chore: version bump 2.33.2 (#1257)

.eslintrc.yml

@@ -17,7 +17,7 @@ plugins:
   - import
 
 parserOptions:
-  ecmaVersion: latest
+  ecmaVersion: 2018
   sourceType: module
   project: './tsconfig.json'
   ecmaFeatures:
@@ -114,13 +114,7 @@ overrides:
       '@typescript-eslint/explicit-module-boundary-types': off
       '@typescript-eslint/no-unused-vars': 'error'
       '@typescript-eslint/no-explicit-any': 'error'
-      'jsx-a11y/label-has-associated-control':
-        - error
-        - assert: either
-          controlComponents:
-            - Input
-            - Checkbox
-      'jsx-a11y/control-has-associated-label': off
+      'jsx-a11y/label-has-associated-control': ['error', { 'assert': 'either', controlComponents: ['Input', 'Checkbox'] }]
       'react/function-component-definition': ['error', { 'namedComponents': 'function-declaration' }]
       'react/jsx-no-bind': off
       'no-await-in-loop': 'off'

.husky/pre-commit

@@ -1,4 +1,4 @@
 #!/usr/bin/env sh
 . "$(dirname -- "$0")/_/husky.sh"
 
-cd $(dirname -- "$0") && pnpm lint-staged
+cd $(dirname -- "$0") && yarn lint-staged

CONTRIBUTING.md

@@ -77,7 +77,7 @@ The feature request process is similar to the bug report process but has an extr
 
 ## Build and run Portainer locally
 
-Ensure you have Docker, Node.js, pnpm, and Golang installed in the correct versions.
+Ensure you have Docker, Node.js, yarn, and Golang installed in the correct versions.
 
 Install dependencies:
 

Makefile

@@ -26,7 +26,7 @@ all: tidy deps build-server build-client ## Build the client, server and downloa
 build-all: all ## Alias for the 'all' target (used by CI)
 
 build-client: init-dist ## Build the client
-	export NODE_ENV=$(ENV) && pnpm run build --config $(WEBPACK_CONFIG)
+	export NODE_ENV=$(ENV) && yarn build --config $(WEBPACK_CONFIG)
 
 build-server: init-dist ## Build the server binary
 	./build/build_binary.sh "$(PLATFORM)" "$(ARCH)"
@@ -35,7 +35,7 @@ build-image: build-all ## Build the Portainer image locally
 	docker buildx build --load -t portainerci/portainer-ce:$(TAG) -f build/linux/Dockerfile .
 
 build-storybook: ## Build and serve the storybook files
-	pnpm run storybook:build
+	yarn storybook:build
 
 devops: clean deps build-client ## Build the everything target specifically for CI
 	echo "Building the devops binary..."
@@ -49,7 +49,7 @@ server-deps: init-dist ## Download dependant server binaries
 	@./build/download_binaries.sh $(PLATFORM) $(ARCH)
 
 client-deps: ## Install client dependencies
-	pnpm install
+	yarn
 
 tidy: ## Tidy up the go.mod file
 	@go mod tidy
@@ -67,7 +67,7 @@ clean: ## Remove all build and download artifacts
 test: test-server test-client ## Run all tests
 
 test-client: ## Run client tests
-	pnpm run test $(ARGS) --coverage
+	yarn test $(ARGS) --coverage
 
 test-server:	## Run server tests
 	$(GOTESTSUM) --format pkgname-and-test-fails --format-hide-empty-pkg --hide-summary skipped -- -cover -covermode=atomic -coverprofile=coverage.out ./...
@@ -79,7 +79,7 @@ dev: ## Run both the client and server in development mode
 	make dev-client
 
 dev-client: ## Run the client in development mode
-	pnpm run dev
+	yarn dev
 
 dev-server: build-server ## Run the server in development mode
 	@./dev/run_container.sh
@@ -93,7 +93,7 @@ dev-server-podman: build-server ## Run the server in development mode
 format: format-client format-server ## Format all code
 
 format-client: ## Format client code
-	pnpm run format
+	yarn format
 
 format-server: ## Format server code
 	go fmt ./...
@@ -103,9 +103,9 @@ format-server: ## Format server code
 lint: lint-client lint-server ## Lint all code
 
 lint-client: ## Lint client code
-	pnpm run lint
+	yarn lint
 
-lint-server: tidy ## Lint server code
+lint-server: ## Lint server code
 	golangci-lint run --timeout=10m -c .golangci.yaml
 
 
@@ -118,12 +118,11 @@ dev-extension: build-server build-client ## Run the extension in development mod
 ##@ Docs
 .PHONY: docs-build docs-validate docs-clean docs-validate-clean
 docs-build: init-dist ## Build docs
-	go mod download -x
 	cd api && $(SWAG) init -o "../dist/docs" -ot "yaml" -g ./http/handler/handler.go --parseDependency --parseInternal --parseDepth 2 -p pascalcase --markdownFiles ./
 
 docs-validate: docs-build ## Validate docs
-	pnpm swagger2openapi --warnOnly dist/docs/swagger.yaml -o dist/docs/openapi.yaml
-	pnpm swagger-cli validate dist/docs/openapi.yaml
+	yarn swagger2openapi --warnOnly dist/docs/swagger.yaml -o dist/docs/openapi.yaml
+	yarn swagger-cli validate dist/docs/openapi.yaml
 
 ##@ Helpers
 .PHONY: help

api/archive/targz.go

@@ -9,8 +9,6 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
-
-	"github.com/portainer/portainer/api/filesystem"
 )
 
 // TarGzDir creates a tar.gz archive and returns it's path.
@@ -107,7 +105,7 @@ func ExtractTarGz(r io.Reader, outputDirPath string) error {
 		case tar.TypeDir:
 			// skip, dir will be created with a file
 		case tar.TypeReg:
-			p := filesystem.JoinPaths(outputDirPath, header.Name)
+			p := filepath.Clean(filepath.Join(outputDirPath, header.Name))
 			if err := os.MkdirAll(filepath.Dir(p), 0o744); err != nil {
 				return fmt.Errorf("Failed to extract dir %s", filepath.Dir(p))
 			}

api/archive/targz_test.go

@@ -1,17 +1,13 @@
 package archive
 
 import (
-	"archive/tar"
-	"compress/gzip"
 	"os"
 	"os/exec"
 	"path"
 	"path/filepath"
 	"testing"
 
-	"github.com/portainer/portainer/api/filesystem"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func listFiles(dir string) []string {
@@ -88,56 +84,3 @@ func Test_shouldCreateArchive2(t *testing.T) {
 	wasExtracted("dir/inner")
 	wasExtracted("dir/.dotfile")
 }
-
-func TestExtractTarGzPathTraversal(t *testing.T) {
-	testDir := t.TempDir()
-
-	// Create an evil file with a path traversal attempt
-	tarPath := filesystem.JoinPaths(testDir, "evil.tar.gz")
-
-	evilFile, err := os.Create(tarPath)
-	require.NoError(t, err)
-
-	gzWriter := gzip.NewWriter(evilFile)
-	tarWriter := tar.NewWriter(gzWriter)
-
-	content := []byte("evil content")
-
-	header := &tar.Header{
-		Name:     "../evil.txt",
-		Mode:     0600,
-		Size:     int64(len(content)),
-		Typeflag: tar.TypeReg,
-	}
-
-	err = tarWriter.WriteHeader(header)
-	require.NoError(t, err)
-
-	_, err = tarWriter.Write(content)
-	require.NoError(t, err)
-
-	err = tarWriter.Close()
-	require.NoError(t, err)
-
-	err = gzWriter.Close()
-	require.NoError(t, err)
-
-	err = evilFile.Close()
-	require.NoError(t, err)
-
-	// Attempt to extract the evil file
-	extractionDir := filesystem.JoinPaths(testDir, "extraction")
-	err = os.Mkdir(extractionDir, 0700)
-	require.NoError(t, err)
-
-	tarFile, err := os.Open(tarPath)
-	require.NoError(t, err)
-
-	// Check that the file didn't escape
-	err = ExtractTarGz(tarFile, extractionDir)
-	require.NoError(t, err)
-	require.NoFileExists(t, filesystem.JoinPaths(testDir, "evil.txt"))
-
-	err = tarFile.Close()
-	require.NoError(t, err)
-}

api/cmd/portainer/main.go

@@ -630,7 +630,7 @@ func main() {
 			Str("build_number", build.BuildNumber).
 			Str("image_tag", build.ImageTag).
 			Str("nodejs_version", build.NodejsVersion).
-			Str("pnpm_version", build.PnpmVersion).
+			Str("yarn_version", build.YarnVersion).
 			Str("webpack_version", build.WebpackVersion).
 			Str("go_version", build.GoVersion).
 			Msg("starting Portainer")

api/database/boltdb/db.go

@@ -136,8 +136,10 @@ func (connection *DbConnection) NeedsEncryptionMigration() (bool, error) {
 func (connection *DbConnection) Open() error {
 	log.Info().Str("filename", connection.GetDatabaseFileName()).Msg("loading PortainerDB")
 
+	// Now we open the db
 	databasePath := connection.GetDatabaseFilePath()
-	db, err := bolt.Open(databasePath, 0600, connection.boltOptions(connection.Compact))
+
+	db, err := bolt.Open(databasePath, 0600, connection.boltOptions())
 	if err != nil {
 		return err
 	}
@@ -150,15 +152,6 @@ func (connection *DbConnection) Open() error {
 		log.Info().Msg("compacting database")
 		if err := connection.compact(); err != nil {
 			log.Error().Err(err).Msg("failed to compact database")
-
-			// Close the read-only database and re-open in read-write mode
-			if err := connection.Close(); err != nil {
-				log.Warn().Err(err).Msg("failure to close the database after failed compaction")
-			}
-
-			connection.Compact = false
-
-			return connection.Open()
 		} else {
 			log.Info().Msg("database compaction completed")
 		}
@@ -431,14 +424,9 @@ func (connection *DbConnection) RestoreMetadata(s map[string]any) error {
 }
 
 // compact attempts to compact the database and replace it iff it succeeds
-func (connection *DbConnection) compact() (err error) {
+func (connection *DbConnection) compact() error {
 	compactedPath := connection.GetDatabaseFilePath() + compactedSuffix
-
-	if err := os.Remove(compactedPath); err != nil && !errors.Is(err, os.ErrNotExist) {
-		return fmt.Errorf("failure to remove an existing compacted database: %w", err)
-	}
-
-	compactedDB, err := bolt.Open(compactedPath, 0o600, connection.boltOptions(false))
+	compactedDB, err := bolt.Open(compactedPath, 0o600, connection.boltOptions())
 	if err != nil {
 		return fmt.Errorf("failure to create the compacted database: %w", err)
 	}
@@ -465,12 +453,11 @@ func (connection *DbConnection) compact() (err error) {
 	return nil
 }
 
-func (connection *DbConnection) boltOptions(readOnly bool) *bolt.Options {
+func (connection *DbConnection) boltOptions() *bolt.Options {
 	return &bolt.Options{
 		Timeout:         1 * time.Second,
 		InitialMmapSize: connection.InitialMmapSize,
 		FreelistType:    bolt.FreelistMapType,
 		NoFreelistSync:  true,
-		ReadOnly:        readOnly,
 	}
 }

api/database/boltdb/db_test.go

@@ -5,8 +5,6 @@ import (
 	"path"
 	"testing"
 
-	"github.com/portainer/portainer/api/filesystem"
-
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.etcd.io/bbolt"
@@ -125,7 +123,10 @@ func Test_NeedsEncryptionMigration(t *testing.T) {
 }
 
 func TestDBCompaction(t *testing.T) {
-	db := &DbConnection{Path: t.TempDir()}
+	db := &DbConnection{
+		Path:    t.TempDir(),
+		Compact: true,
+	}
 
 	err := db.Open()
 	require.NoError(t, err)
@@ -146,7 +147,6 @@ func TestDBCompaction(t *testing.T) {
 	require.NoError(t, err)
 
 	// Reopen the DB to trigger compaction
-	db.Compact = true
 	err = db.Open()
 	require.NoError(t, err)
 
@@ -168,13 +168,9 @@ func TestDBCompaction(t *testing.T) {
 	require.NoError(t, err)
 
 	// Failures
-	compactedPath := db.GetDatabaseFilePath() + compactedSuffix
-	err = os.Mkdir(compactedPath, 0o755)
-	require.NoError(t, err)
 
-	f, err := os.Create(filesystem.JoinPaths(compactedPath, "somefile"))
+	err = os.Mkdir(db.GetDatabaseFilePath()+compactedSuffix, 0o755)
 	require.NoError(t, err)
-	require.NoError(t, f.Close())
 
 	err = db.Open()
 	require.NoError(t, err)

api/database/boltdb/json.go

@@ -45,12 +45,12 @@ func (connection *DbConnection) UnmarshalObject(data []byte, object any) error {
 		}
 	}
 
-	if err := json.Unmarshal(data, object); err != nil {
+	if e := json.Unmarshal(data, object); e != nil {
 		// Special case for the VERSION bucket. Here we're not using json
 		// So we need to return it as a string
 		s, ok := object.(*string)
 		if !ok {
-			return errors.Wrap(err, "Failed unmarshalling object")
+			return errors.Wrap(err, e.Error())
 		}
 
 		*s = string(data)

api/datastore/init.go

@@ -60,7 +60,6 @@ func (store *Store) checkOrCreateDefaultSettings() error {
 			KubectlShellImage:        *store.flags.KubectlShellImage,
 
 			IsDockerDesktopExtension: isDDExtention,
-			EnforceEdgeID:            true,
 		}
 
 		return store.SettingsService.UpdateSettings(defaultSettings)

api/datastore/test_data/output_24_to_latest.json

@@ -615,7 +615,7 @@
       "RequiredPasswordLength": 12
     },
     "KubeconfigExpiry": "0",
-    "KubectlShellImage": "portainer/kubectl-shell:2.33.8",
+    "KubectlShellImage": "portainer/kubectl-shell:2.33.2",
     "LDAPSettings": {
       "AnonymousMode": true,
       "AutoCreateUsers": true,
@@ -944,7 +944,7 @@
     }
   ],
   "version": {
-    "VERSION": "{\"SchemaVersion\":\"2.33.8\",\"MigratorCount\":0,\"Edition\":1,\"InstanceID\":\"463d5c47-0ea5-4aca-85b1-405ceefee254\"}"
+    "VERSION": "{\"SchemaVersion\":\"2.33.2\",\"MigratorCount\":0,\"Edition\":1,\"InstanceID\":\"463d5c47-0ea5-4aca-85b1-405ceefee254\"}"
   },
   "webhooks": null
 }

api/exec/swarm_stack.go

@@ -183,7 +183,7 @@ func (manager *SwarmStackManager) prepareDockerCommandAndArgs(binaryPath, config
 		if !endpoint.TLSConfig.TLSSkipVerify {
 			args = append(args, "--tlsverify", "--tlscacert", endpoint.TLSConfig.TLSCACertPath)
 		} else {
-			args = append(args, "--tlscacert", "")
+			args = append(args, "--tlscacert", "''")
 		}
 
 		if endpoint.TLSConfig.TLSCertPath != "" && endpoint.TLSConfig.TLSKeyPath != "" {

api/exec/swarm_stack_test.go

@@ -3,9 +3,7 @@ package exec
 import (
 	"testing"
 
-	portainer "github.com/portainer/portainer/api"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestConfigFilePaths(t *testing.T) {
@@ -15,29 +13,3 @@ func TestConfigFilePaths(t *testing.T) {
 	output := configureFilePaths(args, filePaths)
 	assert.ElementsMatch(t, expected, output, "wrong output file paths")
 }
-
-func TestPrepareDockerCommandAndArgs(t *testing.T) {
-	binaryPath := "/test/dist"
-	configPath := "/test/config"
-	manager := &SwarmStackManager{
-		binaryPath: binaryPath,
-		configPath: configPath,
-	}
-
-	endpoint := &portainer.Endpoint{
-		URL: "tcp://test:9000",
-		TLSConfig: portainer.TLSConfiguration{
-			TLS:           true,
-			TLSSkipVerify: true,
-		},
-	}
-
-	command, args, err := manager.prepareDockerCommandAndArgs(binaryPath, configPath, endpoint)
-	require.NoError(t, err)
-
-	expectedCommand := "/test/dist/docker"
-	expectedArgs := []string{"--config", "/test/config", "-H", "tcp://test:9000", "--tls", "--tlscacert", ""}
-
-	require.Equal(t, expectedCommand, command)
-	require.Equal(t, expectedArgs, args)
-}

api/filesystem/serialize.go

@@ -167,21 +167,3 @@ func DecodeDirEntries(dirEntries []DirEntry) error {
 
 	return nil
 }
-
-// GetDirEntriesByFilenames returns the dir entries that are files and match the provided filenames
-func GetDirEntriesByFilenames(dirEntries []DirEntry, names []string) []DirEntry {
-	var filteredDirEntries []DirEntry
-
-	for _, dirEntry := range dirEntries {
-		if !dirEntry.IsFile {
-			continue
-		}
-		for _, name := range names {
-			if dirEntry.Name == name {
-				filteredDirEntries = append(filteredDirEntries, dirEntry)
-			}
-		}
-	}
-
-	return filteredDirEntries
-}

api/filesystem/serialize_per_dev_configs.go

@@ -30,20 +30,6 @@ func MultiFilterDirForPerDevConfigs(dirEntries []DirEntry, configPath string, mu
 	return deduplicate(filteredDirEntries), envFiles
 }
 
-// MultiFilterDirForPerDevConfigsWithDefaults filers the given dirEntries with multiple filter args, returns the merged entries for the given device
-// and always includes the defaultFilenames
-func MultiFilterDirForPerDevConfigsWithDefaults(dirEntries []DirEntry, configPath string, multiFilterArgs MultiFilterArgs, defaultFilenames []string) ([]DirEntry, []string) {
-
-	filteredDirEntries, envFiles := MultiFilterDirForPerDevConfigs(dirEntries, configPath, multiFilterArgs)
-
-	// Add files that should always be included
-	// e.g. entrypoint files
-	defaultDirEntries := GetDirEntriesByFilenames(dirEntries, defaultFilenames)
-	filteredDirEntries = append(filteredDirEntries, defaultDirEntries...)
-
-	return deduplicate(filteredDirEntries), envFiles
-}
-
 func deduplicate(dirEntries []DirEntry) []DirEntry {
 	var deduplicatedDirEntries []DirEntry
 

api/filesystem/serialize_per_dev_configs_test.go

@@ -49,11 +49,8 @@ func TestMultiFilterDirForPerDevConfigs(t *testing.T) {
 	f(
 		baseDirEntries,
 		"configs",
-		MultiFilterArgs{
-			{"file1", portainer.PerDevConfigsTypeFile},
-			{"folder1", portainer.PerDevConfigsTypeDir},
-		},
-		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[3], baseDirEntries[5], baseDirEntries[6]},
+		MultiFilterArgs{{"folder1", portainer.PerDevConfigsTypeDir}},
+		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[5], baseDirEntries[6]},
 	)
 
 	// Filter file1 and file2
@@ -79,106 +76,6 @@ func TestMultiFilterDirForPerDevConfigs(t *testing.T) {
 	)
 }
 
