin: true,
+		UserID:  userID,
+	}
+
+	if userRole != portainer.AdministratorRole {
+		requestContext.IsAdmin = false
+		memberships, err := bouncer.teamMembershipService.TeamMembershipsByUserID(userID)
+		if err != nil {
+			return nil, err
+		}
+
+		isTeamLeader := false
+		for _, membership := range memberships {
+			if membership.Role == portainer.TeamLeader {
+				isTeamLeader = true
+			}
+		}
+
+		requestContext.IsTeamLeader = isTeamLeader
+		requestContext.UserMemberships = memberships
+	}
+
+	return requestContext, nil
+}

api/http/security/context.go

@@ -0,0 +1,50 @@
+package security
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/portainer/portainer"
+)
+
+type (
+	contextKey int
+)
+
+const (
+	contextAuthenticationKey contextKey = iota
+	contextRestrictedRequest
+)
+
+// storeTokenData stores a TokenData object inside the request context and returns the enhanced context.
+func storeTokenData(request *http.Request, tokenData *portainer.TokenData) context.Context {
+	return context.WithValue(request.Context(), contextAuthenticationKey, tokenData)
+}
+
+// RetrieveTokenData returns the TokenData object stored in the request context.
+func RetrieveTokenData(request *http.Request) (*portainer.TokenData, error) {
+	contextData := request.Context().Value(contextAuthenticationKey)
+	if contextData == nil {
+		return nil, portainer.ErrMissingContextData
+	}
+
+	tokenData := contextData.(*portainer.TokenData)
+	return tokenData, nil
+}
+
+// storeRestrictedRequestContext stores a RestrictedRequestContext object inside the request context
+// and returns the enhanced context.
+func storeRestrictedRequestContext(request *http.Request, requestContext *RestrictedRequestContext) context.Context {
+	return context.WithValue(request.Context(), contextRestrictedRequest, requestContext)
+}
+
+// RetrieveRestrictedRequestContext returns the RestrictedRequestContext object stored in the request context.
+func RetrieveRestrictedRequestContext(request *http.Request) (*RestrictedRequestContext, error) {
+	contextData := request.Context().Value(contextRestrictedRequest)
+	if contextData == nil {
+		return nil, portainer.ErrMissingSecurityContext
+	}
+
+	requestContext := contextData.(*RestrictedRequestContext)
+	return requestContext, nil
+}

api/http/security/filter.go

@@ -0,0 +1,129 @@
+package security
+
+import "github.com/portainer/portainer"
+
+// FilterUserTeams filters teams based on user role.
+// non-administrator users only have access to team they are member of.
+func FilterUserTeams(teams []portainer.Team, context *RestrictedRequestContext) []portainer.Team {
+	filteredTeams := teams
+
+	if !context.IsAdmin {
+		filteredTeams = make([]portainer.Team, 0)
+		for _, membership := range context.UserMemberships {
+			for _, team := range teams {
+				if team.ID == membership.TeamID {
+					filteredTeams = append(filteredTeams, team)
+					break
+				}
+			}
+		}
+	}
+
+	return filteredTeams
+}
+
+// FilterLeaderTeams filters teams based on user role.
+// Team leaders only have access to team they lead.
+func FilterLeaderTeams(teams []portainer.Team, context *RestrictedRequestContext) []portainer.Team {
+	filteredTeams := teams
+
+	if context.IsTeamLeader {
+		filteredTeams = make([]portainer.Team, 0)
+		for _, membership := range context.UserMemberships {
+			for _, team := range teams {
+				if team.ID == membership.TeamID && membership.Role == portainer.TeamLeader {
+					filteredTeams = append(filteredTeams, team)
+					break
+				}
+			}
+		}
+	}
+
+	return filteredTeams
+}
+
+// FilterUsers filters users based on user role.
+// Non-administrator users only have access to non-administrator users.
+func FilterUsers(users []portainer.User, context *RestrictedRequestContext) []portainer.User {
+	filteredUsers := users
+
+	if !context.IsAdmin {
+		filteredUsers = make([]portainer.User, 0)
+
+		for _, user := range users {
+			if user.Role != portainer.AdministratorRole {
+				filteredUsers = append(filteredUsers, user)
+			}
+		}
+	}
+
+	return filteredUsers
+}
+
+// FilterRegistries filters registries based on user role and team memberships.
+// Non administrator users only have access to authorized endpoints.
+func FilterRegistries(registries []portainer.Registry, context *RestrictedRequestContext) ([]portainer.Registry, error) {
+
+	filteredRegistries := registries
+	if !context.IsAdmin {
+		filteredRegistries = make([]portainer.Registry, 0)
+
+		for _, registry := range registries {
+			if isRegistryAccessAuthorized(&registry, context.UserID, context.UserMemberships) {
+				filteredRegistries = append(filteredRegistries, registry)
+			}
+		}
+	}
+
+	return filteredRegistries, nil
+}
+
+// FilterEndpoints filters endpoints based on user role and team memberships.
+// Non administrator users only have access to authorized endpoints.
+func FilterEndpoints(endpoints []portainer.Endpoint, context *RestrictedRequestContext) ([]portainer.Endpoint, error) {
+	filteredEndpoints := endpoints
+
+	if !context.IsAdmin {
+		filteredEndpoints = make([]portainer.Endpoint, 0)
+
+		for _, endpoint := range endpoints {
+			if isEndpointAccessAuthorized(&endpoint, context.UserID, context.UserMemberships) {
+				filteredEndpoints = append(filteredEndpoints, endpoint)
+			}
+		}
+	}
+
+	return filteredEndpoints, nil
+}
+
+func isRegistryAccessAuthorized(registry *portainer.Registry, userID portainer.UserID, memberships []portainer.TeamMembership) bool {
+	for _, authorizedUserID := range registry.AuthorizedUsers {
+		if authorizedUserID == userID {
+			return true
+		}
+	}
+	for _, membership := range memberships {
+		for _, authorizedTeamID := range registry.AuthorizedTeams {
+			if membership.TeamID == authorizedTeamID {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func isEndpointAccessAuthorized(endpoint *portainer.Endpoint, userID portainer.UserID, memberships []portainer.TeamMembership) bool {
+	for _, authorizedUserID := range endpoint.AuthorizedUsers {
+		if authorizedUserID == userID {
+			return true
+		}
+	}
+	for _, membership := range memberships {
+		for _, authorizedTeamID := range endpoint.AuthorizedTeams {
+			if membership.TeamID == authorizedTeamID {
+				return true
+			}
+		}
+	}
+	return false
+}

api/http/server.go

@@ -0,0 +1,103 @@
+package http
+
+import (
+	"github.com/portainer/portainer"
+	"github.com/portainer/portainer/http/handler"
+	"github.com/portainer/portainer/http/proxy"
+	"github.com/portainer/portainer/http/security"
+
+	"net/http"
+)
+
+// Server implements the portainer.Server interface
+type Server struct {
+	BindAddress            string
+	AssetsPath             string
+	AuthDisabled           bool
+	EndpointManagement     bool
+	Status                 *portainer.Status
+	UserService            portainer.UserService
+	TeamService            portainer.TeamService
+	TeamMembershipService  portainer.TeamMembershipService
+	EndpointService        portainer.EndpointService
+	ResourceControlService portainer.ResourceControlService
+	SettingsService        portainer.SettingsService
+	CryptoService          portainer.CryptoService
+	JWTService             portainer.JWTService
+	FileService            portainer.FileService
+	RegistryService        portainer.RegistryService
+	DockerHubService       portainer.DockerHubService
+	Handler                *handler.Handler
+	SSL                    bool
+	SSLCert                string
+	SSLKey                 string
+}
+
+// Start starts the HTTP server
+func (server *Server) Start() error {
+	requestBouncer := security.NewRequestBouncer(server.JWTService, server.TeamMembershipService, server.AuthDisabled)
+	proxyManager := proxy.NewManager(server.ResourceControlService, server.TeamMembershipService, server.SettingsService)
+
+	var authHandler = handler.NewAuthHandler(requestBouncer, server.AuthDisabled)
+	authHandler.UserService = server.UserService
+	authHandler.CryptoService = server.CryptoService
+	authHandler.JWTService = server.JWTService
+	var userHandler = handler.NewUserHandler(requestBouncer)
+	userHandler.UserService = server.UserService
+	userHandler.TeamService = server.TeamService
+	userHandler.TeamMembershipService = server.TeamMembershipService
+	userHandler.CryptoService = server.CryptoService
+	userHandler.ResourceControlService = server.ResourceControlService
+	var teamHandler = handler.NewTeamHandler(requestBouncer)
+	teamHandler.TeamService = server.TeamService
+	teamHandler.TeamMembershipService = server.TeamMembershipService
+	var teamMembershipHandler = handler.NewTeamMembershipHandler(requestBouncer)
+	teamMembershipHandler.TeamMembershipService = server.TeamMembershipService
+	var statusHandler = handler.NewStatusHandler(requestBouncer, server.Status)
+	var settingsHandler = handler.NewSettingsHandler(requestBouncer)
+	settingsHandler.SettingsService = server.SettingsService
+	var templatesHandler = handler.NewTemplatesHandler(requestBouncer)
+	templatesHandler.SettingsService = server.SettingsService
+	var dockerHandler = handler.NewDockerHandler(requestBouncer)
+	dockerHandler.EndpointService = server.EndpointService
+	dockerHandler.TeamMembershipService = server.TeamMembershipService
+	dockerHandler.ProxyManager = proxyManager
+	var websocketHandler = handler.NewWebSocketHandler()
+	websocketHandler.EndpointService = server.EndpointService
+	var endpointHandler = handler.NewEndpointHandler(requestBouncer, server.EndpointManagement)
+	endpointHandler.EndpointService = server.EndpointService
+	endpointHandler.FileService = server.FileService
+	endpointHandler.ProxyManager = proxyManager
+	var registryHandler = handler.NewRegistryHandler(requestBouncer)
+	registryHandler.RegistryService = server.RegistryService
+	var dockerHubHandler = handler.NewDockerHubHandler(requestBouncer)
+	dockerHubHandler.DockerHubService = server.DockerHubService
+	var resourceHandler = handler.NewResourceHandler(requestBouncer)
+	resourceHandler.ResourceControlService = server.ResourceControlService
+	var uploadHandler = handler.NewUploadHandler(requestBouncer)
+	uploadHandler.FileService = server.FileService
+	var fileHandler = handler.NewFileHandler(server.AssetsPath)
+
+	server.Handler = &handler.Handler{
+		AuthHandler:           authHandler,
+		UserHandler:           userHandler,
+		TeamHandler:           teamHandler,
+		TeamMembershipHandler: teamMembershipHandler,
+		EndpointHandler:       endpointHandler,
+		RegistryHandler:       registryHandler,
+		DockerHubHandler:      dockerHubHandler,
+		ResourceHandler:       resourceHandler,
+		SettingsHandler:       settingsHandler,
+		StatusHandler:         statusHandler,
+		TemplatesHandler:      templatesHandler,
+		DockerHandler:         dockerHandler,
+		WebSocketHandler:      websocketHandler,
+		FileHandler:           fileHandler,
+		UploadHandler:         uploadHandler,
+	}
+
+	if server.SSL {
+		return http.ListenAndServeTLS(server.BindAddress, server.SSLCert, server.SSLKey, server.Handler)
+	}
+	return http.ListenAndServe(server.BindAddress, server.Handler)
+}

api/jwt/jwt.go

@@ -0,0 +1,79 @@
+package jwt
+
+import (
+	"github.com/portainer/portainer"
+
+	"fmt"
+	"time"
+
+	"github.com/dgrijalva/jwt-go"
+	"github.com/gorilla/securecookie"
+)
+
+// Service represents a service for managing JWT tokens.
+type Service struct {
+	secret []byte
+}
+
+type claims struct {
+	UserID   int    `json:"id"`
+	Username string `json:"username"`
+	Role     int    `json:"role"`
+	jwt.StandardClaims
+}
+
+// NewService initializes a new service. It will generate a random key that will be used to sign JWT tokens.
+func NewService() (*Service, error) {
+	secret := securecookie.GenerateRandomKey(32)
+	if secret == nil {
+		return nil, portainer.ErrSecretGeneration
+	}
+	service := &Service{
+		secret,
+	}
+	return service, nil
+}
+
+// GenerateToken generates a new JWT token.
+func (service *Service) GenerateToken(data *portainer.TokenData) (string, error) {
+	expireToken := time.Now().Add(time.Hour * 8).Unix()
+	cl := claims{
+		int(data.ID),
+		data.Username,
+		int(data.Role),
+		jwt.StandardClaims{
+			ExpiresAt: expireToken,
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, cl)
+
+	signedToken, err := token.SignedString(service.secret)
+	if err != nil {
+		return "", err
+	}
+
+	return signedToken, nil
+}
+
+// ParseAndVerifyToken parses a JWT token and verify its validity. It returns an error if token is invalid.
+func (service *Service) ParseAndVerifyToken(token string) (*portainer.TokenData, error) {
+	parsedToken, err := jwt.ParseWithClaims(token, &claims{}, func(token *jwt.Token) (interface{}, error) {
+		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+			msg := fmt.Errorf("Unexpected signing method: %v", token.Header["alg"])
+			return nil, msg
+		}
+		return service.secret, nil
+	})
+	if err == nil && parsedToken != nil {
+		if cl, ok := parsedToken.Claims.(*claims); ok && parsedToken.Valid {
+			tokenData := &portainer.TokenData{
+				ID:       portainer.UserID(cl.UserID),
+				Username: cl.Username,
+				Role:     portainer.UserRole(cl.Role),
+			}
+			return tokenData, nil
+		}
+	}
+
+	return nil, portainer.ErrInvalidJWTToken
+}

api/portainer.go

@@ -0,0 +1,354 @@
+package portainer
+
+import "io"
+
+type (
+	// Pair defines a key/value string pair
+	Pair struct {
+		Name  string `json:"name"`
+		Value string `json:"value"`
+	}
+
+	// CLIFlags represents the available flags on the CLI.
+	CLIFlags struct {
+		Addr              *string
+		Assets            *string
+		Data              *string
+		ExternalEndpoints *string
+		SyncInterval      *string
+		Endpoint          *string
+		NoAuth            *bool
+		NoAnalytics       *bool
+		TLSVerify         *bool
+		TLSCacert         *string
+		TLSCert           *string
+		TLSKey            *string
+		SSL               *bool
+		SSLCert           *string
+		SSLKey            *string
+		AdminPassword     *string
+		// Deprecated fields
+		Logo      *string
+		Templates *string
+		Labels    *[]Pair
+	}
+
+	// Status represents the application status.
+	Status struct {
+		Authentication     bool   `json:"Authentication"`
+		EndpointManagement bool   `json:"EndpointManagement"`
+		Analytics          bool   `json:"Analytics"`
+		Version            string `json:"Version"`
+	}
+
+	// Settings represents the application settings.
+	Settings struct {
+		TemplatesURL                string `json:"TemplatesURL"`
+		LogoURL                     string `json:"LogoURL"`
+		BlackListedLabels           []Pair `json:"BlackListedLabels"`
+		DisplayExternalContributors bool   `json:"DisplayExternalContributors"`
+	}
+
+	// User represents a user account.
+	User struct {
+		ID       UserID   `json:"Id"`
+		Username string   `json:"Username"`
+		Password string   `json:"Password,omitempty"`
+		Role     UserRole `json:"Role"`
+	}
+
+	// UserID represents a user identifier
+	UserID int
+
+	// UserRole represents the role of a user. It can be either an administrator
+	// or a regular user
+	UserRole int
+
+	// Team represents a list of user accounts.
+	Team struct {
+		ID   TeamID `json:"Id"`
+		Name string `json:"Name"`
+	}
+
+	// TeamID represents a team identifier
+	TeamID int
+
+	// TeamMembership represents a membership association between a user and a team
+	TeamMembership struct {
+		ID     TeamMembershipID `json:"Id"`
+		UserID UserID           `json:"UserID"`
+		TeamID TeamID           `json:"TeamID"`
+		Role   MembershipRole   `json:"Role"`
+	}
+
+	// TeamMembershipID represents a team membership identifier
+	TeamMembershipID int
+
+	// MembershipRole represents the role of a user within a team
+	MembershipRole int
+
+	// TokenData represents the data embedded in a JWT token.
+	TokenData struct {
+		ID       UserID
+		Username string
+		Role     UserRole
+	}
+
+	// RegistryID represents a registry identifier.
+	RegistryID int
+
+	// Registry represents a Docker registry with all the info required
+	// to connect to it.
+	Registry struct {
+		ID              RegistryID `json:"Id"`
+		Name            string     `json:"Name"`
+		URL             string     `json:"URL"`
+		Authentication  bool       `json:"Authentication"`
+		Username        string     `json:"Username"`
+		Password        string     `json:"Password"`
+		AuthorizedUsers []UserID   `json:"AuthorizedUsers"`
+		AuthorizedTeams []TeamID   `json:"AuthorizedTeams"`
+	}
+
+	// DockerHub represents all the required information to connect and use the
+	// Docker Hub.
+	DockerHub struct {
+		Authentication bool   `json:"Authentication"`
+		Username       string `json:"Username"`
+		Password       string `json:"Password"`
+	}
+
+	// EndpointID represents an endpoint identifier.
+	EndpointID int
+
+	// Endpoint represents a Docker endpoint with all the info required
+	// to connect to it.
+	Endpoint struct {
+		ID              EndpointID `json:"Id"`
+		Name            string     `json:"Name"`
+		URL             string     `json:"URL"`
+		PublicURL       string     `json:"PublicURL"`
+		TLS             bool       `json:"TLS"`
+		TLSCACertPath   string     `json:"TLSCACert,omitempty"`
+		TLSCertPath     string     `json:"TLSCert,omitempty"`
+		TLSKeyPath      string     `json:"TLSKey,omitempty"`
+		AuthorizedUsers []UserID   `json:"AuthorizedUsers"`
+		AuthorizedTeams []TeamID   `json:"AuthorizedTeams"`
+	}
+
+	// ResourceControlID represents a resource control identifier.
+	ResourceControlID int
+
+	// ResourceControl represent a reference to a Docker resource with specific access controls
+	ResourceControl struct {
+		ID                 ResourceControlID   `json:"Id"`
+		ResourceID         string              `json:"ResourceId"`
+		SubResourceIDs     []string            `json:"SubResourceIds"`
+		Type               ResourceControlType `json:"Type"`
+		AdministratorsOnly bool                `json:"AdministratorsOnly"`
+
+		UserAccesses []UserResourceAccess `json:"UserAccesses"`
+		TeamAccesses []TeamResourceAccess `json:"TeamAccesses"`
+
+		// Deprecated fields
+		// Deprecated: OwnerID field is deprecated in DBVersion == 2
+		OwnerID UserID `json:"OwnerId"`
+		// Deprecated: AccessLevel field is deprecated in DBVersion == 2
+		AccessLevel ResourceAccessLevel `json:"AccessLevel"`
+	}
+
+	// ResourceControlType represents the type of resource associated to the resource control (volume, container, service).
+	ResourceControlType int
+
+	// UserResourceAccess represents the level of control on a resource for a specific user.
+	UserResourceAccess struct {
+		UserID      UserID              `json:"UserId"`
+		AccessLevel ResourceAccessLevel `json:"AccessLevel"`
+	}
+
+	// TeamResourceAccess represents the level of control on a resource for a specific team.
+	TeamResourceAccess struct {
+		TeamID      TeamID              `json:"TeamId"`
+		AccessLevel ResourceAccessLevel `json:"AccessLevel"`
+	}
+
+	// ResourceAccessLevel represents the level of control associated to a resource.
+	ResourceAccessLevel int
+
+	// TLSFileType represents a type of TLS file required to connect to a Docker endpoint.
+	// It can be either a TLS CA file, a TLS certificate file or a TLS key file.
+	TLSFileType int
+
+	// CLIService represents a service for managing CLI.
+	CLIService interface {
+		ParseFlags(version string) (*CLIFlags, error)
+		ValidateFlags(flags *CLIFlags) error
+	}
+
+	// DataStore defines the interface to manage the data.
+	DataStore interface {
+		Open() error
+		Close() error
+		MigrateData() error
+	}
+
+	// Server defines the interface to serve the API.
+	Server interface {
+		Start() error
+	}
+
+	// UserService represents a service for managing user data.
+	UserService interface {
+		User(ID UserID) (*User, error)
+		UserByUsername(username string) (*User, error)
+		Users() ([]User, error)
+		UsersByRole(role UserRole) ([]User, error)
+		CreateUser(user *User) error
+		UpdateUser(ID UserID, user *User) error
+		DeleteUser(ID UserID) error
+	}
+
+	// TeamService represents a service for managing user data.
+	TeamService interface {
+		Team(ID TeamID) (*Team, error)
+		TeamByName(name string) (*Team, error)
+		Teams() ([]Team, error)
+		CreateTeam(team *Team) error
+		UpdateTeam(ID TeamID, team *Team) error
+		DeleteTeam(ID TeamID) error
+	}
+
+	// TeamMembershipService represents a service for managing team membership data.
+	TeamMembershipService interface {
+		TeamMembership(ID TeamMembershipID) (*TeamMembership, error)
+		TeamMemberships() ([]TeamMembership, error)
+		TeamMembershipsByUserID(userID UserID) ([]TeamMembership, error)
+		TeamMembershipsByTeamID(teamID TeamID) ([]TeamMembership, error)
+		CreateTeamMembership(membership *TeamMembership) error
+		UpdateTeamMembership(ID TeamMembershipID, membership *TeamMembership) error
+		DeleteTeamMembership(ID TeamMembershipID) error
+		DeleteTeamMembershipByUserID(userID UserID) error
+		DeleteTeamMembershipByTeamID(teamID TeamID) error
+	}
+
+	// EndpointService represents a service for managing endpoint data.
+	EndpointService interface {
+		Endpoint(ID EndpointID) (*Endpoint, error)
+		Endpoints() ([]Endpoint, error)
+		CreateEndpoint(endpoint *Endpoint) error
+		UpdateEndpoint(ID EndpointID, endpoint *Endpoint) error
+		DeleteEndpoint(ID EndpointID) error
+		Synchronize(toCreate, toUpdate, toDelete []*Endpoint) error
+	}
+
+	// RegistryService represents a service for managing registry data.
+	RegistryService interface {
+		Registry(ID RegistryID) (*Registry, error)
+		Registries() ([]Registry, error)
+		CreateRegistry(registry *Registry) error
+		UpdateRegistry(ID RegistryID, registry *Registry) error
+		DeleteRegistry(ID RegistryID) error
+	}
+
+	// DockerHubService represents a service for managing the DockerHub object.
+	DockerHubService interface {
+		DockerHub() (*DockerHub, error)
+		StoreDockerHub(registry *DockerHub) error
+	}
+
+	// SettingsService represents a service for managing application settings.
+	SettingsService interface {
+		Settings() (*Settings, error)
+		StoreSettings(settings *Settings) error
+	}
+
+	// VersionService represents a service for managing version data.
+	VersionService interface {
+		DBVersion() (int, error)
+		StoreDBVersion(version int) error
+	}
+
+	// ResourceControlService represents a service for managing resource control data.
+	ResourceControlService interface {
+		ResourceControl(ID ResourceControlID) (*ResourceControl, error)
+		ResourceControlByResourceID(resourceID string) (*ResourceControl, error)
+		ResourceControls() ([]ResourceControl, error)
+		CreateResourceControl(rc *ResourceControl) error
+		UpdateResourceControl(ID ResourceControlID, resourceControl *ResourceControl) error
+		DeleteResourceControl(ID ResourceControlID) error
+	}
+
+	// CryptoService represents a service for encrypting/hashing data.
+	CryptoService interface {
+		Hash(data string) (string, error)
+		CompareHashAndData(hash string, data string) error
+	}
+
+	// JWTService represents a service for managing JWT tokens.
+	JWTService interface {
+		GenerateToken(data *TokenData) (string, error)
+		ParseAndVerifyToken(token string) (*TokenData, error)
+	}
+
+	// FileService represents a service for managing files.
+	FileService interface {
+		StoreTLSFile(endpointID EndpointID, fileType TLSFileType, r io.Reader) error
+		GetPathForTLSFile(endpointID EndpointID, fileType TLSFileType) (string, error)
+		DeleteTLSFiles(endpointID EndpointID) error
+	}
+
+	// EndpointWatcher represents a service to synchronize the endpoints via an external source.
+	EndpointWatcher interface {
+		WatchEndpointFile(endpointFilePath string) error
+	}
+)
+
+const (
+	// APIVersion is the version number of the Portainer API.
+	APIVersion = "1.13.6"
+	// DBVersion is the version number of the Portainer database.
+	DBVersion = 2
+	// DefaultTemplatesURL represents the default URL for the templates definitions.
+	DefaultTemplatesURL = "https://raw.githubusercontent.com/portainer/templates/master/templates.json"
+)
+
+const (
+	// TLSFileCA represents a TLS CA certificate file.
+	TLSFileCA TLSFileType = iota
+	// TLSFileCert represents a TLS certificate file.
+	TLSFileCert
+	// TLSFileKey represents a TLS key file.
+	TLSFileKey
+)
+
+const (
+	_ MembershipRole = iota
+	// TeamLeader represents a leader role inside a team
+	TeamLeader
+	// TeamMember represents a member role inside a team
+	TeamMember
+)
+
+const (
+	_ UserRole = iota
+	// AdministratorRole represents an administrator user role
+	AdministratorRole
+	// StandardUserRole represents a regular user role
+	StandardUserRole
+)
+
+const (
+	_ ResourceAccessLevel = iota
+	// ReadWriteAccessLevel represents an access level with read-write permissions on a resource
+	ReadWriteAccessLevel
+)
+
+const (
+	_ ResourceControlType = iota
+	// ContainerResourceControl represents a resource control associated to a Docker container
+	ContainerResourceControl
+	// ServiceResourceControl represents a resource control associated to a Docker service
+	ServiceResourceControl
+	// VolumeResourceControl represents a resource control associated to a Docker volume
+	VolumeResourceControl
+)