-func TestMultiFilterDirForPerDevConfigsWithDefaults(t *testing.T) {
-	f := func(dirEntries []DirEntry, configPath string, multiFilterArgs MultiFilterArgs, defaultFilenames []string, wantDirEntries []DirEntry) {
-		t.Helper()
-
-		dirEntries, _ = MultiFilterDirForPerDevConfigsWithDefaults(dirEntries, configPath, multiFilterArgs, defaultFilenames)
-		require.Equal(t, wantDirEntries, dirEntries)
-	}
-
-	baseDirEntries := []DirEntry{
-		{".env", "", true, 420},
-		{"docker-compose.yaml", "", true, 420},
-		{"configs", "", false, 420},
-		{"configs/file1.conf", "", true, 420},
-		{"configs/file2.conf", "", true, 420},
-		{"configs/folder1", "", false, 420},
-		{"configs/folder1/config1", "", true, 420},
-		{"configs/folder2", "", false, 420},
-		{"configs/folder2/config2", "", true, 420},
-		{"configs/docker-compose-2.yaml", "", true, 420},
-		{"configs/folder2/docker-compose-3.yaml", "", true, 420},
-	}
-
-	// Filter file1
-	f(
-		baseDirEntries,
-		"configs",
-		MultiFilterArgs{{"file1", portainer.PerDevConfigsTypeFile}},
-		nil,
-		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[3]},
-	)
-
-	// Filter folder1
-	f(
-		baseDirEntries,
-		"configs",
-		MultiFilterArgs{{"folder1", portainer.PerDevConfigsTypeDir}},
-		nil,
-		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[5], baseDirEntries[6]},
-	)
-
-	// Filter file1 and folder1
-	f(
-		baseDirEntries,
-		"configs",
-		MultiFilterArgs{
-			{"file1", portainer.PerDevConfigsTypeFile},
-			{"folder1", portainer.PerDevConfigsTypeDir},
-		},
-		nil,
-		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[3], baseDirEntries[5], baseDirEntries[6]},
-	)
-
-	// Filter file1 and file2
-	f(
-		baseDirEntries,
-		"configs",
-		MultiFilterArgs{
-			{"file1", portainer.PerDevConfigsTypeFile},
-			{"file2", portainer.PerDevConfigsTypeFile},
-		},
-		nil,
-		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[3], baseDirEntries[4]},
-	)
-
-	// Filter folder1 and folder2
-	f(
-		baseDirEntries,
-		"configs",
-		MultiFilterArgs{
-			{"folder1", portainer.PerDevConfigsTypeDir},
-			{"folder2", portainer.PerDevConfigsTypeDir},
-		},
-		nil,
-		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[5], baseDirEntries[6], baseDirEntries[7], baseDirEntries[8], baseDirEntries[10]},
-	)
-
-	// Filter file1 and folder1 and docker-compose-2.yaml
-	f(
-		baseDirEntries,
-		"configs",
-		MultiFilterArgs{
-			{"file1", portainer.PerDevConfigsTypeFile},
-			{"folder1", portainer.PerDevConfigsTypeDir},
-		},
-		[]string{"configs/docker-compose-2.yaml"},
-		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[3], baseDirEntries[5], baseDirEntries[6], baseDirEntries[9]},
-	)
-
-	// Filter file1 and docker-compose-3.yaml
-	f(
-		baseDirEntries,
-		"configs",
-		MultiFilterArgs{
-			{"file1", portainer.PerDevConfigsTypeFile},
-		},
-		[]string{"configs/folder2/docker-compose-3.yaml"},
-		[]DirEntry{baseDirEntries[0], baseDirEntries[1], baseDirEntries[2], baseDirEntries[3], baseDirEntries[10]},
-	)
-}
-
 func TestMultiFilterDirForPerDevConfigsEnvFiles(t *testing.T) {
 	f := func(dirEntries []DirEntry, configPath string, multiFilterArgs MultiFilterArgs, wantEnvFiles []string) {
 		t.Helper()

api/git/git.go

@@ -3,42 +3,23 @@ package git
 import (
 	"context"
 	"os"
+	"path/filepath"
 	"strings"
 
-	"github.com/portainer/portainer/api/filesystem"
 	gittypes "github.com/portainer/portainer/api/git/types"
+	"github.com/rs/zerolog/log"
 
-	"github.com/go-git/go-billy/v5"
-	"github.com/go-git/go-billy/v5/osfs"
 	"github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/config"
 	"github.com/go-git/go-git/v5/plumbing"
-	"github.com/go-git/go-git/v5/plumbing/cache"
 	"github.com/go-git/go-git/v5/plumbing/filemode"
 	"github.com/go-git/go-git/v5/plumbing/object"
 	"github.com/go-git/go-git/v5/plumbing/transport"
 	githttp "github.com/go-git/go-git/v5/plumbing/transport/http"
-	gogitfs "github.com/go-git/go-git/v5/storage/filesystem"
 	"github.com/go-git/go-git/v5/storage/memory"
 	"github.com/pkg/errors"
-	"github.com/rs/zerolog/log"
 )
 
-// noSymlinkFS wraps a billy.Filesystem and rejects symlink creation to prevent
-// symlink traversal attacks from untrusted git repositories
-type noSymlinkFS struct {
-	billy.Filesystem
-}
-
-func (fs noSymlinkFS) Symlink(_, _ string) error {
-	return gittypes.ErrSymlinkDetected
-}
-
-// NewNoSymlinkFS wraps fs and rejects any symlink creation
-func NewNoSymlinkFS(fs billy.Filesystem) billy.Filesystem {
-	return noSymlinkFS{fs}
-}
-
 type gitClient struct {
 	preserveGitDirectory bool
 }
@@ -49,33 +30,8 @@ func NewGitClient(preserveGitDir bool) *gitClient {
 	}
 }
 
-func (c *gitClient) Download(ctx context.Context, dst string, opt *git.CloneOptions) error {
-	wt := NewNoSymlinkFS(osfs.New(dst))
-	dot := osfs.New(filesystem.JoinPaths(dst, ".git"))
-	storer := gogitfs.NewStorage(dot, cache.NewObjectLRU(0))
-
-	_, err := git.CloneContext(ctx, storer, wt, opt)
-	if err != nil {
-		if err.Error() == "authentication required" {
-			return gittypes.ErrAuthenticationFailure
-		}
-
-		return errors.Wrap(err, "failed to clone git repository")
-	}
-
-	if c.preserveGitDirectory {
-		return nil
-	}
-
-	if err := os.RemoveAll(filesystem.JoinPaths(dst, ".git")); err != nil {
-		log.Error().Err(err).Msg("failed to remove .git directory")
-	}
-
-	return nil
-}
-
 func (c *gitClient) download(ctx context.Context, dst string, opt cloneOption) error {
-	gitOptions := &git.CloneOptions{
+	gitOptions := git.CloneOptions{
 		URL:             opt.repositoryUrl,
 		Depth:           opt.depth,
 		InsecureSkipTLS: opt.tlsSkipVerify,
@@ -87,7 +43,23 @@ func (c *gitClient) download(ctx context.Context, dst string, opt cloneOption) e
 		gitOptions.ReferenceName = plumbing.ReferenceName(opt.referenceName)
 	}
 
-	return c.Download(ctx, dst, gitOptions)
+	_, err := git.PlainCloneContext(ctx, dst, false, &gitOptions)
+
+	if err != nil {
+		if err.Error() == "authentication required" {
+			return gittypes.ErrAuthenticationFailure
+		}
+		return errors.Wrap(err, "failed to clone git repository")
+	}
+
+	if !c.preserveGitDirectory {
+		err := os.RemoveAll(filepath.Join(dst, ".git"))
+		if err != nil {
+			log.Error().Err(err).Msg("failed to remove .git directory")
+		}
+	}
+
+	return nil
 }
 
 func (c *gitClient) latestCommitID(ctx context.Context, opt fetchOption) (string, error) {
@@ -106,7 +78,6 @@ func (c *gitClient) latestCommitID(ctx context.Context, opt fetchOption) (string
 		if err.Error() == "authentication required" {
 			return "", gittypes.ErrAuthenticationFailure
 		}
-
 		return "", errors.Wrap(err, "failed to list repository refs")
 	}
 
@@ -188,7 +159,6 @@ func (c *gitClient) listRefs(ctx context.Context, opt baseOption) ([]string, err
 		if ref.Name().String() == "HEAD" {
 			continue
 		}
-
 		ret = append(ret, ref.Name().String())
 	}
 
@@ -255,6 +225,5 @@ func checkGitError(err error) error {
 	} else if errMsg == "authentication required" {
 		return gittypes.ErrAuthenticationFailure
 	}
-
 	return err
 }

api/git/git_test.go

@@ -3,26 +3,21 @@ package git
 import (
 	"context"
 	"os"
+	"path/filepath"
 	"testing"
-	"time"
 
 	"github.com/portainer/portainer/api/archive"
-	"github.com/portainer/portainer/api/filesystem"
 	gittypes "github.com/portainer/portainer/api/git/types"
 
-	"github.com/go-git/go-billy/v5/osfs"
 	"github.com/go-git/go-git/v5"
-	"github.com/go-git/go-git/v5/plumbing"
-	"github.com/go-git/go-git/v5/plumbing/filemode"
 	"github.com/go-git/go-git/v5/plumbing/object"
 	"github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func setup(t *testing.T) string {
 	dir := t.TempDir()
-	bareRepoDir := filesystem.JoinPaths(dir, "test-clone.git")
+	bareRepoDir := filepath.Join(dir, "test-clone.git")
 
 	file, err := os.OpenFile("./testdata/test-clone-git-repo.tar.gz", os.O_RDONLY, 0755)
 	if err != nil {
@@ -57,7 +52,7 @@ func Test_ClonePublicRepository_NoGitDirectory(t *testing.T) {
 	t.Logf("Cloning into %s", dir)
 	err := service.CloneRepository(dir, repositoryURL, referenceName, "", "", gittypes.GitCredentialAuthType_Basic, false)
 	assert.NoError(t, err)
-	assert.NoDirExists(t, filesystem.JoinPaths(dir, ".git"))
+	assert.NoDirExists(t, filepath.Join(dir, ".git"))
 }
 
 func Test_cloneRepository(t *testing.T) {
@@ -150,112 +145,6 @@ func getCommitHistoryLength(t *testing.T, dir string) int {
 	return count
 }
 
-func Test_noSymlinkFS_Symlink(t *testing.T) {
-	fs := NewNoSymlinkFS(osfs.New(t.TempDir()))
-	err := fs.Symlink("../../../etc/passwd", "evil-link")
-	require.ErrorIs(t, err, gittypes.ErrSymlinkDetected)
-}
-
-func Test_noSymlinkFS_OtherOperations(t *testing.T) {
-	dir := t.TempDir()
-	fs := NewNoSymlinkFS(osfs.New(dir))
-
-	f, err := fs.Create("test.txt")
-	require.NoError(t, err)
-
-	_, err = f.Write([]byte("hello"))
-	require.NoError(t, err)
-
-	err = f.Close()
-	require.NoError(t, err)
-
-	info, err := fs.Stat("test.txt")
-	require.NoError(t, err)
-	require.Equal(t, "test.txt", info.Name())
-}
-
-func createBareRepoWithSymlink(t *testing.T) string {
-	t.Helper()
-
-	bareDir := filesystem.JoinPaths(t.TempDir(), "symlink-repo.git")
-
-	repo, err := git.PlainInit(bareDir, true)
-	require.NoError(t, err)
-
-	storer := repo.Storer
-
-	fileBlob := &plumbing.MemoryObject{}
-	fileBlob.SetType(plumbing.BlobObject)
-
-	_, err = fileBlob.Write([]byte("hello world\n"))
-	require.NoError(t, err)
-
-	fileHash, err := storer.SetEncodedObject(fileBlob)
-	require.NoError(t, err)
-
-	symlinkBlob := &plumbing.MemoryObject{}
-	symlinkBlob.SetType(plumbing.BlobObject)
-
-	_, err = symlinkBlob.Write([]byte("../../../etc/passwd"))
-	require.NoError(t, err)
-
-	symlinkHash, err := storer.SetEncodedObject(symlinkBlob)
-	require.NoError(t, err)
-
-	tree := &object.Tree{
-		Entries: []object.TreeEntry{
-			{Name: "evil-link", Mode: filemode.Symlink, Hash: symlinkHash},
-			{Name: "file.txt", Mode: filemode.Regular, Hash: fileHash},
-		},
-	}
-
-	treeObj := &plumbing.MemoryObject{}
-
-	err = tree.Encode(treeObj)
-	require.NoError(t, err)
-
-	treeHash, err := storer.SetEncodedObject(treeObj)
-	require.NoError(t, err)
-
-	sig := object.Signature{Name: "Test", Email: "test@test.com", When: time.Now()}
-	commit := &object.Commit{
-		Message:   "add symlink",
-		Author:    sig,
-		Committer: sig,
-		TreeHash:  treeHash,
-	}
-
-	commitObj := &plumbing.MemoryObject{}
-
-	err = commit.Encode(commitObj)
-	require.NoError(t, err)
-
-	commitHash, err := storer.SetEncodedObject(commitObj)
-	require.NoError(t, err)
-
-	err = storer.SetReference(plumbing.NewHashReference("refs/heads/main", commitHash))
-	require.NoError(t, err)
-
-	err = storer.SetReference(plumbing.NewSymbolicReference(plumbing.HEAD, "refs/heads/main"))
-	require.NoError(t, err)
-
-	return bareDir
-}
-
-func Test_Download_RejectsSymlink(t *testing.T) {
-	client := NewGitClient(false)
-	repoURL := createBareRepoWithSymlink(t)
-
-	err := client.Download(t.Context(), t.TempDir(), &git.CloneOptions{
-		URL:          repoURL,
-		Depth:        1,
-		SingleBranch: true,
-		Tags:         git.NoTags,
-	})
-	require.Error(t, err)
-	require.ErrorIs(t, err, gittypes.ErrSymlinkDetected)
-}
-
 func Test_listRefsPrivateRepository(t *testing.T) {
 	ensureIntegrationTest(t)
 

api/git/types/types.go

@@ -7,7 +7,6 @@ import (
 var (
 	ErrIncorrectRepositoryURL = errors.New("git repository could not be found, please ensure that the URL is correct")
 	ErrAuthenticationFailure  = errors.New("authentication failed, please ensure that the git credentials are correct")
-	ErrSymlinkDetected        = errors.New("repository contains a symlink, which is not allowed for security reasons")
 )
 
 type GitCredentialAuthType int

api/http/handler/customtemplates/customtemplate_file.go

@@ -2,14 +2,8 @@ package customtemplates
 
 import (
 	"net/http"
-	"strconv"
 
 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
-	httperrors "github.com/portainer/portainer/api/http/errors"
-	"github.com/portainer/portainer/api/http/security"
-	"github.com/portainer/portainer/api/internal/authorization"
-	"github.com/portainer/portainer/api/slicesx"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
@@ -39,46 +33,11 @@ func (handler *Handler) customTemplateFile(w http.ResponseWriter, r *http.Reques
 		return httperror.BadRequest("Invalid custom template identifier route variable", err)
 	}
 
-	var customTemplate *portainer.CustomTemplate
-	if err := handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
-		var err error
-		customTemplate, err = tx.CustomTemplate().Read(portainer.CustomTemplateID(customTemplateID))
-		if tx.IsErrObjectNotFound(err) {
-			return httperror.NotFound("Unable to find a custom template with the specified identifier inside the database", err)
-		} else if err != nil {
-			return httperror.InternalServerError("Unable to find a custom template with the specified identifier inside the database", err)
-		}
-
-		resourceControl, err := tx.ResourceControl().ResourceControlByResourceIDAndType(strconv.Itoa(customTemplateID), portainer.CustomTemplateResourceControl)
-		if err != nil {
-			return httperror.InternalServerError("Unable to retrieve a resource control associated to the custom template", err)
-		}
-
-		securityContext, err := security.RetrieveRestrictedRequestContext(r)
-		if err != nil {
-			return httperror.InternalServerError("Unable to retrieve user info from request context", err)
-		}
-
-		canEdit := userCanEditTemplate(customTemplate, securityContext)
-		hasAccess := false
-
-		if resourceControl != nil {
-			customTemplate.ResourceControl = resourceControl
-
-			teamIDs := slicesx.Map(securityContext.UserMemberships, func(m portainer.TeamMembership) portainer.TeamID {
-				return m.TeamID
-			})
-
-			hasAccess = authorization.UserCanAccessResource(securityContext.UserID, teamIDs, resourceControl)
-		}
-
-		if canEdit || hasAccess {
-			return nil
-		}
-
-		return httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied)
-	}); err != nil {
-		return response.TxErrorResponse(err)
+	customTemplate, err := handler.DataStore.CustomTemplate().Read(portainer.CustomTemplateID(customTemplateID))
+	if handler.DataStore.IsErrObjectNotFound(err) {
+		return httperror.NotFound("Unable to find a custom template with the specified identifier inside the database", err)
+	} else if err != nil {
+		return httperror.InternalServerError("Unable to find a custom template with the specified identifier inside the database", err)
 	}
 
 	entryPath := customTemplate.EntryPoint

api/http/handler/customtemplates/customtemplate_file_test.go

@@ -1,115 +0,0 @@
-package customtemplates
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/gorilla/mux"
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
-	"github.com/portainer/portainer/api/datastore"
-	"github.com/portainer/portainer/api/filesystem"
-	"github.com/portainer/portainer/api/http/security"
-	"github.com/portainer/portainer/api/internal/testhelpers"
-	httperror "github.com/portainer/portainer/pkg/libhttp/error"
-	"github.com/segmentio/encoding/json"
-	"github.com/stretchr/testify/require"
-)
-
-func TestCustomTemplateFile(t *testing.T) {
-	_, ds := datastore.MustNewTestStore(t, true, false)
-	require.NotNil(t, ds)
-
-	fs, err := filesystem.NewService(t.TempDir(), t.TempDir())
-	require.NoError(t, err)
-
-	templateContent := "some template content"
-	templateEntrypoint := "entrypoint"
-
-	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		require.NoError(t, tx.User().Create(&portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}))
-		require.NoError(t, tx.User().Create(&portainer.User{ID: 2, Username: "std2", Role: portainer.StandardUserRole}))
-		require.NoError(t, tx.User().Create(&portainer.User{ID: 3, Username: "std3", Role: portainer.StandardUserRole}))
-		require.NoError(t, tx.User().Create(&portainer.User{ID: 4, Username: "std4", Role: portainer.StandardUserRole}))
-		require.NoError(t, tx.Endpoint().Create(&portainer.Endpoint{ID: 1,
-			UserAccessPolicies: portainer.UserAccessPolicies{
-				2: portainer.AccessPolicy{RoleID: 0},
-				3: portainer.AccessPolicy{RoleID: 0},
-			}}))
-		require.NoError(t, tx.Team().Create(&portainer.Team{ID: 1}))
-		require.NoError(t, tx.TeamMembership().Create(&portainer.TeamMembership{ID: 1, UserID: 3, TeamID: 1, Role: portainer.TeamMember}))
-
-		// template 1
-		path, err := fs.StoreCustomTemplateFileFromBytes("1", templateEntrypoint, []byte(templateContent))
-		require.NoError(t, err)
-		require.NoError(t, tx.CustomTemplate().Create(&portainer.CustomTemplate{ID: 1, EntryPoint: templateEntrypoint, ProjectPath: path}))
-
-		// template 2
-		path, err = fs.StoreCustomTemplateFileFromBytes("2", templateEntrypoint, []byte(templateContent))
-		require.NoError(t, err)
-		require.NoError(t, tx.CustomTemplate().Create(&portainer.CustomTemplate{ID: 2, EntryPoint: templateEntrypoint, ProjectPath: path}))
-
-		require.NoError(t, tx.ResourceControl().Create(&portainer.ResourceControl{ID: 1, ResourceID: "2", Type: portainer.CustomTemplateResourceControl,
-			UserAccesses: []portainer.UserResourceAccess{{UserID: 2}},
-			TeamAccesses: []portainer.TeamResourceAccess{{TeamID: 1}},
-		}))
-		return nil
-	}))
-
-	handler := NewHandler(testhelpers.NewTestRequestBouncer(), ds, fs, nil)
-
-	test := func(templateID string, restrictedContext *security.RestrictedRequestContext) (*httptest.ResponseRecorder, *httperror.HandlerError) {
-		r := httptest.NewRequest(http.MethodGet, "/custom_templates/"+templateID+"/file", nil)
-		r = mux.SetURLVars(r, map[string]string{"id": templateID})
-		ctx := security.StoreRestrictedRequestContext(r, restrictedContext)
-		r = r.WithContext(ctx)
-		rr := httptest.NewRecorder()
-		return rr, handler.customTemplateFile(rr, r)
-	}
-
-	t.Run("unknown id should get not found error", func(t *testing.T) {
-		_, r := test("0", &security.RestrictedRequestContext{UserID: 1})
-		require.NotNil(t, r)
-		require.Equal(t, http.StatusNotFound, r.StatusCode)
-	})
-
-	t.Run("admin should access adminonly template", func(t *testing.T) {
-		rr, r := test("1", &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
-		require.Nil(t, r)
-		require.Equal(t, http.StatusOK, rr.Result().StatusCode)
-		var res struct{ FileContent string }
-		require.NoError(t, json.NewDecoder(rr.Body).Decode(&res))
-		require.Equal(t, templateContent, res.FileContent)
-	})
-
-	t.Run("std should not access adminonly template", func(t *testing.T) {
-		_, r := test("1", &security.RestrictedRequestContext{UserID: 2})
-		require.NotNil(t, r)
-		require.Equal(t, http.StatusForbidden, r.StatusCode)
-	})
-
-	t.Run("std should access template via direct user access", func(t *testing.T) {
-		rr, r := test("2", &security.RestrictedRequestContext{UserID: 2})
-		require.Nil(t, r)
-		require.Equal(t, http.StatusOK, rr.Result().StatusCode)
-		var res struct{ FileContent string }
-		require.NoError(t, json.NewDecoder(rr.Body).Decode(&res))
-		require.Equal(t, templateContent, res.FileContent)
-	})
-
-	t.Run("std should access template via team access", func(t *testing.T) {
-		rr, r := test("2", &security.RestrictedRequestContext{UserID: 3, UserMemberships: []portainer.TeamMembership{{ID: 1, UserID: 3, TeamID: 1}}})
-		require.Nil(t, r)
-		require.Equal(t, http.StatusOK, rr.Result().StatusCode)
-		var res struct{ FileContent string }
-		require.NoError(t, json.NewDecoder(rr.Body).Decode(&res))
-		require.Equal(t, templateContent, res.FileContent)
-	})
-
-	t.Run("std should not access template without access", func(t *testing.T) {
-		_, r := test("2", &security.RestrictedRequestContext{UserID: 4})
-		require.NotNil(t, r)
-		require.Equal(t, http.StatusForbidden, r.StatusCode)
-	})
-}

api/http/handler/customtemplates/customtemplate_inspect.go

@@ -38,7 +38,7 @@ func (handler *Handler) customTemplateInspect(w http.ResponseWriter, r *http.Req
 	var customTemplate *portainer.CustomTemplate
 	err = handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
 		customTemplate, err = tx.CustomTemplate().Read(portainer.CustomTemplateID(customTemplateID))
-		if tx.IsErrObjectNotFound(err) {
+		if handler.DataStore.IsErrObjectNotFound(err) {
 			return httperror.NotFound("Unable to find a custom template with the specified identifier inside the database", err)
 		} else if err != nil {
 			return httperror.InternalServerError("Unable to find a custom template with the specified identifier inside the database", err)

api/http/handler/customtemplates/customtemplate_inspect_test.go

@@ -9,7 +9,6 @@ import (
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/datastore"
-	"github.com/portainer/portainer/api/filesystem"
 	"github.com/portainer/portainer/api/http/security"
 	"github.com/portainer/portainer/api/internal/testhelpers"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
@@ -21,9 +20,6 @@ func TestInspectHandler(t *testing.T) {
 	_, ds := datastore.MustNewTestStore(t, true, false)
 	require.NotNil(t, ds)
 
-	fs, err := filesystem.NewService(t.TempDir(), t.TempDir())
-	require.NoError(t, err)
-
 	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
 		require.NoError(t, tx.User().Create(&portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}))
 		require.NoError(t, tx.User().Create(&portainer.User{ID: 2, Username: "std2", Role: portainer.StandardUserRole}))
@@ -46,7 +42,7 @@ func TestInspectHandler(t *testing.T) {
 		return nil
 	}))
 
-	handler := NewHandler(testhelpers.NewTestRequestBouncer(), ds, fs, nil)
+	handler := NewHandler(testhelpers.NewTestRequestBouncer(), ds, &TestFileService{}, nil)
 
 	test := func(templateID string, restrictedContext *security.RestrictedRequestContext) (*httptest.ResponseRecorder, *httperror.HandlerError) {
 		r := httptest.NewRequest(http.MethodGet, "/custom_templates/"+templateID, nil)

api/http/handler/edgegroups/edgegroup_create.go

@@ -77,7 +77,8 @@ func (handler *Handler) edgeGroupCreate(w http.ResponseWriter, r *http.Request)
 		return httperror.BadRequest("Invalid request payload", err)
 	}
 
-	var shadowEdgeGroup shadowedEdgeGroup
+	var edgeGroup *portainer.EdgeGroup
+
 	err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
 		edgeGroups, err := tx.EdgeGroup().ReadAll()
 		if err != nil {
@@ -90,7 +91,7 @@ func (handler *Handler) edgeGroupCreate(w http.ResponseWriter, r *http.Request)
 			}
 		}
 
-		edgeGroup := &portainer.EdgeGroup{
+		edgeGroup = &portainer.EdgeGroup{
 			Name:         payload.Name,
 			Dynamic:      payload.Dynamic,
 			TagIDs:       []portainer.TagID{},
@@ -107,10 +108,8 @@ func (handler *Handler) edgeGroupCreate(w http.ResponseWriter, r *http.Request)
 			return httperror.InternalServerError("Unable to persist the Edge group inside the database", err)
 		}
 
-		shadowEdgeGroup = shadowedEdgeGroup{EdgeGroup: *edgeGroup}
-
 		return nil
 	})
 
-	return txResponse(w, shadowEdgeGroup, err)
+	return txResponse(w, shadowedEdgeGroup{EdgeGroup: *edgeGroup}, err)
 }

api/http/handler/edgegroups/edgegroup_create_test.go

@@ -60,22 +60,3 @@ func TestEdgeGroupCreateHandler(t *testing.T) {
 
 	require.ElementsMatch(t, []portainer.EndpointID{1, 2, 3}, responseGroup.Endpoints)
 }
-
-func TestEdgeGroupCreatePanic(t *testing.T) {
-	_, store := datastore.MustNewTestStore(t, true, true)
-
-	handler := NewHandler(testhelpers.NewTestRequestBouncer())
-	handler.DataStore = store
-
-	err := store.EdgeGroup().Create(&portainer.EdgeGroup{ID: 1, Name: "New Edge Group"})
-	require.NoError(t, err)
-
-	rr := httptest.NewRecorder()
-	req := httptest.NewRequest(http.MethodPost,
-		"/edge_groups",
-		strings.NewReader(`{"Name": "New Edge Group", "Endpoints": [1, 2, 3]}`),
-	)
-
-	handler.ServeHTTP(rr, req)
-	require.Equal(t, http.StatusBadRequest, rr.Result().StatusCode)
-}

api/http/handler/edgegroups/edgegroup_inspect.go

@@ -28,21 +28,15 @@ func (handler *Handler) edgeGroupInspect(w http.ResponseWriter, r *http.Request)
 		return httperror.BadRequest("Invalid Edge group identifier route variable", err)
 	}
 
-	var shadowEdgeGroup shadowedEdgeGroup
+	var edgeGroup *portainer.EdgeGroup
 	err = handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
-		edgeGroup, err := getEdgeGroup(tx, portainer.EdgeGroupID(edgeGroupID))
-		if err != nil {
-			return err
-		}
-
-		edgeGroup.Endpoints = edgeGroup.EndpointIDs.ToSlice()
-
-		shadowEdgeGroup = shadowedEdgeGroup{EdgeGroup: *edgeGroup}
-
-		return nil
+		edgeGroup, err = getEdgeGroup(tx, portainer.EdgeGroupID(edgeGroupID))
+		return err
 	})
 
-	return txResponse(w, shadowEdgeGroup, err)
+	edgeGroup.Endpoints = edgeGroup.EndpointIDs.ToSlice()
+
+	return txResponse(w, shadowedEdgeGroup{EdgeGroup: *edgeGroup}, err)
 }
 
 func getEdgeGroup(tx dataservices.DataStoreTx, ID portainer.EdgeGroupID) (*portainer.EdgeGroup, error) {

api/http/handler/edgegroups/edgegroup_inspect_test.go

@@ -174,16 +174,3 @@ func TestDynamicEdgeGroupInspectHandler(t *testing.T) {
 
 	require.ElementsMatch(t, []portainer.EndpointID{1, 2, 3}, responseGroup.Endpoints)
 }
-
-func TestEdgeGroupInspectPanic(t *testing.T) {
-	_, store := datastore.MustNewTestStore(t, true, true)
-
-	handler := NewHandler(testhelpers.NewTestRequestBouncer())
-	handler.DataStore = store
-
-	rr := httptest.NewRecorder()
-	req := httptest.NewRequest(http.MethodGet, "/edge_groups/1", nil)
-
-	handler.ServeHTTP(rr, req)
-	require.Equal(t, http.StatusNotFound, rr.Result().StatusCode)
-}

api/http/handler/edgegroups/edgegroup_update.go

@@ -56,9 +56,9 @@ func (handler *Handler) edgeGroupUpdate(w http.ResponseWriter, r *http.Request)
 		return httperror.BadRequest("Invalid request payload", err)
 	}
 
-	var shadowEdgeGroup shadowedEdgeGroup
+	var edgeGroup *portainer.EdgeGroup
 	err = handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		edgeGroup, err := tx.EdgeGroup().Read(portainer.EdgeGroupID(edgeGroupID))
+		edgeGroup, err = tx.EdgeGroup().Read(portainer.EdgeGroupID(edgeGroupID))
 		if handler.DataStore.IsErrObjectNotFound(err) {
 			return httperror.NotFound("Unable to find an Edge group with the specified identifier inside the database", err)
 		} else if err != nil {
@@ -155,12 +155,10 @@ func (handler *Handler) edgeGroupUpdate(w http.ResponseWriter, r *http.Request)
 			}
 		}
 
-		shadowEdgeGroup = shadowedEdgeGroup{EdgeGroup: *edgeGroup}
-
 		return nil
 	})
 
-	return txResponse(w, shadowEdgeGroup, err)
+	return txResponse(w, shadowedEdgeGroup{EdgeGroup: *edgeGroup}, err)
 }
 
 func (handler *Handler) updateEndpointStacks(tx dataservices.DataStoreTx, endpoint *portainer.Endpoint, edgeGroups []portainer.EdgeGroup, edgeStacks []portainer.EdgeStack) error {

api/http/handler/edgegroups/edgegroup_update_test.go

@@ -68,16 +68,3 @@ func TestEdgeGroupUpdateHandler(t *testing.T) {
 
 	require.ElementsMatch(t, []portainer.EndpointID{1, 2, 3}, responseGroup.Endpoints)
 }
-
-func TestEdgeGroupUpdatePanic(t *testing.T) {
-	_, store := datastore.MustNewTestStore(t, true, true)
-
-	handler := NewHandler(testhelpers.NewTestRequestBouncer())
-	handler.DataStore = store
-
-	rr := httptest.NewRecorder()
-	req := httptest.NewRequest(http.MethodPut, "/edge_groups/1", strings.NewReader("{}"))
-
-	handler.ServeHTTP(rr, req)
-	require.Equal(t, http.StatusNotFound, rr.Result().StatusCode)
-}

api/http/handler/edgestacks/edgestack_status_update.go

@@ -74,7 +74,7 @@ func (handler *Handler) edgeStackStatusUpdate(w http.ResponseWriter, r *http.Req
 	}
 
 	if err := handler.requestBouncer.AuthorizedEdgeEndpointOperation(r, endpoint); err != nil {
-		return httperror.Forbidden("Permission denied to access environment", fmt.Errorf("unauthorized edge endpoint operation: %w. Environment ID: %d", err, payload.EndpointID))
+		return httperror.Forbidden("Permission denied to access environment", fmt.Errorf("unauthorized edge endpoint operation: %w. Environment name: %s", err, endpoint.Name))
 	}
 
 	var stack *portainer.EdgeStack

api/http/handler/endpointedge/endpointedge_job_logs.go

@@ -42,17 +42,17 @@ func (handler *Handler) endpointEdgeJobsLogs(w http.ResponseWriter, r *http.Requ
 	}
 
 	if err := handler.requestBouncer.AuthorizedEdgeEndpointOperation(r, endpoint); err != nil {
-		return httperror.Forbidden("Permission denied to access environment", fmt.Errorf("unauthorized edge endpoint operation: %w. Environment ID: %d", err, endpoint.ID))
+		return httperror.Forbidden("Permission denied to access environment", fmt.Errorf("unauthorized edge endpoint operation: %w. Environment name: %s", err, endpoint.Name))
 	}
 
 	edgeJobID, err := request.RetrieveNumericRouteVariableValue(r, "jobID")
 	if err != nil {
-		return httperror.BadRequest("Invalid edge job identifier route variable", fmt.Errorf("invalid Edge job route variable: %w. Environment ID: %d", err, endpoint.ID))
+		return httperror.BadRequest("Invalid edge job identifier route variable", fmt.Errorf("invalid Edge job route variable: %w. Environment name: %s", err, endpoint.Name))
 	}
 
 	var payload logsPayload
 	if err := request.DecodeAndValidateJSONPayload(r, &payload); err != nil {
-		return httperror.BadRequest("Invalid request payload", fmt.Errorf("invalid Edge job request payload: %w. Environment ID: %d", err, endpoint.ID))
+		return httperror.BadRequest("Invalid request payload", fmt.Errorf("invalid Edge job request payload: %w. Environment name: %s", err, endpoint.Name))
 	}
 
 	if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
@@ -60,11 +60,11 @@ func (handler *Handler) endpointEdgeJobsLogs(w http.ResponseWriter, r *http.Requ
 	}); err != nil {
 		var httpErr *httperror.HandlerError
 		if errors.As(err, &httpErr) {
-			httpErr.Err = fmt.Errorf("edge polling error: %w. Environment ID: %d", httpErr.Err, endpoint.ID)
+			httpErr.Err = fmt.Errorf("edge polling error: %w. Environment name: %s", httpErr.Err, endpoint.Name)
 			return httpErr
 		}
 
-		return httperror.InternalServerError("Unexpected error", fmt.Errorf("edge polling error: %w. Environment ID: %d", err, endpoint.ID))
+		return httperror.InternalServerError("Unexpected error", fmt.Errorf("edge polling error: %w. Environment name: %s", err, endpoint.Name))
 	}
 
 	return response.JSON(w, nil)

api/http/handler/endpointedge/endpointedge_stack_inspect.go

@@ -40,18 +40,18 @@ func (handler *Handler) endpointEdgeStackInspect(w http.ResponseWriter, r *http.
 	}
 
 	if err := handler.requestBouncer.AuthorizedEdgeEndpointOperation(r, endpoint); err != nil {
-		return httperror.Forbidden("Permission denied to access environment", fmt.Errorf("unauthorized edge endpoint operation: %w. Environment ID: %d", err, endpoint.ID))
+		return httperror.Forbidden("Permission denied to access environment", fmt.Errorf("unauthorized edge endpoint operation: %w. Environment name: %s", err, endpoint.Name))
 	}
 
 	edgeStackID, err := request.RetrieveNumericRouteVariableValue(r, "stackId")
 	if err != nil {
-		return httperror.BadRequest("Invalid edge stack identifier route variable", fmt.Errorf("invalid Edge stack route variable: %w. Environment ID: %d", err, endpoint.ID))
+		return httperror.BadRequest("Invalid edge stack identifier route variable", fmt.Errorf("invalid Edge stack route variable: %w. Environment name: %s", err, endpoint.Name))
 	}
 
 	s, err, _ := edgeStackSingleFlightGroup.Do(strconv.Itoa(edgeStackID), func() (any, error) {
 		edgeStack, err := handler.DataStore.EdgeStack().EdgeStack(portainer.EdgeStackID(edgeStackID))
 		if handler.DataStore.IsErrObjectNotFound(err) {
-			return nil, httperror.NotFound("Unable to find an edge stack with the specified identifier inside the database", fmt.Errorf("unable to find the Edge stack from database: %w. Environment ID: %d", err, endpoint.ID))
+			return nil, httperror.NotFound("Unable to find an edge stack with the specified identifier inside the database", fmt.Errorf("unable to find the Edge stack from database: %w. Environment name: %s", err, endpoint.Name))
 		}
 
 		return edgeStack, err
@@ -62,7 +62,7 @@ func (handler *Handler) endpointEdgeStackInspect(w http.ResponseWriter, r *http.
 			return httpErr
 		}
 
-		return httperror.InternalServerError("Unable to find an edge stack with the specified identifier inside the database", fmt.Errorf("failed to find Edge stack from the database: %w. Environment ID: %d", err, endpoint.ID))
+		return httperror.InternalServerError("Unable to find an edge stack with the specified identifier inside the database", fmt.Errorf("failed to find Edge stack from the database: %w. Environment name: %s", err, endpoint.Name))
 	}
 
 	// WARNING: this variable must not be mutated
@@ -71,7 +71,7 @@ func (handler *Handler) endpointEdgeStackInspect(w http.ResponseWriter, r *http.
 	fileName := edgeStack.EntryPoint
 	if endpointutils.IsDockerEndpoint(endpoint) {
 		if fileName == "" {
-			return httperror.BadRequest("Docker is not supported by this stack", fmt.Errorf("no filename is provided for the Docker endpoint. Environment ID: %d", endpoint.ID))
+			return httperror.BadRequest("Docker is not supported by this stack", fmt.Errorf("no filename is provided for the Docker endpoint. Environment name: %s", endpoint.Name))
 		}
 	}
 