app/app.js

@@ -1,147 +1,761 @@
-angular.module('uifordocker', [
-  'uifordocker.templates',
-  'ui.bootstrap',
-  'ui.router',
-  'ui.select',
-  'ngCookies',
-  'ngSanitize',
-  'dockerui.services',
-  'dockerui.filters',
-  'dashboard',
-  'container',
-  'containers',
-  'createContainer',
-  'docker',
-  'images',
-  'image',
-  'containerLogs',
-  'stats',
-  'swarm',
-  'network',
-  'networks',
-  'createNetwork',
-  'volumes',
-  'createVolume'])
-  .config(['$stateProvider', '$urlRouterProvider', '$httpProvider', function ($stateProvider, $urlRouterProvider, $httpProvider) {
-    'use strict';
-
-    $httpProvider.defaults.xsrfCookieName = 'csrfToken';
-    $httpProvider.defaults.xsrfHeaderName = 'X-CSRF-Token';
-
-    $urlRouterProvider.otherwise('/');
-
+angular.module('portainer.filters', []);
+angular.module('portainer.rest', ['ngResource']);
+angular.module('portainer.services', []);
+angular.module('portainer.helpers', []);
+angular.module('portainer', [
+  'ui.bootstrap',
+  'ui.router',
+  'isteven-multi-select',
+  'ngCookies',
+  'ngSanitize',
+  'ngFileUpload',
+  'angularUtils.directives.dirPagination',
+  'LocalStorageModule',
+  'angular-jwt',
+  'angular-google-analytics',
+  'portainer.templates',
+  'portainer.filters',
+  'portainer.rest',
+  'portainer.helpers',
+  'portainer.services',
+  'auth',
+  'dashboard',
+  'container',
+  'containerConsole',
+  'containerLogs',
+  'serviceLogs',
+  'containers',
+  'createContainer',
+  'createNetwork',
+  'createRegistry',
+  'createSecret',
+  'createService',
+  'createVolume',
+  'docker',
+  'endpoint',
+  'endpointAccess',
+  'endpointInit',
+  'endpoints',
+  'events',
+  'image',
+  'images',
+  'main',
+  'network',
+  'networks',
+  'node',
+  'registries',
+  'registry',
+  'registryAccess',
+  'secrets',
+  'secret',
+  'service',
+  'services',
+  'settings',
+  'sidebar',
+  'stats',
+  'swarm',
+  'task',
+  'team',
+  'teams',
+  'templates',
+  'user',
+  'users',
+  'userSettings',
+  'volume',
+  'volumes'])
+  .config(['$stateProvider', '$urlRouterProvider', '$httpProvider', 'localStorageServiceProvider', 'jwtOptionsProvider', 'AnalyticsProvider', '$uibTooltipProvider', '$compileProvider', function ($stateProvider, $urlRouterProvider, $httpProvider, localStorageServiceProvider, jwtOptionsProvider, AnalyticsProvider, $uibTooltipProvider, $compileProvider) {
+    'use strict';
+
+    var environment = '@@ENVIRONMENT';
+    if (environment === 'production') {
+      $compileProvider.debugInfoEnabled(false);
+    }
+
+    localStorageServiceProvider
+    .setPrefix('portainer');
+
+    jwtOptionsProvider.config({
+      tokenGetter: ['LocalStorage', function(LocalStorage) {
+        return LocalStorage.getJWT();
+      }],
+      unauthenticatedRedirector: ['$state', function($state) {
+        $state.go('auth', {error: 'Your session has expired'});
+      }]
+    });
+    $httpProvider.interceptors.push('jwtInterceptor');
+
+    AnalyticsProvider.setAccount('@@CONFIG_GA_ID');
+    AnalyticsProvider.startOffline(true);
+
+    $urlRouterProvider.otherwise('/auth');
+
+    toastr.options.timeOut = 3000;
+
+    $uibTooltipProvider.setTriggers({
+      'mouseenter': 'mouseleave',
+      'click': 'click',
+      'focus': 'blur',
+      'outsideClick': 'outsideClick'
+    });
+
     $stateProvider
-    .state('index', {
-      url: '/',
-      templateUrl: 'app/components/dashboard/dashboard.html',
-      controller: 'DashboardController'
-    })
-    .state('containers', {
-      url: '/containers/',
-      templateUrl: 'app/components/containers/containers.html',
-      controller: 'ContainersController'
-    })
-    .state('container', {
-      url: "^/containers/:id",
-      templateUrl: 'app/components/container/container.html',
-      controller: 'ContainerController'
-    })
-    .state('stats', {
-      url: "^/containers/:id/stats",
-      templateUrl: 'app/components/stats/stats.html',
-      controller: 'StatsController'
-    })
-    .state('logs', {
-      url: "^/containers/:id/logs",
-      templateUrl: 'app/components/containerLogs/containerlogs.html',
-      controller: 'ContainerLogsController'
-    })
-    .state('actions', {
-      abstract: true,
-      url: "/actions",
-      template: '<ui-view/>'
-    })
-    .state('actions.create', {
-      abstract: true,
-      url: "/create",
-      template: '<ui-view/>'
-    })
-    .state('actions.create.container', {
-      url: "/container",
-      templateUrl: 'app/components/createContainer/createcontainer.html',
-      controller: 'CreateContainerController'
-    })
-    .state('actions.create.volume', {
-      url: "/volume",
-      templateUrl: 'app/components/createVolume/createvolume.html',
-      controller: 'CreateVolumeController'
-    })
-    .state('actions.create.network', {
-      url: "/network",
-      templateUrl: 'app/components/createNetwork/createnetwork.html',
-      controller: 'CreateNetworkController'
-    })
-    .state('docker', {
-      url: '/docker/',
-      templateUrl: 'app/components/docker/docker.html',
-      controller: 'DockerController'
-    })
-    .state('images', {
-      url: '/images/',
-      templateUrl: 'app/components/images/images.html',
-      controller: 'ImagesController'
-    })
-    .state('image', {
-      url: '^/images/:id/',
-      templateUrl: 'app/components/image/image.html',
-      controller: 'ImageController'
-    })
-    .state('networks', {
-      url: '/networks/',
-      templateUrl: 'app/components/networks/networks.html',
-      controller: 'NetworksController'
-    })
-    .state('network', {
-      url: '^/networks/:id/',
-      templateUrl: 'app/components/network/network.html',
-      controller: 'NetworkController'
-    })
-    .state('volumes', {
-      url: '/volumes/',
-      templateUrl: 'app/components/volumes/volumes.html',
-      controller: 'VolumesController'
-    })
-    .state('swarm', {
-      url: '/swarm/',
-      templateUrl: 'app/components/swarm/swarm.html',
-      controller: 'SwarmController'
-    });
-
-    // The Docker API likes to return plaintext errors, this catches them and disp
-    $httpProvider.interceptors.push(function() {
-      return {
-        'response': function(response) {
-          if (typeof(response.data) === 'string' &&
-                  (response.data.startsWith('Conflict.') || response.data.startsWith('conflict:'))) {
-            $.gritter.add({
-              title: 'Error',
-              text: $('<div>').text(response.data).html(),
-              time: 10000
-            });
-          }
-          var csrfToken = response.headers('X-Csrf-Token');
-          if (csrfToken) {
-            document.cookie = 'csrfToken=' + csrfToken;
-          }
-          return response;
-        }
-      };
-    });
-  }])
-
-  // This is your docker url that the api will use to make requests
-  // You need to set this to the api endpoint without the port i.e. http://192.168.1.9
-  .constant('DOCKER_ENDPOINT', 'dockerapi')
-  .constant('DOCKER_PORT', '') // Docker port, leave as an empty string if no port is requred.  If you have a port, prefix it with a ':' i.e. :4243
-  .constant('CONFIG_ENDPOINT', '/config')
-  .constant('UI_VERSION', 'v1.3.0');
+    .state('root', {
+      abstract: true,
+      resolve: {
+        requiresLogin: ['StateManager', function (StateManager) {
+          var applicationState = StateManager.getState();
+          return applicationState.application.authentication;
+        }]
+      }
+    })
+    .state('auth', {
+      parent: 'root',
+      url: '/auth',
+      params: {
+        logout: false,
+        error: ''
+      },
+      views: {
+        'content@': {
+          templateUrl: 'app/components/auth/auth.html',
+          controller: 'AuthenticationController'
+        }
+      },
+      data: {
+        requiresLogin: false
+      }
+    })
+    .state('containers', {
+      parent: 'root',
+      url: '/containers/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/containers/containers.html',
+          controller: 'ContainersController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('container', {
+      url: '^/containers/:id',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/container/container.html',
+          controller: 'ContainerController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('stats', {
+      url: '^/containers/:id/stats',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/stats/stats.html',
+          controller: 'StatsController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('containerlogs', {
+      url: '^/containers/:id/logs',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/containerLogs/containerlogs.html',
+          controller: 'ContainerLogsController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('servicelogs', {
+      url: '^/services/:id/logs',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/serviceLogs/servicelogs.html',
+          controller: 'ServiceLogsController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('console', {
+      url: '^/containers/:id/console',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/containerConsole/containerConsole.html',
+          controller: 'ContainerConsoleController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('dashboard', {
+      parent: 'root',
+      url: '/dashboard',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/dashboard/dashboard.html',
+          controller: 'DashboardController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('actions', {
+      abstract: true,
+      url: '/actions',
+      views: {
+        'content@': {
+          template: '<div ui-view="content@"></div>'
+        },
+        'sidebar@': {
+          template: '<div ui-view="sidebar@"></div>'
+        }
+      }
+    })
+    .state('actions.create', {
+      abstract: true,
+      url: '/create',
+      views: {
+        'content@': {
+          template: '<div ui-view="content@"></div>'
+        },
+        'sidebar@': {
+          template: '<div ui-view="sidebar@"></div>'
+        }
+      }
+    })
+    .state('actions.create.container', {
+      url: '/container',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/createContainer/createcontainer.html',
+          controller: 'CreateContainerController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('actions.create.network', {
+      url: '/network',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/createNetwork/createnetwork.html',
+          controller: 'CreateNetworkController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('actions.create.registry', {
+      url: '/registry',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/createRegistry/createregistry.html',
+          controller: 'CreateRegistryController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('actions.create.secret', {
+      url: '/secret',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/createSecret/createsecret.html',
+          controller: 'CreateSecretController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('actions.create.service', {
+      url: '/service',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/createService/createservice.html',
+          controller: 'CreateServiceController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('actions.create.volume', {
+      url: '/volume',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/createVolume/createvolume.html',
+          controller: 'CreateVolumeController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('docker', {
+      url: '/docker/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/docker/docker.html',
+          controller: 'DockerController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('endpoints', {
+      url: '/endpoints/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/endpoints/endpoints.html',
+          controller: 'EndpointsController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('endpoint', {
+      url: '^/endpoints/:id',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/endpoint/endpoint.html',
+          controller: 'EndpointController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('endpoint.access', {
+      url: '^/endpoints/:id/access',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/endpointAccess/endpointAccess.html',
+          controller: 'EndpointAccessController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('endpointInit', {
+      url: '/init/endpoint',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/endpointInit/endpointInit.html',
+          controller: 'EndpointInitController'
+        }
+      }
+    })
+    .state('events', {
+      url: '/events/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/events/events.html',
+          controller: 'EventsController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('images', {
+      url: '/images/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/images/images.html',
+          controller: 'ImagesController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('image', {
+      url: '^/images/:id/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/image/image.html',
+          controller: 'ImageController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('networks', {
+      url: '/networks/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/networks/networks.html',
+          controller: 'NetworksController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('network', {
+      url: '^/networks/:id/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/network/network.html',
+          controller: 'NetworkController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('node', {
+      url: '^/nodes/:id/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/node/node.html',
+          controller: 'NodeController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('registries', {
+      url: '/registries/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/registries/registries.html',
+          controller: 'RegistriesController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('registry', {
+      url: '^/registries/:id',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/registry/registry.html',
+          controller: 'RegistryController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('registry.access', {
+      url: '^/registries/:id/access',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/registryAccess/registryAccess.html',
+          controller: 'RegistryAccessController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('secrets', {
+      url: '^/secrets/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/secrets/secrets.html',
+          controller: 'SecretsController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('secret', {
+      url: '^/secret/:id/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/secret/secret.html',
+          controller: 'SecretController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('services', {
+      url: '/services/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/services/services.html',
+          controller: 'ServicesController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('service', {
+      url: '^/service/:id/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/service/service.html',
+          controller: 'ServiceController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('settings', {
+      url: '/settings/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/settings/settings.html',
+          controller: 'SettingsController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('task', {
+      url: '^/task/:id',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/task/task.html',
+          controller: 'TaskController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('templates', {
+      url: '/templates/',
+      params: {
+        key: 'containers',
+        hide_descriptions: false
+      },
+      views: {
+        'content@': {
+          templateUrl: 'app/components/templates/templates.html',
+          controller: 'TemplatesController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('templates_linuxserver', {
+      url: '^/templates/linuxserver.io',
+      params: {
+        key: 'linuxserver.io',
+        hide_descriptions: true
+      },
+      views: {
+        'content@': {
+          templateUrl: 'app/components/templates/templates.html',
+          controller: 'TemplatesController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('volumes', {
+      url: '/volumes/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/volumes/volumes.html',
+          controller: 'VolumesController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('volume', {
+      url: '^/volumes/:id',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/volume/volume.html',
+          controller: 'VolumeController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('users', {
+      url: '/users/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/users/users.html',
+          controller: 'UsersController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('user', {
+      url: '^/users/:id',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/user/user.html',
+          controller: 'UserController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('userSettings', {
+      url: '/userSettings/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/userSettings/userSettings.html',
+          controller: 'UserSettingsController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('teams', {
+      url: '/teams/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/teams/teams.html',
+          controller: 'TeamsController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('team', {
+      url: '^/teams/:id',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/team/team.html',
+          controller: 'TeamController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    })
+    .state('swarm', {
+      url: '/swarm/',
+      views: {
+        'content@': {
+          templateUrl: 'app/components/swarm/swarm.html',
+          controller: 'SwarmController'
+        },
+        'sidebar@': {
+          templateUrl: 'app/components/sidebar/sidebar.html',
+          controller: 'SidebarController'
+        }
+      }
+    });
+  }])
+  .run(['$rootScope', '$state', 'Authentication', 'authManager', 'StateManager', 'EndpointProvider', 'Notifications', 'Analytics', function ($rootScope, $state, Authentication, authManager, StateManager, EndpointProvider, Notifications, Analytics) {
+    EndpointProvider.initialize();
+    StateManager.initialize().then(function success(state) {
+      if (state.application.authentication) {
+        authManager.checkAuthOnRefresh();
+        authManager.redirectWhenUnauthenticated();
+        Authentication.init();
+        $rootScope.$on('tokenHasExpired', function($state) {
+          $state.go('auth', {error: 'Your session has expired'});
+        });
+      }
+      if (state.application.analytics) {
+        Analytics.offline(false);
+        Analytics.registerScriptTags();
+        Analytics.registerTrackers();
+        $rootScope.$on('$stateChangeSuccess', function (event, toState, toParams, fromState, fromParams) {
+          Analytics.trackPage(toState.url);
+          Analytics.pageView();
+        });
+      }
+    }, function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve application settings');
+    });
+
+    $rootScope.$state = $state;
+  }])
+  // This is your docker url that the api will use to make requests
+  // You need to set this to the api endpoint without the port i.e. http://192.168.1.9
+  // .constant('DOCKER_PORT', '') // Docker port, leave as an empty string if no port is required.  If you have a port, prefix it with a ':' i.e. :4243
+  .constant('DOCKER_ENDPOINT', 'api/docker')
+  .constant('CONFIG_ENDPOINT', 'api/old_settings')
+  .constant('SETTINGS_ENDPOINT', 'api/settings')
+  .constant('STATUS_ENDPOINT', 'api/status')
+  .constant('AUTH_ENDPOINT', 'api/auth')
+  .constant('USERS_ENDPOINT', 'api/users')
+  .constant('TEAMS_ENDPOINT', 'api/teams')
+  .constant('TEAM_MEMBERSHIPS_ENDPOINT', 'api/team_memberships')
+  .constant('RESOURCE_CONTROL_ENDPOINT', 'api/resource_controls')
+  .constant('ENDPOINTS_ENDPOINT', 'api/endpoints')
+  .constant('DOCKERHUB_ENDPOINT', 'api/dockerhub')
+  .constant('REGISTRIES_ENDPOINT', 'api/registries')
+  .constant('TEMPLATES_ENDPOINT', 'api/templates')
+  .constant('DEFAULT_TEMPLATES_URL', 'https://raw.githubusercontent.com/portainer/templates/master/templates.json')
+  .constant('PAGINATION_MAX_ITEMS', 10);

app/components/auth/auth.html

@@ -0,0 +1,101 @@
+<div class="page-wrapper">
+  <!-- login box -->
+  <div class="container simple-box">
+    <div class="col-md-6 col-md-offset-3 col-sm-6 col-sm-offset-3">
+      <!-- login box logo -->
+      <div class="row">
+        <img ng-if="logo" ng-src="{{ logo }}" class="simple-box-logo">
+        <img ng-if="!logo" src="images/logo_alt.png" class="simple-box-logo" alt="Portainer">
+      </div>
+      <!-- !login box logo -->
+      <!-- init password panel -->
+      <div class="panel panel-default" ng-if="initPassword">
+        <div class="panel-body">
+          <!-- init password form -->
+          <form class="login-form form-horizontal" enctype="multipart/form-data" method="POST">
+            <!-- comment -->
+            <div class="input-group">
+              <p style="margin: 5px;">
+                Please specify a password for the <b>admin</b> user account.
+              </p>
+            </div>
+            <!-- !comment input -->
+            <!-- comment -->
+            <div class="input-group">
+              <p style="margin: 5px;">
+                <i ng-class="{true: 'fa fa-check green-icon', false: 'fa fa-times red-icon'}[initPasswordData.password.length >= 8]" aria-hidden="true"></i>
+                Your password must be at least 8 characters long
+              </p>
+            </div>
+            <!-- !comment input -->
+            <!-- password input -->
+            <div class="input-group">
+              <span class="input-group-addon"><i class="fa fa-lock" aria-hidden="true"></i></span>
+              <input id="admin_password" type="password" class="form-control" name="password" ng-model="initPasswordData.password" autofocus>
+            </div>
+            <!-- !password input -->
+            <!-- comment -->
+            <div class="input-group">
+              <p style="margin: 5px;">
+                <i ng-class="{true: 'fa fa-check green-icon', false: 'fa fa-times red-icon'}[initPasswordData.password !== '' && initPasswordData.password === initPasswordData.password_confirmation]" aria-hidden="true"></i>
+                Confirm your password
+              </p>
+            </div>
+            <!-- !comment input -->
+            <!-- password confirmation input -->
+            <div class="input-group">
+              <span class="input-group-addon"><i class="fa fa-lock" aria-hidden="true"></i></span>
+              <input id="password_confirmation" type="password" class="form-control" name="password" ng-model="initPasswordData.password_confirmation">
+            </div>
+            <!-- !password confirmation input -->
+            <!-- validate button -->
+            <div class="form-group">
+              <div class="col-sm-12 controls">
+                <p class="pull-left text-danger" ng-if="initPasswordData.error" style="margin: 5px;">
+                  <i class="fa fa-exclamation-circle" aria-hidden="true"></i> Unable to create default user
+                </p>
+                <button type="submit" class="btn btn-primary pull-right" ng-disabled="initPasswordData.password.length < 8 || initPasswordData.password !== initPasswordData.password_confirmation" ng-click="createAdminUser()"><i class="fa fa-key" aria-hidden="true"></i> Validate</button>
+              </div>
+            </div>
+            <!-- !validate button -->
+          </form>
+          <!-- !init password form -->
+        </div>
+      </div>
+      <!-- !init password panel -->
+      <!-- login panel -->
+      <div class="panel panel-default" ng-if="!initPassword">
+        <div class="panel-body">
+          <!-- login form -->
+          <form class="login-form form-horizontal" enctype="multipart/form-data" method="POST">
+            <!-- username input -->
+            <div class="input-group">
+              <span class="input-group-addon"><i class="fa fa-user" aria-hidden="true"></i></span>
+              <input id="username" type="text" class="form-control" name="username" ng-model="authData.username" placeholder="Username">
+            </div>
+            <!-- !username input -->
+            <!-- password input -->
+            <div class="input-group">
+              <span class="input-group-addon"><i class="fa fa-lock" aria-hidden="true"></i></span>
+              <input id="password" type="password" class="form-control" name="password" ng-model="authData.password" autofocus>
+            </div>
+            <!-- !password input -->
+            <!-- login button -->
+            <div class="form-group">
+              <div class="col-sm-12 controls">
+                <p class="pull-left text-danger" ng-if="authData.error" style="margin: 5px;">
+                  <i class="fa fa-exclamation-circle" aria-hidden="true"></i> {{ authData.error }}
+                </p>
+                <button type="submit" class="btn btn-primary pull-right" ng-click="authenticateUser()"><i class="fa fa-sign-in" aria-hidden="true"></i> Login</button>
+              </div>
+            </div>
+            <!-- !login button -->
+          </form>
+          <!-- !login form -->
+        </div>
+      </div>
+      <!-- !login panel -->
+    </div>
+  </div>
+  <!-- !login box -->
+</div>

app/components/auth/authController.js

@@ -0,0 +1,113 @@
+angular.module('auth', [])
+.controller('AuthenticationController', ['$scope', '$state', '$stateParams', '$window', '$timeout', '$sanitize', 'Authentication', 'Users', 'EndpointService', 'StateManager', 'EndpointProvider', 'Notifications',
+function ($scope, $state, $stateParams, $window, $timeout, $sanitize, Authentication, Users, EndpointService, StateManager, EndpointProvider, Notifications) {
+
+  $scope.authData = {
+    username: 'admin',
+    password: '',
+    error: ''
+  };
+  $scope.initPasswordData = {
+    password: '',
+    password_confirmation: '',
+    error: false
+  };
+
+  $scope.logo = StateManager.getState().application.logo;
+
+  if (!$scope.applicationState.application.authentication) {
+    EndpointService.endpoints()
+    .then(function success(data) {
+      if (data.length > 0)  {
+        endpointID = EndpointProvider.endpointID();
+        if (!endpointID) {
+          endpointID = data[0].Id;
+          EndpointProvider.setEndpointID(endpointID);
+        }
+        StateManager.updateEndpointState(true)
+        .then(function success() {
+          $state.go('dashboard');
+        }, function error(err) {
+          Notifications.error('Failure', err, 'Unable to connect to the Docker endpoint');
+        });
+      }
+      else {
+        $state.go('endpointInit');
+      }
+    }, function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve endpoints');
+    });
+  } else {
+    Users.checkAdminUser({}, function () {},
+    function (e) {
+      if (e.status === 404) {
+        $scope.initPassword = true;
+      } else {
+        Notifications.error('Failure', e, 'Unable to verify administrator account existence');
+      }
+    });
+  }
+
+  if ($stateParams.logout) {
+    Authentication.logout();
+  }
+
+  if ($stateParams.error) {
+    $scope.authData.error = $stateParams.error;
+    Authentication.logout();
+  }
+
+  if (Authentication.isAuthenticated()) {
+    $state.go('dashboard');
+  }
+
+  $scope.createAdminUser = function() {
+    var password = $sanitize($scope.initPasswordData.password);
+    Users.initAdminUser({password: password}, function (d) {
+      $scope.initPassword = false;
+      $timeout(function() {
+        var element = $window.document.getElementById('password');
+        if(element) {
+          element.focus();
+        }
+      });
+    }, function (e) {
+      $scope.initPassword.error = true;
+    });
+  };
+
+  $scope.authenticateUser = function() {
+    $scope.authenticationError = false;
+    var username = $sanitize($scope.authData.username);
+    var password = $sanitize($scope.authData.password);
+    Authentication.login(username, password)
+    .then(function success(data) {
+      return EndpointService.endpoints();
+    })
+    .then(function success(data) {
+      var userDetails = Authentication.getUserDetails();
+      if (data.length > 0)  {
+        endpointID = EndpointProvider.endpointID();
+        if (!endpointID) {
+          endpointID = data[0].Id;
+          EndpointProvider.setEndpointID(endpointID);
+        }
+        StateManager.updateEndpointState(true)
+        .then(function success() {
+          $state.go('dashboard');
+        }, function error(err) {
+          Notifications.error('Failure', err, 'Unable to connect to the Docker endpoint');
+        });
+      }
+      else if (data.length === 0 && userDetails.role === 1) {
+        $state.go('endpointInit');
+      } else if (data.length === 0 && userDetails.role === 2) {
+        Authentication.logout();
+        $scope.authData.error = 'User not allowed. Please contact your administrator.';
+      }
+    })
+    .catch(function error(err) {
+      $scope.authData.error = 'Authentication error';
+    });
+  };
+}]);

app/components/container/container.html

@@ -3,71 +3,23 @@
     <i id="loadingViewSpinner" class="fa fa-cog fa-spin"></i>
   </rd-header-title>
   <rd-header-content>
-    Containers > <a ui-sref="container({id: container.Id})">{{ container.Name|trimcontainername }}</a>
+    <a ui-sref="containers">Containers</a> &gt; <a ui-sref="container({id: container.Id})">{{ container.Name|trimcontainername }}</a>
   </rd-header-content>
 </rd-header>
 
-<div class="row">
-  <div class="col-lg-6 col-md-12 col-xs-12">
-    <rd-widget>
-      <rd-widget-body>
-        <div class="widget-icon grey pull-left">
-          <i class="fa fa-tasks"></i>
-        </div>
-        <div ng-if="!container.edit">
-          <div class="title">{{ container.Name|trimcontainername }}</div>
-          <div class="comment">
-            Name <a href="" ng-click="container.edit = true;"><i class="fa fa-edit"></i></a>
-          </div>
-        </div>
-        <div ng-if="container.edit">
-          <div class="title"><input type="text" class="containerNameInput" ng-model="container.newContainerName"></div>
-          <div class="comment">
-            Name
-            <a href="" ng-click="container.edit = false;"><i class="fa fa-times"></i></a>
-            <a href="" ng-click="renameContainer()"><i class="fa fa-check-square-o"></i></a>
-          </div>
-        </div>
-      </rd-widget-body>
-    </rd-widget>
-  </div>
-  <div class="col-lg-6 col-md-12 col-xs-12">
-    <rd-widget>
-      <rd-widget-body>
-        <div ng-class="{true: 'widget-icon green pull-left', false: 'widget-icon red pull-left'}[container.State.Running]">
-          <i class="fa fa-heartbeat"></i>
-        </div>
-        <div class="title">{{ container.State|getstatetext }}</div>
-        <div class="comment">State</div>
-      </rd-widget-body>
-    </rd-widget>
-  </div>
-</div>
 <div class="row">
   <div class="col-lg-12 col-md-12 col-xs-12">
     <rd-widget>
-      <rd-widget-body>
-        <div class="widget-icon grey pull-left">
-          <i class="fa fa-cogs"></i>
-        </div>
-        <div class="title">
-          <div class="btn-group" role="group" aria-label="...">
-            <button class="btn btn-primary" ng-click="commit()">Commit</button>
-            <button class="btn btn-primary" ng-click="start()" ng-disabled="container.State.Running">Start</button>
-            <button class="btn btn-primary" ng-click="stop()" ng-disabled="!container.State.Running">Stop</button>
-            <button class="btn btn-primary" ng-click="kill()" ng-disabled="!container.State.Running">Kill</button>
-            <button class="btn btn-primary" ng-click="restart()">Restart</button>
-            <button class="btn btn-primary" ng-click="pause()" ng-disabled="!container.State.Running && !container.State.Paused">Pause</button>
-            <button class="btn btn-primary" ng-click="unpause()" ng-disabled="!container.State.Paused">Unpause</button>
-            <button class="btn btn-danger" ng-click="remove()" ng-disabled="container.State.Running">Remove</button>
-          </div>
-          <div class="btn-group" role="group" aria-label="...">
-            <a class="btn btn-default" type="button" ui-sref="stats({id: container.Id})">Stats</a>
-            <a class="btn btn-default" type="button" ui-sref="logs({id: container.Id})">Logs</a>
-          </div>
-        </div>
-        <div class="comment">
-          Actions
+      <rd-widget-header icon="fa-cogs" title="Actions"></rd-widget-header>
+      <rd-widget-body classes="padding">
+        <div class="btn-group" role="group" aria-label="...">
+          <button class="btn btn-success" ng-click="start()" ng-disabled="container.State.Running"><i class="fa fa-play space-right" aria-hidden="true"></i>Start</button>
+          <button class="btn btn-danger" ng-click="stop()" ng-disabled="!container.State.Running"><i class="fa fa-stop space-right" aria-hidden="true"></i>Stop</button>
+          <button class="btn btn-danger" ng-click="kill()" ng-disabled="!container.State.Running"><i class="fa fa-bomb space-right" aria-hidden="true"></i>Kill</button>
+          <button class="btn btn-primary" ng-click="restart()" ng-disabled="!container.State.Running"><i class="fa fa-refresh space-right" aria-hidden="true"></i>Restart</button>
+          <button class="btn btn-primary" ng-click="pause()" ng-disabled="!container.State.Running || container.State.Paused"><i class="fa fa-pause space-right" aria-hidden="true"></i>Pause</button>
+          <button class="btn btn-primary" ng-click="unpause()" ng-disabled="!container.State.Paused"><i class="fa fa-play space-right" aria-hidden="true"></i>Resume</button>
+          <button class="btn btn-danger" ng-click="confirmRemove()"><i class="fa fa-trash space-right" aria-hidden="true"></i>Remove</button>
         </div>
       </rd-widget-body>
     </rd-widget>
@@ -75,44 +27,185 @@
 </div>
 
 <div class="row">
-  <div class="col-lg-9">
+  <div class="col-lg-12 col-md-12 col-xs-12">
     <rd-widget>
-      <rd-widget-header icon="fa-tasks" title="Container status"></rd-widget-header>
+      <rd-widget-header icon="fa-server" title="Container status"></rd-widget-header>
       <rd-widget-body classes="no-padding">
         <table class="table">
           <tbody>
+            <tr>
+              <td>ID</td>
+              <td>{{ container.Id }}</td>
+            </tr>
+            <tr>
+              <td>Name</td>
+              <td ng-if="!container.edit">
+                {{ container.Name|trimcontainername }}
+                <a href="" data-toggle="tooltip" title="Edit container name" ng-click="container.edit = true;"><i class="fa fa-edit"></i></a>
+              </td>
+              <td ng-if="container.edit">
+                <form ng-submit="renameContainer()">
+                  <input type="text" class="containerNameInput" ng-model="container.newContainerName">
+                  <a href="" ng-click="container.edit = false;"><i class="fa fa-times"></i></a>
+                  <a href="" ng-click="renameContainer()"><i class="fa fa-check-square-o"></i></a>
+                </form>
+              </td>
+            </tr>
+            <tr ng-if="container.NetworkSettings.IPAddress">
+              <td>IP address</td>
+              <td>{{ container.NetworkSettings.IPAddress }}</td>
+            </tr>
+            <tr>
+              <td>Status</td>
+              <td>
+                <i class="fa fa-heartbeat space-right green-icon" ng-if="container.State.Running"></i>
+                <i class="fa fa-heartbeat space-right red-icon" ng-if="!container.State.Running && container.State.Status !== 'created'"></i>
+                {{ container.State|getstatetext }} since {{ activityTime }}<span ng-if="!container.State.Running && container.State.Status !== 'created'"> with exit code {{ container.State.ExitCode }}</span>
+              </td>
+            </tr>
             <tr>
               <td>Created</td>
-              <td>{{ container.Created | date: 'medium' }}</td>
+              <td>{{ container.Created|getisodate }}</td>
+            </tr>
+            <tr ng-if="container.State.Running">
+              <td>Start time</td>
+              <td>{{ container.State.StartedAt|getisodate }}</td>
+            </tr>
+            <tr ng-if="!container.State.Running && container.State.Status !== 'created'">
+              <td>Finished</td>
+              <td>{{ container.State.FinishedAt|getisodate }}</td>
             </tr>
             <tr>
-              <td>Path</td>
-              <td>{{ container.Path }}</td>
+              <td colspan="2">
+                <div class="btn-group" role="group" aria-label="...">
+                  <a class="btn btn-outline-secondary" type="button" ui-sref="stats({id: container.Id})"><i class="fa fa-area-chart space-right" aria-hidden="true"></i>Stats</a>
+                  <a class="btn btn-outline-secondary" type="button" ui-sref="containerlogs({id: container.Id})"><i class="fa fa-exclamation-circle space-right" aria-hidden="true"></i>Logs</a>
+                  <a class="btn btn-outline-secondary" type="button" ui-sref="console({id: container.Id})"><i class="fa fa-terminal space-right" aria-hidden="true"></i>Console</a>
+                </div>
+              </td>
             </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<!-- access-control-panel -->
+<por-access-control-panel
+  ng-if="container && applicationState.application.authentication"
+  resource-control="container.ResourceControl"
+  resource-type="'container'">
+</por-access-control-panel>
+<!-- !access-control-panel -->
+
+<div ng-if="container.State.Health" class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="fa-server" title="Container health"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
             <tr>
-              <td>Args</td>
-              <td>{{ container.Args.join(' ') || 'None' }}</td>
-            </tr>
-            <tr>
-              <td>Exposed Ports</td>
+              <td>Status</td>
               <td>
-                <ul>
-                  <li ng-repeat="(k, v) in container.Config.ExposedPorts">{{ k }}</li>
-                </ul>
+                <i ng-class="{'healthy': 'fa fa-heartbeat space-right green-icon', 'unhealthy': 'fa fa-heartbeat space-right red-icon', 'starting': 'fa fa-heartbeat space-right orange-icon'}[container.State.Health.Status]"></i>
+                {{ container.State.Health.Status }}
               </td>
             </tr>
             <tr>
-              <td>Environment</td>
+              <td>Failure count</td>
+              <td>{{ container.State.Health.FailingStreak }}</td>
+            </tr>
+            <tr>
+              <td>Last output</td>
+              <td>{{ container.State.Health.Log[container.State.Health.Log.length - 1].Output }}</td>
+            </tr>
+          </tbody>
+        </table>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="fa-clone" title="Create image"></rd-widget-header>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <!-- tag-description -->
+          <div class="form-group">
+            <div class="col-sm-12">
+              <span class="small text-muted">
+                You can create an image from this container, this allows you to backup important data or save
+                helpful configurations. You'll be able to spin up another container based on this image afterward.
+              </span>
+            </div>
+          </div>
+          <!-- !tag-description -->
+          <!-- image-and-registry -->
+          <div class="form-group">
+            <por-image-registry image="config.Image" registry="config.Registry"></por-image-registry>
+          </div>
+          <!-- !image-and-registry -->
+          <!-- tag-note -->
+          <div class="form-group">
+            <div class="col-sm-12">
+              <span class="small text-muted">Note: if you don't specify the tag in the image name, <span class="label label-default">latest</span> will be used.</span>
+            </div>
+          </div>
+          <!-- !tag-note -->
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!config.Image" ng-click="commit()">Create</button>
+              <i id="createImageSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+            </div>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="fa-server" title="Container details"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <tr>
+              <td>Image</td>
+              <td><a ui-sref="image({id: container.Image})">{{ container.Image }}</a></td>
+            </tr>
+            <tr ng-if="portBindings.length > 0">
+              <td>Port configuration</td>
               <td>
-                <ul>
-                  <li ng-repeat="k in container.Config.Env">{{ k }}</li>
-                </ul>
+                <div ng-repeat="portMapping in portBindings">
+                  {{ portMapping.container }} <i class="fa fa-long-arrow-right"></i> {{ portMapping.host }}
+                </div>
               </td>
             </tr>
             <tr>
+              <td>CMD</td>
+              <td><code>{{ container.Config.Cmd|command }}</code></td>
+            </tr>
+            <tr>
+              <td>ENV</td>
+              <td>
+                <table class="table table-bordered table-condensed">
+                  <tr ng-repeat="var in container.Config.Env track by $index">
+                    <td>{{ var|key: '=' }}</td>
+                    <td>{{ var|value: '=' }}</td>
+                  </tr>
+                </table>
+              </td>
+            </tr>
+            <tr ng-if="!(container.Config.Labels | emptyobject)">
               <td>Labels</td>
               <td>
-                <table role="table" class="table">
+                <table class="table table-bordered table-condensed">
                   <tr ng-repeat="(k, v) in container.Config.Labels">
                     <td>{{ k }}</td>
                     <td>{{ v }}</td>
@@ -120,76 +213,110 @@
                 </table>
               </td>
             </tr>
-            <tr>
-              <td>Publish all ports</td>
-              <td>{{ container.HostConfig.PublishAllPorts }}</td>
-            </tr>
-            <tr>
-              <td>Ports</td>
+            <tr ng-if="container.HostConfig.RestartPolicy.Name !== 'no'">
+              <td>Restart policies</td>
               <td>
-                <ul>
-                  <li ng-repeat="(containerport, hostports) in container.NetworkSettings.Ports">
-                    {{ containerport }} =>
-                    <span class="label label-default" style="margin-right: 5px;" ng-repeat="(k,v) in hostports">{{ v.HostIp }}:{{ v.HostPort }}</span>
-                  </li>
-                </ul>
+                <table class="table table-bordered table-condensed">
+                  <tr>
+                    <td class="col-md-3">Name</td>
+                    <td>{{ container.HostConfig.RestartPolicy.Name }}</td>
+                  </tr>
+                  <tr>
+                    <td class="col-md-3">MaximumRetryCount</td>
+                    <td>
+                      {{ container.HostConfig.RestartPolicy.MaximumRetryCount }}
+                    </td>
+                  </tr>
+                </table>
               </td>
             </tr>
-            <tr>
-              <td>Hostname</td>
-              <td>{{ container.Config.Hostname }}</td>
-            </tr>
-            <tr>
-              <td>IPAddress</td>
-              <td>{{ container.NetworkSettings.IPAddress }}</td>
-            </tr>
-            <tr>
-              <td>Cmd</td>
-              <td>{{ container.Config.Cmd }}</td>
-            </tr>
-            <tr>
-              <td>Entrypoint</td>
-              <td>{{ container.Config.Entrypoint.join(' ') }}</td>
-            </tr>
-            <tr>
-              <td>Bindings</td>
-              <td>
-                <ul>
-                  <li ng-repeat="b in container.HostConfig.Binds">{{ b }}</li>
-                </ul>
-              </td>
-            </tr>
-            <tr>
-              <td>Volumes</td>
-              <td>{{ container.Volumes }}</td>
-            </tr>
-
-            <tr>
-              <td>SysInitpath</td>
-              <td>{{ container.SysInitPath }}</td>
-            </tr>
-            <tr>
-              <td>Image</td>
-              <td><a ui-sref="image({id: container.Image})">{{ container.Image }}</a></td>
-            </tr>
           </tbody>
         </table>
       </rd-widget-body>
     </rd-widget>
   </div>
-  <div class="col-lg-3">
+</div>
+
+<div class="row" ng-if="container.HostConfig.Binds.length > 0">
+  <div class="col-lg-12 col-md-12 col-xs-12">
     <rd-widget>
-      <rd-widget-header icon="fa-tasks" title="Container state details"></rd-widget-header>
+      <rd-widget-header icon="fa-cubes" title="Volumes"></rd-widget-header>
       <rd-widget-body classes="no-padding">
         <table class="table">
+          <thead>
+            <tr>
+              <th>Host</th>
+              <th>Container</th>
+            </tr>
+          </thead>
           <tbody>
-            <tr ng-repeat="(key, val) in container.State">
-              <td>{{key}}</td>
-              <td>{{ val }}</td>
+            <tr ng-repeat="vol in container.HostConfig.Binds">
+              <td>{{ vol|key: ':' }}</td>
+              <td>{{ vol|value: ':' }}</td>
             </tr>
           </tbody>
         </table>
       </rd-widget-body>
     </rd-widget>
   </div>
-<div>
+</div>
+
+<div class="row" ng-if="!(container.NetworkSettings.Networks | emptyobject)">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="fa-sitemap" title="Connected networks">
+        <div class="pull-right">
+          Items per page:
+          <select ng-model="state.pagination_count" ng-change="changePaginationCount()">
+            <option value="0">All</option>
+            <option value="10">10</option>
+            <option value="25">25</option>
+            <option value="50">50</option>
+            <option value="100">100</option>
+          </select>
+        </div>
+      </rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <thead>
+            <th>Network Name</th>
+            <th>IP Address</th>
+            <th>Gateway</th>
+            <th>MacAddress</th>
+            <th>Actions</th>
+          </thead>
+          <tbody>
+            <tr dir-paginate="(key, value) in container.NetworkSettings.Networks | itemsPerPage: state.pagination_count">
+              <td><a ui-sref="network({id: value.NetworkID})">{{ key }}</a></td>
+              <td>{{ value.IPAddress || '-' }}</td>
+              <td>{{ value.Gateway || '-' }}</td>
+              <td>{{ value.MacAddress || '-' }}</td>
+              <td>
+                <button type="button" class="btn btn-xs btn-danger" ng-click="containerLeaveNetwork(container, value.NetworkID)"><i class="fa fa-trash space-right" aria-hidden="true"></i>Leave Network</button>
+              </td>
+            </tr>
+          </tbody>
+        </table>
+        <div class="pagination-controls">
+          <dir-pagination-controls></dir-pagination-controls>
+        </div>
+        <hr />
+        <form class="form-horizontal">
+          <!-- network-input -->
+          <div class="row">
+            <label for="container_network" class="col-sm-3 col-lg-2 control-label text-left">Join a Network</label>
+            <div class="col-sm-5 col-lg-4">
+              <select class="form-control" ng-model="selectedNetwork" id="container_network">
+                <option selected disabled hidden value="">Select a network</option>
+                <option ng-repeat="net in availableNetworks" ng-value="net.Id">{{ net.Name }}</option>
+              </select>
+            </div>
+            <div class="col-sm-1">
+              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!selectedNetwork" ng-click="containerJoinNetwork(container, selectedNetwork)">Join Network</button>
+            </div>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>

app/components/container/containerController.js

@@ -1,90 +1,61 @@
 angular.module('container', [])
-.controller('ContainerController', ['$scope', '$stateParams', '$state', '$filter', 'Container', 'ContainerCommit', 'Image', 'Messages', '$timeout',
-function ($scope, $stateParams, $state, $filter, Container, ContainerCommit, Image, Messages, $timeout) {
-  $scope.changes = [];
-  $scope.editEnv = false;
-  $scope.editPorts = false;
-  $scope.editBinds = false;
-  $scope.newCfg = {
-    Env: [],
-    Ports: {}
+.controller('ContainerController', ['$scope', '$state','$stateParams', '$filter', 'Container', 'ContainerCommit', 'ContainerService', 'ImageHelper', 'Network', 'Notifications', 'Pagination', 'ModalService',
+function ($scope, $state, $stateParams, $filter, Container, ContainerCommit, ContainerService, ImageHelper, Network, Notifications, Pagination, ModalService) {
+  $scope.activityTime = 0;
+  $scope.portBindings = [];
+  $scope.config = {
+    Image: '',
+    Registry: ''
+  };
+  $scope.state = {};
+  $scope.state.pagination_count = Pagination.getPaginationCount('container_networks');
+
+  $scope.changePaginationCount = function() {
+    Pagination.setPaginationCount('container_networks', $scope.state.pagination_count);
   };
 
   var update = function () {
     $('#loadingViewSpinner').show();
     Container.get({id: $stateParams.id}, function (d) {
-      $scope.container = d;
+      var container = new ContainerDetailsViewModel(d);
+      $scope.container = container;
       $scope.container.edit = false;
-      $scope.container.newContainerName = $filter('trimcontainername')(d.Name);
+      $scope.container.newContainerName = $filter('trimcontainername')(container.Name);
 
-      // fill up env
-      if (d.Config.Env) {
-        $scope.newCfg.Env = d.Config.Env.map(function (entry) {
-          return {name: entry.split('=')[0], value: entry.split('=')[1]};
+      if (container.State.Running) {
+        $scope.activityTime = moment.duration(moment(container.State.StartedAt).utc().diff(moment().utc())).humanize();
+      } else if (container.State.Status === 'created') {
+        $scope.activityTime = moment.duration(moment(container.Created).utc().diff(moment().utc())).humanize();
+      } else {
+        $scope.activityTime = moment.duration(moment().utc().diff(moment(container.State.FinishedAt).utc())).humanize();
+      }
+
+      $scope.portBindings = [];
+      if (container.NetworkSettings.Ports) {
+        angular.forEach(Object.keys(container.NetworkSettings.Ports), function(portMapping) {
+          if (container.NetworkSettings.Ports[portMapping]) {
+            var mapping = {};
+            mapping.container = portMapping;
+            mapping.host = container.NetworkSettings.Ports[portMapping][0].HostIp + ':' + container.NetworkSettings.Ports[portMapping][0].HostPort;
+            $scope.portBindings.push(mapping);
+          }
         });
       }
-
-      // fill up ports
-      $scope.newCfg.Ports = {};
-      angular.forEach(d.Config.ExposedPorts, function(i, port) {
-        if (d.HostConfig.PortBindings && port in d.HostConfig.PortBindings) {
-          $scope.newCfg.Ports[port] = d.HostConfig.PortBindings[port];
-        }
-        else {
-          $scope.newCfg.Ports[port] = [];
-        }
-      });
-
-      // fill up bindings
-      $scope.newCfg.Binds = [];
-      var defaultBinds = {};
-      angular.forEach(d.Config.Volumes, function(value, vol) {
-        defaultBinds[vol] = { ContPath: vol, HostPath: '', ReadOnly: false, DefaultBind: true };
-      });
-      angular.forEach(d.HostConfig.Binds, function(binding, i) {
-        var mountpoint = binding.split(':')[0];
-        var vol = binding.split(':')[1] || '';
-        var ro = binding.split(':').length > 2 && binding.split(':')[2] === 'ro';
-        var defaultBind = false;
-        if (vol === '') {
-          vol = mountpoint;
-          mountpoint = '';
-        }
-
-        if (vol in defaultBinds) {
-          delete defaultBinds[vol];
-          defaultBind = true;
-        }
-        $scope.newCfg.Binds.push({ ContPath: vol, HostPath: mountpoint, ReadOnly: ro, DefaultBind: defaultBind });
-      });
-      angular.forEach(defaultBinds, function(bind) {
-        $scope.newCfg.Binds.push(bind);
-      });
-
       $('#loadingViewSpinner').hide();
     }, function (e) {
-      if (e.status === 404) {
-        $('.detail').hide();
-        Messages.error("Not found", "Container not found.");
-      } else {
-        Messages.error("Failure", e.data);
-      }
       $('#loadingViewSpinner').hide();
+      Notifications.error('Failure', e, 'Unable to retrieve container info');
     });
-
   };
 
   $scope.start = function () {
     $('#loadingViewSpinner').show();
-    Container.start({
-      id: $scope.container.Id,
-      HostConfig: $scope.container.HostConfig
-    }, function (d) {
+    Container.start({id: $scope.container.Id}, {}, function (d) {
       update();
-      Messages.send("Container started", $stateParams.id);
+      Notifications.success('Container started', $stateParams.id);
     }, function (e) {
       update();
-      Messages.error("Failure", "Container failed to start." + e.data);
+      Notifications.error('Failure', e, 'Unable to start container');
     });
   };
 
@@ -92,10 +63,10 @@ function ($scope, $stateParams, $state, $filter, Container, ContainerCommit, Ima
     $('#loadingViewSpinner').show();
     Container.stop({id: $stateParams.id}, function (d) {
       update();
-      Messages.send("Container stopped", $stateParams.id);
+      Notifications.success('Container stopped', $stateParams.id);
     }, function (e) {
       update();
-      Messages.error("Failure", "Container failed to stop." + e.data);
+      Notifications.error('Failure', e, 'Unable to stop container');
     });
   };
 
@@ -103,31 +74,37 @@ function ($scope, $stateParams, $state, $filter, Container, ContainerCommit, Ima
     $('#loadingViewSpinner').show();
     Container.kill({id: $stateParams.id}, function (d) {
       update();
-      Messages.send("Container killed", $stateParams.id);
+      Notifications.success('Container killed', $stateParams.id);
     }, function (e) {
       update();
-      Messages.error("Failure", "Container failed to die." + e.data);
+      Notifications.error('Failure', e, 'Unable to kill container');
     });
   };
 
   $scope.commit = function () {
-    $('#loadingViewSpinner').show();
-    ContainerCommit.commit({id: $stateParams.id, repo: $scope.container.Config.Image}, function (d) {
+    $('#createImageSpinner').show();
+    var image = $scope.config.Image;
+    var registry = $scope.config.Registry;
+    var imageConfig = ImageHelper.createImageConfigForCommit(image, registry.URL);
+    ContainerCommit.commit({id: $stateParams.id, tag: imageConfig.tag, repo: imageConfig.repo}, function (d) {
+      $('#createImageSpinner').hide();
       update();
-      Messages.send("Container commited", $stateParams.id);
+      Notifications.success('Container commited', $stateParams.id);
     }, function (e) {
+      $('#createImageSpinner').hide();
       update();
-      Messages.error("Failure", "Container failed to commit." + e.data);
+      Notifications.error('Failure', e, 'Unable to commit container');
     });
   };
+
   $scope.pause = function () {
     $('#loadingViewSpinner').show();
     Container.pause({id: $stateParams.id}, function (d) {
       update();
-      Messages.send("Container paused", $stateParams.id);
+      Notifications.success('Container paused', $stateParams.id);
     }, function (e) {
       update();
-      Messages.error("Failure", "Container failed to pause." + e.data);
+      Notifications.error('Failure', e, 'Unable to pause container');
     });
   };
 
@@ -135,22 +112,43 @@ function ($scope, $stateParams, $state, $filter, Container, ContainerCommit, Ima
     $('#loadingViewSpinner').show();
     Container.unpause({id: $stateParams.id}, function (d) {
       update();
-      Messages.send("Container unpaused", $stateParams.id);
+      Notifications.success('Container unpaused', $stateParams.id);
     }, function (e) {
       update();
-      Messages.error("Failure", "Container failed to unpause." + e.data);
+      Notifications.error('Failure', e, 'Unable to unpause container');
     });
   };
 
-  $scope.remove = function () {
+  $scope.confirmRemove = function () {
+    var title = 'You are about to remove a container.';
+    if ($scope.container.State.Running) {
+      title = 'You are about to remove a running container.';
+    }
+    ModalService.confirmContainerDeletion(
+      title,
+      function (result) {
+        if(!result) { return; }
+        var cleanAssociatedVolumes = false;
+        if (result[0]) {
+          cleanAssociatedVolumes = true;
+        }
+        $scope.remove(cleanAssociatedVolumes);
+      }
+    );
+  };
+
+  $scope.remove = function(cleanAssociatedVolumes) {
     $('#loadingViewSpinner').show();
-    Container.remove({id: $stateParams.id}, function (d) {
-      update();
+    ContainerService.remove($scope.container, cleanAssociatedVolumes)
+    .then(function success() {
+      Notifications.success('Container successfully removed');
       $state.go('containers', {}, {reload: true});
-      Messages.send("Container removed", $stateParams.id);
-    }, function (e) {
-      update();
-      Messages.error("Failure", "Container failed to remove." + e.data);
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to remove container');
+    })
+    .finally(function final() {
+      $('#loadingViewSpinner').hide();
     });
   };
 
@@ -158,51 +156,82 @@ function ($scope, $stateParams, $state, $filter, Container, ContainerCommit, Ima
     $('#loadingViewSpinner').show();
     Container.restart({id: $stateParams.id}, function (d) {
       update();
-      Messages.send("Container restarted", $stateParams.id);
+      Notifications.success('Container restarted', $stateParams.id);
     }, function (e) {
       update();
-      Messages.error("Failure", "Container failed to restart." + e.data);
-    });
-  };
-
-  $scope.hasContent = function (data) {
-    return data !== null && data !== undefined;
-  };
-
-  $scope.getChanges = function () {
-    $('#loadingViewSpinner').show();
-    Container.changes({id: $stateParams.id}, function (d) {
-      $scope.changes = d;
-      $('#loadingViewSpinner').hide();
+      Notifications.error('Failure', e, 'Unable to restart container');
     });
   };
 
   $scope.renameContainer = function () {
-    // #FIXME fix me later to handle http status to show the correct error message
-    Container.rename({id: $stateParams.id, 'name': $scope.container.newContainerName}, function (data) {
-      if (data.name) {
-        $scope.container.Name = data.name;
-        Messages.send("Container renamed", $stateParams.id);
+    var container = $scope.container;
+    Container.rename({id: $stateParams.id, 'name': container.newContainerName}, function (d) {
+      if (d.message) {
+        container.newContainerName = container.Name;
+        Notifications.error('Unable to rename container', {}, d.message);
       } else {
-        $scope.container.newContainerName = $scope.container.Name;
-        Messages.error("Failure", "Container failed to rename.");
+        container.Name = container.newContainerName;
+        Notifications.success('Container successfully renamed', container.Name);
       }
+    }, function (e) {
+      Notifications.error('Failure', e, 'Unable to rename container');
     });
     $scope.container.edit = false;
   };
 
-  $scope.addEntry = function (array, entry) {
-    array.push(entry);
-  };
-  $scope.rmEntry = function (array, entry) {
-    var idx = array.indexOf(entry);
-    array.splice(idx, 1);
+  $scope.containerLeaveNetwork = function containerLeaveNetwork(container, networkId) {
+    $('#loadingViewSpinner').show();
+    Network.disconnect({id: networkId}, { Container: $stateParams.id, Force: false }, function (d) {
+      if (container.message) {
+        $('#loadingViewSpinner').hide();
+        Notifications.error('Error', d, 'Unable to disconnect container from network');
+      } else {
+        $('#loadingViewSpinner').hide();
+        Notifications.success('Container left network', $stateParams.id);
+        $state.go('container', {id: $stateParams.id}, {reload: true});
+      }
+    }, function (e) {
+      $('#loadingViewSpinner').hide();
+      Notifications.error('Failure', e, 'Unable to disconnect container from network');
+    });
   };
 
-  $scope.toggleEdit = function() {
-    $scope.edit = !$scope.edit;
+  $scope.containerJoinNetwork = function containerJoinNetwork(container, networkId) {
+    $('#joinNetworkSpinner').show();
+    Network.connect({id: networkId}, { Container: $stateParams.id }, function (d) {
+      if (container.message) {
+        $('#joinNetworkSpinner').hide();
+        Notifications.error('Error', d, 'Unable to connect container to network');
+      } else {
+        $('#joinNetworkSpinner').hide();
+        Notifications.success('Container joined network', $stateParams.id);
+        $state.go('container', {id: $stateParams.id}, {reload: true});
+      }
+    }, function (e) {
+      $('#joinNetworkSpinner').hide();
+      Notifications.error('Failure', e, 'Unable to connect container to network');
+    });
   };
 