@@ -84,18 +84,18 @@ func (handler *Handler) endpointEdgeStackInspect(w http.ResponseWriter, r *http.
 		fileName = edgeStack.ManifestPath
 
 		if fileName == "" {
-			return httperror.BadRequest("Kubernetes is not supported by this stack", fmt.Errorf("no filename is provided for the Kubernetes endpoint. Environment ID: %d", endpoint.ID))
+			return httperror.BadRequest("Kubernetes is not supported by this stack", fmt.Errorf("no filename is provided for the Kubernetes endpoint. Environment name: %s", endpoint.Name))
 		}
 	}
 
 	dirEntries, err := filesystem.LoadDir(edgeStack.ProjectPath)
 	if err != nil {
-		return httperror.InternalServerError("Unable to load repository", fmt.Errorf("failed to load project directory: %w. Environment ID: %d", err, endpoint.ID))
+		return httperror.InternalServerError("Unable to load repository", fmt.Errorf("failed to load project directory: %w. Environment name: %s", err, endpoint.Name))
 	}
 
 	fileContent, err := filesystem.FilterDirForCompatibility(dirEntries, fileName, endpoint.Agent.Version)
 	if err != nil {
-		return httperror.InternalServerError("File not found", fmt.Errorf("unable to find file: %w. Environment ID: %d", err, endpoint.ID))
+		return httperror.InternalServerError("File not found", fmt.Errorf("unable to find file: %w. Environment name: %s", err, endpoint.Name))
 	}
 
 	dirEntries = filesystem.FilterDirForEntryFile(dirEntries, fileName)

api/http/handler/endpointedge/endpointedge_status_inspect.go

@@ -97,13 +97,13 @@ func (handler *Handler) endpointEdgeStatusInspect(w http.ResponseWriter, r *http
 	firstConn := endpoint.LastCheckInDate == 0
 
 	if err := handler.requestBouncer.AuthorizedEdgeEndpointOperation(r, endpoint); err != nil {
-		return httperror.Forbidden("Permission denied to access environment. The device has not been trusted yet", fmt.Errorf("unauthorized Edge endpoint operation: %w. Environment ID: %d", err, endpoint.ID))
+		return httperror.Forbidden("Permission denied to access environment. The device has not been trusted yet", fmt.Errorf("unauthorized Edge endpoint operation: %w. Environment name: %s", err, endpoint.Name))
 	}
 
 	handler.DataStore.Endpoint().UpdateHeartbeat(endpoint.ID)
 
 	if err := handler.requestBouncer.TrustedEdgeEnvironmentAccess(handler.DataStore, endpoint); err != nil {
-		return httperror.Forbidden("Permission denied to access environment. The device has not been trusted yet", fmt.Errorf("untrusted Edge environment access: %w. Environment ID: %d", err, endpoint.ID))
+		return httperror.Forbidden("Permission denied to access environment. The device has not been trusted yet", fmt.Errorf("untrusted Edge environment access: %w. Environment name: %s", err, endpoint.Name))
 	}
 
 	var statusResponse *endpointEdgeStatusInspectResponse
@@ -113,11 +113,11 @@ func (handler *Handler) endpointEdgeStatusInspect(w http.ResponseWriter, r *http
 	}); err != nil {
 		var httpErr *httperror.HandlerError
 		if errors.As(err, &httpErr) {
-			httpErr.Err = fmt.Errorf("edge polling error: %w. Environment ID: %d", httpErr.Err, endpoint.ID)
+			httpErr.Err = fmt.Errorf("edge polling error: %w. Environment name: %s", httpErr.Err, endpoint.Name)
 			return httpErr
 		}
 
-		return httperror.InternalServerError("Unexpected error", fmt.Errorf("edge polling error: %w. Environment ID: %d", err, endpoint.ID))
+		return httperror.InternalServerError("Unexpected error", fmt.Errorf("edge polling error: %w. Environment name: %s", err, endpoint.Name))
 	}
 
 	return cacheResponse(w, endpoint.ID, *statusResponse)

api/http/handler/endpoints/endpoint_inspect.go

@@ -20,6 +20,7 @@ import (
 // @produce json
 // @param id path int true "Environment(Endpoint) identifier"
 // @param excludeSnapshot query bool false "if true, the snapshot data won't be retrieved"
+// @param excludeSnapshotRaw query bool false "if true, the SnapshotRaw field won't be retrieved"
 // @success 200 {object} portainer.Endpoint "Success"
 // @failure 400 "Invalid request"
 // @failure 404 "Environment(Endpoint) not found"
@@ -52,9 +53,10 @@ func (handler *Handler) endpointInspect(w http.ResponseWriter, r *http.Request)
 	endpoint.ComposeSyntaxMaxVersion = handler.ComposeStackManager.ComposeSyntaxMaxVersion()
 
 	excludeSnapshot, _ := request.RetrieveBooleanQueryParameter(r, "excludeSnapshot", true)
+	excludeRaw, _ := request.RetrieveBooleanQueryParameter(r, "excludeSnapshotRaw", true)
 
 	if !excludeSnapshot {
-		if err := handler.SnapshotService.FillSnapshotData(endpoint, false); err != nil {
+		if err := handler.SnapshotService.FillSnapshotData(endpoint, !excludeRaw); err != nil {
 			return httperror.InternalServerError("Unable to add snapshot data", err)
 		}
 	}

api/http/handler/endpoints/endpoint_list.go

@@ -45,6 +45,7 @@ const (
 // @param edgeDeviceUntrusted query bool false "if true, show only untrusted edge agents, if false show only trusted edge agents (relevant only for edge agents)"
 // @param edgeCheckInPassedSeconds query number false "if bigger then zero, show only edge agents that checked-in in the last provided seconds (relevant only for edge agents)"
 // @param excludeSnapshots query bool false "if true, the snapshot data won't be retrieved"
+// @param excludeSnapshotRaw query bool false "if true, the SnapshotRaw field won't be retrieved"
 // @param name query string false "will return only environments(endpoints) with this name"
 // @param edgeStackId query portainer.EdgeStackID false "will return the environements of the specified edge stack"
 // @param edgeStackStatus query string false "only applied when edgeStackId exists. Filter the returned environments based on their deployment status in the stack (not the environment status!)" Enum("Pending", "Ok", "Error", "Acknowledged", "Remove", "RemoteUpdateSuccess", "ImagesPulled")
@@ -62,6 +63,7 @@ func (handler *Handler) endpointList(w http.ResponseWriter, r *http.Request) *ht
 	limit, _ := request.RetrieveNumericQueryParameter(r, "limit", true)
 	sortField, _ := request.RetrieveQueryParameter(r, "sort", true)
 	sortOrder, _ := request.RetrieveQueryParameter(r, "order", true)
+	excludeRaw, _ := request.RetrieveBooleanQueryParameter(r, "excludeSnapshotRaw", true)
 
 	endpointGroups, err := handler.DataStore.EndpointGroup().ReadAll()
 	if err != nil {
@@ -116,7 +118,7 @@ func (handler *Handler) endpointList(w http.ResponseWriter, r *http.Request) *ht
 		endpointutils.UpdateEdgeEndpointHeartbeat(&paginatedEndpoints[idx], settings)
 
 		if !query.excludeSnapshots {
-			if err := handler.SnapshotService.FillSnapshotData(&paginatedEndpoints[idx], false); err != nil {
+			if err := handler.SnapshotService.FillSnapshotData(&paginatedEndpoints[idx], !excludeRaw); err != nil {
 				return httperror.InternalServerError("Unable to add snapshot data", err)
 			}
 		}

api/http/handler/endpoints/endpoint_list_test.go

@@ -5,7 +5,6 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
-	"strings"
 	"testing"
 
 	portainer "github.com/portainer/portainer/api"
@@ -79,14 +78,12 @@ func Test_EndpointList_AgentVersion(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.title, func(t *testing.T) {
 			is := assert.New(t)
-			var sb strings.Builder
+			query := ""
 			for _, filter := range test.filter {
-				sb.WriteString("agentVersions[]=")
-				sb.WriteString(filter)
-				sb.WriteString("&")
+				query += fmt.Sprintf("agentVersions[]=%s&", filter)
 			}
 
-			req := buildEndpointListRequest(sb.String())
+			req := buildEndpointListRequest(query)
 
 			resp, err := doEndpointListRequest(req, handler, is)
 			is.NoError(err)

api/http/handler/handler.go

@@ -81,7 +81,7 @@ type Handler struct {
 }
 
 // @title PortainerCE API
-// @version 2.33.8
+// @version 2.33.2
 // @description.markdown api-description.md
 // @termsOfService
 

api/http/handler/kubernetes/handler.go

@@ -176,7 +176,6 @@ func (handler *Handler) kubeClientMiddleware(next http.Handler) http.Handler {
 		tokenData, err := security.RetrieveTokenData(r)
 		if err != nil {
 			httperror.WriteError(w, http.StatusForbidden, "an error occurred during the KubeClientMiddleware operation, permission denied to access the environment. Error: ", err)
-			return
 		}
 
 		// Check if we have a kubeclient against this auth token already, otherwise generate a new one

api/http/handler/stacks/stack_start.go

@@ -161,13 +161,7 @@ func (handler *Handler) startStack(
 			return handler.StackDeployer.StartRemoteComposeStack(stack, endpoint, filteredRegistries)
 		}
 
-		options := portainer.ComposeUpOptions{
-			ComposeOptions: portainer.ComposeOptions{
-				Registries: filteredRegistries,
-			},
-		}
-
-		return handler.ComposeStackManager.Up(context.TODO(), stack, endpoint, options)
+		return handler.ComposeStackManager.Up(context.TODO(), stack, endpoint, portainer.ComposeUpOptions{})
 	case portainer.DockerSwarmStack:
 		stack.Name = handler.SwarmStackManager.NormalizeStackName(stack.Name)
 

api/http/handler/websocket/attach.go

@@ -26,6 +26,7 @@ import (
 // @produce json
 // @param endpointId query int true "environment(endpoint) ID of the environment(endpoint) where the resource is located"
 // @param nodeName query string false "node name"
+// @param token query string true "JWT token used for authentication against this environment(endpoint)"
 // @success 200
 // @failure 400
 // @failure 403

api/http/handler/websocket/exec.go

@@ -31,6 +31,7 @@ type execStartOperationPayload struct {
 // @produce json
 // @param endpointId query int true "environment(endpoint) ID of the environment(endpoint) where the resource is located"
 // @param nodeName query string false "node name"
+// @param token query string true "JWT token used for authentication against this environment(endpoint)"
 // @success 200
 // @failure 400
 // @failure 409

api/http/handler/websocket/pod.go

@@ -30,6 +30,7 @@ import (
 // @param podName query string true "name of the pod containing the container"
 // @param containerName query string true "name of the container"
 // @param command query string true "command to execute in the container"
+// @param token query string true "JWT token used for authentication against this environment(endpoint)"
 // @success 200
 // @failure 400
 // @failure 403

api/http/handler/websocket/shell_pod.go

@@ -18,6 +18,7 @@ import (
 // @accept json
 // @produce json
 // @param endpointId query int true "environment(endpoint) ID of the environment(endpoint) where the resource is located"
+// @param token query string true "JWT token used for authentication against this environment(endpoint)"
 // @success 200 "Success"
 // @failure 400 "Invalid request"
 // @failure 403 "Permission denied"

api/http/proxy/factory/docker/containers.go

@@ -170,23 +170,18 @@ func containerHasBlackListedLabel(containerLabels map[string]any, labelBlackList
 func (transport *Transport) decorateContainerCreationOperation(request *http.Request, resourceIdentifierAttribute string, resourceType portainer.ResourceControlType) (*http.Response, error) {
 	type PartialContainer struct {
 		HostConfig struct {
-			Privileged  bool           `json:"Privileged"`
-			PidMode     string         `json:"PidMode"`
-			Devices     []any          `json:"Devices"`
-			Sysctls     map[string]any `json:"Sysctls"`
-			SecurityOpt []string       `json:"SecurityOpt"`
-			CapAdd      []string       `json:"CapAdd"`
-			CapDrop     []string       `json:"CapDrop"`
-			Binds       []string       `json:"Binds"`
-			Mounts      []struct {
-				Type string `json:"Type"`
-			} `json:"Mounts"`
+			Privileged bool           `json:"Privileged"`
+			PidMode    string         `json:"PidMode"`
+			Devices    []any          `json:"Devices"`
+			Sysctls    map[string]any `json:"Sysctls"`
+			CapAdd     []string       `json:"CapAdd"`
+			CapDrop    []string       `json:"CapDrop"`
+			Binds      []string       `json:"Binds"`
 		} `json:"HostConfig"`
 	}
 
 	forbiddenResponse := &http.Response{
 		StatusCode: http.StatusForbidden,
-		Body:       http.NoBody,
 	}
 
 	tokenData, err := security.RetrieveTokenData(request)
@@ -235,7 +230,7 @@ func (transport *Transport) decorateContainerCreationOperation(request *http.Req
 			return nil, ErrContainerCapabilitiesForbidden
 		}
 
-		if !securitySettings.AllowBindMountsForRegularUsers && len(partialContainer.HostConfig.Binds) > 0 {
+		if !securitySettings.AllowBindMountsForRegularUsers && (len(partialContainer.HostConfig.Binds) > 0) {
 			for _, bind := range partialContainer.HostConfig.Binds {
 				if strings.HasPrefix(bind, "/") {
 					return forbiddenResponse, ErrBindMountsForbidden
@@ -243,14 +238,6 @@ func (transport *Transport) decorateContainerCreationOperation(request *http.Req
 			}
 		}
 
-		if !securitySettings.AllowBindMountsForRegularUsers && len(partialContainer.HostConfig.Mounts) > 0 {
-			for _, mount := range partialContainer.HostConfig.Mounts {
-				if mount.Type == "bind" {
-					return forbiddenResponse, ErrBindMountsForbidden
-				}
-			}
-		}
-
 		request.Body = io.NopCloser(bytes.NewBuffer(body))
 	}
 
@@ -265,45 +252,3 @@ func (transport *Transport) decorateContainerCreationOperation(request *http.Req
 
 	return response, err
 }
-
-func (transport *Transport) decorateContainerUpdateOperation(request *http.Request, containerID string) (*http.Response, error) {
-	type PartialContainerUpdate struct {
-		Devices []any `json:"Devices"`
-	}
-
-	forbiddenResponse := &http.Response{
-		StatusCode: http.StatusForbidden,
-	}
-
-	isAdminOrEndpointAdmin, err := transport.isAdminOrEndpointAdmin(request)
-	if err != nil {
-		return nil, err
-	}
-
-	if isAdminOrEndpointAdmin {
-		return transport.restrictedResourceOperation(request, containerID, containerID, portainer.ContainerResourceControl, false)
-	}
-
-	securitySettings, err := transport.fetchEndpointSecuritySettings()
-	if err != nil {
-		return nil, err
-	}
-
-	body, err := io.ReadAll(request.Body)
-	if err != nil {
-		return nil, err
-	}
-
-	partialUpdate := &PartialContainerUpdate{}
-	if err := json.Unmarshal(body, partialUpdate); err != nil {
-		return nil, err
-	}
-
-	if !securitySettings.AllowDeviceMappingForRegularUsers && len(partialUpdate.Devices) > 0 {
-		return forbiddenResponse, ErrDeviceMappingForbidden
-	}
-
-	request.Body = io.NopCloser(bytes.NewBuffer(body))
-
-	return transport.restrictedResourceOperation(request, containerID, containerID, portainer.ContainerResourceControl, false)
-}

api/http/proxy/factory/docker/containers_test.go

@@ -1,123 +0,0 @@
-package docker
-
-import (
-	"bytes"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
-	"github.com/portainer/portainer/api/datastore"
-	"github.com/portainer/portainer/api/http/security"
-
-	"github.com/segmentio/encoding/json"
-	"github.com/stretchr/testify/require"
-)
-
-func TestDecorateContainerCreationOperation_BindMounts(t *testing.T) {
-	t.Parallel()
-
-	admin := portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
-	regularUser := portainer.User{ID: 2, Username: "user", Role: portainer.StandardUserRole}
-
-	_, ds := datastore.MustNewTestStore(t, true, false)
-
-	err := ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		err := tx.User().Create(&admin)
-		require.NoError(t, err)
-
-		err = tx.User().Create(&regularUser)
-		require.NoError(t, err)
-
-		err = tx.Endpoint().Create(&portainer.Endpoint{
-			ID:   1,
-			Name: "test",
-			SecuritySettings: portainer.EndpointSecuritySettings{
-				AllowBindMountsForRegularUsers: false,
-			},
-		})
-		require.NoError(t, err)
-
-		return nil
-	})
-	require.NoError(t, err)
-
-	srv, version := mockDockerAPIServer(t, RoutesDefinition{
-		{http.MethodPost, "/containers/create"}: map[string]any{"Id": "abc123", "Warnings": []any{}},
-	})
-	defer srv.Close()
-
-	transport := &Transport{
-		endpoint:      &portainer.Endpoint{ID: 1, URL: srv.URL},
-		dataStore:     ds,
-		HTTPTransport: &http.Transport{},
-	}
-
-	adminToken := portainer.TokenData{ID: admin.ID, Username: admin.Username, Role: admin.Role}
-	userToken := portainer.TokenData{ID: regularUser.ID, Username: regularUser.Username, Role: regularUser.Role}
-
-	makeRequest := func(token portainer.TokenData, body any) *http.Request {
-		bodyBytes, err := json.Marshal(body)
-		require.NoError(t, err)
-
-		req := httptest.NewRequest(http.MethodPost, srv.URL+"/v"+version+"/containers/create", bytes.NewReader(bodyBytes))
-		req = req.WithContext(security.StoreTokenData(req, &token))
-
-		return req
-	}
-
-	// Admin bypasses security checks
-	req := makeRequest(adminToken, map[string]any{
-		"HostConfig": map[string]any{
-			"Mounts": []map[string]any{{"Type": "bind", "Source": "/", "Target": "/host"}},
-		},
-	})
-	resp, err := transport.decorateContainerCreationOperation(req, containerObjectIdentifier, portainer.ContainerResourceControl)
-	require.NoError(t, err)
-	require.NotNil(t, resp)
-
-	err = resp.Body.Close()
-	require.NoError(t, err)
-
-	// HostConfig.Binds with an absolute path is blocked for regular users
-	req = makeRequest(userToken, map[string]any{
-		"HostConfig": map[string]any{
-			"Binds": []string{"/:/host:ro"},
-		},
-	})
-	resp, err = transport.decorateContainerCreationOperation(req, containerObjectIdentifier, portainer.ContainerResourceControl)
-	require.ErrorIs(t, err, ErrBindMountsForbidden)
-	require.NotNil(t, resp)
-	require.Equal(t, http.StatusForbidden, resp.StatusCode)
-
-	err = resp.Body.Close()
-	require.NoError(t, err)
-
-	// HostConfig.Mounts with type bind is blocked for regular users
-	req = makeRequest(userToken, map[string]any{
-		"HostConfig": map[string]any{
-			"Mounts": []map[string]any{{"Type": "bind", "Source": "/", "Target": "/host"}},
-		},
-	})
-	resp, err = transport.decorateContainerCreationOperation(req, containerObjectIdentifier, portainer.ContainerResourceControl)
-	require.ErrorIs(t, err, ErrBindMountsForbidden)
-	require.NotNil(t, resp)
-	require.Equal(t, http.StatusForbidden, resp.StatusCode)
-
-	err = resp.Body.Close()
-	require.NoError(t, err)
-
-	// HostConfig.Mounts with a non-bind type is allowed for regular users
-	req = makeRequest(userToken, map[string]any{
-		"HostConfig": map[string]any{
-			"Mounts": []map[string]any{{"Type": "volume", "Source": "myvolume", "Target": "/data"}},
-		},
-	})
-	resp, err = transport.decorateContainerCreationOperation(req, containerObjectIdentifier, portainer.ContainerResourceControl)
-	require.NoError(t, err)
-	require.NotNil(t, resp)
-
-	err = resp.Body.Close()
-	require.NoError(t, err)
-}

api/http/proxy/factory/docker/services.go

@@ -3,6 +3,7 @@ package docker
 import (
 	"bytes"
 	"context"
+	"errors"
 	"io"
 	"net/http"
 