+  Network.query({}, function (d) {
+      var networks = d;
+      if ($scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM' || $scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM_MODE') {
+        networks = d.filter(function (network) {
+          if (network.Scope === 'global') {
+            return network;
+          }
+        });
+        networks.push({Name: 'bridge'});
+        networks.push({Name: 'host'});
+        networks.push({Name: 'none'});
+      }
+      $scope.availableNetworks = networks;
+      if (!_.find(networks, {'Name': 'bridge'})) {
+        networks.push({Name: 'nat'});
+      }
+    }, function (e) {
+      Notifications.error('Failure', e, 'Unable to retrieve networks');
+    });
+
   update();
-  $scope.getChanges();
 }]);

app/components/containerConsole/containerConsole.html

@@ -0,0 +1,76 @@
+<rd-header>
+  <rd-header-title title="Container console">
+    <i id="loadingViewSpinner" class="fa fa-cog fa-spin"></i>
+  </rd-header-title>
+  <rd-header-content ng-if="state.loaded">
+    <a ui-sref="containers">Containers</a> &gt; <a ui-sref="container({id: container.Id})">{{ container.Name|trimcontainername }}</a> &gt; Console
+  </rd-header-content>
+</rd-header>
+
+<div class="row" ng-if="state.loaded">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-header icon="fa-terminal" title="Console">
+        <div class="pull-right">
+          <i id="loadConsoleSpinner" class="fa fa-cog fa-2x fa-spin" style="margin-top: 5px; display: none;"></i>
+        </div>
+      </rd-widget-header>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <div ng-if="!state.connected">
+            <!-- command-list -->
+              <div class="form-group">
+                <label for="command" class="col-lg-1 text-left col-sm-2 control-label">Command</label>
+                <div class="col-lg-11 col-sm-10">
+                  <div class="input-group" ng-if="!formValues.isCustomCommand">
+                    <span class="input-group-addon">
+                      <i class="fa fa-linux" aria-hidden="true" ng-if="imageOS == 'linux'"></i>
+                      <i class="fa fa-windows" aria-hidden="true" ng-if="imageOS == 'windows'"></i>
+                    </span>
+                    <select class="form-control" ng-model="formValues.command" id="command">
+                      <option value="bash" ng-if="imageOS == 'linux'">/bin/bash</option>
+                      <option value="sh" ng-if="imageOS == 'linux'">/bin/sh</option>
+                      <option value="powershell" ng-if="imageOS == 'windows'">powershell</option>
+                      <option value="cmd.exe" ng-if="imageOS == 'windows'">cmd.exe</option>
+                    </select>
+                  </div>
+                  <input class="form-control" ng-if="formValues.isCustomCommand" type="text" name="custom-command" ng-model="formValues.customCommand" placeholder="e.g. ps aux">
+                </div>
+              </div>
+            <!-- !command-list -->
+            <div class="form-group col-lg-12">
+              <label for="command" class="text-left control-label">Use custom command</label>
+              <label class="switch" style="margin-left: 20px;">
+                <input type="checkbox" ng-model="formValues.isCustomCommand"><i></i>
+              </label>
+            </div>
+            <div class="form-group">
+              <label for="username" class="col-lg-1 text-left col-sm-2 control-label">
+                User
+                <portainer-tooltip position="bottom" message="Format is one of: user, user:group, uid or uid:gid"></portainer-tooltip>
+              </label>
+              <div class="col-lg-11 col-sm-10">
+                <input class="form-control" type="text" name="username" ng-model="formValues.user" placeholder="root">
+              </div>
+            </div>
+            <div class="form-group">
+              <div class="col-lg-offset-1 col-sm-offset-2 col-lg-11 col-sm-10">
+                <button type="button" class="btn btn-primary" ng-click="connect()">Connect</button>
+              </div>
+            </div>
+          </div>
+          <div ng-if="state.connected">
+            <label>Exec into container as <code>{{ ::formValues.user || 'default user' }}</code> using command <code>{{ formValues.isCustomCommand ? formValues.customCommand : formValues.command }}</code></label>
+            <button type="button" class="btn btn-default" ng-click="disconnect()">Disconnect</button>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <div id="terminal-container" class="terminal-container"></div>
+  </div>
+</div>

app/components/containerConsole/containerConsoleController.js

@@ -0,0 +1,112 @@
+angular.module('containerConsole', [])
+.controller('ContainerConsoleController', ['$scope', '$stateParams', 'Container', 'Image', 'EndpointProvider', 'Notifications', 'ContainerHelper', 'ContainerService', 'ExecService',
+function ($scope, $stateParams, Container, Image, EndpointProvider, Notifications, ContainerHelper, ContainerService, ExecService) {
+  $scope.state = {};
+  $scope.state.loaded = false;
+  $scope.state.connected = false;
+  $scope.formValues = {};
+
+  var socket, term;
+
+  // Ensure the socket is closed before leaving the view
+  $scope.$on('$stateChangeStart', function (event, next, current) {
+    if (socket && socket !== null) {
+      socket.close();
+    }
+  });
+
+  Container.get({id: $stateParams.id}, function(d) {
+    $scope.container = d;
+    if (d.message) {
+      Notifications.error('Error', d, 'Unable to retrieve container details');
+      $('#loadingViewSpinner').hide();
+    } else {
+      Image.get({id: d.Image}, function(imgData) {
+        $scope.imageOS = imgData.Os;
+        $scope.formValues.command = imgData.Os === 'windows' ? 'powershell' : 'bash';
+        $scope.state.loaded = true;
+        $('#loadingViewSpinner').hide();
+      }, function (e) {
+        Notifications.error('Failure', e, 'Unable to retrieve image details');
+        $('#loadingViewSpinner').hide();
+      });
+    }
+  }, function (e) {
+    Notifications.error('Failure', e, 'Unable to retrieve container details');
+    $('#loadingViewSpinner').hide();
+  });
+
+  $scope.connect = function() {
+    $('#loadConsoleSpinner').show();
+    var termWidth = Math.round($('#terminal-container').width() / 8.2);
+    var termHeight = 30;
+    var command = $scope.formValues.isCustomCommand ?
+                    $scope.formValues.customCommand : $scope.formValues.command;
+    var execConfig = {
+      id: $stateParams.id,
+      AttachStdin: true,
+      AttachStdout: true,
+      AttachStderr: true,
+      Tty: true,
+      User: $scope.formValues.user,
+      Cmd: ContainerHelper.commandStringToArray(command)
+    };
+
+    var execId;
+    ContainerService.createExec(execConfig)
+    .then(function success(data) {
+      execId = data.Id;
+      var url = window.location.href.split('#')[0] + 'api/websocket/exec?id=' + execId + '&endpointId=' + EndpointProvider.endpointID();
+      if (url.indexOf('https') > -1) {
+        url = url.replace('https://', 'wss://');
+      } else {
+        url = url.replace('http://', 'ws://');
+      }
+      initTerm(url, termHeight, termWidth);
+      return ExecService.resizeTTY(execId, termHeight, termWidth, 2000);
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to exec into container');
+    })
+    .finally(function final() {
+      $('#loadConsoleSpinner').hide();
+    });
+  };
+
+  $scope.disconnect = function() {
+    $scope.state.connected = false;
+    if (socket !== null) {
+      socket.close();
+    }
+    if (term !== null) {
+      term.destroy();
+    }
+  };
+
+  function initTerm(url, height, width) {
+    socket = new WebSocket(url);
+
+    $scope.state.connected = true;
+    socket.onopen = function(evt) {
+      $('#loadConsoleSpinner').hide();
+      term = new Terminal();
+
+      term.on('data', function (data) {
+        socket.send(data);
+      });
+      term.open(document.getElementById('terminal-container'), true);
+      term.resize(width, height);
+      term.setOption('cursorBlink', true);
+
+      socket.onmessage = function (e) {
+        term.write(e.data);
+      };
+      socket.onerror = function (error) {
+        $scope.state.connected = false;
+      };
+      socket.onclose = function(evt) {
+        $scope.state.connected = false;
+      };
+    };
+  }
+}]);

app/components/containerLogs/containerLogsController.js

@@ -13,12 +13,8 @@ function ($scope, $stateParams, $anchorScroll, ContainerLogs, Container) {
     $scope.container = d;
     $('#loadingViewSpinner').hide();
   }, function (e) {
-    if (e.status === 404) {
-      Messages.error("Not found", "Container not found.");
-    } else {
-      Messages.error("Failure", e.data);
-    }
     $('#loadingViewSpinner').hide();
+    Notifications.error('Failure', e, 'Unable to retrieve container info');
   });
 
   function getLogs() {
@@ -64,7 +60,7 @@ function ($scope, $stateParams, $anchorScroll, ContainerLogs, Container) {
   getLogs();
   var logIntervalId = window.setInterval(getLogs, 5000);
 
-  $scope.$on("$destroy", function () {
+  $scope.$on('$destroy', function () {
     // clearing interval when view changes
     clearInterval(logIntervalId);
   });

app/components/containerLogs/containerlogs.html

@@ -3,7 +3,7 @@
       <i id="loadingViewSpinner" class="fa fa-cog fa-spin"></i>
   </rd-header-title>
   <rd-header-content>
-    Containers > <a ui-sref="container({id: container.Id})">{{ container.Name|trimcontainername }}</a> > Logs
+    <a ui-sref="containers">Containers</a> &gt; <a ui-sref="container({id: container.Id})">{{ container.Name|trimcontainername }}</a> &gt; Logs
   </rd-header-content>
 </rd-header>
 
@@ -12,7 +12,7 @@
     <rd-widget>
       <rd-widget-body>
         <div class="widget-icon grey pull-left">
-          <i class="fa fa-tasks"></i>
+          <i class="fa fa-server"></i>
         </div>
         <div class="title">{{ container.Name|trimcontainername }}</div>
         <div class="comment">Name</div>

app/components/containers/containers.html

@@ -3,29 +3,37 @@
     <a data-toggle="tooltip" title="Refresh" ui-sref="containers" ui-sref-opts="{reload: true}">
       <i class="fa fa-refresh" aria-hidden="true"></i>
     </a>
+    <i id="loadContainersSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px;"></i>
   </rd-header-title>
   <rd-header-content>Containers</rd-header-content>
 </rd-header>
 
 <div class="col-lg-12">
   <rd-widget>
-    <rd-widget-header icon="fa-tasks" title="Containers">
+    <rd-widget-header icon="fa-server" title="Containers">
       <div class="pull-right">
-        <i id="loadContainersSpinner" class="fa fa-cog fa-2x fa-spin" style="margin-top: 5px;"></i>
+        Items per page:
+        <select ng-model="state.pagination_count" ng-change="changePaginationCount()">
+          <option value="0">All</option>
+          <option value="10">10</option>
+          <option value="25">25</option>
+          <option value="50">50</option>
+          <option value="100">100</option>
+        </select>
       </div>
     </rd-widget-header>
     <rd-widget-taskbar classes="col-lg-12">
       <div class="pull-left">
         <div class="btn-group" role="group" aria-label="...">
-          <button type="button" class="btn btn-primary" ng-click="startAction()" ng-disabled="!state.selectedItemCount">Start</button>
-          <button type="button" class="btn btn-primary" ng-click="stopAction()" ng-disabled="!state.selectedItemCount">Stop</button>
-          <button type="button" class="btn btn-primary" ng-click="killAction()" ng-disabled="!state.selectedItemCount">Kill</button>
-          <button type="button" class="btn btn-primary" ng-click="restartAction()" ng-disabled="!state.selectedItemCount">Restart</button>
-          <button type="button" class="btn btn-primary" ng-click="pauseAction()" ng-disabled="!state.selectedItemCount">Pause</button>
-          <button type="button" class="btn btn-primary" ng-click="unpauseAction()" ng-disabled="!state.selectedItemCount">Unpause</button>
-          <button type="button" class="btn btn-danger" ng-click="removeAction()" ng-disabled="!state.selectedItemCount">Remove</button>
+          <button type="button" class="btn btn-success btn-responsive" ng-click="startAction()" ng-disabled="!state.selectedItemCount || state.noStoppedItemsSelected"><i class="fa fa-play space-right" aria-hidden="true"></i>Start</button>
+          <button type="button" class="btn btn-danger btn-responsive" ng-click="stopAction()" ng-disabled="!state.selectedItemCount || state.noRunningItemsSelected"><i class="fa fa-stop space-right" aria-hidden="true"></i>Stop</button>
+          <button type="button" class="btn btn-danger btn-responsive" ng-click="killAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-bomb space-right" aria-hidden="true"></i>Kill</button>
+          <button type="button" class="btn btn-primary btn-responsive" ng-click="restartAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-refresh space-right" aria-hidden="true"></i>Restart</button>
+          <button type="button" class="btn btn-primary btn-responsive" ng-click="pauseAction()" ng-disabled="!state.selectedItemCount || state.noRunningItemsSelected"><i class="fa fa-pause space-right" aria-hidden="true"></i>Pause</button>
+          <button type="button" class="btn btn-primary btn-responsive" ng-click="unpauseAction()" ng-disabled="!state.selectedItemCount || state.noPausedItemsSelected"><i class="fa fa-play space-right" aria-hidden="true"></i>Resume</button>
+          <button type="button" class="btn btn-danger btn-responsive" ng-click="confirmRemoveAction()" ng-disabled="!state.selectedItemCount"><i class="fa fa-trash space-right" aria-hidden="true"></i>Remove</button>
         </div>
-        <a class="btn btn-default" type="button" ui-sref="actions.create.container">Add container</a>
+        <a class="btn btn-primary" type="button" ui-sref="actions.create.container"><i class="fa fa-plus space-right" aria-hidden="true"></i>Add container</a>
       </div>
       <div class="pull-right">
         <input type="checkbox" ng-model="state.displayAll" id="displayAll" ng-change="toggleGetAll()" style="margin-top: -2px; margin-right: 5px;"/><label for="displayAll">Show all containers</label>
@@ -37,12 +45,14 @@
         <table class="table table-hover">
           <thead>
             <tr>
-              <th></th>
               <th>
-                <a ui-sref="containers" ng-click="order('State')">
+                <input type="checkbox" ng-model="allSelected" ng-change="selectItems(allSelected)" />
+              </th>
+              <th>
+                <a ui-sref="containers" ng-click="order('Status')">
                   State
-                  <span ng-show="sortType == 'State' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
-                  <span ng-show="sortType == 'State' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
+                  <span ng-show="sortType == 'Status' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
+                  <span ng-show="sortType == 'Status' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
                 </a>
               </th>
               <th>
@@ -52,20 +62,6 @@
                   <span ng-show="sortType == 'Names' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
                 </a>
               </th>
-              <th>
-                <a ui-sref="containers" ng-click="order('IP')">
-                  IP Address
-                  <span ng-show="sortType == 'IP' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
-                  <span ng-show="sortType == 'IP' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
-                </a>
-              </th>
-              <th ng-if="swarm">
-                <a ui-sref="containers" ng-click="order('Host')">
-                  Host
-                  <span ng-show="sortType == 'Host' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
-                  <span ng-show="sortType == 'Host' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
-                </a>
-              </th>
               <th>
                 <a ui-sref="containers" ng-click="order('Image')">
                   Image
@@ -73,29 +69,73 @@
                   <span ng-show="sortType == 'Image' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
                 </a>
               </th>
+              <th ng-if="state.displayIP">
+                <a ui-sref="containers" ng-click="order('IP')">
+                  IP Address
+                  <span ng-show="sortType == 'IP' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
+                  <span ng-show="sortType == 'IP' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
+                </a>
+              </th>
+              <th ng-if="applicationState.endpoint.mode.provider === 'DOCKER_SWARM'">
+                <a ui-sref="containers" ng-click="order('Host')">
+                  Host IP
+                  <span ng-show="sortType == 'Host' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
+                  <span ng-show="sortType == 'Host' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
+                </a>
+              </th>
               <th>
-                <a ui-sref="containers" ng-click="order('Command')">
-                  Command
-                  <span ng-show="sortType == 'Command' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
-                  <span ng-show="sortType == 'Command' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
+                <a ui-sref="containers" ng-click="order('Ports')">
+                  Published Ports
+                  <span ng-show="sortType == 'Ports' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
+                  <span ng-show="sortType == 'Ports' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
+                </a>
+              </th>
+              <th ng-if="applicationState.application.authentication">
+                <a ui-sref="containers" ng-click="order('ResourceControl.Ownership')">
+                  Ownership
+                  <span ng-show="sortType == 'ResourceControl.Ownership' && !sortReverse" class="glyphicon glyphicon-chevron-down"></span>
+                  <span ng-show="sortType == 'ResourceControl.Ownership' && sortReverse" class="glyphicon glyphicon-chevron-up"></span>
                 </a>
               </th>
             </tr>
           </thead>
           <tbody>
-            <tr ng-repeat="container in (state.filteredContainers = ( containers | filter:state.filter | orderBy:sortType:sortReverse))">
+            <tr dir-paginate="container in (state.filteredContainers = ( containers | filter:state.filter | orderBy:sortType:sortReverse | itemsPerPage: state.pagination_count))">
               <td><input type="checkbox" ng-model="container.Checked" ng-change="selectItem(container)"/></td>
-              <td><span class="label label-{{ container.State|containerstatusbadge }}">{{ container.State }}</span></td>
-              <td ng-if="swarm"><a ui-sref="container({id: container.Id})">{{ container|swarmcontainername}}</a></td>
-              <td ng-if="!swarm"><a ui-sref="container({id: container.Id})">{{ container|containername}}</a></td>
-              <td>{{ container.IP ? container.IP : '-' }}</td>
-              <td ng-if="swarm">{{ container|swarmhostname}}</td>
-              <td><a ui-sref="image({id: container.Image})">{{ container.Image }}</a></td>
-              <td>{{ container.Command|truncate:60 }}</td>
+              <td>
+                <span ng-if="['starting','healthy','unhealthy'].indexOf(container.Status) !== -1" class="label label-{{ container.Status|containerstatusbadge }} interactive" uib-tooltip="This container has a health check">{{ container.Status }}</span>
+                <span ng-if="['starting','healthy','unhealthy'].indexOf(container.Status) === -1" class="label label-{{ container.Status|containerstatusbadge }}">{{ container.Status }}</span>
+              </td>
+              <td ng-if="applicationState.endpoint.mode.provider === 'DOCKER_SWARM'"><a ui-sref="container({id: container.Id})">{{ container|swarmcontainername|truncate: 40}}</a></td>
+              <td ng-if="applicationState.endpoint.mode.provider !== 'DOCKER_SWARM'"><a ui-sref="container({id: container.Id})">{{ container|containername|truncate: 40}}</a></td>
+              <td><a ui-sref="image({id: container.Image})">{{ container.Image | hideshasum }}</a></td>
+              <td ng-if="state.displayIP">{{ container.IP ? container.IP : '-' }}</td>
+              <td ng-if="applicationState.endpoint.mode.provider === 'DOCKER_SWARM'">{{ container.hostIP }}</td>
+              <td>
+                <a ng-if="container.Ports.length > 0" ng-repeat="p in container.Ports" class="image-tag" ng-href="http://{{ PublicURL || p.host }}:{{p.public}}" target="_blank">
+                  <i class="fa fa-external-link" aria-hidden="true"></i> {{p.public}}:{{ p.private }}
+                </a>
+                <span ng-if="container.Ports.length == 0" >-</span>
+              </td>
+              <td ng-if="applicationState.application.authentication">
+                <span>
+                  <i ng-class="container.ResourceControl.Ownership | ownershipicon" aria-hidden="true"></i>
+                  {{ container.ResourceControl.Ownership ? container.ResourceControl.Ownership : container.ResourceControl.Ownership = 'public' }}
+                </span>
+              </td>
+            </tr>
+            <tr ng-if="!containers">
+              <td colspan="9" class="text-center text-muted">Loading...</td>
+            </tr>
+            <tr ng-if="containers.length == 0">
+              <td colspan="9" class="text-center text-muted">No containers available.</td>
             </tr>
           </tbody>
         </table>
+        <div ng-if="containers" class="pull-left pagination-controls">
+          <dir-pagination-controls></dir-pagination-controls>
+        </div>
       </div>
     </rd-widget-body>
-  <rd-widget>
+  </rd-widget>
 </div>

app/components/containers/containersController.js

@@ -1,30 +1,52 @@
 angular.module('containers', [])
-.controller('ContainersController', ['$scope', 'Container', 'Settings', 'Messages', 'Config', 'errorMsgFilter',
-function ($scope, Container, Settings, Messages, Config, errorMsgFilter) {
-
+  .controller('ContainersController', ['$q', '$scope', '$filter', 'Container', 'ContainerService', 'ContainerHelper', 'SystemService', 'Notifications', 'Pagination', 'EntityListService', 'ModalService', 'ResourceControlService', 'EndpointProvider',
+  function ($q, $scope, $filter, Container, ContainerService, ContainerHelper, SystemService, Notifications, Pagination, EntityListService, ModalService, ResourceControlService, EndpointProvider) {
   $scope.state = {};
-  $scope.state.displayAll = Settings.displayAll;
+  $scope.state.pagination_count = Pagination.getPaginationCount('containers');
+  $scope.state.displayAll = true;
+  $scope.state.displayIP = false;
   $scope.sortType = 'State';
-  $scope.sortReverse = true;
+  $scope.sortReverse = false;
   $scope.state.selectedItemCount = 0;
-
   $scope.order = function (sortType) {
     $scope.sortReverse = ($scope.sortType === sortType) ? !$scope.sortReverse : false;
     $scope.sortType = sortType;
   };
+  $scope.PublicURL = EndpointProvider.endpointPublicURL();
+
+  $scope.changePaginationCount = function() {
+    Pagination.setPaginationCount('containers', $scope.state.pagination_count);
+  };
+
+  $scope.cleanAssociatedVolumes = false;
 
   var update = function (data) {
     $('#loadContainersSpinner').show();
     $scope.state.selectedItemCount = 0;
     Container.query(data, function (d) {
       var containers = d;
-      if (hiddenLabels) {
-        containers = hideContainers(d);
-      }
       $scope.containers = containers.map(function (container) {
-        return new ContainerViewModel(container);
+        var model = new ContainerViewModel(container);
+        model.Status = $filter('containerstatus')(model.Status);
+
+        EntityListService.rememberPreviousSelection($scope.containers, model, function onSelect(model){
+          $scope.selectItem(model);
+        });
+
+        if (model.IP) {
+          $scope.state.displayIP = true;
+        }
+        if ($scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM') {
+          model.hostIP = $scope.swarm_hosts[_.split(container.Names[0], '/')[1]];
+        }
+        return model;
       });
+      updateSelectionFlags();
       $('#loadContainersSpinner').hide();
+    }, function (e) {
+      $('#loadContainersSpinner').hide();
+      Notifications.error('Failure', e, 'Unable to retrieve containers');
+      $scope.containers = [];
     });
   };
 
@@ -35,53 +57,52 @@ function ($scope, Container, Settings, Messages, Config, errorMsgFilter) {
       counter = counter - 1;
       if (counter === 0) {
         $('#loadContainersSpinner').hide();
-        update({all: Settings.displayAll ? 1 : 0});
+        update({all: $scope.state.displayAll ? 1 : 0});
       }
     };
     angular.forEach(items, function (c) {
       if (c.Checked) {
         counter = counter + 1;
         if (action === Container.start) {
-          Container.get({id: c.Id}, function (d) {
-            c = d;
-            action({id: c.Id, HostConfig: c.HostConfig || {}}, function (d) {
-              Messages.send("Container " + msg, c.Id);
-              complete();
-            }, function (e) {
-              Messages.error("Failure", e.data);
-              complete();
-            });
+          action({id: c.Id}, {}, function (d) {
+            Notifications.success('Container ' + msg, c.Id);
+            complete();
           }, function (e) {
-            if (e.status === 404) {
-              $('.detail').hide();
-              Messages.error("Not found", "Container not found.");
-            } else {
-              Messages.error("Failure", e.data);
-            }
+            Notifications.error('Failure', e, 'Unable to start container');
             complete();
           });
         }
         else if (action === Container.remove) {
+          ContainerService.remove(c, $scope.cleanAssociatedVolumes)
+          .then(function success() {
+            Notifications.success('Container successfully removed');
+          })
+          .catch(function error(err) {
+            Notifications.error('Failure', err, 'Unable to remove container');
+          })
+          .finally(function final() {
+            complete();
+          });
+        }
+        else if (action === Container.pause) {
           action({id: c.Id}, function (d) {
-            var error = errorMsgFilter(d);
-            if (error) {
-              Messages.send("Error", "Unable to remove running container");
-            }
-            else {
-              Messages.send("Container " + msg, c.Id);
+            if (d.message) {
+              Notifications.success('Container is already paused', c.Id);
+            } else {
+              Notifications.success('Container ' + msg, c.Id);
             }
             complete();
           }, function (e) {
-            Messages.error("Failure", e.data);
+            Notifications.error('Failure', e, 'Unable to pause container');
             complete();
           });
         }
         else {
           action({id: c.Id}, function (d) {
-            Messages.send("Container " + msg, c.Id);
+            Notifications.success('Container ' + msg, c.Id);
             complete();
           }, function (e) {
-            Messages.error("Failure", e.data);
+            Notifications.error('Failure', e, 'An error occured');
             complete();
           });
 
@@ -93,66 +114,133 @@ function ($scope, Container, Settings, Messages, Config, errorMsgFilter) {
     }
   };
 
+  $scope.selectItems = function (allSelected) {
+    angular.forEach($scope.state.filteredContainers, function (container) {
+      if (container.Checked !== allSelected) {
+        container.Checked = allSelected;
+        toggleItemSelection(container);
+      }
+    });
+    updateSelectionFlags();
+  };
+
   $scope.selectItem = function (item) {
+    toggleItemSelection(item);
+    updateSelectionFlags();
+  };
+
+  $scope.toggleGetAll = function () {
+    update({all: $scope.state.displayAll ? 1 : 0});
+  };
+
+  $scope.startAction = function () {
+    batch($scope.containers, Container.start, 'Started');
+  };
+
+  $scope.stopAction = function () {
+    batch($scope.containers, Container.stop, 'Stopped');
+  };
+
+  $scope.restartAction = function () {
+    batch($scope.containers, Container.restart, 'Restarted');
+  };
+
+  $scope.killAction = function () {
+    batch($scope.containers, Container.kill, 'Killed');
+  };
+
+  $scope.pauseAction = function () {
+    batch($scope.containers, Container.pause, 'Paused');
+  };
+
+  $scope.unpauseAction = function () {
+    batch($scope.containers, Container.unpause, 'Unpaused');
+  };
+
+  $scope.removeAction = function () {
+    batch($scope.containers, Container.remove, 'Removed');
+  };
+
+  $scope.confirmRemoveAction = function () {
+    var isOneContainerRunning = false;
+    angular.forEach($scope.containers, function (c) {
+      if (c.Checked && c.State === 'running') {
+        isOneContainerRunning = true;
+        return;
+      }
+    });
+    var title = 'You are about to remove one or more container.';
+    if (isOneContainerRunning) {
+      title = 'You are about to remove one or more running containers.';
+    }
+    ModalService.confirmContainerDeletion(
+      title,
+      function (result) {
+        if(!result) { return; }
+        $scope.cleanAssociatedVolumes = false;
+        if (result[0]) {
+          $scope.cleanAssociatedVolumes = true;
+        }
+        $scope.removeAction();
+      }
+    );
+  };
+
+  function toggleItemSelection(item) {
     if (item.Checked) {
       $scope.state.selectedItemCount++;
     } else {
       $scope.state.selectedItemCount--;
     }
-  };
+  }
 
-  $scope.toggleGetAll = function () {
-    Settings.displayAll = $scope.state.displayAll;
-    update({all: Settings.displayAll ? 1 : 0});
-  };
-
-  $scope.startAction = function () {
-    batch($scope.containers, Container.start, "Started");
-  };
-
-  $scope.stopAction = function () {
-    batch($scope.containers, Container.stop, "Stopped");
-  };
-
-  $scope.restartAction = function () {
-    batch($scope.containers, Container.restart, "Restarted");
-  };
-
-  $scope.killAction = function () {
-    batch($scope.containers, Container.kill, "Killed");
-  };
-
-  $scope.pauseAction = function () {
-    batch($scope.containers, Container.pause, "Paused");
-  };
-
-  $scope.unpauseAction = function () {
-    batch($scope.containers, Container.unpause, "Unpaused");
-  };
-
-  $scope.removeAction = function () {
-    batch($scope.containers, Container.remove, "Removed");
-  };
-
-  var hideContainers = function (containers) {
-    return containers.filter(function (container) {
-      var filterContainer = false;
-      hiddenLabels.forEach(function(label, index) {
-        if (_.has(container.Labels, label.name) &&
-        container.Labels[label.name] === label.value) {
-          filterContainer = true;
-        }
-      });
-      if (!filterContainer) {
-        return container;
+  function updateSelectionFlags() {
+    $scope.state.noStoppedItemsSelected = true;
+    $scope.state.noRunningItemsSelected = true;
+    $scope.state.noPausedItemsSelected = true;
+    $scope.containers.forEach(function(container) {
+      if(!container.Checked) {
+        return;
       }
-    });
-  };
 
-  $scope.swarm = false;
-  Config.$promise.then(function (c) {
-    hiddenLabels = c.hiddenLabels;
-    $scope.swarm = c.swarm;
-    update({all: Settings.displayAll ? 1 : 0});
-  });
+      if(container.Status === 'paused') {
+        $scope.state.noPausedItemsSelected = false;
+      } else if(container.Status === 'stopped') {
+        $scope.state.noStoppedItemsSelected = false;
+      } else if(container.Status === 'running') {
+        $scope.state.noRunningItemsSelected = false;
+      }
+    } );
+  }
+
+  function retrieveSwarmHostsInfo(data) {
+    var swarm_hosts = {};
+    var systemStatus = data.SystemStatus;
+    var node_count = parseInt(systemStatus[3][1], 10);
+    var node_offset = 4;
+    for (i = 0; i < node_count; i++) {
+      var host = {};
+      host.name = _.trim(systemStatus[node_offset][0]);
+      host.ip = _.split(systemStatus[node_offset][1], ':')[0];
+      swarm_hosts[host.name] = host.ip;
+      node_offset += 9;
+    }
+    return swarm_hosts;
+  }
+
+  function initView() {
+    var provider = $scope.applicationState.endpoint.mode.provider;
+    $q.when(provider !== 'DOCKER_SWARM' || SystemService.info())
+    .then(function success(data) {
+      if (provider === 'DOCKER_SWARM') {
+        $scope.swarm_hosts = retrieveSwarmHostsInfo(data);
+      }
+      update({all: $scope.state.displayAll ? 1 : 0});
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to retrieve cluster information');
+    });
+  }
+
+  initView();
 }]);

app/components/createContainer/createContainerController.js

@@ -1,38 +1,51 @@
+// @@OLD_SERVICE_CONTROLLER: this service should be rewritten to use services.
+// See app/components/templates/templatesController.js as a reference.
 angular.module('createContainer', [])
-.controller('CreateContainerController', ['$scope', '$state', 'Config', 'Container', 'Image', 'Volume', 'Network', 'Messages', 'errorMsgFilter',
-function ($scope, $state, Config, Container, Image, Volume, Network, Messages, errorMsgFilter) {
-
-  $scope.state = {
-    alwaysPull: true
-  };
+.controller('CreateContainerController', ['$q', '$scope', '$state', '$stateParams', '$filter', 'Container', 'ContainerHelper', 'Image', 'ImageHelper', 'Volume', 'Network', 'ResourceControlService', 'Authentication', 'Notifications', 'ContainerService', 'ImageService', 'FormValidator',
+function ($q, $scope, $state, $stateParams, $filter, Container, ContainerHelper, Image, ImageHelper, Volume, Network, ResourceControlService, Authentication, Notifications, ContainerService, ImageService, FormValidator) {
 
   $scope.formValues = {
+    alwaysPull: true,
     Console: 'none',
     Volumes: [],
-    Registry: ''
+    Registry: '',
+    NetworkContainer: '',
+    Labels: [],
+    ExtraHosts: [],
+    IPv4: '',
+    IPv6: '',
+    AccessControlData: new AccessControlFormData()
   };
 
-  $scope.imageConfig = {};
+  $scope.state = {
+    formValidationError: ''
+  };
 
   $scope.config = {
+    Image: '',
     Env: [],
+    Cmd: '',
+    ExposedPorts: {},
     HostConfig: {
       RestartPolicy: {
         Name: 'no'
       },
       PortBindings: [],
+      PublishAllPorts: false,
       Binds: [],
       NetworkMode: 'bridge',
-      Privileged: false
-    }
-  };
-
-  $scope.resetVolumePath = function(index) {
-    $scope.formValues.Volumes[index].name = '';
+      Privileged: false,
+      ExtraHosts: [],
+      Devices:[]
+    },
+    NetworkingConfig: {
+      EndpointsConfig: {}
+    },
+    Labels: {}
   };
 
   $scope.addVolume = function() {
-    $scope.formValues.Volumes.push({ name: '', containerPath: '', readOnly: false, isPath: false });
+    $scope.formValues.Volumes.push({ name: '', containerPath: '', readOnly: false, type: 'volume' });
   };
 
   $scope.removeVolume = function(index) {
@@ -55,91 +68,34 @@ function ($scope, $state, Config, Container, Image, Volume, Network, Messages, e
     $scope.config.HostConfig.PortBindings.splice(index, 1);
   };
 
-  Config.$promise.then(function (c) {
-    var swarm = c.swarm;
+  $scope.addLabel = function() {
+    $scope.formValues.Labels.push({ name: '', value: ''});
+  };
 
-    Volume.query({}, function (d) {
-      $scope.availableVolumes = d.Volumes;
-    }, function (e) {
-      Messages.error("Failure", e.data);
-    });
+  $scope.removeLabel = function(index) {
+    $scope.formValues.Labels.splice(index, 1);
+  };
 
-    Network.query({}, function (d) {
-      var networks = d;
-      if (swarm) {
-        networks = d.filter(function (network) {
-          if (network.Scope === 'global') {
-            return network;
-          }
-        });
-        networks.push({Name: "bridge"});
-        networks.push({Name: "host"});
-        networks.push({Name: "none"});
-      }
-      $scope.availableNetworks = networks;
-    }, function (e) {
-      Messages.error("Failure", e.data);
-    });
-  });
+  $scope.addExtraHost = function() {
+    $scope.formValues.ExtraHosts.push({ value: '' });
+  };
 
-  function createContainer(config) {
-    $('#createContainerSpinner').show();
-    Container.create(config, function (d) {
-      if (d.Id) {
-        var reqBody = config.HostConfig || {};
-        reqBody.id = d.Id;
-        Container.start(reqBody, function (cd) {
-          $('#createContainerSpinner').hide();
-          Messages.send('Container Started', d.Id);
-          $state.go('containers', {}, {reload: true});
-        }, function (e) {
-          $('#createContainerSpinner').hide();
-          Messages.error('Error', errorMsgFilter(e));
-        });
-      } else {
-        $('#createContainerSpinner').hide();
-        Messages.error('Error', errorMsgFilter(d));
-      }
-    }, function (e) {
-      $('#createContainerSpinner').hide();
-      Messages.error('Error', errorMsgFilter(e));
-    });
-  }
+  $scope.removeExtraHost = function(index) {
+    $scope.formValues.ExtraHosts.splice(index, 1);
+  };
 
-  function pullImageAndCreateContainer(config) {
-    $('#createContainerSpinner').show();
-    Image.create($scope.imageConfig, function (data) {
-        var err = data.length > 0 && data[data.length - 1].hasOwnProperty('error');
-        if (err) {
-          var detail = data[data.length - 1];
-          $('#createContainerSpinner').hide();
-          Messages.error('Error', detail.error);
-        } else {
-          createContainer(config);
-        }
-    }, function (e) {
-      $('#createContainerSpinner').hide();
-      Messages.error('Error', 'Unable to pull image ' + image);
-    });
-  }
+  $scope.addDevice = function() {
+    $scope.config.HostConfig.Devices.push({ pathOnHost: '', pathInContainer: '' });
+  };
 
-  function createImageConfig(imageName, registry) {
-    var imageNameAndTag = imageName.split(':');
-    var image = imageNameAndTag[0];
-    if (registry) {
-      image = registry + '/' + imageNameAndTag[0];
-    }
-    var imageConfig = {
-      fromImage: image,
-      tag: imageNameAndTag[1] ? imageNameAndTag[1] : 'latest'
-    };
-    return imageConfig;
-  }
+  $scope.removeDevice = function(index) {
+    $scope.config.HostConfig.Devices.splice(index, 1);
+  };
 
   function prepareImageConfig(config) {
-    var image = _.toLower(config.Image);
+    var image = config.Image;
     var registry = $scope.formValues.Registry;
-    var imageConfig = createImageConfig(image, registry);
+    var imageConfig = ImageHelper.createImageConfigForContainer(image, registry.URL);
     config.Image = imageConfig.fromImage + ':' + imageConfig.tag;
     $scope.imageConfig = imageConfig;
   }
@@ -147,9 +103,18 @@ function ($scope, $state, Config, Container, Image, Volume, Network, Messages, e
   function preparePortBindings(config) {
     var bindings = {};
     config.HostConfig.PortBindings.forEach(function (portBinding) {
-      if (portBinding.hostPort && portBinding.containerPort) {
-        var key = portBinding.containerPort + "/" + portBinding.protocol;
-        bindings[key] = [{ HostPort: portBinding.hostPort }];
+      if (portBinding.containerPort) {
+        var key = portBinding.containerPort + '/' + portBinding.protocol;
+        var binding = {};
+        if (portBinding.hostPort && portBinding.hostPort.indexOf(':') > -1) {
+          var hostAndPort = portBinding.hostPort.split(':');
+          binding.HostIp = hostAndPort[0];
+          binding.HostPort = hostAndPort[1];
+        } else {
+          binding.HostPort = portBinding.hostPort;
+        }
+        bindings[key] = [binding];
+        config.ExposedPorts[key] = {};
       }
     });
     config.HostConfig.PortBindings = bindings;
@@ -175,7 +140,7 @@ function ($scope, $state, Config, Container, Image, Volume, Network, Messages, e
     var env = [];
     config.Env.forEach(function (v) {
       if (v.name && v.value) {
-        env.push(v.name + "=" + v.value);
+        env.push(v.name + '=' + v.value);
       }
     });
     config.Env = env;
@@ -201,24 +166,160 @@ function ($scope, $state, Config, Container, Image, Volume, Network, Messages, e
     config.Volumes = volumes;
   }
 
+  function prepareNetworkConfig(config) {
+    var mode = config.HostConfig.NetworkMode;
+    var container = $scope.formValues.NetworkContainer;
+    var containerName = container;
+    if (container && typeof container === 'object') {
+      containerName = $filter('trimcontainername')(container.Names[0]);
+      if ($scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM') {
+        containerName = $filter('swarmcontainername')(container);
+      }
+    }
+    var networkMode = mode;
+    if (containerName) {
+      networkMode += ':' + containerName;
+    }
+    config.HostConfig.NetworkMode = networkMode;
+
+    config.NetworkingConfig.EndpointsConfig[networkMode] = {
+      IPAMConfig: {
+        IPv4Address: $scope.formValues.IPv4,
+        IPv6Address: $scope.formValues.IPv6
+      }
+    };
+
+    $scope.formValues.ExtraHosts.forEach(function (v) {
+    if (v.value) {
+        config.HostConfig.ExtraHosts.push(v.value);
+      }
+    });
+  }
+
+  function prepareLabels(config) {
+    var labels = {};
+    $scope.formValues.Labels.forEach(function (label) {
+      if (label.name && label.value) {
+        labels[label.name] = label.value;
+      }
+    });
+    config.Labels = labels;
+  }
+
+  function prepareDevices(config) {
+    var path = [];
+    config.HostConfig.Devices.forEach(function (p) {
+      if (p.pathOnHost) {
+        if(p.pathInContainer === '') {
+          p.pathInContainer = p.pathOnHost;
+        }
+        path.push({PathOnHost:p.pathOnHost,PathInContainer:p.pathInContainer,CgroupPermissions:'rwm'});
+      }
+    });
+    config.HostConfig.Devices = path;
+  }
+
   function prepareConfiguration() {
     var config = angular.copy($scope.config);
+    config.Cmd = ContainerHelper.commandStringToArray(config.Cmd);
+    prepareNetworkConfig(config);
     prepareImageConfig(config);
     preparePortBindings(config);
     prepareConsole(config);
     prepareEnvironmentVariables(config);
     prepareVolumes(config);
+    prepareLabels(config);
+    prepareDevices(config);
     return config;
   }
 
-  $scope.create = function () {
-    var config = prepareConfiguration();
+  function initView() {
+    Volume.query({}, function (d) {
+      $scope.availableVolumes = d.Volumes;
+    }, function (e) {
+      Notifications.error('Failure', e, 'Unable to retrieve volumes');
+    });
 
-    if ($scope.state.alwaysPull) {
-      pullImageAndCreateContainer(config);
-    } else {
-      createContainer(config);
+    Network.query({}, function (d) {
+      var networks = d;
+      if ($scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM' || $scope.applicationState.endpoint.mode.provider === 'DOCKER_SWARM_MODE') {
+        networks = d.filter(function (network) {
+          if (network.Scope === 'global') {
+            return network;
+          }
+        });
+        $scope.globalNetworkCount = networks.length;
+        networks.push({Name: 'bridge'});
+        networks.push({Name: 'host'});
+        networks.push({Name: 'none'});
+      }
+      networks.push({Name: 'container'});
+      $scope.availableNetworks = networks;
+      if (!_.find(networks, {'Name': 'bridge'})) {
+        $scope.config.HostConfig.NetworkMode = 'nat';
+      }
+    }, function (e) {
+      Notifications.error('Failure', e, 'Unable to retrieve networks');
+    });
+
+    Container.query({}, function (d) {
+      var containers = d;
+      $scope.runningContainers = containers;
+    }, function(e) {
+      Notifications.error('Failure', e, 'Unable to retrieve running containers');
+    });
+
+  }
+
+  function validateForm(accessControlData, isAdmin) {
+    $scope.state.formValidationError = '';
+    var error = '';
+    error = FormValidator.validateAccessControl(accessControlData, isAdmin);
+
+    if (error) {
+      $scope.state.formValidationError = error;
+      return false;
     }
+    return true;
+  }
+
+  $scope.create = function () {
+    $('#createContainerSpinner').show();
+
+    var accessControlData = $scope.formValues.AccessControlData;
+    var userDetails = Authentication.getUserDetails();
+    var isAdmin = userDetails.role === 1 ? true : false;
+
+    if (!validateForm(accessControlData, isAdmin)) {
+      $('#createContainerSpinner').hide();
+      return;
+    }
+
+    var config = prepareConfiguration();
+    createContainer(config, accessControlData);
   };
 
+  function createContainer(config, accessControlData) {
+    $q.when(!$scope.formValues.alwaysPull || ImageService.pullImage($scope.config.Image, $scope.formValues.Registry, true))
+    .finally(function final() {
+      ContainerService.createAndStartContainer(config)
+      .then(function success(data) {
+        var containerIdentifier = data.Id;
+        var userId = Authentication.getUserDetails().ID;
+        return ResourceControlService.applyResourceControl('container', containerIdentifier, userId, accessControlData, []);
+      })
+      .then(function success() {
+        Notifications.success('Container successfully created');
+        $state.go('containers', {}, {reload: true});
+      })
+      .catch(function error(err) {
+        Notifications.error('Failure', err, 'Unable to create container');
+      })
+      .finally(function final() {
+        $('#createContainerSpinner').hide();
+      });
+    });
+  }
+
+  initView();
 }]);

app/components/createContainer/createcontainer.html

@@ -1,7 +1,7 @@
 <rd-header>
   <rd-header-title title="Create container"></rd-header-title>
   <rd-header-content>
-    Containers > Add container
+    <a ui-sref="containers">Containers</a> &gt; Add container
   </rd-header-content>
 </rd-header>
 
@@ -18,79 +18,101 @@
             </div>
           </div>
           <!-- !name-input -->
-          <!-- image-and-registry-inputs -->
-          <div class="form-group">
-            <label for="container_image" class="col-sm-1 control-label text-left">Name</label>
-            <div class="col-sm-7">
-              <input type="text" class="form-control" ng-model="config.Image" id="container_image" placeholder="e.g. ubuntu:trusty">
-            </div>
-            <label for="image_registry" class="col-sm-1 control-label text-left">Registry</label>
-            <div class="col-sm-3">
-              <input type="text" class="form-control" ng-model="formValues.Registry" id="image_registry" placeholder="leave empty to use DockerHub">
-            </div>
-            <div class="col-sm-offset-1 col-sm-11">
-              <div class="checkbox">
-                <label>
-                  <input type="checkbox" ng-model="state.alwaysPull"> Always pull image before creating
-                </label>
-              </div>
-            </div>
+          <div class="col-sm-12 form-section-title">
+            Image configuration
           </div>
-          <!-- !image-and-registry-inputs -->
-          <!-- restart-policy -->
+          <!-- image-and-registry -->
           <div class="form-group">
-            <label class="col-sm-1 control-label text-left">Restart policy</label>
-            <div class="col-sm-11">
-              <label class="radio-inline">
-                <input type="radio" name="container_restart_policy" ng-model="config.HostConfig.RestartPolicy.Name" value="no">
-                Never
+            <por-image-registry image="config.Image" registry="formValues.Registry"></por-image-registry>
+          </div>
+          <!-- !image-and-registry -->
+          <!-- always-pull -->
+          <div class="form-group">
+            <div class="col-sm-12">
+              <label for="ownership" class="control-label text-left">
+                Always pull the image
+                <portainer-tooltip position="bottom" message="When enabled, Portainer will automatically try to pull the specified image before creating the container."></portainer-tooltip>
               </label>
-              <label class="radio-inline">
-                <input type="radio" name="container_restart_policy" ng-model="config.HostConfig.RestartPolicy.Name" value="always">
-                Always
-              </label>
-              <label class="radio-inline">
-                <input type="radio" name="container_restart_policy" ng-model="config.HostConfig.RestartPolicy.Name" value="on-failure">
-                <span class="radio-value">On failure</span>
+              <label class="switch" style="margin-left: 20px;">
+                <input type="checkbox" ng-model="formValues.alwaysPull"><i></i>
               </label>
             </div>
           </div>
-          <!-- !restart-policy -->
+          <!-- !always-pull -->
+          <div class="col-sm-12 form-section-title">
+            Ports configuration
+          </div>
+          <!-- publish-exposed-ports -->
+          <div class="form-group">
+            <div class="col-sm-12">
+              <label class="control-label text-left">
+                Publish all exposed ports
+                <portainer-tooltip position="bottom" message="When enabled, Portainer will let Docker automatically map a random port on the host to each one defined in the image Dockerfile."></portainer-tooltip>
+              </label>
+              <label class="switch" style="margin-left: 20px;">
+                <input type="checkbox" ng-model="config.HostConfig.PublishAllPorts"><i></i>
+              </label>
+            </div>
+          </div>
+          <!-- !publish-exposed-ports -->
           <!-- port-mapping -->
           <div class="form-group">
-            <label for="container_ports" class="col-sm-1 control-label text-left">Port mapping</label>
-            <div class="col-sm-11">
-              <span class="label label-default clickable" ng-click="addPortBinding()">
-                <i class="fa fa-plus-circle" aria-hidden="true"></i> map port
+            <div class="col-sm-12">
+              <label class="control-label text-left">Port mapping</label>
+              <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addPortBinding()">
+                <i class="fa fa-plus-circle" aria-hidden="true"></i> map additional port
               </span>
             </div>
             <!-- port-mapping-input-list -->
-            <div class="col-sm-offset-1 col-sm-11 form-inline" style="margin-top: 10px;">
+            <div class="col-sm-12 form-inline" style="margin-top: 10px;">
               <div ng-repeat="portBinding in config.HostConfig.PortBindings" style="margin-top: 2px;">
-                <div class="input-group col-sm-5 input-group-sm">
+                <!-- host-port -->
+                <div class="input-group col-sm-4 input-group-sm">
                   <span class="input-group-addon">host</span>
-                  <input type="text" class="form-control" ng-model="portBinding.hostPort" placeholder="e.g. 80 or 1.2.3.4:80">
+                  <input type="text" class="form-control" ng-model="portBinding.hostPort" placeholder="e.g. 80 or 1.2.3.4:80 (optional)">
                 </div>
-                <div class="input-group col-sm-5 input-group-sm">
+                <!-- !host-port -->
+                <span style="margin: 0 10px 0 10px;">
+                  <i class="fa fa-long-arrow-right" aria-hidden="true"></i>
+                </span>
+                <!-- container-port -->
+                <div class="input-group col-sm-4 input-group-sm">
                   <span class="input-group-addon">container</span>
                   <input type="text" class="form-control" ng-model="portBinding.containerPort" placeholder="e.g. 80">
                 </div>
-                <div class="input-group col-sm-1 input-group-sm">
-                  <select class="selectpicker form-control" ng-model="portBinding.protocol">
-                    <option value="tcp">tcp</option>
-                    <option value="udp">udp</option>
-                  </select>
-                  <span class="input-group-btn">
-                    <button class="btn btn-default" type="button" ng-click="removePortBinding($index)">
-                      <i class="fa fa-minus" aria-hidden="true"></i>
-                    </button>
-                  </span>
+                <!-- !container-port -->
+                <!-- protocol-actions -->
+                <div class="input-group col-sm-3 input-group-sm">
+                  <div class="btn-group btn-group-sm">
+                    <label class="btn btn-primary" ng-model="portBinding.protocol" uib-btn-radio="'tcp'">TCP</label>
+                    <label class="btn btn-primary" ng-model="portBinding.protocol" uib-btn-radio="'udp'">UDP</label>
+                  </div>
+                  <button class="btn btn-sm btn-danger" type="button" ng-click="removePortBinding($index)">
+                    <i class="fa fa-trash" aria-hidden="true"></i>
+                  </button>
                 </div>
+                <!-- !protocol-actions -->
               </div>
             </div>
             <!-- !port-mapping-input-list -->
           </div>
           <!-- !port-mapping -->
+          <!-- access-control -->
+          <por-access-control-form form-data="formValues.AccessControlData"></por-access-control-form>
+          <!-- !access-control -->
+          <!-- actions -->
+          <div class="col-sm-12 form-section-title">
+            Actions
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!config.Image" ng-click="create()">Start container</button>
+              <a type="button" class="btn btn-default btn-sm" ui-sref="containers">Cancel</a>
+              <i id="createContainerSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+              <span class="text-danger" ng-if="state.formValidationError" style="margin-left: 5px;">{{ state.formValidationError }}</span>
+            </div>
+          </div>
+          <!-- !actions -->
         </form>
       </rd-widget-body>
     </rd-widget>
@@ -100,14 +122,17 @@
 <div class="row">
   <div class="col-lg-12 col-md-12 col-xs-12">
     <rd-widget>
+      <rd-widget-header icon="fa-cog" title="Advanced container settings"></rd-widget-header>
       <rd-widget-body>
-        <ul class="nav nav-tabs">
-          <li class="active clickable"><a data-target="#command" data-toggle="tab">Command</a></li>
-          <li class="clickable"><a data-target="#volumes" data-toggle="tab">Volumes</a></li>
-          <li class="clickable"><a data-target="#network" data-toggle="tab">Network</a></li>
-          <li class="clickable"><a data-target="#security" data-toggle="tab">Security/Host</a></li>
+        <ul class="nav nav-pills nav-justified">
+          <li class="active interactive"><a data-target="#command" data-toggle="tab">Command</a></li>
+          <li class="interactive"><a data-target="#volumes" data-toggle="tab">Volumes</a></li>
+          <li class="interactive"><a data-target="#network" data-toggle="tab">Network</a></li>
+          <li class="interactive"><a data-target="#env" data-toggle="tab">Env</a></li>
+          <li class="interactive"><a data-target="#labels" data-toggle="tab">Labels</a></li>
+          <li class="interactive"><a data-target="#restart-policy" data-toggle="tab">Restart policy</a></li>
+          <li class="interactive"><a data-target="#runtime" data-toggle="tab">Runtime</a></li>
         </ul>
-
         <!-- tab-content -->
         <div class="tab-content">
           <!-- tab-command -->
@@ -115,7 +140,7 @@
             <form class="form-horizontal" style="margin-top: 15px;">
               <!-- command-input -->
               <div class="form-group">
-                <label for="container_command" class="col-sm-1 control-label text-left">Command</label>
+                <label for="container_command" class="col-sm-2 col-lg-1 control-label text-left">Command</label>
                 <div class="col-sm-9">
                   <input type="text" class="form-control" ng-model="config.Cmd" id="container_command" placeholder="e.g. /usr/bin/nginx -t -c /mynginx.conf">
                 </div>
@@ -123,7 +148,7 @@
               <!-- !command-input -->
               <!-- entrypoint-input -->
               <div class="form-group">
-                <label for="container_entrypoint" class="col-sm-1 control-label text-left">Entry Point</label>
+                <label for="container_entrypoint" class="col-sm-2 col-lg-1 control-label text-left">Entry Point</label>
                 <div class="col-sm-9">
                   <input type="text" class="form-control" ng-model="config.Entrypoint" id="container_entrypoint" placeholder="e.g. /bin/sh -c">
                 </div>
@@ -131,7 +156,7 @@
               <!-- !entrypoint-input -->
               <!-- workdir-user-input -->
               <div class="form-group">
-                <label for="container_workingdir" class="col-sm-1 control-label text-left">Working Dir</label>
+                <label for="container_workingdir" class="col-sm-2 col-lg-1 control-label text-left">Working Dir</label>
                 <div class="col-sm-4">
                   <input type="text" class="form-control" ng-model="config.WorkingDir" id="container_workingdir" placeholder="e.g. /myapp">
                 </div>
@@ -143,8 +168,8 @@
               <!-- !workdir-user-input -->
               <!-- console -->
               <div class="form-group">
-                <label for="container_console" class="col-sm-1 control-label text-left">Console</label>
-                <div class="col-sm-11">
+                <label for="container_console" class="col-sm-2 col-lg-1 control-label text-left">Console</label>
+                <div class="col-sm-10 col-lg-11">
                   <div class="col-sm-4">
                     <label class="radio-inline">
                       <input type="radio" name="container_console" ng-model="formValues.Console" value="both">
@@ -158,7 +183,7 @@
                     </label>
                   </div>
                 </div>
-                <div class="col-sm-offset-1 col-sm-11">
+                <div class="col-sm-offset-2 col-sm-10 col-lg-offset-1 col-lg-11">
                   <div class="col-sm-4">
                     <label class="radio-inline">
                       <input type="radio" name="container_console" ng-model="formValues.Console" value="tty">
@@ -174,35 +199,6 @@
                 </div>
               </div>
               <!-- !console -->
-              <!-- environment-variables -->
-              <div class="form-group">
-                <label for="container_env" class="col-sm-1 control-label text-left">Environment variables</label>
-                <div class="col-sm-11">
-                  <span class="label label-default clickable" ng-click="addEnvironmentVariable()">
-                    <i class="fa fa-plus-circle" aria-hidden="true"></i> environment variable
-                  </span>
-                </div>
-                <!-- environment-variable-input-list -->
-                <div class="col-sm-offset-1 col-sm-11 form-inline" style="margin-top: 10px;">
-                  <div ng-repeat="variable in config.Env" style="margin-top: 2px;">
-                    <div class="input-group col-sm-5 input-group-sm">
-                      <span class="input-group-addon">name</span>
-                      <input type="text" class="form-control" ng-model="variable.name" placeholder="e.g. FOO">
-                    </div>
-                    <div class="input-group col-sm-5 input-group-sm">
-                      <span class="input-group-addon">value</span>
-                      <input type="text" class="form-control" ng-model="variable.value" placeholder="e.g. bar">
-                      <span class="input-group-btn">
-                        <button class="btn btn-default" type="button" ng-click="removeEnvironmentVariable($index)">
-                          <i class="fa fa-minus" aria-hidden="true"></i>
-                        </button>
-                      </span>
-                    </div>
-                  </div>
-                </div>
-                <!-- !environment-variable-input-list -->
-              </div>
-              <!-- !environment-variables -->
             </form>
           </div>
           <!-- !tab-command -->
@@ -211,39 +207,64 @@
             <form class="form-horizontal" style="margin-top: 15px;">
               <!-- volumes -->
               <div class="form-group">
-                <label for="container_volumes" class="col-sm-1 control-label text-left">Volumes</label>
-                <div class="col-sm-11">
-                  <span class="label label-default clickable" ng-click="addVolume()">
-                    <i class="fa fa-plus-circle" aria-hidden="true"></i> volume
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Volume mapping</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addVolume()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> map additional volume
                   </span>
                 </div>
                 <!-- volumes-input-list -->
-                <div class="col-sm-offset-1 col-sm-11 form-inline" style="margin-top: 10px;">
-                  <div ng-repeat="volume in formValues.Volumes" style="margin-top: 2px;">
-                    <div class="input-group col-sm-1 input-group-sm">
-                      <div class="checkbox">
-                        <label>
-                          <input type="checkbox" ng-model="volume.readOnly"> Read-only
-                        </label>
+                <div class="form-inline" style="margin-top: 10px;">
+                  <div ng-repeat="volume in formValues.Volumes">
+                    <!-- volume-line1 -->
+                    <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+                      <!-- container-path -->
+                      <div class="input-group input-group-sm col-sm-6">
+                        <span class="input-group-addon">container</span>
+                        <input type="text" class="form-control" ng-model="volume.containerPath" placeholder="e.g. /path/in/container">
                       </div>
-                    </div>
-                    <div class="input-group col-sm-5 input-group-sm">
-                      <span class="input-group-addon"><input type="checkbox" ng-model="volume.isPath" ng-click="resetVolumePath($index)">Path</span>
-                      <select class="selectpicker form-control" ng-model="volume.name" ng-if="!volume.isPath">
-                        <option selected disabled hidden value="">Select a volume</option>
-                        <option ng-repeat="vol in availableVolumes" ng-value="vol.Name">{{ vol.Name|truncate:30}}</option>
-                      </select>
-                      <input ng-if="volume.isPath" type="text" class="form-control" ng-model="volume.name" placeholder="e.g. /path/on/host">
-                    </div>
-                    <div class="input-group col-sm-5 input-group-sm">
-                      <span class="input-group-addon">container</span>
-                      <input type="text" class="form-control" ng-model="volume.containerPath" placeholder="e.g. /path/in/container">
-                      <span class="input-group-btn">
-                        <button class="btn btn-default" type="button" ng-click="removeVolume($index)">
-                          <i class="fa fa-minus" aria-hidden="true"></i>
+                      <!-- !container-path -->
+                      <!-- volume-type -->
+                      <div class="input-group col-sm-5" style="margin-left: 5px;">
+                        <div class="btn-group btn-group-sm">
+                          <label class="btn btn-primary" ng-model="volume.type" uib-btn-radio="'volume'" ng-click="volume.name = ''">Volume</label>
+                          <label class="btn btn-primary" ng-model="volume.type" uib-btn-radio="'bind'" ng-click="volume.name = ''">Bind</label>
+                        </div>
+                        <button class="btn btn-sm btn-danger" type="button" ng-click="removeVolume($index)">
+                          <i class="fa fa-trash" aria-hidden="true"></i>
                         </button>
-                      </span>
+                      </div>
+                      <!-- !volume-type -->
                     </div>
+                    <!-- !volume-line1 -->
+                    <!-- volume-line2 -->
+                    <div class="col-sm-12 form-inline" style="margin-top: 5px;">
+                      <i class="fa fa-long-arrow-right" aria-hidden="true"></i>
+                      <!-- volume -->
+                      <div class="input-group input-group-sm col-sm-6" ng-if="volume.type === 'volume'">
+                        <span class="input-group-addon">volume</span>
+                        <select class="form-control" ng-model="volume.name">
+                          <option selected disabled hidden value="">Select a volume</option>
+                          <option ng-repeat="vol in availableVolumes" ng-value="vol.Name">{{ vol.Name|truncate:30}}</option>
+                        </select>
+                      </div>
+                      <!-- !volume -->
+                      <!-- bind -->
+                      <div class="input-group input-group-sm col-sm-6" ng-if="volume.type === 'bind'">
+                        <span class="input-group-addon">host</span>
+                        <input type="text" class="form-control" ng-model="volume.name" placeholder="e.g. /path/on/host">
+                      </div>
+                      <!-- !bind -->
+                      <!-- read-only -->
+                      <div class="input-group input-group-sm col-sm-5" style="margin-left: 5px;">
+                        <div class="btn-group btn-group-sm">
+                          <label class="btn btn-primary" ng-model="volume.readOnly" uib-btn-radio="false">Writable</label>
+                          <label class="btn btn-primary" ng-model="volume.readOnly" uib-btn-radio="true">Read-only</label>
+                        </div>
+                      </div>
+                      <!-- !read-only -->
+                    </div>
+                    <!-- !volume-line2 -->
                   </div>
                 </div>
                 <!-- !volumes-input-list -->
@@ -255,20 +276,38 @@
           <!-- tab-network -->
           <div class="tab-pane" id="network">
             <form class="form-horizontal" style="margin-top: 15px;">
+              <div class="form-group" ng-if="globalNetworkCount === 0 && applicationState.endpoint.mode.provider !== 'DOCKER_SWARM_MODE'">
+                <div class="col-sm-12">
+                  <span class="small text-muted">You don't have any shared network. Head over the <a ui-sref="networks">networks view</a> to create one.</span>
+                </div>
+              </div>
               <!-- network-input -->
               <div class="form-group">
-                <label for="container_network" class="col-sm-1 control-label text-left">Network</label>
+                <label for="container_network" class="col-sm-2 col-lg-1 control-label text-left">Network</label>
                 <div class="col-sm-9">
-                  <select class="selectpicker form-control" ng-model="config.HostConfig.NetworkMode">
+                  <select class="form-control" ng-model="config.HostConfig.NetworkMode" id="container_network">
                     <option selected disabled hidden value="">Select a network</option>
                     <option ng-repeat="net in availableNetworks" ng-value="net.Name">{{ net.Name }}</option>
                   </select>
                 </div>
               </div>
               <!-- !network-input -->
+              <!-- container-name-input -->
+              <div class="form-group" ng-if="config.HostConfig.NetworkMode == 'container'">
+                <label for="container_network_container" class="col-sm-2 col-lg-1 control-label text-left">Container</label>
+                <div class="col-sm-9">
+                  <select ng-if="applicationState.endpoint.mode.provider !== 'DOCKER_SWARM'" ng-options="container|containername for container in runningContainers" class="form-control" ng-model="formValues.NetworkContainer">
+                    <option selected disabled hidden value="">Select a container</option>
+                  </select>
+                  <select ng-if="applicationState.endpoint.mode.provider === 'DOCKER_SWARM'" ng-options="container|swarmcontainername for container in runningContainers" class="form-control" ng-model="formValues.NetworkContainer">
+                    <option selected disabled hidden value="">Select a container</option>
+                  </select>
+                </div>
+              </div>
+              <!-- !container-name-input -->
               <!-- hostname-input -->
               <div class="form-group">
-                <label for="container_hostname" class="col-sm-1 control-label text-left">Hostname</label>
+                <label for="container_hostname" class="col-sm-2 col-lg-1 control-label text-left">Hostname</label>
                 <div class="col-sm-9">
                   <input type="text" class="form-control" ng-model="config.Hostname" id="container_hostname" placeholder="e.g. web01">
                 </div>
@@ -276,44 +315,197 @@
               <!-- !hostname-input -->
               <!-- domainname-input -->
               <div class="form-group">
-                <label for="container_domainname" class="col-sm-1 control-label text-left">Domain Name</label>
+                <label for="container_domainname" class="col-sm-2 col-lg-1 control-label text-left">Domain Name</label>
                 <div class="col-sm-9">
                   <input type="text" class="form-control" ng-model="config.Domainname" id="container_domainname" placeholder="e.g. example.com">
                 </div>
               </div>
               <!-- !domainname -->
+              <!-- ipv4-input -->
+              <div class="form-group">
+                <label for="container_ipv4" class="col-sm-2 col-lg-1 control-label text-left">IPv4 Address</label>
+                <div class="col-sm-9">
+                  <input type="text" class="form-control" ng-model="formValues.IPv4" id="container_ipv4" placeholder="e.g. 172.20.0.7">
+                </div>
+              </div>
+              <!-- !ipv4-input -->
+              <!-- ipv6-input -->
+              <div class="form-group">
+                <label for="container_ipv6" class="col-sm-2 col-lg-1 control-label text-left">IPv6 Address</label>
+                <div class="col-sm-9">
+                  <input type="text" class="form-control" ng-model="formValues.IPv6" id="container_ipv6" placeholder="e.g. a:b:c:d::1234">
+                </div>
+              </div>
+              <!-- !ipv6-input -->
+              <!-- extra-hosts-variables -->
+              <div class="form-group">
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Hosts file entries</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addExtraHost()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> add additional entry
+                  </span>
+                </div>
+                <!-- extra-hosts-input-list -->
+                <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+                  <div ng-repeat="variable in formValues.ExtraHosts" style="margin-top: 2px;">
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">value</span>
+                      <input type="text" class="form-control" ng-model="variable.value" placeholder="e.g. host:IP">
+                    </div>
+                    <button class="btn btn-sm btn-danger" type="button" ng-click="removeExtraHost($index)">
+                      <i class="fa fa-trash" aria-hidden="true"></i>
+                    </button>
+                  </div>
+                </div>
+                <!-- !extra-hosts-input-list -->
+              </div>
+              <!-- !extra-hosts-variables -->
             </form>
           </div>
           <!-- !tab-network -->
-          <!-- tab-security -->
-          <div class="tab-pane" id="security">
+          <!-- tab-labels -->
+          <div class="tab-pane" id="labels">
+            <form class="form-horizontal" style="margin-top: 15px;">
+              <!-- labels -->
+              <div class="form-group">
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Labels</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addLabel()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> add label
+                  </span>
+                </div>
+                <!-- labels-input-list -->
+                <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+                  <div ng-repeat="label in formValues.Labels" style="margin-top: 2px;">
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">name</span>
+                      <input type="text" class="form-control" ng-model="label.name" placeholder="e.g. com.example.foo">
+                    </div>
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">value</span>
+                      <input type="text" class="form-control" ng-model="label.value" placeholder="e.g. bar">
+                    </div>
+                    <button class="btn btn-sm btn-danger" type="button" ng-click="removeLabel($index)">
+                      <i class="fa fa-trash" aria-hidden="true"></i>
+                    </button>
+                  </div>
+                </div>
+                <!-- !labels-input-list -->
+              </div>
+              <!-- !labels-->
+            </form>
+          </div>
+          <!-- !tab-labels -->
+          <!-- tab-env -->
+          <div class="tab-pane" id="env">
+            <form class="form-horizontal" style="margin-top: 15px;">
+              <!-- environment-variables -->
+              <div class="form-group">
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Environment variables</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addEnvironmentVariable()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> add environment variable
+                  </span>
+                </div>
+                <!-- environment-variable-input-list -->
+                <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+                  <div ng-repeat="variable in config.Env" style="margin-top: 2px;">
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">name</span>
+                      <input type="text" class="form-control" ng-model="variable.name" placeholder="e.g. FOO">
+                    </div>
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">value</span>
+                      <input type="text" class="form-control" ng-model="variable.value" placeholder="e.g. bar">
+                    </div>
+                    <button class="btn btn-sm btn-danger" type="button" ng-click="removeEnvironmentVariable($index)">
+                      <i class="fa fa-trash" aria-hidden="true"></i>
+                    </button>
+                  </div>
+                </div>
+                <!-- !environment-variable-input-list -->
+              </div>
+              <!-- !environment-variables -->
+            </form>
+          </div>
+          <!-- !tab-labels -->
+          <!-- tab-restart-policy -->
+          <div class="tab-pane" id="restart-policy">
             <form class="form-horizontal" style="margin-top: 15px;">
-              <!-- privileged-mode -->
               <div class="form-group">
                 <div class="col-sm-12">
-                  <div class="checkbox">
-                    <label>
-                      <input type="checkbox" ng-model="config.HostConfig.Privileged"> Privileged mode
+                  <label class="control-label text-left">
+                    Restart policy
+                  </label>
+                  <div class="btn-group btn-group-sm" style="margin-left: 20px;">
+                    <label class="btn btn-primary" ng-model="config.HostConfig.RestartPolicy.Name" uib-btn-radio="'no'">
+                      Never
+                    </label>
+                    <label class="btn btn-primary" ng-model="config.HostConfig.RestartPolicy.Name" uib-btn-radio="'always'">
+                      Always
+                    </label>
+                    <label class="btn btn-primary" ng-model="config.HostConfig.RestartPolicy.Name" uib-btn-radio="'on-failure'">
+                      On failure
+                    </label>
+                    <label class="btn btn-primary" ng-model="config.HostConfig.RestartPolicy.Name" uib-btn-radio="'unless-stopped'">
+                      Unless stopped
                     </label>
                   </div>
                 </div>
               </div>
-              <!-- !privileged-mode -->
             </form>
           </div>
-          <!-- !tab-security -->
+          <!-- !tab-restart-policy -->
+          <!-- tab-runtime -->
+          <div class="tab-pane" id="runtime">
+            <form class="form-horizontal" style="margin-top: 15px;">
+              <!-- privileged-mode -->
+              <div class="form-group">
+                <div class="col-sm-12">
+                  <label for="ownership" class="control-label text-left">
+                    Privileged mode
+                  </label>
+                  <label class="switch" style="margin-left: 20px;">
+                    <input type="checkbox" ng-model="config.HostConfig.Privileged"><i></i>
+                  </label>
+                </div>
+              </div>
+              <!-- !privileged-mode -->
+            </form>
+            <form class="form-horizontal" style="margin-top: 15px;">
+              <!-- devices -->
+              <div class="form-group">
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Devices</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addDevice()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> add device
+                  </span>
+                </div>
+               <!-- devices-input-list -->
+                <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+                  <div ng-repeat="device in config.HostConfig.Devices" style="margin-top: 2px;">
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">host</span>
+                      <input type="text" class="form-control" ng-model="device.pathOnHost" placeholder="e.g. /dev/tty0">
+                    </div>
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">container</span>
+                      <input type="text" class="form-control" ng-model="device.pathInContainer" placeholder="e.g. /dev/tty0">
+                    </div>
+                    <button class="btn btn-sm btn-danger" type="button" ng-click="removeDevice($index)">
+                      <i class="fa fa-trash" aria-hidden="true"></i>
+                    </button>
+                  </div>
+                </div>
+                <!-- !devices-input-list -->
+              </div>
+              <!-- !devices-->
+            </form>
+
+          </div>
+          <!-- !tab-runtime -->
         </div>
       </rd-widget-body>
     </rd-widget>
   </div>
 </div>
-
-<div class="row">
-  <div class="col-lg-12 col-md-12 col-xs-12" style="text-align: center;">
-    <div>
-      <i id="createContainerSpinner" class="fa fa-cog fa-3x fa-spin" style="margin-bottom: 5px; display: none;"></i>
-    </div>
-    <button type="button" class="btn btn-default btn-lg" ng-click="create()">Create</button>
-    <a type="button" class="btn btn-default btn-lg" ui-sref="containers">Cancel</a>
-  </div>
-</div>