@@ -17,70 +18,6 @@ import (
 
 const serviceObjectIdentifier = "ID"
 
-type partialServiceSpec struct {
-	TaskTemplate struct {
-		ContainerSpec struct {
-			CapabilityAdd  []string       `json:"CapabilityAdd"`
-			CapabilityDrop []string       `json:"CapabilityDrop"`
-			Sysctls        map[string]any `json:"Sysctls"`
-			Privileges     *struct {
-				Seccomp  *struct{ Mode string } `json:"Seccomp"`
-				AppArmor *struct{ Mode string } `json:"AppArmor"`
-			} `json:"Privileges"`
-			Mounts []struct {
-				Type          string `json:"Type"`
-				VolumeOptions *struct {
-					DriverConfig *struct {
-						Options map[string]string `json:"Options"`
-					} `json:"DriverConfig"`
-				} `json:"VolumeOptions"`
-			} `json:"Mounts"`
-		} `json:"ContainerSpec"`
-	} `json:"TaskTemplate"`
-}
-
-func CheckServiceBodyRestrictions(request *http.Request, securitySettings *portainer.EndpointSecuritySettings) error {
-	defer request.Body.Close()
-
-	body, err := io.ReadAll(request.Body)
-	if err != nil {
-		return err
-	}
-
-	spec := &partialServiceSpec{}
-	if err := json.Unmarshal(body, spec); err != nil {
-		return err
-	}
-
-	containerSpec := spec.TaskTemplate.ContainerSpec
-
-	if !securitySettings.AllowContainerCapabilitiesForRegularUsers && (len(containerSpec.CapabilityAdd) > 0 || len(containerSpec.CapabilityDrop) > 0) {
-		return ErrContainerCapabilitiesForbidden
-	}
-
-	if !securitySettings.AllowSysctlSettingForRegularUsers && len(containerSpec.Sysctls) > 0 {
-		return ErrSysCtlSettingsForbidden
-	}
-
-	if !securitySettings.AllowBindMountsForRegularUsers {
-		for _, mount := range containerSpec.Mounts {
-			if mount.Type == "bind" {
-				return ErrBindMountsForbidden
-			}
-
-			if mount.VolumeOptions != nil && mount.VolumeOptions.DriverConfig != nil {
-				if mount.VolumeOptions.DriverConfig.Options["type"] == "bind" {
-					return ErrBindMountsForbidden
-				}
-			}
-		}
-	}
-
-	request.Body = io.NopCloser(bytes.NewBuffer(body))
-
-	return nil
-}
-
 func getInheritedResourceControlFromServiceLabels(dockerClient *client.Client, endpointID portainer.EndpointID, serviceID string, resourceControls []portainer.ResourceControl) (*portainer.ResourceControl, error) {
 	service, _, err := dockerClient.ServiceInspectWithRaw(context.Background(), serviceID, swarm.ServiceInspectOptions{})
 	if err != nil {
@@ -153,6 +90,20 @@ func selectorServiceLabels(responseObject map[string]any) map[string]any {
 }
 
 func (transport *Transport) decorateServiceCreationOperation(request *http.Request) (*http.Response, error) {
+	type PartialService struct {
+		TaskTemplate struct {
+			ContainerSpec struct {
+				Mounts []struct {
+					Type string
+				}
+			}
+		}
+	}
+
+	forbiddenResponse := &http.Response{
+		StatusCode: http.StatusForbidden,
+	}
+
 	isAdminOrEndpointAdmin, err := transport.isAdminOrEndpointAdmin(request)
 	if err != nil {
 		return nil, err
@@ -167,45 +118,25 @@ func (transport *Transport) decorateServiceCreationOperation(request *http.Reque
 		return nil, err
 	}
 
-	if err := CheckServiceBodyRestrictions(request, securitySettings); err != nil {
-		return &http.Response{
-			StatusCode: http.StatusForbidden,
-			Body:       io.NopCloser(bytes.NewBufferString("Access denied: insufficient permissions to create service with specified configuration")),
-		}, err
+	body, err := io.ReadAll(request.Body)
+	if err != nil {
+		return nil, err
 	}
 
+	partialService := &PartialService{}
+	if err := json.Unmarshal(body, partialService); err != nil {
+		return nil, err
+	}
+
+	if !securitySettings.AllowBindMountsForRegularUsers && (len(partialService.TaskTemplate.ContainerSpec.Mounts) > 0) {
+		for _, mount := range partialService.TaskTemplate.ContainerSpec.Mounts {
+			if mount.Type == "bind" {
+				return forbiddenResponse, errors.New("forbidden to use bind mounts")
+			}
+		}
+	}
+
+	request.Body = io.NopCloser(bytes.NewBuffer(body))
+
 	return transport.replaceRegistryAuthenticationHeader(request)
 }
-
-func (transport *Transport) decorateServiceUpdateOperation(request *http.Request, serviceID string) (*http.Response, error) {
-	isAdminOrEndpointAdmin, err := transport.isAdminOrEndpointAdmin(request)
-	if err != nil {
-		return nil, err
-	}
-
-	if isAdminOrEndpointAdmin {
-		if err := transport.decorateRegistryAuthenticationHeader(request); err != nil {
-			return nil, err
-		}
-
-		return transport.executeDockerRequest(request)
-	}
-
-	securitySettings, err := transport.fetchEndpointSecuritySettings()
-	if err != nil {
-		return nil, err
-	}
-
-	if err := CheckServiceBodyRestrictions(request, securitySettings); err != nil {
-		return &http.Response{
-			StatusCode: http.StatusForbidden,
-			Body:       io.NopCloser(bytes.NewBufferString("Access denied: insufficient permissions to update service with specified configuration")),
-		}, err
-	}
-
-	if err := transport.decorateRegistryAuthenticationHeader(request); err != nil {
-		return nil, err
-	}
-
-	return transport.restrictedResourceOperation(request, serviceID, serviceID, portainer.ServiceResourceControl, false)
-}

api/http/proxy/factory/docker/services_test.go

@@ -1,522 +0,0 @@
-package docker
-
-import (
-	"bytes"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
-	"github.com/portainer/portainer/api/datastore"
-	"github.com/portainer/portainer/api/http/security"
-
-	"github.com/docker/docker/api/types/mount"
-	"github.com/docker/docker/api/types/swarm"
-	"github.com/segmentio/encoding/json"
-	"github.com/stretchr/testify/require"
-)
-
-const serviceCreationAPIVersion = "1.51"
-
-type serviceCreationFixtures struct {
-	dockerSrv  *httptest.Server
-	ds         dataservices.DataStore
-	stdUser    portainer.User
-	adminUser  portainer.User
-	endpointID portainer.EndpointID
-}
-
-func newServiceCreationFixtures(t *testing.T) *serviceCreationFixtures {
-	t.Helper()
-
-	const serviceID = "some-service-id"
-
-	dockerSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == http.MethodHead && r.URL.Path == "/_ping" {
-			w.Header().Add("Api-Version", serviceCreationAPIVersion)
-			_, _ = w.Write([]byte{})
-
-			return
-		}
-
-		if r.Method == http.MethodPost {
-			data, err := json.Marshal(map[string]string{"ID": serviceID})
-			if err != nil {
-				http.Error(w, err.Error(), http.StatusInternalServerError)
-
-				return
-			}
-
-			w.Header().Set("Content-Type", "application/json")
-			w.WriteHeader(http.StatusCreated)
-			_, _ = w.Write(data)
-
-			return
-		}
-
-		http.NotFound(w, r)
-	}))
-	t.Cleanup(dockerSrv.Close)
-
-	_, store := datastore.MustNewTestStore(t, true, false)
-
-	f := &serviceCreationFixtures{
-		dockerSrv:  dockerSrv,
-		ds:         store,
-		stdUser:    portainer.User{ID: 1, Username: "std", Role: portainer.StandardUserRole},
-		adminUser:  portainer.User{ID: 2, Username: "admin", Role: portainer.AdministratorRole},
-		endpointID: portainer.EndpointID(1),
-	}
-
-	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		err := tx.User().Create(&f.stdUser)
-		require.NoError(t, err)
-
-		err = tx.User().Create(&f.adminUser)
-		require.NoError(t, err)
-
-		err = tx.Endpoint().Create(&portainer.Endpoint{ID: f.endpointID, Name: "test-env"})
-		require.NoError(t, err)
-
-		return nil
-	})
-	require.NoError(t, err)
-
-	return f
-}
-
-func (f *serviceCreationFixtures) setSecuritySettings(t *testing.T, settings portainer.EndpointSecuritySettings) {
-	t.Helper()
-
-	err := f.ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		return tx.Endpoint().UpdateEndpoint(f.endpointID, &portainer.Endpoint{
-			ID:               f.endpointID,
-			Name:             "test-env",
-			SecuritySettings: settings,
-		})
-	})
-	require.NoError(t, err)
-}
-
-func (f *serviceCreationFixtures) newTransport() *Transport {
-	return &Transport{
-		endpoint:      &portainer.Endpoint{ID: f.endpointID},
-		dataStore:     f.ds,
-		HTTPTransport: &http.Transport{},
-	}
-}
-
-func (f *serviceCreationFixtures) newRequest(t *testing.T, spec swarm.ServiceSpec, user portainer.User) *http.Request {
-	t.Helper()
-
-	data, err := json.Marshal(spec)
-	require.NoError(t, err)
-
-	req, err := http.NewRequestWithContext(
-		t.Context(),
-		http.MethodPost,
-		f.dockerSrv.URL+"/v"+serviceCreationAPIVersion+"/services/create",
-		bytes.NewReader(data),
-	)
-	require.NoError(t, err)
-
-	return req.WithContext(security.StoreTokenData(req, &portainer.TokenData{
-		ID:       user.ID,
-		Username: user.Username,
-		Role:     user.Role,
-	}))
-}
-
-var (
-	restrictiveSettings = portainer.EndpointSecuritySettings{
-		AllowContainerCapabilitiesForRegularUsers: false,
-		AllowSysctlSettingForRegularUsers:         false,
-		AllowBindMountsForRegularUsers:            false,
-	}
-
-	permissiveSettings = portainer.EndpointSecuritySettings{
-		AllowContainerCapabilitiesForRegularUsers: true,
-		AllowSysctlSettingForRegularUsers:         true,
-		AllowBindMountsForRegularUsers:            true,
-	}
-)
-
-func TestDecorateServiceCreationOperation_CapabilityAddForbidden(t *testing.T) {
-	t.Parallel()
-
-	f := newServiceCreationFixtures(t)
-	f.setSecuritySettings(t, restrictiveSettings)
-
-	spec := swarm.ServiceSpec{
-		TaskTemplate: swarm.TaskSpec{
-			ContainerSpec: &swarm.ContainerSpec{
-				CapabilityAdd: []string{"NET_ADMIN"},
-			},
-		},
-	}
-
-	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
-	require.ErrorIs(t, err, ErrContainerCapabilitiesForbidden)
-	require.NotNil(t, resp)
-	require.Equal(t, http.StatusForbidden, resp.StatusCode)
-
-	err = resp.Body.Close()
-	require.NoError(t, err)
-}
-
-func TestDecorateServiceCreationOperation_CapabilityDropForbidden(t *testing.T) {
-	t.Parallel()
-
-	f := newServiceCreationFixtures(t)
-	f.setSecuritySettings(t, restrictiveSettings)
-
-	spec := swarm.ServiceSpec{
-		TaskTemplate: swarm.TaskSpec{
-			ContainerSpec: &swarm.ContainerSpec{
-				CapabilityDrop: []string{"MKNOD"},
-			},
-		},
-	}
-
-	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
-	require.ErrorIs(t, err, ErrContainerCapabilitiesForbidden)
-	require.NotNil(t, resp)
-	require.Equal(t, http.StatusForbidden, resp.StatusCode)
-
-	err = resp.Body.Close()
-	require.NoError(t, err)
-}
-
-func TestDecorateServiceCreationOperation_CapabilitiesAllowed(t *testing.T) {
-	t.Parallel()
-
-	f := newServiceCreationFixtures(t)
-	f.setSecuritySettings(t, permissiveSettings)
-
-	spec := swarm.ServiceSpec{
-		TaskTemplate: swarm.TaskSpec{
-			ContainerSpec: &swarm.ContainerSpec{
-				CapabilityAdd: []string{"NET_ADMIN"},
-			},
-		},
-	}
-
-	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
-	require.NoError(t, err)
-	require.NotNil(t, resp)
-	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
-
-	err = resp.Body.Close()
-	require.NoError(t, err)
-}
-
-func TestDecorateServiceCreationOperation_NoCapabilitiesAllowed(t *testing.T) {
-	t.Parallel()
-
-	f := newServiceCreationFixtures(t)
-	f.setSecuritySettings(t, restrictiveSettings)
-
-	var spec swarm.ServiceSpec
-
-	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
-	require.NotErrorIs(t, err, ErrContainerCapabilitiesForbidden)
-	require.NotNil(t, resp)
-	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
-
-	err = resp.Body.Close()
-	require.NoError(t, err)
-}
-
-func TestDecorateServiceCreationOperation_SysctlForbidden(t *testing.T) {
-	t.Parallel()
-
-	f := newServiceCreationFixtures(t)
-	f.setSecuritySettings(t, restrictiveSettings)
-
-	spec := swarm.ServiceSpec{
-		TaskTemplate: swarm.TaskSpec{
-			ContainerSpec: &swarm.ContainerSpec{
-				Sysctls: map[string]string{"net.ipv4.ip_forward": "1"},
-			},
-		},
-	}
-
-	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
-	require.ErrorIs(t, err, ErrSysCtlSettingsForbidden)
-	require.NotNil(t, resp)
-	require.Equal(t, http.StatusForbidden, resp.StatusCode)
-
-	err = resp.Body.Close()
-	require.NoError(t, err)
-}
-
-func TestDecorateServiceCreationOperation_SysctlAllowed(t *testing.T) {
-	t.Parallel()
-
-	f := newServiceCreationFixtures(t)
-	f.setSecuritySettings(t, permissiveSettings)
-
-	spec := swarm.ServiceSpec{
-		TaskTemplate: swarm.TaskSpec{
-			ContainerSpec: &swarm.ContainerSpec{
-				Sysctls: map[string]string{"net.ipv4.ip_forward": "1"},
-			},
-		},
-	}
-
-	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
-	require.NoError(t, err)
-	require.NotNil(t, resp)
-	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
-
-	err = resp.Body.Close()
-	require.NoError(t, err)
-}
-
-func TestDecorateServiceCreationOperation_BindMountForbidden(t *testing.T) {
-	t.Parallel()
-
-	f := newServiceCreationFixtures(t)
-	f.setSecuritySettings(t, restrictiveSettings)
-
-	spec := swarm.ServiceSpec{
-		TaskTemplate: swarm.TaskSpec{
-			ContainerSpec: &swarm.ContainerSpec{
-				Mounts: []mount.Mount{{Type: mount.TypeBind}},
-			},
-		},
-	}
-
-	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
-	require.ErrorIs(t, err, ErrBindMountsForbidden)
-	require.NotNil(t, resp)
-	require.Equal(t, http.StatusForbidden, resp.StatusCode)
-
-	err = resp.Body.Close()
-	require.NoError(t, err)
-}
-
-func TestDecorateServiceCreationOperation_NonBindMountNotForbidden(t *testing.T) {
-	t.Parallel()
-
-	f := newServiceCreationFixtures(t)
-
-	f.setSecuritySettings(t, portainer.EndpointSecuritySettings{
-		AllowContainerCapabilitiesForRegularUsers: true,
-		AllowSysctlSettingForRegularUsers:         true,
-		AllowBindMountsForRegularUsers:            false,
-	})
-
-	spec := swarm.ServiceSpec{
-		TaskTemplate: swarm.TaskSpec{
-			ContainerSpec: &swarm.ContainerSpec{
-				Mounts: []mount.Mount{{Type: mount.TypeVolume}},
-			},
-		},
-	}
-
-	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
-	require.NotErrorIs(t, err, ErrBindMountsForbidden)
-	require.NotNil(t, resp)
-	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
-
-	err = resp.Body.Close()
-	require.NoError(t, err)
-}
-
-func TestDecorateServiceCreationOperation_BindMountAllowed(t *testing.T) {
-	t.Parallel()
-
-	f := newServiceCreationFixtures(t)
-	f.setSecuritySettings(t, permissiveSettings)
-
-	spec := swarm.ServiceSpec{
-		TaskTemplate: swarm.TaskSpec{
-			ContainerSpec: &swarm.ContainerSpec{
-				Mounts: []mount.Mount{{Type: mount.TypeBind}},
-			},
-		},
-	}
-
-	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
-	require.NoError(t, err)
-	require.NotNil(t, resp)
-	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
-
-	err = resp.Body.Close()
-	require.NoError(t, err)
-}
-
-func TestDecorateServiceCreationOperation_AdminBypassesAllSecurityChecks(t *testing.T) {
-	t.Parallel()
-
-	f := newServiceCreationFixtures(t)
-	f.setSecuritySettings(t, restrictiveSettings)
-
-	spec := swarm.ServiceSpec{
-		TaskTemplate: swarm.TaskSpec{
-			ContainerSpec: &swarm.ContainerSpec{
-				CapabilityAdd:  []string{"NET_ADMIN"},
-				CapabilityDrop: []string{"MKNOD"},
-				Sysctls:        map[string]string{"net.ipv4.ip_forward": "1"},
-				Mounts:         []mount.Mount{{Type: mount.TypeBind}},
-			},
-		},
-	}
-
-	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.adminUser))
-	require.NotErrorIs(t, err, ErrContainerCapabilitiesForbidden)
-	require.NotErrorIs(t, err, ErrSysCtlSettingsForbidden)
-	require.NotErrorIs(t, err, ErrBindMountsForbidden)
-	require.NotNil(t, resp)
-	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
-
-	err = resp.Body.Close()
-	require.NoError(t, err)
-}
-
-func TestDecorateServiceCreationOperation_StandardUserPermissiveSettingsSucceeds(t *testing.T) {
-	t.Parallel()
-
-	f := newServiceCreationFixtures(t)
-	f.setSecuritySettings(t, permissiveSettings)
-
-	spec := swarm.ServiceSpec{
-		TaskTemplate: swarm.TaskSpec{
-			ContainerSpec: &swarm.ContainerSpec{
-				CapabilityAdd: []string{"NET_ADMIN"},
-				Sysctls:       map[string]string{"net.core.somaxconn": "128"},
-				Mounts:        []mount.Mount{{Type: mount.TypeBind}},
-			},
-		},
-	}
-
-	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
-	require.NoError(t, err)
-	require.NotNil(t, resp)
-	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
-
-	err = resp.Body.Close()
-	require.NoError(t, err)
-}
-
-func TestDecorateServiceCreationOperation_VolumeWithBindDriverOptionForbidden(t *testing.T) {
-	t.Parallel()
-
-	f := newServiceCreationFixtures(t)
-	f.setSecuritySettings(t, restrictiveSettings)
-
-	spec := swarm.ServiceSpec{
-		TaskTemplate: swarm.TaskSpec{
-			ContainerSpec: &swarm.ContainerSpec{
-				Mounts: []mount.Mount{{
-					Type: mount.TypeVolume,
-					VolumeOptions: &mount.VolumeOptions{
-						DriverConfig: &mount.Driver{
-							Options: map[string]string{"type": "bind", "device": "/etc"},
-						},
-					},
-				}},
-			},
-		},
-	}
-
-	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
-	require.ErrorIs(t, err, ErrBindMountsForbidden)
-	require.NotNil(t, resp)
-	require.Equal(t, http.StatusForbidden, resp.StatusCode)
-
-	err = resp.Body.Close()
-	require.NoError(t, err)
-}
-
-func TestDecorateServiceCreationOperation_VolumeWithBindDriverOptionAllowed(t *testing.T) {
-	t.Parallel()
-
-	f := newServiceCreationFixtures(t)
-	f.setSecuritySettings(t, permissiveSettings)
-
-	spec := swarm.ServiceSpec{
-		TaskTemplate: swarm.TaskSpec{
-			ContainerSpec: &swarm.ContainerSpec{
-				Mounts: []mount.Mount{{
-					Type: mount.TypeVolume,
-					VolumeOptions: &mount.VolumeOptions{
-						DriverConfig: &mount.Driver{
-							Options: map[string]string{"type": "bind", "device": "/etc"},
-						},
-					},
-				}},
-			},
-		},
-	}
-
-	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
-	require.NoError(t, err)
-	require.NotNil(t, resp)
-	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
-
-	err = resp.Body.Close()
-	require.NoError(t, err)
-}
-
-func TestDecorateServiceCreationOperation_VolumeWithNonBindDriverOptionNotForbidden(t *testing.T) {
-	t.Parallel()
-
-	f := newServiceCreationFixtures(t)
-	f.setSecuritySettings(t, restrictiveSettings)
-
-	spec := swarm.ServiceSpec{
-		TaskTemplate: swarm.TaskSpec{
-			ContainerSpec: &swarm.ContainerSpec{
-				Mounts: []mount.Mount{{
-					Type: mount.TypeVolume,
-					VolumeOptions: &mount.VolumeOptions{
-						DriverConfig: &mount.Driver{
-							Options: map[string]string{"type": "tmpfs"},
-						},
-					},
-				}},
-			},
-		},
-	}
-
-	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
-	require.NotErrorIs(t, err, ErrBindMountsForbidden)
-	require.NotNil(t, resp)
-	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
-
-	err = resp.Body.Close()
-	require.NoError(t, err)
-}
-
-func TestDecorateServiceUpdateOperation_VolumeWithBindDriverOptionForbidden(t *testing.T) {
-	t.Parallel()
-
-	f := newServiceCreationFixtures(t)
-	f.setSecuritySettings(t, restrictiveSettings)
-
-	spec := swarm.ServiceSpec{
-		TaskTemplate: swarm.TaskSpec{
-			ContainerSpec: &swarm.ContainerSpec{
-				Mounts: []mount.Mount{{
-					Type: mount.TypeVolume,
-					VolumeOptions: &mount.VolumeOptions{
-						DriverConfig: &mount.Driver{
-							Options: map[string]string{"type": "bind", "device": "/etc"},
-						},
-					},
-				}},
-			},
-		},
-	}
-
-	resp, err := f.newTransport().decorateServiceUpdateOperation(f.newRequest(t, spec, f.stdUser), "test-service-id")
-	require.ErrorIs(t, err, ErrBindMountsForbidden)
-	require.NotNil(t, resp)
-	require.Equal(t, http.StatusForbidden, resp.StatusCode)
-
-	err = resp.Body.Close()
-	require.NoError(t, err)
-}

api/http/proxy/factory/docker/transport.go

@@ -21,7 +21,6 @@ import (
 	"github.com/portainer/portainer/api/http/proxy/factory/utils"
 	"github.com/portainer/portainer/api/http/security"
 	"github.com/portainer/portainer/api/internal/authorization"
-	"github.com/portainer/portainer/api/slicesx"
 
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/api/types/swarm"
@@ -109,32 +108,10 @@ var prefixProxyFuncMap = map[string]func(*Transport, *http.Request, string) (*ht
 	"volumes":    (*Transport).proxyVolumeRequest,
 }
 
-type route struct {
-	method  string
-	pattern *regexp.Regexp
-}
-
-var adminOnlyRoutes = []route{
-	{http.MethodPost, regexp.MustCompile(`^/plugins/.+/enable$`)},
-	{http.MethodPost, regexp.MustCompile(`^/plugins/.+/disable$`)},
-	{http.MethodPost, regexp.MustCompile(`^/plugins/pull$`)},
-	{http.MethodPost, regexp.MustCompile(`^/plugins/.+/push$`)},
-	{http.MethodPost, regexp.MustCompile(`^/plugins/.+/upgrade$`)},
-	{http.MethodPost, regexp.MustCompile(`^/plugins/.+/set$`)},
-	{http.MethodPost, regexp.MustCompile(`^/plugins/create$`)},
-	{http.MethodDelete, regexp.MustCompile(`^/plugins/.+$`)},
-}
-
-func isAdminOnlyRoute(method string, path string) bool {
-	return slicesx.Some(adminOnlyRoutes, func(r route) bool {
-		return method == r.method && r.pattern.MatchString(path)
-	})
-}
-
 // ProxyDockerRequest intercepts a Docker API request and apply logic based
 // on the requested operation.
 func (transport *Transport) ProxyDockerRequest(request *http.Request) (*http.Response, error) {
-	// from : /v1.44/containers/{id}/json
+	// from : /v1.41/containers/{id}/json
 	// or   : /containers/{id}/json
 	// to   : /containers/{id}/json
 	unversionedPath := apiVersionRe.ReplaceAllString(request.URL.Path, "")
@@ -159,10 +136,6 @@ func (transport *Transport) ProxyDockerRequest(request *http.Request) (*http.Res
 		return proxyFunc(transport, request, unversionedPath)
 	}
 
-	if isAdminOnlyRoute(request.Method, unversionedPath) {
-		return transport.administratorOperation(request)
-	}
-
 	return transport.executeDockerRequest(request)
 }
 
@@ -287,11 +260,6 @@ func (transport *Transport) proxyContainerRequest(request *http.Request, unversi
 			if action == "json" {
 				return transport.rewriteOperation(request, transport.containerInspectOperation)
 			}
-
-			if action == "update" {
-				return transport.decorateContainerUpdateOperation(request, containerID)
-			}
-
 			return transport.restrictedResourceOperation(request, containerID, containerID, portainer.ContainerResourceControl, false)
 		} else if match, _ := path.Match("/containers/*", requestPath); match {
 			// Handle /containers/{id} requests
@@ -323,11 +291,6 @@ func (transport *Transport) proxyServiceRequest(request *http.Request, unversion
 		if match, _ := path.Match("/services/*/*", requestPath); match {
 			// Handle /services/{id}/{action} requests
 			serviceID := path.Base(path.Dir(requestPath))
-			action := path.Base(requestPath)
-
-			if action == "update" {
-				return transport.decorateServiceUpdateOperation(request, serviceID)
-			}
 
 			if err := transport.decorateRegistryAuthenticationHeader(request); err != nil {
 				return nil, err

api/http/proxy/factory/docker/transport_test.go

@@ -109,141 +109,6 @@ func mockDockerAPIServer(t *testing.T, routes RoutesDefinition) (*httptest.Serve
 	return srv, version
 }
 
-func TestTransport_adminProxy(t *testing.T) {
-	t.Parallel()
-	admin := portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
-	std1 := portainer.User{ID: 2, Username: "std1", Role: portainer.StandardUserRole}
-	std2 := portainer.User{ID: 3, Username: "std2", Role: portainer.StandardUserRole}
-
-	_, ds := datastore.MustNewTestStore(t, true, false)
-
-	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		require.NoError(t, tx.User().Create(&admin))
-		require.NoError(t, tx.User().Create(&std1))
-		require.NoError(t, tx.User().Create(&std2))
-		require.NoError(t, tx.Endpoint().Create(&portainer.Endpoint{ID: 1, Name: "env",
-			UserAccessPolicies: portainer.UserAccessPolicies{std1.ID: portainer.AccessPolicy{RoleID: 1}},
-		}))
-
-		return nil
-	}))
-	srv, version := mockDockerAPIServer(t, RoutesDefinition{
-		// allowed routes
-		{http.MethodGet, "/plugins"}:            nil,
-		{http.MethodGet, "/plugins/xxx/json"}:   nil,
-		{http.MethodGet, "/plugins/privileges"}: nil,
-		// admin routes ; see `adminOnlyRoutes`
-		{http.MethodDelete, "/plugins/xxx"}:              nil,
-		{http.MethodPost, "/plugins/sshfs/enable"}:       nil, // simulate plugin "sshfs"
-		{http.MethodPost, "/plugins/vieux/sshfs/enable"}: nil, // simulate "vieux/sshfs"
-		{http.MethodPost, "/plugins/xxx/disable"}:        nil,
-		{http.MethodPost, "/plugins/pull"}:               nil,
-		{http.MethodPost, "/plugins/xxx/push"}:           nil,
-		{http.MethodPost, "/plugins/xxx/upgrade"}:        nil,
-		{http.MethodPost, "/plugins/xxx/set"}:            nil,
-		{http.MethodPost, "/plugins/create"}:             nil,
-	})
-	defer srv.Close()
-
-	transport := &Transport{
-		endpoint:      &portainer.Endpoint{URL: srv.URL},
-		dataStore:     ds,
-		HTTPTransport: &http.Transport{},
-	}
-
-	test := func(method string, url string, token portainer.TokenData) (*http.Response, error) {
-		req := httptest.NewRequest(method, srv.URL+"/v"+version+url, nil)
-		req = req.WithContext(security.StoreTokenData(req, &token))
-		require.NotNil(t, req)
-
-		return transport.ProxyDockerRequest(req)
-	}
-
-	adminToken := portainer.TokenData{ID: admin.ID, Username: admin.Username, Role: admin.Role}
-	std1Token := portainer.TokenData{ID: std1.ID, Username: std1.Username, Role: std1.Role}
-	std2Token := portainer.TokenData{ID: std2.ID, Username: std2.Username, Role: std2.Role}
-
-	{
-		r, err := test(http.MethodGet, "/plugins", adminToken)
-		require.NoError(t, err)
-		require.NotNil(t, r)
-		require.Equal(t, http.StatusOK, r.StatusCode)
-		require.NoError(t, r.Body.Close())
-	}
-
-	{
-		r, err := test(http.MethodGet, "/plugins", std1Token)
-		require.NoError(t, err)
-		require.NotNil(t, r)
-		require.Equal(t, http.StatusOK, r.StatusCode)
-		require.NoError(t, r.Body.Close())
-	}
-
-	{
-		r, err := test(http.MethodGet, "/plugins", std2Token)
-		require.NoError(t, err)
-		require.NotNil(t, r)
-		require.Equal(t, http.StatusOK, r.StatusCode)
-		require.NoError(t, r.Body.Close())
-	}
-
-	{
-		r, err := test(http.MethodPost, "/plugins/pull", adminToken)
-		require.NoError(t, err)
-		require.NotNil(t, r)
-		require.Equal(t, http.StatusOK, r.StatusCode)
-		require.NoError(t, r.Body.Close())
-	}
-
-	{
-		r, err := test(http.MethodPost, "/plugins/pull", std1Token)
-		require.NoError(t, err)
-		require.NotNil(t, r)
-		require.Equal(t, http.StatusForbidden, r.StatusCode)
-		require.NoError(t, r.Body.Close())
-	}
-
-	{
-		r, err := test(http.MethodPost, "/plugins/pull", std2Token)
-		require.NoError(t, err)
-		require.NotNil(t, r)
-		require.Equal(t, http.StatusForbidden, r.StatusCode)
-		require.NoError(t, r.Body.Close())
-	}
-
-	{
-		r, err := test(http.MethodPost, "/plugins/sshfs/enable", adminToken)
-		require.NoError(t, err)
-		require.NotNil(t, r)
-		require.Equal(t, http.StatusOK, r.StatusCode)
-		require.NoError(t, r.Body.Close())
-	}
-
-	{
-		r, err := test(http.MethodPost, "/plugins/sshfs/enable", std2Token)
-		require.NoError(t, err)
-		require.NotNil(t, r)
-		require.Equal(t, http.StatusForbidden, r.StatusCode)
-		require.NoError(t, r.Body.Close())
-	}
-
-	{
-		r, err := test(http.MethodPost, "/plugins/vieux/sshfs/enable", adminToken)
-		require.NoError(t, err)
-		require.NotNil(t, r)
-		require.Equal(t, http.StatusOK, r.StatusCode)
-		require.NoError(t, r.Body.Close())
-	}
-
-	{
-		r, err := test(http.MethodPost, "/plugins/vieux/sshfs/enable", std2Token)
-		require.NoError(t, err)
-		require.NotNil(t, r)
-		require.Equal(t, http.StatusForbidden, r.StatusCode)
-		require.NoError(t, r.Body.Close())
-	}
-}
-
 func TestTransport_getRealResourceID(t *testing.T) {
 	srv, _ := mockDockerAPIServer(t, RoutesDefinition{
 		{http.MethodGet, "/networks"}:           []network.Summary{{ID: "16e37c629e88694663791dc738fd37affb908d7b85ce00a20680675d10554fd4", Name: "mynetwork"}},

api/http/proxy/factory/docker/volumes.go

@@ -1,11 +1,9 @@
 package docker
 
 import (
-	"bytes"
 	"context"
 	"errors"
 	"fmt"
-	"io"
 	"net/http"
 	"path"
 
@@ -16,7 +14,6 @@ import (
 	"github.com/portainer/portainer/api/internal/snapshot"
 
 	"github.com/docker/docker/client"
-	"github.com/segmentio/encoding/json"
 )
 
 const volumeObjectIdentifier = "ResourceID"
@@ -124,58 +121,12 @@ func selectorVolumeLabels(responseObject map[string]any) map[string]any {
 	return utils.GetJSONObject(responseObject, "Labels")
 }
 
-func CheckVolumeBodyRestrictions(request *http.Request) error {
-	defer request.Body.Close()
-
-	body, err := io.ReadAll(request.Body)
-	if err != nil {
-		return err
-	}
-
-	var volumeCreateBody struct {
-		DriverOpts map[string]string `json:"DriverOpts"`
-	}
-
-	if err := json.Unmarshal(body, &volumeCreateBody); err != nil {
-		return err
-	}
-
-	if volumeCreateBody.DriverOpts["type"] == "bind" {
-		return ErrBindMountsForbidden
-	}
-
-	request.Body = io.NopCloser(bytes.NewBuffer(body))
-
-	return nil
-}
-
 func (transport *Transport) decorateVolumeResourceCreationOperation(request *http.Request, resourceType portainer.ResourceControlType) (*http.Response, error) {
 	tokenData, err := security.RetrieveTokenData(request)
 	if err != nil {
 		return nil, err
 	}
 
-	isAdminOrEndpointAdmin, err := transport.isAdminOrEndpointAdmin(request)
-	if err != nil {
-		return nil, err
-	}
-
-	if !isAdminOrEndpointAdmin {
-		securitySettings, err := transport.fetchEndpointSecuritySettings()
-		if err != nil {
-			return nil, err
-		}
-
-		if !securitySettings.AllowBindMountsForRegularUsers {
-			if err := CheckVolumeBodyRestrictions(request); err != nil {
-				return &http.Response{
-					StatusCode: http.StatusForbidden,
-					Body:       io.NopCloser(bytes.NewBufferString("Access denied: insufficient permissions to create volume with specified configuration")),
-				}, err
-			}
-		}
-	}
-
 	volumeID := request.Header.Get("X-Portainer-VolumeName")
 