app/components/createNetwork/createNetworkController.js

@@ -1,14 +1,24 @@
 angular.module('createNetwork', [])
-.controller('CreateNetworkController', ['$scope', '$state', 'Messages', 'Network', 'errorMsgFilter',
-function ($scope, $state, Messages, Network, errorMsgFilter) {
+.controller('CreateNetworkController', ['$scope', '$state', 'Notifications', 'Network', 'LabelHelper',
+function ($scope, $state, Notifications, Network, LabelHelper) {
   $scope.formValues = {
-    DriverOptions: []
+    DriverOptions: [],
+    Subnet: '',
+    Gateway: '',
+    Labels: []
   };
 
   $scope.config = {
     Driver: 'bridge',
     CheckDuplicate: true,
-    Internal: false
+    Internal: false,
+    // Force IPAM Driver to 'default', should not be required.
+    // See: https://github.com/docker/docker/issues/25735
+    IPAM: {
+      Driver: 'default',
+      Config: []
+    },
+    Labels: {}
   };
 
   $scope.addDriverOption = function() {
@@ -19,23 +29,42 @@ function ($scope, $state, Messages, Network, errorMsgFilter) {
     $scope.formValues.DriverOptions.splice(index, 1);
   };
 
+  $scope.addLabel = function() {
+    $scope.formValues.Labels.push({ key: '', value: ''});
+  };
+
+  $scope.removeLabel = function(index) {
+    $scope.formValues.Labels.splice(index, 1);
+  };
+
   function createNetwork(config) {
     $('#createNetworkSpinner').show();
     Network.create(config, function (d) {
-      if (d.Id) {
-        Messages.send("Network created", d.Id);
+      if (d.message) {
+        $('#createNetworkSpinner').hide();
+        Notifications.error('Unable to create network', {}, d.message);
+      } else {
+        Notifications.success('Network created', d.Id);
         $('#createNetworkSpinner').hide();
         $state.go('networks', {}, {reload: true});
-      } else {
-        $('#createNetworkSpinner').hide();
-        Messages.error('Unable to create network', errorMsgFilter(d));
       }
     }, function (e) {
       $('#createNetworkSpinner').hide();
-      Messages.error('Unable to create network', e.data);
+      Notifications.error('Failure', e, 'Unable to create network');
     });
   }
 
+  function prepareIPAMConfiguration(config) {
+    if ($scope.formValues.Subnet) {
+      var ipamConfig = {};
+      ipamConfig.Subnet = $scope.formValues.Subnet;
+      if ($scope.formValues.Gateway) {
+        ipamConfig.Gateway = $scope.formValues.Gateway  ;
+      }
+      config.IPAM.Config.push(ipamConfig);
+    }
+  }
+
   function prepareDriverOptions(config) {
     var options = {};
     $scope.formValues.DriverOptions.forEach(function (option) {
@@ -44,9 +73,15 @@ function ($scope, $state, Messages, Network, errorMsgFilter) {
     config.Options = options;
   }
 
+  function prepareLabelsConfig(config) {
+    config.Labels = LabelHelper.fromKeyValueToLabelHash($scope.formValues.Labels);
+  }
+
   function prepareConfiguration() {
     var config = angular.copy($scope.config);
+    prepareIPAMConfiguration(config);
     prepareDriverOptions(config);
+    prepareLabelsConfig(config);
     return config;
   }
 

app/components/createNetwork/createnetwork.html

@@ -1,7 +1,7 @@
 <rd-header>
   <rd-header-title title="Create network"></rd-header-title>
   <rd-header-content>
-    Networks > Add network
+    <a ui-sref="networks">Networks</a> &gt; Add network
   </rd-header-content>
 </rd-header>
 
@@ -18,24 +18,45 @@
             </div>
           </div>
           <!-- !name-input -->
+          <div class="col-sm-12 form-section-title">
+            Network configuration
+          </div>
+          <!-- subnet-gateway-inputs -->
+          <div class="form-group">
+            <label for="network_subnet" class="col-sm-2 col-lg-1 control-label text-left">Subnet</label>
+            <div class="col-sm-4 col-lg-5">
+              <input type="text" class="form-control" ng-model="formValues.Subnet" id="network_subnet" placeholder="e.g. 172.20.0.0/16">
+            </div>
+            <label for="network_gateway" class="col-sm-2 col-lg-1 control-label text-left">Gateway</label>
+            <div class="col-sm-4 col-lg-5">
+              <input type="text" class="form-control" ng-model="formValues.Gateway" id="network_gateway" placeholder="e.g. 172.20.10.11">
+            </div>
+          </div>
+          <!-- !subnet-gateway-inputs -->
+          <div class="col-sm-12 form-section-title">
+            Driver configuration
+          </div>
           <!-- driver-input -->
           <div class="form-group">
-            <label for="network_driver" class="col-sm-1 control-label text-left">Driver</label>
-            <div class="col-sm-11">
+            <label for="network_driver" class="col-sm-2 col-lg-1 control-label text-left">Driver</label>
+            <div class="col-sm-10">
               <input type="text" class="form-control" ng-model="config.Driver" id="network_driver" placeholder="e.g. driverName">
             </div>
           </div>
           <!-- !driver-input -->
           <!-- driver-options -->
           <div class="form-group">
-            <label for="network_driveropts" class="col-sm-1 control-label text-left">Driver options</label>
-            <div class="col-sm-11">
-              <span class="label label-default clickable" ng-click="addDriverOption()">
-                <i class="fa fa-plus-circle" aria-hidden="true"></i> driver option
+            <div class="col-sm-12" style="margin-top: 5px;">
+              <label class="control-label text-left">
+                Driver options
+                <portainer-tooltip position="bottom" message="Driver options are specific to the selected driver. Please refer to the selected driver documentation."></portainer-tooltip>
+              </label>
+              <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addDriverOption()">
+                <i class="fa fa-plus-circle" aria-hidden="true"></i> add driver option
               </span>
             </div>
             <!-- driver-options-input-list -->
-            <div class="col-sm-offset-1 col-sm-11 form-inline" style="margin-top: 10px;">
+            <div class="col-sm-12 form-inline" style="margin-top: 10px;">
               <div ng-repeat="option in formValues.DriverOptions" style="margin-top: 2px;">
                 <div class="input-group col-sm-5 input-group-sm">
                   <span class="input-group-addon">name</span>
@@ -44,40 +65,71 @@
                 <div class="input-group col-sm-5 input-group-sm">
                   <span class="input-group-addon">value</span>
                   <input type="text" class="form-control" ng-model="option.value" placeholder="e.g. true">
-                  <span class="input-group-btn">
-                    <button class="btn btn-default" type="button" ng-click="removeDriverOption($index)">
-                      <i class="fa fa-minus" aria-hidden="true"></i>
-                    </button>
-                  </span>
                 </div>
+                <button class="btn btn-sm btn-danger" type="button" ng-click="removeDriverOption($index)">
+                  <i class="fa fa-trash" aria-hidden="true"></i>
+                </button>
               </div>
             </div>
             <!-- !driver-options-input-list -->
           </div>
           <!-- !driver-options -->
+          <div class="col-sm-12 form-section-title">
+            Advanced configuration
+          </div>
+          <!-- labels -->
+          <div class="form-group">
+            <div class="col-sm-12" style="margin-top: 5px;">
+              <label class="control-label text-left">Labels</label>
+              <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addLabel()">
+                <i class="fa fa-plus-circle" aria-hidden="true"></i> add label
+              </span>
+            </div>
+            <!-- labels-input-list -->
+            <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+              <div ng-repeat="label in formValues.Labels" style="margin-top: 2px;">
+                <div class="input-group col-sm-5 input-group-sm">
+                  <span class="input-group-addon">name</span>
+                  <input type="text" class="form-control" ng-model="label.key" placeholder="e.g. com.example.foo">
+                </div>
+                <div class="input-group col-sm-5 input-group-sm">
+                  <span class="input-group-addon">value</span>
+                  <input type="text" class="form-control" ng-model="label.value" placeholder="e.g. bar">
+                </div>
+                <button class="btn btn-sm btn-danger" type="button" ng-click="removeLabel($index)">
+                  <i class="fa fa-trash" aria-hidden="true"></i>
+                </button>
+              </div>
+            </div>
+            <!-- !labels-input-list -->
+          </div>
+          <!-- !labels-->
           <!-- internal -->
           <div class="form-group">
             <div class="col-sm-12">
-              <div class="checkbox">
-                <label>
-                  <input type="checkbox" ng-model="config.Internal"> Restrict external access to the network
-                </label>
-              </div>
+              <label for="ownership" class="control-label text-left">
+                Restrict external access to the network
+              </label>
+              <label class="switch" style="margin-left: 20px;">
+                <input type="checkbox" ng-model="config.Internal"><i></i>
+              </label>
             </div>
           </div>
           <!-- !internal -->
+          <!-- actions -->
+          <div class="col-sm-12 form-section-title">
+            Actions
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!config.Name" ng-click="create()">Create network</button>
+              <a type="button" class="btn btn-default btn-sm" ui-sref="networks">Cancel</a>
+              <i id="createNetworkSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+            </div>
+          </div>
+          <!-- !actions -->
         </form>
       </rd-widget-body>
     </rd-widget>
   </div>
 </div>
-
-<div class="row">
-  <div class="col-lg-12 col-md-12 col-xs-12" style="text-align: center;">
-    <div>
-      <i id="createNetworkSpinner" class="fa fa-cog fa-3x fa-spin" style="margin-bottom: 5px; display: none;"></i>
-    </div>
-    <button type="button" class="btn btn-default btn-lg" ng-click="create()">Create</button>
-    <a type="button" class="btn btn-default btn-lg" ui-sref="networks">Cancel</a>
-  </div>
-</div>

app/components/createRegistry/createRegistryController.js

@@ -0,0 +1,49 @@
+angular.module('createRegistry', [])
+.controller('CreateRegistryController', ['$scope', '$state', 'RegistryService', 'Notifications',
+function ($scope, $state, RegistryService, Notifications) {
+
+  $scope.state = {
+    RegistryType: 'quay'
+  };
+
+  $scope.formValues = {
+    Name: 'Quay',
+    URL: 'quay.io',
+    Authentication: true,
+    Username: '',
+    Password: ''
+  };
+
+  $scope.selectQuayRegistry = function() {
+    $scope.formValues.Name = 'Quay';
+    $scope.formValues.URL = 'quay.io';
+    $scope.formValues.Authentication = true;
+  };
+
+  $scope.selectCustomRegistry = function() {
+    $scope.formValues.Name = '';
+    $scope.formValues.URL = '';
+    $scope.formValues.Authentication = false;
+  };
+
+  $scope.addRegistry = function() {
+    $('#createRegistrySpinner').show();
+    var registryName = $scope.formValues.Name;
+    var registryURL = $scope.formValues.URL.replace(/^https?\:\/\//i, '');
+    var authentication = $scope.formValues.Authentication;
+    var username = $scope.formValues.Username;
+    var password = $scope.formValues.Password;
+
+    RegistryService.createRegistry(registryName, registryURL, authentication, username, password)
+    .then(function success(data) {
+      Notifications.success('Registry successfully created');
+      $state.go('registries');
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to create registry');
+    })
+    .finally(function final() {
+      $('#createRegistrySpinner').hide();
+    });
+  };
+}]);

app/components/createRegistry/createregistry.html

@@ -0,0 +1,117 @@
+<rd-header>
+  <rd-header-title title="Create registry">
+    <i id="loadingViewSpinner" class="fa fa-cog fa-spin" style="display:none"></i>
+  </rd-header-title>
+  <rd-header-content>
+    <a ui-sref="registries">Registries</a> &gt; Add registry
+  </rd-header-content>
+</rd-header>
+
+<div class="row">
+  <div class="col-sm-12">
+    <rd-widget>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <div class="col-sm-12 form-section-title">
+            Registry provider
+          </div>
+          <div class="form-group"></div>
+          <div class="form-group" style="margin-bottom: 0">
+            <div class="boxselector_wrapper">
+              <div ng-click="selectQuayRegistry()">
+                <input type="radio" id="registry_quay" ng-model="state.RegistryType" value="quay">
+                <label for="registry_quay">
+                  <div class="boxselector_header">
+                    <i class="fa fa-database" aria-hidden="true" style="margin-right: 2px;"></i>
+                    Quay.io
+                  </div>
+                  <p>Quay container registry</p>
+                </label>
+              </div>
+              <div ng-click="selectCustomRegistry()">
+                <input type="radio" id="registry_custom" ng-model="state.RegistryType" value="custom">
+                <label for="registry_custom">
+                  <div class="boxselector_header">
+                    <i class="fa fa-database" aria-hidden="true" style="margin-right: 2px;"></i>
+                    Custom registry
+                  </div>
+                  <p>Define your own registry</p>
+                </label>
+              </div>
+            </div>
+          </div>
+          <div class="col-sm-12 form-section-title" ng-if="state.RegistryType === 'custom'">
+            Important notice
+          </div>
+          <div class="form-group" ng-if="state.RegistryType === 'custom'">
+            <span class="col-sm-12 text-muted small">
+              Docker requires you to connect to a <a href="https://docs.docker.com/registry/deploying/#running-a-domain-registry" target="_blank">secure registry</a>.
+              You can find more information about how to connect to an insecure registry <a href="https://docs.docker.com/registry/insecure/" target="_blank">in the Docker documentation</a>.
+            </span>
+          </div>
+          <div class="col-sm-12 form-section-title">
+            Registry details
+          </div>
+          <!-- name-input -->
+          <div class="form-group" ng-if="state.RegistryType === 'custom'">
+            <label for="registry_name" class="col-sm-3 col-lg-2 control-label text-left">Name</label>
+            <div class="col-sm-9 col-lg-10">
+              <input type="text" class="form-control" id="registry_name" ng-model="formValues.Name" placeholder="e.g. my-registry">
+            </div>
+          </div>
+          <!-- !name-input -->
+          <!-- registry-url-input -->
+          <div class="form-group" ng-if="state.RegistryType === 'custom'">
+            <label for="registry_url" class="col-sm-3 col-lg-2 control-label text-left">
+              Registry URL
+              <portainer-tooltip position="bottom" message="URL or IP address of a Docker registry. Any protocol will be stripped."></portainer-tooltip>
+            </label>
+            <div class="col-sm-9 col-lg-10">
+              <input type="text" class="form-control" id="registry_url" ng-model="formValues.URL" placeholder="e.g. 10.0.0.10:5000 or myregistry.domain.tld">
+            </div>
+          </div>
+          <!-- !registry-url-input -->
+          <!-- authentication-checkbox -->
+          <div class="form-group" ng-if="state.RegistryType === 'custom'">
+            <div class="col-sm-12">
+              <label for="registry_auth" class="control-label text-left">
+                Authentication
+                <portainer-tooltip position="bottom" message="Enable this option if you need to specify credentials to connect to this registry."></portainer-tooltip>
+              </label>
+              <label class="switch" style="margin-left: 20px;">
+                <input type="checkbox" ng-model="formValues.Authentication"><i></i>
+              </label>
+            </div>
+          </div>
+          <!-- !authentication-checkbox -->
+          <!-- authentication-credentials -->
+          <div ng-if="formValues.Authentication || state.RegistryType === 'quay'">
+            <!-- credentials-user -->
+            <div class="form-group">
+              <label for="credentials_username" class="col-sm-3 col-lg-2 control-label text-left">Username</label>
+              <div class="col-sm-9 col-lg-10">
+                <input type="text" class="form-control" id="credentials_username" ng-model="formValues.Username">
+              </div>
+            </div>
+            <!-- !credentials-user -->
+            <!-- credentials-password -->
+            <div class="form-group">
+              <label for="credentials_password" class="col-sm-3 col-lg-2 control-label text-left">Password</label>
+              <div class="col-sm-9 col-lg-10">
+                <input type="password" class="form-control" id="credentials_password" ng-model="formValues.Password">
+              </div>
+            </div>
+            <!-- !credentials-password -->
+          </div>
+          <!-- !authentication-credentials -->
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!formValues.Name || !formValues.URL || (formValues.Authentication && (!formValues.Username || !formValues.Password))" ng-click="addRegistry()">Add registry</button>
+              <i id="createRegistrySpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+            </div>
+          </div>
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>