 	if volumeID != "" {

api/http/proxy/factory/docker/volumes_test.go

@@ -1,226 +0,0 @@
-package docker
-
-import (
-	"bytes"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
-	"github.com/portainer/portainer/api/datastore"
-	"github.com/portainer/portainer/api/http/security"
-
-	"github.com/docker/docker/api/types/volume"
-	"github.com/segmentio/encoding/json"
-	"github.com/stretchr/testify/require"
-)
-
-const volumeCreationAPIVersion = "1.51"
-
-type volumeCreationFixtures struct {
-	dockerSrv  *httptest.Server
-	ds         dataservices.DataStore
-	stdUser    portainer.User
-	adminUser  portainer.User
-	endpointID portainer.EndpointID
-}
-
-func newVolumeCreationFixtures(t *testing.T) *volumeCreationFixtures {
-	t.Helper()
-
-	dockerSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == http.MethodHead && r.URL.Path == "/_ping" {
-			w.Header().Add("Api-Version", volumeCreationAPIVersion)
-			_, _ = w.Write([]byte{})
-
-			return
-		}
-
-		if r.Method == http.MethodPost {
-			data, err := json.Marshal(map[string]string{"Name": "test-volume"})
-			if err != nil {
-				http.Error(w, err.Error(), http.StatusInternalServerError)
-
-				return
-			}
-
-			w.Header().Set("Content-Type", "application/json")
-			w.WriteHeader(http.StatusCreated)
-			_, _ = w.Write(data)
-
-			return
-		}
-
-		http.NotFound(w, r)
-	}))
-	t.Cleanup(dockerSrv.Close)
-
-	_, store := datastore.MustNewTestStore(t, true, false)
-
-	f := &volumeCreationFixtures{
-		dockerSrv:  dockerSrv,
-		ds:         store,
-		stdUser:    portainer.User{ID: 1, Username: "std", Role: portainer.StandardUserRole},
-		adminUser:  portainer.User{ID: 2, Username: "admin", Role: portainer.AdministratorRole},
-		endpointID: portainer.EndpointID(1),
-	}
-
-	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		err := tx.User().Create(&f.stdUser)
-		require.NoError(t, err)
-
-		err = tx.User().Create(&f.adminUser)
-		require.NoError(t, err)
-
-		err = tx.Endpoint().Create(&portainer.Endpoint{ID: f.endpointID, Name: "test-env"})
-		require.NoError(t, err)
-
-		return nil
-	})
-	require.NoError(t, err)
-
-	return f
-}
-
-func (f *volumeCreationFixtures) setSecuritySettings(t *testing.T, settings portainer.EndpointSecuritySettings) {
-	t.Helper()
-
-	err := f.ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		return tx.Endpoint().UpdateEndpoint(f.endpointID, &portainer.Endpoint{
-			ID:               f.endpointID,
-			Name:             "test-env",
-			SecuritySettings: settings,
-		})
-	})
-	require.NoError(t, err)
-}
-
-func (f *volumeCreationFixtures) newTransport() *Transport {
-	return &Transport{
-		endpoint:      &portainer.Endpoint{ID: f.endpointID},
-		dataStore:     f.ds,
-		HTTPTransport: &http.Transport{},
-	}
-}
-
-func (f *volumeCreationFixtures) newRequest(t *testing.T, body volume.CreateOptions, user portainer.User) *http.Request {
-	t.Helper()
-
-	data, err := json.Marshal(body)
-	require.NoError(t, err)
-
-	req, err := http.NewRequestWithContext(
-		t.Context(),
-		http.MethodPost,
-		f.dockerSrv.URL+"/v"+volumeCreationAPIVersion+"/volumes/create",
-		bytes.NewReader(data),
-	)
-	require.NoError(t, err)
-
-	return req.WithContext(security.StoreTokenData(req, &portainer.TokenData{
-		ID:       user.ID,
-		Username: user.Username,
-		Role:     user.Role,
-	}))
-}
-
-func TestDecorateVolumeResourceCreationOperation_BindDriverOptForbidden(t *testing.T) {
-	t.Parallel()
-
-	f := newVolumeCreationFixtures(t)
-	f.setSecuritySettings(t, portainer.EndpointSecuritySettings{
-		AllowBindMountsForRegularUsers: false,
-	})
-
-	body := volume.CreateOptions{
-		Name:   "evil-volume",
-		Driver: "local",
-		DriverOpts: map[string]string{
-			"type":   "bind",
-			"device": "/etc",
-			"o":      "bind",
-		},
-	}
-
-	resp, err := f.newTransport().decorateVolumeResourceCreationOperation(f.newRequest(t, body, f.stdUser), portainer.VolumeResourceControl)
-	require.ErrorIs(t, err, ErrBindMountsForbidden)
-	require.NotNil(t, resp)
-	require.Equal(t, http.StatusForbidden, resp.StatusCode)
-	err = resp.Body.Close()
-	require.NoError(t, err)
-}
-
-func TestDecorateVolumeResourceCreationOperation_BindDriverOptAllowedForAdmin(t *testing.T) {
-	t.Parallel()
-
-	f := newVolumeCreationFixtures(t)
-	f.setSecuritySettings(t, portainer.EndpointSecuritySettings{
-		AllowBindMountsForRegularUsers: false,
-	})
-
-	body := volume.CreateOptions{
-		Name:   "admin-volume",
-		Driver: "local",
-		DriverOpts: map[string]string{
-			"type":   "bind",
-			"device": "/etc",
-		},
-	}
-
-	resp, err := f.newTransport().decorateVolumeResourceCreationOperation(f.newRequest(t, body, f.adminUser), portainer.VolumeResourceControl)
-	require.NotErrorIs(t, err, ErrBindMountsForbidden)
-	require.NotNil(t, resp)
-	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
-	err = resp.Body.Close()
-	require.NoError(t, err)
-}
-
-func TestDecorateVolumeResourceCreationOperation_BindDriverOptAllowedWhenSettingPermissive(t *testing.T) {
-	t.Parallel()
-
-	f := newVolumeCreationFixtures(t)
-	f.setSecuritySettings(t, portainer.EndpointSecuritySettings{
-		AllowBindMountsForRegularUsers: true,
-	})
-
-	body := volume.CreateOptions{
-		Name:   "allowed-volume",
-		Driver: "local",
-		DriverOpts: map[string]string{
-			"type":   "bind",
-			"device": "/data",
-		},
-	}
-
-	resp, err := f.newTransport().decorateVolumeResourceCreationOperation(f.newRequest(t, body, f.stdUser), portainer.VolumeResourceControl)
-	require.NotErrorIs(t, err, ErrBindMountsForbidden)
-	require.NotNil(t, resp)
-	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
-	err = resp.Body.Close()
-	require.NoError(t, err)
-}
-
-func TestDecorateVolumeResourceCreationOperation_NonBindDriverOptNotForbidden(t *testing.T) {
-	t.Parallel()
-
-	f := newVolumeCreationFixtures(t)
-	f.setSecuritySettings(t, portainer.EndpointSecuritySettings{
-		AllowBindMountsForRegularUsers: false,
-	})
-
-	body := volume.CreateOptions{
-		Name:   "normal-volume",
-		Driver: "local",
-		DriverOpts: map[string]string{
-			"type": "tmpfs",
-		},
-	}
-
-	resp, err := f.newTransport().decorateVolumeResourceCreationOperation(f.newRequest(t, body, f.stdUser), portainer.VolumeResourceControl)
-	require.NotErrorIs(t, err, ErrBindMountsForbidden)
-	require.NotNil(t, resp)
-	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
-	err = resp.Body.Close()
-	require.NoError(t, err)
-}

api/http/proxy/factory/reverse_proxy.go

@@ -23,11 +23,6 @@ var allowedHeaders = map[string]struct{}{
 	"X-Portainer-Volumename":    {},
 	"X-Registry-Auth":           {},
 	"X-Stream-Protocol-Version": {},
-	// WebSocket headers those are required for kubectl exec/attach/port-forward operations
-	"Sec-Websocket-Key":        {},
-	"Sec-Websocket-Version":    {},
-	"Sec-Websocket-Protocol":   {},
-	"Sec-Websocket-Extensions": {},
 }
 
 // newSingleHostReverseProxyWithHostHeader is based on NewSingleHostReverseProxy

api/http/security/bouncer.go

@@ -447,14 +447,26 @@ func (bouncer *RequestBouncer) apiKeyLookup(r *http.Request) (*portainer.TokenDa
 	return tokenData, nil
 }
 
-// extractBearerToken extracts the Bearer token from the Authorization header and returns the token.
+// extractBearerToken extracts the Bearer token from the request header or query parameter and returns the token.
 func extractBearerToken(r *http.Request) (string, bool) {
+	// Token might be set via the "token" query parameter.
+	// For example, in websocket requests
+	// For these cases, hide the token from the query
+	query := r.URL.Query()
+	token := query.Get("token")
+	if token != "" {
+		query.Del("token")
+		r.URL.RawQuery = query.Encode()
+
+		return token, true
+	}
+
 	tokens, ok := r.Header[jwtTokenHeader]
 	if !ok || len(tokens) == 0 {
 		return "", false
 	}
 
-	token := tokens[0]
+	token = tokens[0]
 	token = strings.TrimPrefix(token, "Bearer ")
 
 	return token, true

api/internal/errorlist/errorlist.go

@@ -1,9 +1,6 @@
 package errorlist
 
-import (
-	"errors"
-	"strings"
-)
+import "errors"
 
 // Combine a slice of errors into a single error
 // to use this, generate errors by appending to errorList in a loop, then return combine(errorList)
@@ -12,12 +9,10 @@ func Combine(errorList []error) error {
 		return nil
 	}
 
-	var sb strings.Builder
-	sb.WriteString("Multiple errors occurred:")
+	errorMsg := "Multiple errors occurred:"
 	for _, err := range errorList {
-		sb.WriteString("\n")
-		sb.WriteString(err.Error())
+		errorMsg += "\n" + err.Error()
 	}
 
-	return errors.New(sb.String())
+	return errors.New(errorMsg)
 }

api/kubernetes/cli/exec.go

@@ -12,16 +12,6 @@ import (
 	utilexec "k8s.io/client-go/util/exec"
 )
 
-var (
-	channelProtocolList = []string{
-		"v5.channel.k8s.io",
-		"v4.channel.k8s.io",
-		"v3.channel.k8s.io",
-		"v2.channel.k8s.io",
-		"channel.k8s.io",
-	}
-)
-
 // StartExecProcess will start an exec process inside a container located inside a pod inside a specific namespace
 // using the specified command. The stdin parameter will be bound to the stdin process and the stdout process will write
 // to the stdout parameter.
@@ -55,18 +45,10 @@ func (kcl *KubeClient) StartExecProcess(token string, useAdminToken bool, namesp
 		TTY:       true,
 	}, scheme.ParameterCodec)
 
-	exec, err := remotecommand.NewWebSocketExecutorForProtocols(
-		config,
-		"GET", // WebSocket uses GET for the upgrade request
-		req.URL().String(),
-		channelProtocolList...,
-	)
+	exec, err := remotecommand.NewSPDYExecutor(config, "POST", req.URL())
 	if err != nil {
-		exec, err = remotecommand.NewSPDYExecutor(config, "POST", req.URL())
-		if err != nil {
-			errChan <- err
-			return
-		}
+		errChan <- err
+		return
 	}
 
 	err = exec.StreamWithContext(context.TODO(), remotecommand.StreamOptions{

api/kubernetes/cli/resource_test.go

@@ -74,6 +74,7 @@ func Test_GenerateYAML(t *testing.T) {
 				name: portainer-ctx
 			current-context: portainer-ctx
 			kind: Config
+			preferences: {}
 			users:
 			- name: test-user
 				user:

api/kubernetes/validation/validation.go

@@ -6,7 +6,6 @@ package validation
 import (
 	"fmt"
 	"regexp"
-	"strings"
 )
 
 const dns1123LabelFmt string = "[a-z0-9]([-a-z0-9]*[a-z0-9])?"
@@ -34,22 +33,16 @@ func MaxLenError(length int) string {
 
 // RegexError returns a string explanation of a regex validation failure.
 func RegexError(fmt string, examples ...string) string {
+	s := "must match the regex " + fmt
 	if len(examples) == 0 {
-		return "must match the regex " + fmt
+		return s
 	}
-
-	var sb strings.Builder
-	sb.WriteString("must match the regex ")
-	sb.WriteString(fmt)
-	sb.WriteString(" (e.g. ")
+	s += " (e.g. "
 	for i := range examples {
 		if i > 0 {
-			sb.WriteString(" or ")
+			s += " or "
 		}
-		sb.WriteString("'")
-		sb.WriteString(examples[i])
-		sb.WriteString("'")
+		s += "'" + examples[i] + "'"
 	}
-	sb.WriteString(")")
-	return sb.String()
+	return s + ")"
 }

api/portainer.go

@@ -1782,7 +1782,7 @@ type (
 
 const (
 	// APIVersion is the version number of the Portainer API
-	APIVersion = "2.33.8"
+	APIVersion = "2.33.2"
 	// Support annotation for the API version ("STS" for Short-Term Support or "LTS" for Long-Term Support)
 	APIVersionSupport = "LTS"
 	// Edition is what this edition of Portainer is called

api/stacks/deployments/deployer_remote.go

@@ -55,11 +55,12 @@ func (d *stackDeployer) DeployRemoteComposeStack(
 	d.lock.Lock()
 	defer d.lock.Unlock()
 
-	options := portainer.ComposeOptions{Registries: registries}
+	d.swarmStackManager.Login(registries, endpoint)
+	defer d.swarmStackManager.Logout(endpoint)
 
 	// --force-recreate doesn't pull updated images
 	if forcePullImage {
-		if err := d.composeStackManager.Pull(context.TODO(), stack, endpoint, options); err != nil {
+		if err := d.composeStackManager.Pull(context.TODO(), stack, endpoint, portainer.ComposeOptions{}); err != nil {
 			return err
 		}
 	}

app/assets/css/rdash.css

@@ -117,7 +117,9 @@ div.input-mask {
 .widget .widget-body .error {
   color: #ff0000;
 }
-
+.widget .widget-body button {
+  margin-left: 5px;
+}
 .widget .widget-body div.alert {
   margin-bottom: 10px;
 }

app/docker/filters/utils.ts

@@ -1,4 +1,4 @@
-import { NodeStatus, TaskState } from 'docker-types/generated/1.44';
+import { NodeStatus, TaskState } from 'docker-types/generated/1.41';
 import _ from 'lodash';
 
 export function trimVersionTag(fullName: string) {

app/docker/models/config.ts

@@ -1,4 +1,4 @@
-import { Config } from 'docker-types/generated/1.44';
+import { Config } from 'docker-types/generated/1.41';
 
 import { IResource } from '@/react/docker/components/datatable/createOwnershipColumn';
 import { PortainerResponse } from '@/react/docker/types';

app/docker/models/image.ts

@@ -1,4 +1,4 @@
-import { ImageSummary } from 'docker-types/generated/1.44';
+import { ImageSummary } from 'docker-types/generated/1.41';
 
 import { PortainerResponse } from '@/react/docker/types';
 

app/docker/models/imageDetails.ts

@@ -1,4 +1,4 @@
-import { ImageInspect } from 'docker-types/generated/1.44';
+import { ImageInspect } from 'docker-types/generated/1.41';
 
 type ImageInspectConfig = NonNullable<ImageInspect['Config']>;
 

app/docker/models/network.ts

@@ -1,4 +1,4 @@
-import { IPAM, Network, NetworkContainer } from 'docker-types/generated/1.44';
+import { IPAM, Network, NetworkContainer } from 'docker-types/generated/1.41';
 
 import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
 import { IResource } from '@/react/docker/components/datatable/createOwnershipColumn';

app/docker/models/node.ts

@@ -8,7 +8,7 @@ import {
   ObjectVersion,
   Platform,
   ResourceObject,
-} from 'docker-types/generated/1.44';
+} from 'docker-types/generated/1.41';
 
 export class NodeViewModel {
   Model: Node;

app/docker/models/secret.ts

@@ -1,4 +1,4 @@
-import { Secret } from 'docker-types/generated/1.44';
+import { Secret } from 'docker-types/generated/1.41';
 
 import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
 import { PortainerResponse } from '@/react/docker/types';

app/docker/models/service.ts

@@ -6,7 +6,7 @@ import {
   Service,
   ServiceSpec,
   TaskSpec,
-} from 'docker-types/generated/1.44';
+} from 'docker-types/generated/1.41';
 
 import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
 import { PortainerResponse } from '@/react/docker/types';

app/docker/models/task.ts

@@ -1,4 +1,4 @@
-import { Task } from 'docker-types/generated/1.44';
+import { Task } from 'docker-types/generated/1.41';
 
 import { DeepPick } from '@/types/deepPick';
 

app/docker/models/volume.ts

@@ -1,4 +1,4 @@
-import { Volume } from 'docker-types/generated/1.44';
+import { Volume } from 'docker-types/generated/1.41';
 
 import { ResourceControlViewModel } from '@/react/portainer/access-control/models/ResourceControlViewModel';
 import { IResource } from '@/react/docker/components/datatable/createOwnershipColumn';

app/docker/views/services/edit/serviceController.js

@@ -720,7 +720,7 @@ angular.module('portainer.docker').controller('ServiceController', [
 
     $scope.onResetPorts = function (all = false) {
       $scope.$evalAsync(() => {
-        $scope.formValues.ports = portsMappingUtils.toViewModel($scope.service.Model.Spec.EndpointSpec?.Ports);
+        $scope.formValues.ports = portsMappingUtils.toViewModel($scope.service.Model.Spec.EndpointSpec.Ports);
 
         $scope.cancelChanges($scope.service, all ? undefined : ['Ports']);
       });
@@ -744,7 +744,7 @@ angular.module('portainer.docker').controller('ServiceController', [
             $scope.lastVersion = service.Version;
           }
 
-          $scope.formValues.ports = portsMappingUtils.toViewModel(service.Model.Spec.EndpointSpec?.Ports);
+          $scope.formValues.ports = portsMappingUtils.toViewModel(service.Model.Spec.EndpointSpec.Ports);
 
           transformResources(service);
           translateServiceArrays(service);

app/portainer/services/dockerMaxApiVersion.ts

@@ -4,4 +4,8 @@ export const MaxDockerAPIVersionKey = 'maxDockerAPIVersion' as const;
 export type DockerAPIVersionType = number;
 
 // this is the version we are using with the generated API types
-export const MAX_DOCKER_API_VERSION: DockerAPIVersionType = 1.44;
+export const MAX_DOCKER_API_VERSION: DockerAPIVersionType = 1.41;
+
+// https://docs.docker.com/engine/api/#api-version-matrix
+// Docker 26 = API 1.45
+export const LATEST_DOCKER_API_VERSION: DockerAPIVersionType = 1.45;

app/portainer/services/dockerMaxApiVersionInterceptor.ts

@@ -1,4 +1,4 @@
-import { SystemVersion } from 'docker-types/generated/1.44';
+import { SystemVersion } from 'docker-types/generated/1.41';
 import Axios, { InternalAxiosRequestConfig } from 'axios';
 import { setupCache, buildMemoryStorage } from 'axios-cache-interceptor';
 

app/react/components/datatables/TableHeaderRow.tsx

@@ -1,4 +1,4 @@
-import { Header, flexRender, ColumnMeta } from '@tanstack/react-table';
+import { Header, flexRender } from '@tanstack/react-table';
 
 import { filterHOC } from './Filter';
 import { TableHeaderCell } from './TableHeaderCell';
@@ -17,9 +17,9 @@ export function TableHeaderRow<D extends DefaultType = DefaultType>({
     <tr>
       {headers.map((header) => {
         const sortDirection = header.column.getIsSorted();
-        const { className, filter, width } = parseMeta(
-          header.column.columnDef.meta
-        );
+        const {
+          meta: { className, width } = { className: '', width: undefined },
+        } = header.column.columnDef;
 
         return (
           <TableHeaderCell
@@ -43,9 +43,13 @@ export function TableHeaderRow<D extends DefaultType = DefaultType>({
             renderFilter={
               header.column.getCanFilter()
                 ? () =>
-                    flexRender(filter, {
-                      column: header.column,
-                    })
+                    flexRender(
+                      header.column.columnDef.meta?.filter ||
+                        filterHOC('Filter'),
+                      {
+                        column: header.column,
+                      }
+                    )
                 : undefined
             }
           />
@@ -54,28 +58,3 @@ export function TableHeaderRow<D extends DefaultType = DefaultType>({
     </tr>
   );
 }
-
-function parseMeta<D extends DefaultType = DefaultType>(
-  meta: ColumnMeta<D, unknown> | undefined
-) {
-  if (!meta) {
-    return {
-      className: '',
-      width: undefined,
-      filter: filterHOC('Filter'),
-    };
-  }
-
-  const className =
-    'className' in meta && typeof meta.className === 'string'
-      ? meta.className
-      : undefined;
-  const width =
-    'width' in meta && typeof meta.width === 'string' ? meta.width : undefined;
-  const filter =
-    'filter' in meta && typeof meta.filter === 'function'
-      ? meta.filter
-      : filterHOC('Filter');
-
-  return { className, width, filter };
-}

app/react/components/datatables/TableRow.tsx

@@ -1,4 +1,4 @@
-import { Cell, ColumnMeta, flexRender } from '@tanstack/react-table';
+import { Cell, flexRender } from '@tanstack/react-table';
 import clsx from 'clsx';
 
 import { DefaultType } from './types';
@@ -20,18 +20,10 @@ export function TableRow<D extends DefaultType = DefaultType>({
       onClick={onClick}
     >
       {cells.map((cell) => (
-        <td key={cell.id} className={getClassName(cell.column.columnDef.meta)}>
+        <td key={cell.id} className={cell.column.columnDef.meta?.className}>
           {flexRender(cell.column.columnDef.cell, cell.getContext())}
         </td>
       ))}
     </tr>
   );
 }
-
-function getClassName<D extends DefaultType = DefaultType>(
-  meta: ColumnMeta<D, unknown> | undefined
-) {
-  return !!meta && 'className' in meta && typeof meta.className === 'string'
-    ? meta.className
-    : '';
-}

app/react/docker/components/FilesTable/types.ts

@@ -22,5 +22,5 @@ export type FilesTableMeta = TableMeta<FileData> & {
 export function isFilesTableMeta(
   meta?: TableMeta<FileData>
 ): meta is FilesTableMeta {
-  return !!meta && 'table' in meta && meta.table === 'files';
+  return !!meta && meta.table === 'files';
 }

app/react/docker/configs/queries/useConfig.ts

@@ -1,4 +1,4 @@
-import { Config } from 'docker-types/generated/1.44';
+import { Config } from 'docker-types/generated/1.41';
 
 import axios, { parseAxiosError } from '@/portainer/services/axios';
 import { EnvironmentId } from '@/react/portainer/environments/types';

app/react/docker/configs/queries/useConfigs.ts

@@ -1,4 +1,4 @@
-import { Config } from 'docker-types/generated/1.44';
+import { Config } from 'docker-types/generated/1.41';
 
 import axios, { parseAxiosError } from '@/portainer/services/axios';
 import { EnvironmentId } from '@/react/portainer/environments/types';

app/react/docker/configs/queries/useCreateConfigMutation.ts

@@ -1,4 +1,4 @@
-import { ConfigSpec } from 'docker-types/generated/1.44';
+import { ConfigSpec } from 'docker-types/generated/1.41';
 
 import axios, { parseAxiosError } from '@/portainer/services/axios';
 import { EnvironmentId } from '@/react/portainer/environments/types';

app/react/docker/containers/CreateView/BaseForm/PortsMappingField.requestModel.ts