app/components/createSecret/createSecretController.js

@@ -0,0 +1,58 @@
+angular.module('createSecret', [])
+.controller('CreateSecretController', ['$scope', '$state', 'Notifications', 'SecretService', 'LabelHelper',
+function ($scope, $state, Notifications, SecretService, LabelHelper) {
+  $scope.formValues = {
+    Name: '',
+    Data: '',
+    Labels: [],
+    encodeSecret: true
+  };
+
+  $scope.addLabel = function() {
+    $scope.formValues.Labels.push({ key: '', value: ''});
+  };
+
+  $scope.removeLabel = function(index) {
+    $scope.formValues.Labels.splice(index, 1);
+  };
+
+  function prepareLabelsConfig(config) {
+    config.Labels = LabelHelper.fromKeyValueToLabelHash($scope.formValues.Labels);
+  }
+
+  function prepareSecretData(config) {
+    if ($scope.formValues.encodeSecret) {
+      config.Data = btoa(unescape(encodeURIComponent($scope.formValues.Data)));
+    } else {
+      config.Data = $scope.formValues.Data;
+    }
+  }
+
+  function prepareConfiguration() {
+    var config = {};
+    config.Name = $scope.formValues.Name;
+    prepareSecretData(config);
+    prepareLabelsConfig(config);
+    return config;
+  }
+
+  function createSecret(config) {
+    $('#createSecretSpinner').show();
+    SecretService.create(config)
+    .then(function success(data) {
+      Notifications.success('Secret successfully created');
+      $state.go('secrets', {}, {reload: true});
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to create secret');
+    })
+    .finally(function final() {
+      $('#createSecretSpinner').hide();
+    });
+  }
+
+  $scope.create = function () {
+    var config = prepareConfiguration();
+    createSecret(config);
+  };
+}]);

app/components/createSecret/createsecret.html

@@ -0,0 +1,85 @@
+<rd-header>
+  <rd-header-title title="Create secret"></rd-header-title>
+  <rd-header-content>
+    <a ui-sref="secrets">Secrets</a> &gt; Add secret
+  </rd-header-content>
+</rd-header>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <!-- name-input -->
+          <div class="form-group">
+            <label for="secret_name" class="col-sm-1 control-label text-left">Name</label>
+            <div class="col-sm-11">
+              <input type="text" class="form-control" ng-model="formValues.Name" id="secret_name" placeholder="e.g. mySecret">
+            </div>
+          </div>
+          <!-- !name-input -->
+          <!-- secret-data -->
+          <div class="form-group">
+            <label for="secret_data" class="col-sm-1 control-label text-left">Secret</label>
+            <div class="col-sm-11">
+              <textarea class="form-control" rows="5" ng-model="formValues.Data"></textarea>
+            </div>
+          </div>
+          <!-- !secret-data -->
+          <!-- encode-secret -->
+          <div class="form-group">
+            <div class="col-sm-12">
+              <label for="encode_secret" class="control-label text-left">
+                Encode secret
+                <portainer-tooltip position="bottom" message="Secrets need to be base64 encoded. Disable this if your secret is already base64 encoded."></portainer-tooltip>
+              </label>
+              <label class="switch" style="margin-left: 20px;">
+                <input type="checkbox" name="encode_secret" ng-model="formValues.encodeSecret"><i></i>
+              </label>
+            </div>
+          </div>
+          <!-- !encode-secret -->
+          <!-- labels -->
+          <div class="form-group">
+            <div class="col-sm-12" style="margin-top: 5px;">
+              <label class="control-label text-left">Labels</label>
+              <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addLabel()">
+                <i class="fa fa-plus-circle" aria-hidden="true"></i> add label
+              </span>
+            </div>
+            <!-- labels-input-list -->
+            <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+              <div ng-repeat="label in formValues.Labels" style="margin-top: 2px;">
+                <div class="input-group col-sm-5 input-group-sm">
+                  <span class="input-group-addon">name</span>
+                  <input type="text" class="form-control" ng-model="label.key" placeholder="e.g. com.example.foo">
+                </div>
+                <div class="input-group col-sm-5 input-group-sm">
+                  <span class="input-group-addon">value</span>
+                  <input type="text" class="form-control" ng-model="label.value" placeholder="e.g. bar">
+                </div>
+                <button class="btn btn-sm btn-danger" type="button" ng-click="removeLabel($index)">
+                  <i class="fa fa-trash" aria-hidden="true"></i>
+                </button>
+              </div>
+            </div>
+            <!-- !labels-input-list -->
+          </div>
+          <!-- !labels-->
+          <!-- actions -->
+          <div class="col-sm-12 form-section-title">
+            Actions
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!formValues.Name || !formValues.Data" ng-click="create()">Create secret</button>
+              <a type="button" class="btn btn-default btn-sm" ui-sref="secrets">Cancel</a>
+              <i id="createSecretSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+            </div>
+          </div>
+          <!-- !actions -->
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>

app/components/createService/createServiceController.js

@@ -0,0 +1,324 @@
+// @@OLD_SERVICE_CONTROLLER: this service should be rewritten to use services.
+// See app/components/templates/templatesController.js as a reference.
+angular.module('createService', [])
+.controller('CreateServiceController', ['$q', '$scope', '$state', 'Service', 'ServiceHelper', 'SecretHelper', 'SecretService', 'VolumeService', 'NetworkService', 'ImageHelper', 'LabelHelper', 'Authentication', 'ResourceControlService', 'Notifications', 'FormValidator', 'RegistryService', 'HttpRequestHelper',
+function ($q, $scope, $state, Service, ServiceHelper, SecretHelper, SecretService, VolumeService, NetworkService, ImageHelper, LabelHelper, Authentication, ResourceControlService, Notifications, FormValidator, RegistryService, HttpRequestHelper) {
+
+  $scope.formValues = {
+    Name: '',
+    Image: '',
+    Registry: {},
+    Mode: 'replicated',
+    Replicas: 1,
+    Command: '',
+    EntryPoint: '',
+    WorkingDir: '',
+    User: '',
+    Env: [],
+    Labels: [],
+    ContainerLabels: [],
+    Volumes: [],
+    Network: '',
+    ExtraNetworks: [],
+    Ports: [],
+    Parallelism: 1,
+    PlacementConstraints: [],
+    PlacementPreferences: [],
+    UpdateDelay: 0,
+    FailureAction: 'pause',
+    Secrets: [],
+    AccessControlData: new AccessControlFormData()
+  };
+
+  $scope.state = {
+    formValidationError: ''
+  };
+
+  $scope.addPortBinding = function() {
+    $scope.formValues.Ports.push({ PublishedPort: '', TargetPort: '', Protocol: 'tcp', PublishMode: 'ingress' });
+  };
+
+  $scope.removePortBinding = function(index) {
+    $scope.formValues.Ports.splice(index, 1);
+  };
+
+  $scope.addExtraNetwork = function() {
+    $scope.formValues.ExtraNetworks.push({ Name: '' });
+  };
+
+  $scope.removeExtraNetwork = function(index) {
+    $scope.formValues.ExtraNetworks.splice(index, 1);
+  };
+
+  $scope.addVolume = function() {
+    $scope.formValues.Volumes.push({ Source: '', Target: '', ReadOnly: false, Type: 'volume' });
+  };
+
+  $scope.removeVolume = function(index) {
+    $scope.formValues.Volumes.splice(index, 1);
+  };
+
+  $scope.addSecret = function() {
+    $scope.formValues.Secrets.push({});
+  };
+
+  $scope.removeSecret = function(index) {
+    $scope.formValues.Secrets.splice(index, 1);
+  };
+
+  $scope.addEnvironmentVariable = function() {
+    $scope.formValues.Env.push({ name: '', value: ''});
+  };
+
+  $scope.removeEnvironmentVariable = function(index) {
+    $scope.formValues.Env.splice(index, 1);
+  };
+
+  $scope.addPlacementConstraint = function() {
+    $scope.formValues.PlacementConstraints.push({ key: '', operator: '==', value: '' });
+  };
+
+  $scope.removePlacementConstraint = function(index) {
+    $scope.formValues.PlacementConstraints.splice(index, 1);
+  };
+
+  $scope.addPlacementPreference = function() {
+    $scope.formValues.PlacementPreferences.push({ strategy: 'spread', value: '' });
+  };
+
+  $scope.removePlacementPreference = function(index) {
+    $scope.formValues.PlacementPreferences.splice(index, 1);
+  };
+
+  $scope.addLabel = function() {
+    $scope.formValues.Labels.push({ key: '', value: ''});
+  };
+
+  $scope.removeLabel = function(index) {
+    $scope.formValues.Labels.splice(index, 1);
+  };
+
+  $scope.addContainerLabel = function() {
+    $scope.formValues.ContainerLabels.push({ key: '', value: ''});
+  };
+
+  $scope.removeContainerLabel = function(index) {
+    $scope.formValues.ContainerLabels.splice(index, 1);
+  };
+
+  function prepareImageConfig(config, input) {
+    var imageConfig = ImageHelper.createImageConfigForContainer(input.Image, input.Registry.URL);
+    config.TaskTemplate.ContainerSpec.Image = imageConfig.fromImage + ':' + imageConfig.tag;
+  }
+
+  function preparePortsConfig(config, input) {
+    var ports = [];
+    input.Ports.forEach(function (binding) {
+      var port = {
+        Protocol: binding.Protocol,
+        PublishMode: binding.PublishMode
+      };
+      if (binding.TargetPort) {
+        port.TargetPort = +binding.TargetPort;
+        if (binding.PublishedPort) {
+          port.PublishedPort = +binding.PublishedPort;
+        }
+        ports.push(port);
+      }
+    });
+    config.EndpointSpec.Ports = ports;
+  }
+
+  function prepareSchedulingConfig(config, input) {
+    if (input.Mode === 'replicated') {
+      config.Mode.Replicated = {
+        Replicas: input.Replicas
+      };
+    } else {
+      config.Mode.Global = {};
+    }
+  }
+
+  function commandToArray(cmd) {
+    var tokens = [].concat.apply([], cmd.split('\'').map(function(v,i) {
+       return i%2 ? v : v.split(' ');
+    })).filter(Boolean);
+    return tokens;
+  }
+
+  function prepareCommandConfig(config, input) {
+    if (input.EntryPoint) {
+      config.TaskTemplate.ContainerSpec.Command = commandToArray(input.EntryPoint);
+    }
+    if (input.Command) {
+      config.TaskTemplate.ContainerSpec.Args = commandToArray(input.Command);
+    }
+    if (input.User) {
+      config.TaskTemplate.ContainerSpec.User = input.User;
+    }
+    if (input.WorkingDir) {
+      config.TaskTemplate.ContainerSpec.Dir = input.WorkingDir;
+    }
+  }
+
+  function prepareEnvConfig(config, input) {
+    var env = [];
+    input.Env.forEach(function (v) {
+      if (v.name) {
+        env.push(v.name + '=' + v.value);
+      }
+    });
+    config.TaskTemplate.ContainerSpec.Env = env;
+  }
+
+  function prepareLabelsConfig(config, input) {
+    config.Labels = LabelHelper.fromKeyValueToLabelHash(input.Labels);
+    config.TaskTemplate.ContainerSpec.Labels = LabelHelper.fromKeyValueToLabelHash(input.ContainerLabels);
+  }
+
+  function prepareVolumes(config, input) {
+    input.Volumes.forEach(function (volume) {
+      if (volume.Source && volume.Target) {
+        config.TaskTemplate.ContainerSpec.Mounts.push(volume);
+      }
+    });
+  }
+
+  function prepareNetworks(config, input) {
+    var networks = [];
+    if (input.Network) {
+      networks.push({ Target: input.Network });
+    }
+    input.ExtraNetworks.forEach(function (network) {
+      networks.push({ Target: network.Name });
+    });
+    config.Networks = _.uniqWith(networks, _.isEqual);
+  }
+
+  function prepareUpdateConfig(config, input) {
+    config.UpdateConfig = {
+      Parallelism: input.Parallelism || 0,
+      Delay: input.UpdateDelay || 0,
+      FailureAction: input.FailureAction
+    };
+  }
+
+  function preparePlacementConfig(config, input) {
+    config.TaskTemplate.Placement.Constraints = ServiceHelper.translateKeyValueToPlacementConstraints(input.PlacementConstraints);
+    config.TaskTemplate.Placement.Preferences = ServiceHelper.translateKeyValueToPlacementPreferences(input.PlacementPreferences);
+  }
+
+  function prepareSecretConfig(config, input) {
+    if (input.Secrets) {
+      var secrets = [];
+      angular.forEach(input.Secrets, function(secret) {
+        if (secret.model) {
+          var s = SecretHelper.secretConfig(secret.model);
+          s.File.Name = s.SecretName;
+          secrets.push(s);
+        }
+      });
+      config.TaskTemplate.ContainerSpec.Secrets = secrets;
+    }
+  }
+
+  function prepareConfiguration() {
+    var input = $scope.formValues;
+    var config = {
+      Name: input.Name,
+      TaskTemplate: {
+        ContainerSpec: {
+          Mounts: []
+        },
+        Placement: {}
+      },
+      Mode: {},
+      EndpointSpec: {}
+    };
+    prepareSchedulingConfig(config, input);
+    prepareImageConfig(config, input);
+    preparePortsConfig(config, input);
+    prepareCommandConfig(config, input);
+    prepareEnvConfig(config, input);
+    prepareLabelsConfig(config, input);
+    prepareVolumes(config, input);
+    prepareNetworks(config, input);
+    prepareUpdateConfig(config, input);
+    prepareSecretConfig(config, input);
+    preparePlacementConfig(config, input);
+    return config;
+  }
+
+  function createNewService(config, accessControlData) {
+
+    var registry = $scope.formValues.Registry;
+    var authenticationDetails = registry.Authentication ? RegistryService.encodedCredentials(registry) : '';
+    HttpRequestHelper.setRegistryAuthenticationHeader(authenticationDetails);
+    Service.create(config).$promise
+    .then(function success(data) {
+      var serviceIdentifier = data.ID;
+      var userId = Authentication.getUserDetails().ID;
+      return ResourceControlService.applyResourceControl('service', serviceIdentifier, userId, accessControlData, []);
+    })
+    .then(function success() {
+      Notifications.success('Service successfully created');
+      $state.go('services', {}, {reload: true});
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to create service');
+    })
+    .finally(function final() {
+      $('#createServiceSpinner').hide();
+    });
+  }
+
+  function validateForm(accessControlData, isAdmin) {
+    $scope.state.formValidationError = '';
+    var error = '';
+    error = FormValidator.validateAccessControl(accessControlData, isAdmin);
+
+    if (error) {
+      $scope.state.formValidationError = error;
+      return false;
+    }
+    return true;
+  }
+
+  $scope.create = function createService() {
+    $('#createServiceSpinner').show();
+
+    var accessControlData = $scope.formValues.AccessControlData;
+    var userDetails = Authentication.getUserDetails();
+    var isAdmin = userDetails.role === 1 ? true : false;
+
+    if (!validateForm(accessControlData, isAdmin)) {
+      $('#createServiceSpinner').hide();
+      return;
+    }
+
+    var config = prepareConfiguration();
+    createNewService(config, accessControlData);
+  };
+
+  function initView() {
+    $('#loadingViewSpinner').show();
+    $q.all({
+      volumes: VolumeService.volumes(),
+      networks: NetworkService.retrieveSwarmNetworks(),
+      secrets: SecretService.secrets()
+    })
+    .then(function success(data) {
+      $scope.availableVolumes = data.volumes;
+      $scope.availableNetworks = data.networks;
+      $scope.availableSecrets = data.secrets;
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'Unable to initialize view');
+    })
+    .finally(function final() {
+      $('#loadingViewSpinner').hide();
+    });
+  }
+
+  initView();
+}]);

app/components/createService/createservice.html

@@ -0,0 +1,428 @@
+<rd-header>
+  <rd-header-title title="Create service">
+    <i id="loadingViewSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px;"></i>
+  </rd-header-title>
+  <rd-header-content>
+    <a ui-sref="services">Services</a> &gt; Add service
+  </rd-header-content>
+</rd-header>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-body>
+        <form class="form-horizontal">
+          <!-- name-input -->
+          <div class="form-group">
+            <label for="service_name" class="col-sm-1 control-label text-left">Name</label>
+            <div class="col-sm-11">
+              <input type="text" class="form-control" ng-model="formValues.Name" id="service_name" placeholder="e.g. myService">
+            </div>
+          </div>
+          <!-- !name-input -->
+          <div class="col-sm-12 form-section-title">
+            Image configuration
+          </div>
+          <!-- image-and-registry -->
+          <div class="form-group">
+            <por-image-registry image="formValues.Image" registry="formValues.Registry"></por-image-registry>
+          </div>
+          <!-- !image-and-registry -->
+          <div class="col-sm-12 form-section-title">
+            Scheduling
+          </div>
+          <!-- scheduling-mode -->
+          <div class="form-group">
+            <div class="col-sm-12">
+              <label class="control-label text-left">
+                Scheduling mode
+              </label>
+              <div class="btn-group btn-group-sm" style="margin-left: 20px;">
+                <label class="btn btn-primary" ng-model="formValues.Mode" uib-btn-radio="'global'">Global</label>
+                <label class="btn btn-primary" ng-model="formValues.Mode" uib-btn-radio="'replicated'">Replicated</label>
+              </div>
+            </div>
+          </div>
+          <div class="form-group form-inline" ng-if="formValues.Mode === 'replicated'">
+            <div class="col-sm-12">
+              <label class="control-label text-left">
+                Replicas
+              </label>
+              <input type="number" class="form-control" ng-model="formValues.Replicas" id="replicas" placeholder="e.g. 3" style="margin-left: 20px;">
+            </div>
+          </div>
+          <!-- !scheduling-mode -->
+          <div class="col-sm-12 form-section-title">
+            Ports configuration
+          </div>
+          <!-- port-mapping -->
+          <div class="form-group">
+            <div class="col-sm-12" style="margin-top: 5px;">
+              <label class="control-label text-left">Port mapping</label>
+              <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addPortBinding()">
+                <i class="fa fa-plus-circle" aria-hidden="true"></i> map additional port
+              </span>
+            </div>
+            <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+              <div ng-repeat="portBinding in formValues.Ports" style="margin-top: 2px;">
+                <!-- host-port -->
+                <div class="input-group col-sm-3 input-group-sm">
+                  <span class="input-group-addon">host</span>
+                  <input type="text" class="form-control" ng-model="portBinding.PublishedPort" placeholder="e.g. 80 or 1.2.3.4:80 (optional)">
+                </div>
+                <!-- !host-port -->
+                <span style="margin: 0 10px 0 10px;">
+                  <i class="fa fa-long-arrow-right" aria-hidden="true"></i>
+                </span>
+                <!-- container-port -->
+                <div class="input-group col-sm-3 input-group-sm">
+                  <span class="input-group-addon">container</span>
+                  <input type="text" class="form-control" ng-model="portBinding.TargetPort" placeholder="e.g. 80">
+                </div>
+                <!-- !container-port -->
+                <!-- protocol-actions -->
+                <div class="input-group col-sm-5 input-group-sm">
+                  <div class="btn-group btn-group-sm">
+                    <label class="btn btn-primary" ng-model="portBinding.Protocol" uib-btn-radio="'tcp'">TCP</label>
+                    <label class="btn btn-primary" ng-model="portBinding.Protocol" uib-btn-radio="'udp'">UDP</label>
+                  </div>
+                  <div class="btn-group btn-group-sm">
+                    <label class="btn btn-primary" ng-model="portBinding.PublishMode" uib-btn-radio="'ingress'">Ingress</label>
+                    <label class="btn btn-primary" ng-model="portBinding.PublishMode" uib-btn-radio="'host'">Host</label>
+                  </div>
+                  <button class="btn btn-sm btn-danger" type="button" ng-click="removePortBinding($index)">
+                    <i class="fa fa-trash" aria-hidden="true"></i>
+                  </button>
+                </div>
+                <!-- !protocol-actions -->
+              </div>
+            </div>
+            <!-- !port-mapping-input-list -->
+          </div>
+          <!-- !port-mapping -->
+          <!-- access-control -->
+          <por-access-control-form form-data="formValues.AccessControlData"></por-access-control-form>
+          <!-- !access-control -->
+          <!-- actions -->
+          <div class="col-sm-12 form-section-title">
+            Actions
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button type="button" class="btn btn-primary btn-sm" ng-disabled="!formValues.Image" ng-click="create()">Create service</button>
+              <a type="button" class="btn btn-default btn-sm" ui-sref="services">Cancel</a>
+              <i id="createServiceSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+              <span class="text-danger" ng-if="state.formValidationError" style="margin-left: 5px;">{{ state.formValidationError }}</span>
+            </div>
+          </div>
+          <!-- !actions -->
+        </form>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>
+
+<div class="row">
+  <div class="col-lg-12 col-md-12 col-xs-12">
+    <rd-widget>
+      <rd-widget-body>
+        <ul class="nav nav-pills nav-justified">
+          <li class="active interactive"><a data-target="#command" data-toggle="tab">Command</a></li>
+          <li class="interactive"><a data-target="#volumes" data-toggle="tab">Volumes</a></li>
+          <li class="interactive"><a data-target="#network" data-toggle="tab">Network</a></li>
+          <li class="interactive"><a data-target="#labels" data-toggle="tab">Labels</a></li>
+          <li class="interactive"><a data-target="#update-config" data-toggle="tab">Update config</a></li>
+          <li class="interactive"><a data-target="#secrets" data-toggle="tab" ng-if="applicationState.endpoint.apiVersion >= 1.25">Secrets</a></li>
+          <li class="interactive"><a data-target="#placement" data-toggle="tab">Placement</a></li>
+        </ul>
+        <!-- tab-content -->
+        <div class="tab-content">
+          <!-- tab-command -->
+          <div class="tab-pane active" id="command">
+            <form class="form-horizontal" style="margin-top: 15px;">
+              <!-- command-input -->
+              <div class="form-group">
+                <label for="service_command" class="col-sm-2 col-lg-1 control-label text-left">Command</label>
+                <div class="col-sm-9">
+                  <input type="text" class="form-control" ng-model="formValues.Command" id="service_command" placeholder="e.g. /usr/bin/nginx -t -c /mynginx.conf">
+                </div>
+              </div>
+              <!-- !command-input -->
+              <!-- entrypoint-input -->
+              <div class="form-group">
+                <label for="service_entrypoint" class="col-sm-2 col-lg-1 control-label text-left">Entrypoint</label>
+                <div class="col-sm-9">
+                  <input type="text" class="form-control" ng-model="formValues.EntryPoint" id="service_entrypoint" placeholder="e.g. /bin/sh -c">
+                </div>
+              </div>
+              <!-- !entrypoint-input -->
+              <!-- workdir-user-input -->
+              <div class="form-group">
+                <label for="service_workingdir" class="col-sm-2 col-lg-1 control-label text-left">Working Dir</label>
+                <div class="col-sm-4">
+                  <input type="text" class="form-control" ng-model="formValues.WorkingDir" id="service_workingdir" placeholder="e.g. /myapp">
+                </div>
+                <label for="service_user" class="col-sm-1 control-label text-left">User</label>
+                <div class="col-sm-4">
+                  <input type="text" class="form-control" ng-model="formValues.User" id="service_user" placeholder="e.g. nginx">
+                </div>
+              </div>
+              <!-- !workdir-user-input -->
+              <!-- environment-variables -->
+              <div class="form-group">
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Environment variables</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addEnvironmentVariable()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> add environment variable
+                  </span>
+                </div>
+                <!-- environment-variable-input-list -->
+                <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+                  <div ng-repeat="variable in formValues.Env" style="margin-top: 2px;">
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">name</span>
+                      <input type="text" class="form-control" ng-model="variable.name" placeholder="e.g. FOO">
+                    </div>
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">value</span>
+                      <input type="text" class="form-control" ng-model="variable.value" placeholder="e.g. bar">
+                    </div>
+                    <button class="btn btn-sm btn-danger" type="button" ng-click="removeEnvironmentVariable($index)">
+                      <i class="fa fa-trash" aria-hidden="true"></i>
+                    </button>
+                  </div>
+                </div>
+                <!-- !environment-variable-input-list -->
+              </div>
+              <!-- !environment-variables -->
+            </form>
+          </div>
+          <!-- !tab-command -->
+          <!-- tab-volume -->
+          <div class="tab-pane" id="volumes">
+            <form class="form-horizontal" style="margin-top: 15px;">
+              <!-- volumes -->
+              <div class="form-group">
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Volume mapping</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addVolume()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> map additional volume
+                  </span>
+                </div>
+                <!-- volumes-input-list -->
+                <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+                  <div ng-repeat="volume in formValues.Volumes">
+                    <div class="col-sm-12" style="margin-top: 10px;">
+                      <!-- volume-line1 -->
+                      <div class="col-sm-12 form-inline">
+                        <!-- container-path -->
+                        <div class="input-group input-group-sm col-sm-6">
+                          <span class="input-group-addon">container</span>
+                          <input type="text" class="form-control" ng-model="volume.Target" placeholder="e.g. /path/in/container">
+                        </div>
+                        <!-- !container-path -->
+                        <!-- volume-type -->
+                        <div class="input-group col-sm-5" style="margin-left: 5px;">
+                          <div class="btn-group btn-group-sm">
+                            <label class="btn btn-primary" ng-model="volume.Type" uib-btn-radio="'volume'" ng-click="volume.name = ''">Volume</label>
+                            <label class="btn btn-primary" ng-model="volume.Type" uib-btn-radio="'bind'" ng-click="volume.Id = ''">Bind</label>
+                          </div>
+                          <button class="btn btn-sm btn-danger" type="button" ng-click="removeVolume($index)">
+                            <i class="fa fa-trash" aria-hidden="true"></i>
+                          </button>
+                        </div>
+                        <!-- !volume-type -->
+                      </div>
+                      <!-- !volume-line1 -->
+                      <!-- volume-line2 -->
+                      <div class="col-sm-12 form-inline" style="margin-top: 5px;">
+                        <i class="fa fa-long-arrow-right" aria-hidden="true"></i>
+                        <!-- volume -->
+                        <div class="input-group input-group-sm col-sm-6" ng-if="volume.Type === 'volume'">
+                          <span class="input-group-addon">volume</span>
+                          <select class="form-control" ng-model="volume.Source">
+                            <option selected disabled hidden value="">Select a volume</option>
+                            <option ng-repeat="vol in availableVolumes" ng-value="vol.Id">{{ vol.Id|truncate:30 }}</option>
+                          </select>
+                        </div>
+                        <!-- !volume -->
+                        <!-- bind -->
+                        <div class="input-group input-group-sm col-sm-6" ng-if="volume.Type === 'bind'">
+                          <span class="input-group-addon">host</span>
+                          <input type="text" class="form-control" ng-model="volume.Source" placeholder="e.g. /path/on/host">
+                        </div>
+                        <!-- !bind -->
+                        <!-- read-only -->
+                        <div class="input-group input-group-sm col-sm-5" style="margin-left: 5px;">
+                          <div class="btn-group btn-group-sm">
+                            <label class="btn btn-primary" ng-model="volume.ReadOnly" uib-btn-radio="false">Writable</label>
+                            <label class="btn btn-primary" ng-model="volume.ReadOnly" uib-btn-radio="true">Read-only</label>
+                          </div>
+                        </div>
+                        <!-- !read-only -->
+                      </div>
+                      <!-- !volume-line2 -->
+                    </div>
+                  </div>
+                </div>
+                <!-- !volumes-input-list -->
+              </div>
+              <!-- !volumes -->
+            </form>
+          </div>
+          <!-- !tab-volume -->
+          <!-- tab-network -->
+          <div class="tab-pane" id="network">
+            <form class="form-horizontal" style="margin-top: 15px;">
+              <!-- network-input -->
+              <div class="form-group">
+                <label for="container_network" class="col-sm-2 col-lg-1 control-label text-left">Network</label>
+                <div class="col-sm-9">
+                  <select class="form-control" ng-model="formValues.Network">
+                    <option selected disabled hidden value="">Select a network</option>
+                    <option ng-repeat="net in availableNetworks" ng-value="net.Name">{{ net.Name }}</option>
+                  </select>
+                </div>
+                <div class="col-sm-2"></div>
+              </div>
+              <!-- !network-input -->
+              <!-- extra-networks -->
+              <div class="form-group">
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Extra networks</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addExtraNetwork()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> add extra network
+                  </span>
+                </div>
+                <!-- network-input-list -->
+                <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+                  <div ng-repeat="network in formValues.ExtraNetworks" style="margin-top: 2px;">
+                    <select class="form-control" ng-model="network.Name">
+                      <option selected disabled hidden value="">Select a network</option>
+                      <option ng-repeat="net in availableNetworks" ng-value="net.Name">{{ net.Name }}</option>
+                    </select>
+                    <button class="btn btn-sm btn-danger" type="button" ng-click="removeExtraNetwork($index)">
+                      <i class="fa fa-trash" aria-hidden="true"></i>
+                    </button>
+                  </div>
+                </div>
+                <!-- !network-input-list -->
+              </div>
+              <!-- !extra-networks -->
+            </form>
+          </div>
+          <!-- !tab-network -->
+          <!-- tab-labels -->
+          <div class="tab-pane" id="labels">
+            <form class="form-horizontal" style="margin-top: 15px;">
+              <!-- labels -->
+              <div class="form-group">
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Service labels</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addLabel()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> add service label
+                  </span>
+                </div>
+                <!-- labels-input-list -->
+                <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+                  <div ng-repeat="label in formValues.Labels" style="margin-top: 2px;">
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">name</span>
+                      <input type="text" class="form-control" ng-model="label.key" placeholder="e.g. com.example.foo">
+                    </div>
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">value</span>
+                      <input type="text" class="form-control" ng-model="label.value" placeholder="e.g. bar">
+                    </div>
+                    <button class="btn btn-sm btn-danger" type="button" ng-click="removeLabel($index)">
+                      <i class="fa fa-trash" aria-hidden="true"></i>
+                    </button>
+                  </div>
+                </div>
+                <!-- !labels-input-list -->
+              </div>
+              <!-- !labels-->
+              <!-- container-labels -->
+              <div class="form-group">
+                <div class="col-sm-12" style="margin-top: 5px;">
+                  <label class="control-label text-left">Container labels</label>
+                  <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addContainerLabel()">
+                    <i class="fa fa-plus-circle" aria-hidden="true"></i> add container label
+                  </span>
+                </div>
+                <!-- container-labels-input-list -->
+                <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+                  <div ng-repeat="label in formValues.ContainerLabels" style="margin-top: 2px;">
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">name</span>
+                      <input type="text" class="form-control" ng-model="label.key" placeholder="e.g. com.example.foo">
+                    </div>
+                    <div class="input-group col-sm-5 input-group-sm">
+                      <span class="input-group-addon">value</span>
+                      <input type="text" class="form-control" ng-model="label.value" placeholder="e.g. bar">
+                    </div>
+                    <button class="btn btn-sm btn-danger" type="button" ng-click="removeContainerLabel($index)">
+                      <i class="fa fa-trash" aria-hidden="true"></i>
+                    </button>
+                  </div>
+                </div>
+                <!-- !container-labels-input-list -->
+              </div>
+              <!-- !container-labels-->
+            </form>
+          </div>
+          <!-- !tab-labels -->
+          <!-- tab-update-config -->
+          <div class="tab-pane" id="update-config">
+            <form class="form-horizontal" style="margin-top: 15px;">
+              <!-- parallelism-input -->
+              <div class="form-group">
+                <label for="parallelism" class="col-sm-2 col-lg-1 control-label text-left">Parallelism</label>
+                <div class="col-sm-2">
+                  <input type="number" class="form-control" ng-model="formValues.Parallelism" id="parallelism" placeholder="e.g. 1">
+                </div>
+                <div class="col-sm-8">
+                  <p class="small text-muted" style="margin-top: 10px;">
+                    Maximum number of tasks to be updated simultaneously (0 to update all at once).
+                  </p>
+                </div>
+              </div>
+              <!-- !parallelism-input -->
+              <!-- delay-input -->
+              <div class="form-group">
+                <label for="update-delay" class="col-sm-2 col-lg-1 control-label text-left">Delay</label>
+                <div class="col-sm-2">
+                  <input type="number" class="form-control" ng-model="formValues.UpdateDelay" id="update-delay" placeholder="e.g. 10">
+                </div>
+                <div class="col-sm-8">
+                  <p class="small text-muted" style="margin-top: 10px;">
+                    Amount of time between updates.
+                  </p>
+                </div>
+              </div>
+              <!-- !delay-input -->
+              <!-- failureAction-input -->
+              <div class="form-group">
+                <div class="col-sm-12">
+                  <label class="control-label text-left">Failure action</label>
+                  <div class="btn-group btn-group-sm" style="margin-left: 20px;">
+                    <label class="btn btn-primary" ng-model="formValues.FailureAction" uib-btn-radio="'continue'">Continue</label>
+                    <label class="btn btn-primary" ng-model="formValues.FailureAction" uib-btn-radio="'pause'">Pause</label>
+                  </div>
+                </div>
+              </div>
+              <!-- !failureAction-input -->
+            </form>
+          </div>
+          <!-- !tab-update-config -->
+          <!-- tab-secrets -->
+          <div class="tab-pane" id="secrets" ng-if="applicationState.endpoint.apiVersion >= 1.25" ng-include="'app/components/createService/includes/secret.html'"></div>
+          <!-- !tab-secrets -->
+          <!-- tab-placement -->
+          <div class="tab-pane" id="placement" ng-include="'app/components/createService/includes/placement.html'"></div>
+          <!-- !tab-placement -->
+        </div>
+      </rd-widget-body>
+    </rd-widget>
+  </div>
+</div>

app/components/createService/includes/placement.html

@@ -0,0 +1,57 @@
+<form class="form-horizontal" style="margin-top: 15px;">
+  <div class="form-group">
+    <div class="col-sm-12" style="margin-top: 5px;">
+      <label class="control-label text-left">Placement constraints</label>
+      <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addPlacementConstraint()">
+        <i class="fa fa-plus-circle" aria-hidden="true"></i> placement constraint
+      </span>
+    </div>
+    <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+      <div ng-repeat="constraint in formValues.PlacementConstraints" style="margin-top: 2px;">
+        <div class="input-group col-sm-4 input-group-sm">
+          <span class="input-group-addon">name</span>
+          <input type="text" class="form-control" ng-model="constraint.key" placeholder="e.g. node.role">
+        </div>
+        <div class="input-group col-sm-1 input-group-sm">
+          <select name="constraintOperator" class="form-control" ng-model="constraint.operator">
+            <option value="==">==</option>
+            <option value="!=">!=</option>
+          </select>
+        </div>
+        <div class="input-group col-sm-5 input-group-sm">
+          <span class="input-group-addon">value</span>
+          <input type="text" class="form-control" ng-model="constraint.value" placeholder="e.g. manager">
+        </div>
+        <button class="btn btn-sm btn-danger" type="button" ng-click="removePlacementConstraint($index)">
+          <i class="fa fa-trash" aria-hidden="true"></i>
+        </button>
+      </div>
+    </div>
+  </div>
+</form>
+
+<form class="form-horizontal" style="margin-top: 15px;" ng-if="applicationState.endpoint.apiVersion >= 1.30">
+  <div class="form-group">
+    <div class="col-sm-12" style="margin-top: 5px;">
+      <label class="control-label text-left">Placement preferences</label>
+      <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addPlacementPreference()">
+        <i class="fa fa-plus-circle" aria-hidden="true"></i> placement preference
+      </span>
+    </div>
+    <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+      <div ng-repeat="preference in formValues.PlacementPreferences" style="margin-top: 2px;">
+        <div class="input-group col-sm-4 input-group-sm">
+          <span class="input-group-addon">strategy</span>
+          <input type="text" class="form-control" ng-model="preference.strategy" placeholder="e.g. spread">
+        </div>
+        <div class="input-group col-sm-5 input-group-sm">
+          <span class="input-group-addon">value</span>
+          <input type="text" class="form-control" ng-model="preference.value" placeholder="e.g. node.labels.datacenter">
+        </div>
+        <button class="btn btn-sm btn-danger" type="button" ng-click="removePlacementPreference($index)">
+          <i class="fa fa-trash" aria-hidden="true"></i>
+        </button>
+      </div>
+    </div>
+  </div>
+</form>

app/components/createService/includes/secret.html

@@ -0,0 +1,28 @@
+<form class="form-horizontal" style="margin-top: 15px;">
+  <div class="form-group">
+    <div class="col-sm-12 small text-muted">
+      Secrets will be available under <code>/run/secrets/$SECRET_NAME</code> in containers.
+    </div>
+  </div>
+  <div class="form-group">
+    <div class="col-sm-12" style="margin-top: 5px;">
+      <label class="control-label text-left">Secrets</label>
+      <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addSecret()">
+        <i class="fa fa-plus-circle" aria-hidden="true"></i> add a secret
+      </span>
+    </div>
+    <div class="col-sm-12 form-inline" style="margin-top: 10px;">
+      <div ng-repeat="secret in formValues.Secrets" style="margin-top: 2px;">
+        <div class="input-group col-sm-4 input-group-sm">
+          <span class="input-group-addon">secret</span>
+          <select class="form-control" ng-model="secret.model" ng-options="secret.Name for secret in availableSecrets">
+            <option value="" selected="selected">Select a secret</option>
+          </select>
+        </div>
+        <button class="btn btn-sm btn-danger" type="button" ng-click="removeSecret($index)">
+          <i class="fa fa-trash" aria-hidden="true"></i>
+        </button>
+      </div>
+    </div>
+  </div>
+</form>

app/components/createVolume/createVolumeController.js

@@ -1,15 +1,19 @@
 angular.module('createVolume', [])
-.controller('CreateVolumeController', ['$scope', '$state', 'Volume', 'Messages', 'errorMsgFilter',
-function ($scope, $state, Volume, Messages, errorMsgFilter) {
+.controller('CreateVolumeController', ['$scope', '$state', 'VolumeService', 'SystemService', 'ResourceControlService', 'Authentication', 'Notifications', 'FormValidator',
+function ($scope, $state, VolumeService, SystemService, ResourceControlService, Authentication, Notifications, FormValidator) {
 
   $scope.formValues = {
-    DriverOptions: []
+    Driver: 'local',
+    DriverOptions: [],
+    AccessControlData: new AccessControlFormData()
   };
 
-  $scope.config = {
-    Driver: 'local'
+  $scope.state = {
+    formValidationError: ''
   };
 
+  $scope.availableVolumeDrivers = [];
+
   $scope.addDriverOption = function() {
     $scope.formValues.DriverOptions.push({ name: '', value: '' });
   };
@@ -18,39 +22,67 @@ function ($scope, $state, Volume, Messages, errorMsgFilter) {
     $scope.formValues.DriverOptions.splice(index, 1);
   };
 
-  function createVolume(config) {
-    $('#createVolumeSpinner').show();
-    Volume.create(config, function (d) {
-      if (d.Name) {
-        Messages.send("Volume created", d.Name);
-        $('#createVolumeSpinner').hide();
-        $state.go('volumes', {}, {reload: true});
-      } else {
-        $('#createVolumeSpinner').hide();
-        Messages.error('Unable to create volume', errorMsgFilter(d));
-      }
-    }, function (e) {
-      $('#createVolumeSpinner').hide();
-      Messages.error('Unable to create volume', e.data);
-    });
-  }
+  function validateForm(accessControlData, isAdmin) {
+    $scope.state.formValidationError = '';
+    var error = '';
+    error = FormValidator.validateAccessControl(accessControlData, isAdmin);
 
-  function prepareDriverOptions(config) {
-    var options = {};
-    $scope.formValues.DriverOptions.forEach(function (option) {
-      options[option.name] = option.value;
-    });
-    config.DriverOpts = options;
-  }
-
-  function prepareConfiguration() {
-    var config = angular.copy($scope.config);
-    prepareDriverOptions(config);
-    return config;
+    if (error) {
+      $scope.state.formValidationError = error;
+      return false;
+    }
+    return true;
   }
 
   $scope.create = function () {
-    var config = prepareConfiguration();
-    createVolume(config);
+    $('#createVolumeSpinner').show();
+
+    var name = $scope.formValues.Name;
+    var driver = $scope.formValues.Driver;
+    var driverOptions = $scope.formValues.DriverOptions;
+    var volumeConfiguration = VolumeService.createVolumeConfiguration(name, driver, driverOptions);
+    var accessControlData = $scope.formValues.AccessControlData;
+    var userDetails = Authentication.getUserDetails();
+    var isAdmin = userDetails.role === 1 ? true : false;
+
+    if (!validateForm(accessControlData, isAdmin)) {
+      $('#createVolumeSpinner').hide();
+      return;
+    }
+
+    VolumeService.createVolume(volumeConfiguration)
+    .then(function success(data) {
+      var volumeIdentifier = data.Id;
+      var userId = userDetails.ID;
+      return ResourceControlService.applyResourceControl('volume', volumeIdentifier, userId, accessControlData, []);
+    })
+    .then(function success(data) {
+      Notifications.success('Volume successfully created');
+      $state.go('volumes', {}, {reload: true});
+    })
+    .catch(function error(err) {
+      Notifications.error('Failure', err, 'An error occured during volume creation');
+    })
+    .finally(function final() {
+      $('#createVolumeSpinner').hide();
+    });
   };
+
+  function initView() {
+    $('#loadingViewSpinner').show();
+    if ($scope.applicationState.endpoint.mode.provider !== 'DOCKER_SWARM') {
+      SystemService.getVolumePlugins()
+      .then(function success(data) {
+        $scope.availableVolumeDrivers = data;
+      })
+      .catch(function error(err) {
+        Notifications.error('Failure', err, 'Unable to retrieve volume drivers');
+      })
+      .finally(function final() {
+        $('#loadingViewSpinner').hide();
+      });
+    }
+  }
+
+  initView();
 }]);

app/components/createVolume/createvolume.html

@@ -1,7 +1,9 @@
 <rd-header>
-  <rd-header-title title="Create volume"></rd-header-title>
+  <rd-header-title title="Create volume">
+    <i id="loadingViewSpinner" class="fa fa-cog fa-spin"></i>
+  </rd-header-title>
   <rd-header-content>
-    Volumes > Add volume
+    <a ui-sref="volumes">Volumes</a> &gt; Add volume
   </rd-header-content>
 </rd-header>
 
@@ -14,28 +16,37 @@
           <div class="form-group">
             <label for="volume_name" class="col-sm-1 control-label text-left">Name</label>
             <div class="col-sm-11">
-              <input type="text" class="form-control" ng-model="config.Name" id="volume_name" placeholder="e.g. myVolume">
+              <input type="text" class="form-control" ng-model="formValues.Name" id="volume_name" placeholder="e.g. myVolume">
             </div>
           </div>
           <!-- !name-input -->
+          <div class="col-sm-12 form-section-title">
+            Driver configuration
+          </div>
           <!-- driver-input -->
           <div class="form-group">
             <label for="volume_driver" class="col-sm-1 control-label text-left">Driver</label>
             <div class="col-sm-11">
-              <input type="text" class="form-control" ng-model="config.Driver" id="volume_driver" placeholder="e.g. driverName">
+              <select class="form-control" ng-options="driver for driver in availableVolumeDrivers" ng-model="formValues.Driver" ng-if="availableVolumeDrivers.length > 0">
+                <option disabled hidden value="">Select a driver</option>
+              </select>
+              <input type="text" class="form-control" ng-model="formValues.Driver" id="volume_driver" placeholder="e.g. driverName" ng-if="availableVolumeDrivers.length === 0">
             </div>
           </div>
           <!-- !driver-input -->
           <!-- driver-options -->
           <div class="form-group">
-            <label for="volume_driveropts" class="col-sm-1 control-label text-left">Driver options</label>
-            <div class="col-sm-11">
-              <span class="label label-default clickable" ng-click="addDriverOption()">
-                <i class="fa fa-plus-circle" aria-hidden="true"></i> driver option
+            <div class="col-sm-12" style="margin-top: 5px;">
+              <label class="control-label text-left">
+                Driver options
+                <portainer-tooltip position="bottom" message="Driver options are specific to the selected driver. Please refer to the selected driver documentation."></portainer-tooltip>
+              </label>
+              <span class="label label-default interactive" style="margin-left: 10px;" ng-click="addDriverOption()">
+                <i class="fa fa-plus-circle" aria-hidden="true"></i> add driver option
               </span>
             </div>
             <!-- driver-options-input-list -->
-            <div class="col-sm-offset-1 col-sm-11 form-inline" style="margin-top: 10px;">
+            <div class="col-sm-12 form-inline" style="margin-top: 10px;">
               <div ng-repeat="option in formValues.DriverOptions" style="margin-top: 2px;">
                 <div class="input-group col-sm-5 input-group-sm">
                   <span class="input-group-addon">name</span>
@@ -44,29 +55,33 @@
                 <div class="input-group col-sm-5 input-group-sm">
                   <span class="input-group-addon">value</span>
                   <input type="text" class="form-control" ng-model="option.value" placeholder="e.g. /path/on/host">
-                  <span class="input-group-btn">
-                    <button class="btn btn-default" type="button" ng-click="removeDriverOption($index)">
-                      <i class="fa fa-minus" aria-hidden="true"></i>
-                    </button>
-                  </span>
                 </div>
+                <button class="btn btn-sm btn-danger" type="button" ng-click="removeDriverOption($index)">
+                  <i class="fa fa-trash" aria-hidden="true"></i>
+                </button>
               </div>
             </div>
             <!-- !driver-options-input-list -->
           </div>
           <!-- !driver-options -->
+          <!-- access-control -->
+          <por-access-control-form form-data="formValues.AccessControlData"></por-access-control-form>
+          <!-- !access-control -->
+          <!-- actions -->
+          <div class="col-sm-12 form-section-title">
+            Actions
+          </div>
+          <div class="form-group">
+            <div class="col-sm-12">
+              <button type="button" class="btn btn-primary btn-sm" ng-click="create()">Create volume</button>
+              <a type="button" class="btn btn-default btn-sm" ui-sref="volumes">Cancel</a>
+              <i id="createVolumeSpinner" class="fa fa-cog fa-spin" style="margin-left: 5px; display: none;"></i>
+              <span class="text-danger" ng-if="state.formValidationError" style="margin-left: 5px;">{{ state.formValidationError }}</span>
+            </div>
+          </div>
+          <!-- !actions -->
         </form>
       </rd-widget-body>
     </rd-widget>
   </div>
 </div>
-
-<div class="row">
-  <div class="col-lg-12 col-md-12 col-xs-12" style="text-align: center;">
-    <div>
-      <i id="createVolumeSpinner" class="fa fa-cog fa-3x fa-spin" style="margin-bottom: 5px; display: none;"></i>
-    </div>
-    <button type="button" class="btn btn-default btn-lg" ng-click="create()">Create</button>
-    <a type="button" class="btn btn-default btn-lg" ui-sref="volumes">Cancel</a>
-  </div>
-</div>

app/components/dashboard/dashboard.html

@@ -1,76 +1,153 @@
 <rd-header>
-  <rd-header-title title="Home"></rd-header-title>
+  <rd-header-title title="Home">
+    <i id="loadingViewSpinner" class="fa fa-cog fa-spin"></i>
+  </rd-header-title>
   <rd-header-content>Dashboard</rd-header-content>
 </rd-header>
 
 <div class="row">
-  <div class="col-lg-3 col-md-6 col-xs-12">
+  <div class="col-lg-12 col-md-12 col-xs-12" ng-if="applicationState.endpoint.mode.provider !== 'DOCKER_SWARM'">
     <rd-widget>
-      <rd-widget-body>
-        <div class="widget-icon blue pull-left">
-          <i class="fa fa-tasks"></i>
-        </div>
-        <div class="title">{{ containerData.total }}</div>
-        <div class="comment">Containers</div>
+      <rd-widget-header icon="fa-tachometer" title="Node info"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <tr>
+              <td>Name</td>
+              <td>{{ infoData.Name }}</td>
+            </tr>
+            <tr>
+              <td>Docker version</td>
+              <td>{{ infoData.ServerVersion }}</td>
+            </tr>
+            <tr>
+              <td>CPU</td>
+              <td>{{ infoData.NCPU }}</td>
+            </tr>
+            <tr>
+              <td>Memory</td>
+              <td>{{ infoData.MemTotal|humansize }}</td>
+            </tr>
+          </tbody>
+        </table>
       </rd-widget-body>
     </rd-widget>
   </div>
-  <div class="col-lg-3 col-md-6 col-xs-12">
+  <div class="col-lg-12 col-md-12 col-xs-12" ng-if="applicationState.endpoint.mode.provider === 'DOCKER_SWARM'">
     <rd-widget>
-      <rd-widget-body>
-        <div class="widget-icon green pull-left">
-          <i class="fa fa-tasks"></i>
-        </div>
-        <div class="title">{{ containerData.running }}</div>
-        <div class="comment">Running</div>
+      <rd-widget-header icon="fa-tachometer" title="Cluster info"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <tr>
+              <td>Nodes</td>
+              <td>{{ infoData.SystemStatus[0][1] == 'primary' ? infoData.SystemStatus[3][1] : infoData.SystemStatus[4][1] }}</td>
+            </tr>
+            <tr>
+              <td>Swarm version</td>
+              <td>{{ infoData.ServerVersion|swarmversion }}</td>
+            </tr>
+            <tr>
+              <td>Total CPU</td>
+              <td>{{ infoData.NCPU }}</td>
+            </tr>
+            <tr>
+              <td>Total memory</td>
+              <td>{{ infoData.MemTotal|humansize: 2 }}</td>
+            </tr>
+          </tbody>
+        </table>
       </rd-widget-body>
     </rd-widget>
   </div>
-  <div class="col-lg-3 col-md-6 col-xs-12">
+  <div class="col-lg-12 col-md-12 col-xs-12" ng-if="applicationState.endpoint.mode.provider === 'DOCKER_SWARM_MODE'">
     <rd-widget>
-      <rd-widget-body>
-        <div class="widget-icon red pull-left">
-          <i class="fa fa-tasks"></i>
-        </div>
-        <div class="title">{{ containerData.stopped }}</div>
-        <div class="comment">Stopped</div>
-      </rd-widget-body>
-    </rd-widget>
-  </div>
-  <div class="col-lg-3 col-md-6 col-xs-12">
-    <rd-widget>
-      <rd-widget-body>
-        <div class="widget-icon gray pull-left">
-          <i class="fa fa-tasks"></i>
-        </div>
-        <div class="title">{{ containerData.ghost }}</div>
-        <div class="comment">Ghost</div>
+      <rd-widget-header icon="fa-tachometer" title="Swarm info"></rd-widget-header>
+      <rd-widget-body classes="no-padding">
+        <table class="table">
+          <tbody>
+            <tr>
+              <td colspan="2"><span class="small text-muted">This node is part of a Swarm cluster</span></td>
+            </tr>
+            <tr >
+              <td>Node role</td>
+              <td>{{ infoData.Swarm.ControlAvailable ? 'Manager' : 'Worker' }}</td>
+            </tr>
+            <tr ng-if="infoData.Swarm.ControlAvailable">
+              <td>Nodes in the cluster</td>
+              <td>{{ infoData.Swarm.Nodes }}</td>
+            </tr>
+          </tbody>
+        </table>
       </rd-widget-body>
     </rd-widget>
   </div>
 </div>
 
 <div class="row">
-  <div class="col-lg-6">
-    <rd-widget>
-      <rd-widget-header icon="fa-tasks" title="Containers created"></rd-widget-header>
-      <rd-widget-body>
-        <canvas id="containers-started-chart" width="770" height="230">
-            <p class="browserupgrade">You are using an <strong>outdated</strong> browser. Please <a
-                    href="http://browsehappy.com/">upgrade your browser</a> to improve your experience.</p>
-        </canvas>
-      </rd-widget-body>
-    </rd-widget>
+  <div class="col-xs-12 col-md-6">
+    <a ui-sref="containers">
+      <rd-widget>
+        <rd-widget-body>
+          <div class="widget-icon blue pull-left">
+            <i class="fa fa-server"></i>
+          </div>
+          <div class="pull-right">
+            <div><i class="fa fa-heartbeat space-right green-icon"></i>{{ containerData.running }} running</div>
+            <div><i class="fa fa-heartbeat space-right red-icon"></i>{{ containerData.stopped }} stopped</div>
+          </div>
+          <div class="title">{{ containerData.total }}</div>
+          <div class="comment">Containers</div>
+        </rd-widget-body>
+      </rd-widget>
+    </a>
   </div>
-  <div class="col-lg-6">
-    <rd-widget>
-      <rd-widget-header icon="fa-clone" title="Images created"></rd-widget-header>
-      <rd-widget-body>
-        <canvas id="images-created-chart" width="770" height="230">
-            <p class="browserupgrade">You are using an <strong>outdated</strong> browser. Please <a
-                    href="http://browsehappy.com/">upgrade your browser</a> to improve your experience.</p>
-        </canvas>
-      </rd-widget-body>
-    </rd-widget>
+  <div class="col-xs-12 col-md-6">
+    <a ui-sref="images">
+      <rd-widget>
+        <rd-widget-body>
+          <div class="widget-icon blue pull-left">
+            <i class="fa fa-clone"></i>
+          </div>
+          <div class="pull-right">
+            <div><i class="fa fa-pie-chart space-right"></i>{{ imageData.size|humansize }}</div>
+          </div>
+          <div class="title">{{ imageData.total }}</div>
+          <div class="comment">Images</div>
+        </rd-widget-body>
+      </rd-widget>
+    </a>
+  </div>
+  <div class="col-xs-12 col-md-6">
+    <a ui-sref="volumes">
+      <rd-widget>
+        <rd-widget-body>
+          <div class="widget-icon blue pull-left">
+            <i class="fa fa-cubes"></i>
+          </div>
+          <div class="pull-right" ng-if="infoData.Driver">
+            <div><i class="fa fa-hdd-o space-right"></i>{{ infoData.Driver }} driver</div>
+          </div>
+          <div class="title">{{ volumeData.total }}</div>
+          <div class="comment">Volumes</div>
+        </rd-widget-body>
+      </rd-widget>
+    </a>
+  </div>
+  <div class="col-xs-12 col-md-6">
+    <a ui-sref="networks">
+      <rd-widget>
+        <rd-widget-body>
+          <div class="widget-icon blue pull-left">
+            <i class="fa fa-sitemap"></i>
+          </div>
+          <div class="title">{{ networkData.total }}</div>
+          <div class="comment">Networks</div>
+        </rd-widget-body>
+      </rd-widget>
+    </a>
   </div>
 </div>
+
+<div class="row">
+</div>