@@ -1,4 +1,4 @@
-import { PortMap } from 'docker-types/generated/1.44';
+import { PortMap } from 'docker-types/generated/1.41';
 import _ from 'lodash';
 
 import { PortMapping, Protocol, Values } from './PortsMappingField';

app/react/docker/containers/CreateView/BaseForm/PortsMappingField.viewModel.ts

@@ -1,4 +1,4 @@
-import { PortMap } from 'docker-types/generated/1.44';
+import { PortMap } from 'docker-types/generated/1.41';
 import _ from 'lodash';
 
 import { Protocol, Values } from './PortsMappingField';

app/react/docker/containers/CreateView/CommandsTab/ConsoleSettings.tsx

@@ -1,6 +1,6 @@
 import { ReactNode } from 'react';
 import { mixed } from 'yup';
-import { ContainerConfig } from 'docker-types/generated/1.44';
+import { ContainerConfig } from 'docker-types/generated/1.41';
 
 import { AutomationTestingProps } from '@/types';
 

app/react/docker/containers/CreateView/CommandsTab/toViewModel.tsx

@@ -1,4 +1,4 @@
-import { HostConfig } from 'docker-types/generated/1.44';
+import { HostConfig } from 'docker-types/generated/1.41';
 
 import { commandArrayToString } from '@/docker/helpers/containers';
 

app/react/docker/containers/CreateView/NetworkTab/toRequest.test.ts

@@ -1,82 +0,0 @@
-import { describe, it, expect } from 'vitest';
-
-import { CreateContainerRequest } from '../types';
-
-import { toRequest } from './toRequest';
-import { Values } from './types';
-
-describe('toRequest', () => {
-  const mockOldConfig: CreateContainerRequest = {
-    Hostname: 'old-hostname',
-    Domainname: 'old-domain',
-    MacAddress: '02:42:ac:11:00:99',
-    HostConfig: {
-      NetworkMode: 'bridge',
-      Dns: ['1.1.1.1'],
-      ExtraHosts: [],
-    },
-    NetworkingConfig: {
-      EndpointsConfig: {
-        bridge: {
-          Aliases: [],
-        },
-      },
-    },
-  };
-
-  const mockValues: Values = {
-    networkMode: 'bridge',
-    hostname: 'new-hostname',
-    domain: 'new-domain',
-    macAddress: '02:42:ac:11:00:88',
-    ipv4Address: '172.17.0.5',
-    ipv6Address: 'fe80::42:acff:fe11:5',
-    primaryDns: '8.8.8.8',
-    secondaryDns: '8.8.4.4',
-    hostsFileEntries: ['host1:127.0.0.1'],
-    container: '',
-  };
-
-  it('should use MAC address from values, not from oldConfig', () => {
-    const oldMacAddress = '02:42:ac:11:00:99';
-    const macAddress = '02:42:ac:11:00:88';
-    const result = toRequest(
-      { ...mockOldConfig, MacAddress: oldMacAddress },
-      { ...mockValues, macAddress },
-      'container-123'
-    );
-
-    expect(result.MacAddress).toBe(macAddress);
-    expect(result.MacAddress).not.toBe(oldMacAddress);
-  });
-
-  it('should allow empty MAC address when duplicating containers', () => {
-    const valuesWithEmptyMac: Values = {
-      ...mockValues,
-      macAddress: '', // Empty MAC from toViewModel
-    };
-
-    const result = toRequest(
-      mockOldConfig,
-      valuesWithEmptyMac,
-      'container-123'
-    );
-
-    expect(result.MacAddress).toBe('');
-    expect(result.MacAddress).not.toBe(mockOldConfig.MacAddress);
-  });
-
-  it('should set other network properties from values', () => {
-    const result = toRequest(mockOldConfig, mockValues, 'container-123');
-
-    expect(result.Hostname).toBe('new-hostname');
-    expect(result.Domainname).toBe('new-domain');
-    expect(result.HostConfig.NetworkMode).toBe('bridge');
-    expect(result.HostConfig.Dns).toEqual(['8.8.8.8', '8.8.4.4']);
-    expect(result.HostConfig.ExtraHosts).toEqual(['host1:127.0.0.1']);
-    expect(result.NetworkingConfig.EndpointsConfig?.bridge.IPAMConfig).toEqual({
-      IPv4Address: '172.17.0.5',
-      IPv6Address: 'fe80::42:acff:fe11:5',
-    });
-  });
-});

app/react/docker/containers/CreateView/NetworkTab/toViewModel.test.ts

@@ -5,11 +5,7 @@ import { DockerNetwork } from '@/react/docker/networks/types';
 import { ContainerListViewModel } from '../../types';
 import { ContainerDetailsJSON } from '../../queries/useContainer';
 
-import {
-  getDefaultViewModel,
-  getNetworkMode,
-  toViewModel,
-} from './toViewModel';
+import { getDefaultViewModel, getNetworkMode } from './toViewModel';
 
 describe('getDefaultViewModel', () => {
   it('should return the correct default view model for Windows', () => {
@@ -149,86 +145,3 @@ describe('getNetworkMode', () => {
     expect(getNetworkMode(config, mockNetworks)).toEqual(['bridge']);
   });
 });
-
-describe('toViewModel', () => {
-  const mockNetworks: Array<DockerNetwork> = [
-    {
-      Name: 'bridge',
-      Id: 'bridge-id',
-      Driver: 'bridge',
-      Scope: 'local',
-      Attachable: false,
-      Internal: false,
-      IPAM: { Config: [], Driver: '', Options: {} },
-      Options: {},
-      Containers: {},
-    },
-  ];
-
-  it('should copy network settings while clearing mac address', () => {
-    const config: ContainerDetailsJSON = {
-      Config: {
-        Hostname: 'test-host',
-        Domainname: 'test-domain',
-      },
-      HostConfig: {
-        NetworkMode: 'bridge',
-        Dns: ['8.8.8.8', '8.8.4.4'],
-        ExtraHosts: ['host1:127.0.0.1'],
-      },
-      NetworkSettings: {
-        Networks: {
-          bridge: {
-            MacAddress: '02:42:ac:11:00:02',
-            IPAMConfig: {
-              IPv4Address: '172.17.0.2',
-              IPv6Address: 'fe80::42:acff:fe11:2',
-            },
-          },
-        },
-      },
-    };
-
-    const result = toViewModel(config, mockNetworks);
-
-    expect(result.macAddress).toBe('');
-    expect(result.hostname).toBe('test-host');
-    expect(result.domain).toBe('test-domain');
-    expect(result.ipv4Address).toBe('172.17.0.2');
-    expect(result.ipv6Address).toBe('fe80::42:acff:fe11:2');
-  });
-
-  it('should return empty MAC address for new containers', () => {
-    const config: ContainerDetailsJSON = {
-      Config: {},
-      HostConfig: { NetworkMode: 'bridge' },
-    };
-
-    const result = toViewModel(config, mockNetworks);
-
-    expect(result.macAddress).toBe('');
-  });
-
-  it('should not duplicate MAC address when duplicating containers', () => {
-    const config: ContainerDetailsJSON = {
-      Config: {
-        Hostname: 'original-container',
-      },
-      HostConfig: {
-        NetworkMode: 'bridge',
-      },
-      NetworkSettings: {
-        Networks: {
-          bridge: {
-            MacAddress: '02:42:ac:11:00:99',
-          },
-        },
-      },
-    };
-
-    const result = toViewModel(config, mockNetworks);
-
-    expect(result.macAddress).toBe('');
-    expect(result.hostname).toBe('original-container');
-  });
-});

app/react/docker/containers/CreateView/NetworkTab/toViewModel.ts

@@ -53,11 +53,13 @@ export function toViewModel(
     ipv6Address = networkSettings.IPAMConfig.IPv6Address || '';
   }
 
+  const macAddress = networkSettings?.MacAddress || '';
+
   return {
     networkMode,
     hostname: config.Config?.Hostname || '',
     domain: config.Config?.Domainname || '',
-    macAddress: '', // mac address is cleared between edit/duplicate
+    macAddress,
     ipv4Address,
     ipv6Address,
     primaryDns,

app/react/docker/containers/CreateView/ResourcesTab/DevicesField.tsx

@@ -1,6 +1,6 @@
 import { FormikErrors } from 'formik';
 import { array, object, SchemaOf, string } from 'yup';
-import { DeviceMapping } from 'docker-types/generated/1.44';
+import { DeviceMapping } from 'docker-types/generated/1.41';
 
 import { FormError } from '@@/form-components/FormError';
 import { InputList, ItemProps } from '@@/form-components/InputList';

app/react/docker/containers/CreateView/ResourcesTab/GpuFieldset/toRequest.ts

@@ -1,4 +1,4 @@
-import { DeviceRequest } from 'docker-types/generated/1.44';
+import { DeviceRequest } from 'docker-types/generated/1.41';
 
 import { Values } from './types';
 

app/react/docker/containers/CreateView/ResourcesTab/GpuFieldset/toViewModel.ts

@@ -1,4 +1,4 @@
-import { DeviceRequest } from 'docker-types/generated/1.44';
+import { DeviceRequest } from 'docker-types/generated/1.41';
 
 import { Values } from './types';
 

app/react/docker/containers/CreateView/types.ts

@@ -2,7 +2,7 @@ import {
   ContainerConfig,
   HostConfig,
   NetworkingConfig,
-} from 'docker-types/generated/1.44';
+} from 'docker-types/generated/1.41';
 
 export interface CreateContainerRequest extends ContainerConfig {
   HostConfig: HostConfig;

app/react/docker/containers/ItemView/ContainerNetworksDatatable/ContainerNetworksDatatable.tsx

@@ -1,6 +1,6 @@
 import { useMemo } from 'react';
 import { Network } from 'lucide-react';
-import { EndpointSettings, NetworkSettings } from 'docker-types/generated/1.44';
+import { EndpointSettings, NetworkSettings } from 'docker-types/generated/1.41';
 
 import { createPersistedStore } from '@@/datatables/types';
 import { useTableState } from '@@/datatables/useTableState';

app/react/docker/containers/ItemView/ContainerNetworksDatatable/types.ts

@@ -1,5 +1,5 @@
 import { TableMeta } from '@tanstack/react-table';
-import { EndpointSettings } from 'docker-types/generated/1.44';
+import { EndpointSettings } from 'docker-types/generated/1.41';
 
 export type TableNetwork = EndpointSettings & { id: string; name: string };
 
@@ -11,5 +11,5 @@ export type ContainerNetworkTableMeta = TableMeta<TableNetwork> & {
 export function isContainerNetworkTableMeta(
   meta?: TableMeta<TableNetwork>
 ): meta is ContainerNetworkTableMeta {
-  return !!meta && 'table' in meta && meta.table === 'container-networks';
+  return !!meta && meta.table === 'container-networks';
 }

app/react/docker/containers/queries/useContainer.ts

@@ -6,7 +6,7 @@ import {
   HostConfig,
   MountPoint,
   NetworkSettings,
-} from 'docker-types/generated/1.44';
+} from 'docker-types/generated/1.41';
 
 import { PortainerResponse } from '@/react/docker/types';
 import axios, { parseAxiosError } from '@/portainer/services/axios';

app/react/docker/containers/queries/useUpdateContainer.ts

@@ -1,4 +1,4 @@
-import { Resources, RestartPolicy } from 'docker-types/generated/1.44';
+import { Resources, RestartPolicy } from 'docker-types/generated/1.41';
 
 import axios, { parseAxiosError } from '@/portainer/services/axios';
 import { EnvironmentId } from '@/react/portainer/environments/types';

app/react/docker/containers/types/response.ts

@@ -1,4 +1,4 @@
-import { ContainerSummary } from 'docker-types/generated/1.44';
+import { ContainerSummary } from 'docker-types/generated/1.41';
 
 import { PortainerResponse } from '@/react/docker/types';
 import { WithRequiredProperties } from '@/types';

app/react/docker/containers/utils.test.ts

@@ -1,174 +0,0 @@
-import { describe, it, expect } from 'vitest';
-
-import { toListViewModel } from './utils';
-import { DockerContainerResponse } from './types/response';
-
-describe('toListViewModel', () => {
-  function createMockResponse(
-    overrides: Partial<DockerContainerResponse> = {}
-  ): DockerContainerResponse {
-    return {
-      Id: 'container123',
-      Names: ['/test-container'],
-      Image: 'nginx:latest',
-      ImageID: 'sha256:abc123',
-      Command: 'nginx -g daemon off;',
-      Created: 1234567890,
-      State: 'running',
-      Status: 'Up 2 hours',
-      Ports: [],
-      Labels: {},
-      SizeRw: 0,
-      SizeRootFs: 0,
-      HostConfig: { NetworkMode: 'bridge' },
-      NetworkSettings: { Networks: {} },
-      Mounts: [],
-      ...overrides,
-    };
-  }
-
-  describe('Names field handling', () => {
-    it('should remove leading slash from container names', () => {
-      const response = createMockResponse({
-        Names: ['/container1', '/container2'],
-      });
-
-      const result = toListViewModel(response);
-
-      expect(result.Names).toEqual(['container1', 'container2']);
-    });
-
-    it('should keep names without leading slash unchanged', () => {
-      const response = createMockResponse({
-        Names: ['container1', 'container2'],
-      });
-
-      const result = toListViewModel(response);
-
-      expect(result.Names).toEqual(['container1', 'container2']);
-    });
-
-    it('should handle mixed names with and without leading slashes', () => {
-      const response = createMockResponse({
-        Names: ['/container1', 'container2', '/container3'],
-      });
-
-      const result = toListViewModel(response);
-
-      expect(result.Names).toEqual(['container1', 'container2', 'container3']);
-    });
-
-    it('should handle empty string names', () => {
-      const response = createMockResponse({
-        Names: [''],
-      });
-
-      const result = toListViewModel(response);
-
-      expect(result.Names).toEqual(['']);
-    });
-
-    it('should handle names that are only a slash', () => {
-      const response = createMockResponse({
-        Names: ['/'],
-      });
-
-      const result = toListViewModel(response);
-
-      expect(result.Names).toEqual(['']);
-    });
-
-    it('should return default empty name when Names is undefined', () => {
-      const response = createMockResponse({
-        Names: undefined,
-      });
-
-      const result = toListViewModel(response);
-
-      expect(result.Names).toEqual(['<empty_name>']);
-    });
-
-    it('should return default empty name when Names is empty array', () => {
-      const response = createMockResponse({
-        Names: [],
-      });
-
-      const result = toListViewModel(response);
-
-      expect(result.Names).toEqual(['<empty_name>']);
-    });
-
-    it('should handle names with multiple leading slashes', () => {
-      const response = createMockResponse({
-        Names: ['//container1', '///container2'],
-      });
-
-      const result = toListViewModel(response);
-
-      // Note: The function only removes the first character if it's a slash
-      expect(result.Names).toEqual(['/container1', '//container2']);
-    });
-
-    it('should handle names with slashes in the middle', () => {
-      const response = createMockResponse({
-        Names: ['/container/name', 'another/container'],
-      });
-
-      const result = toListViewModel(response);
-
-      expect(result.Names).toEqual(['container/name', 'another/container']);
-    });
-  });
-
-  describe('Full integration tests', () => {
-    it('should transform complete response correctly', () => {
-      const response = createMockResponse({
-        Names: ['/my-container'],
-        Status: 'Up 5 minutes',
-        Labels: {
-          'com.docker.compose.project': 'my-stack',
-        },
-        NetworkSettings: {
-          Networks: {
-            bridge: {
-              IPAddress: '172.17.0.2',
-              Gateway: '172.17.0.1',
-            },
-          },
-        },
-        Ports: [
-          {
-            IP: '0.0.0.0',
-            PrivatePort: 80,
-            PublicPort: 8080,
-            Type: 'tcp',
-          },
-        ],
-        Portainer: {
-          ResourceControl: {
-            Id: 1,
-            ResourceId: 'container123',
-            Type: 1,
-            AdministratorsOnly: false,
-            Public: false,
-            System: false,
-            TeamAccesses: [],
-            UserAccesses: [],
-          },
-          Agent: {
-            NodeName: 'node1',
-          },
-        },
-      });
-
-      const result = toListViewModel(response);
-
-      expect(result.Names).toEqual(['my-container']);
-      expect(result.IP).toBe('172.17.0.2');
-      expect(result.StackName).toBe('my-stack');
-      expect(result.NodeName).toBe('node1');
-      expect(result.Ports).toHaveLength(1);
-      expect(result.StatusText).toBe('Up 5 minutes');
-    });
-  });
-});

app/react/docker/containers/utils.ts

@@ -43,15 +43,11 @@ export function toListViewModel(
     )
   );
 
-  let names = response.Names?.map((n) => {
+  const names = response.Names?.map((n) => {
     const nameWithoutSlash = n[0] === '/' ? n.slice(1) : n;
     return nameWithoutSlash;
   });
 
-  if (!names || names.length === 0) {
-    names = ['<empty_name>'];
-  }
-
   return {
     ...response,
     ResourceControl: resourceControl,

app/react/docker/events/EventsDatatables.tsx

@@ -1,6 +1,6 @@
 import { createColumnHelper } from '@tanstack/react-table';
 import { Clock } from 'lucide-react';
-import { EventMessage } from 'docker-types/generated/1.44';
+import { EventMessage } from 'docker-types/generated/1.41';
 
 import { isoDateFromTimestamp } from '@/portainer/filters/filters';