Bump version to 2.38.0 (#1727 )

2026-01-29 09:28:41 +13:00
2015 changed files with 28863 additions and 73930 deletions
@@ -0,0 +1,3 @@
+node_modules/
+dist/
+test/
@@ -0,0 +1,157 @@
+env:
+  browser: true
+  jquery: true
+  node: true
+  es6: true
+
+globals:
+  angular: true
+
+extends:
+  - 'eslint:recommended'
+  - 'plugin:storybook/recommended'
+  - 'plugin:import/typescript'
+  - prettier
+
+plugins:
+  - import
+
+parserOptions:
+  ecmaVersion: latest
+  sourceType: module
+  project: './tsconfig.json'
+  ecmaFeatures:
+    modules: true
+
+rules:
+  no-console: error
+  no-alert: error
+  no-control-regex: 'off'
+  no-empty: warn
+  no-empty-function: warn
+  no-useless-escape: 'off'
+  import/named: error
+  import/order:
+    [
+      'error',
+      {
+        pathGroups:
+          [
+            { pattern: '@@/**', group: 'internal', position: 'after' },
+            { pattern: '@/**', group: 'internal' },
+            { pattern: '{Kubernetes,Portainer,Agent,Azure,Docker}/**', group: 'internal' },
+          ],
+        groups: ['builtin', 'external', 'internal', 'parent', 'sibling', 'index'],
+        pathGroupsExcludedImportTypes: ['internal'],
+      },
+    ]
+  no-restricted-imports:
+    - error
+    - patterns:
+        - group:
+            - '@/react/test-utils/*'
+          message: 'These utils are just for test files'
+
+settings:
+  'import/resolver':
+    alias:
+      map:
+        - ['@@', './app/react/components']
+        - ['@', './app']
+      extensions: ['.js', '.ts', '.tsx']
+    typescript: true
+    node: true
+
+overrides:
+  - files:
+      - app/**/*.ts{,x}
+    parserOptions:
+      project: './tsconfig.json'
+    parser: '@typescript-eslint/parser'
+    plugins:
+      - '@typescript-eslint'
+      - 'regex'
+    extends:
+      - airbnb
+      - airbnb-typescript
+      - 'plugin:eslint-comments/recommended'
+      - 'plugin:react-hooks/recommended'
+      - 'plugin:react/jsx-runtime'
+      - 'plugin:@typescript-eslint/recommended'
+      - 'plugin:@typescript-eslint/eslint-recommended'
+      - 'plugin:promise/recommended'
+      - 'plugin:storybook/recommended'
+      - prettier # should be last
+    settings:
+      react:
+        version: 'detect'
+
+    rules:
+      no-console: error
+      import/order:
+        [
+          'error',
+          {
+            pathGroups: [{ pattern: '@@/**', group: 'internal', position: 'after' }, { pattern: '@/**', group: 'internal' }],
+            groups: ['builtin', 'external', 'internal', 'parent', 'sibling', 'index'],
+            'newlines-between': 'always',
+          },
+        ]
+      no-plusplus: off
+      func-style: [error, 'declaration']
+      import/prefer-default-export: off
+      no-use-before-define: 'off'
+      '@typescript-eslint/no-use-before-define': ['error', { functions: false, 'allowNamedExports': true }]
+      no-shadow: 'off'
+      '@typescript-eslint/no-shadow': off
+      jsx-a11y/no-autofocus: warn
+      react/forbid-prop-types: off
+      react/require-default-props: off
+      react/no-array-index-key: off
+      no-underscore-dangle: off
+      react/jsx-filename-extension: [0]
+      import/no-extraneous-dependencies: ['error', { devDependencies: true }]
+      '@typescript-eslint/explicit-module-boundary-types': off
+      '@typescript-eslint/no-unused-vars': 'error'
+      '@typescript-eslint/no-explicit-any': 'error'
+      'jsx-a11y/label-has-associated-control':
+        - error
+        - assert: either
+          controlComponents:
+            - Input
+            - Checkbox
+      'jsx-a11y/control-has-associated-label': off
+      'react/function-component-definition': ['error', { 'namedComponents': 'function-declaration' }]
+      'react/jsx-no-bind': off
+      'no-await-in-loop': 'off'
+      'react/jsx-no-useless-fragment': ['error', { allowExpressions: true }]
+      'regex/invalid': ['error', [{ 'regex': '<Icon icon="(.*)"', 'message': 'Please directly import the `lucide-react` icon instead of using the string' }]]
+      '@typescript-eslint/no-restricted-imports':
+        - error
+        - patterns:
+            - group:
+                - '@/react/test-utils/*'
+              message: 'These utils are just for test files'
+    overrides: # allow props spreading for hoc files
+      - files:
+          - app/**/with*.ts{,x}
+        rules:
+          'react/jsx-props-no-spreading': off
+  - files:
+      - app/**/*.test.*
+    extends:
+      - 'plugin:vitest/recommended'
+    env:
+      'vitest/env': true
+    rules:
+      'react/jsx-no-constructed-context-values': off
+      '@typescript-eslint/no-restricted-imports': off
+      no-restricted-imports: off
+      'react/jsx-props-no-spreading': off
+  - files:
+      - app/**/*.stories.*
+    rules:
+      'no-alert': off
+      '@typescript-eslint/no-restricted-imports': off
+      no-restricted-imports: off
+      'react/jsx-props-no-spreading': off
@@ -94,20 +94,10 @@ body:
      description: We only provide support for current versions of Portainer as per the lifecycle policy linked above. If you are on an older version of Portainer we recommend [updating first](https://docs.portainer.io/start/upgrade) in case your bug has already been fixed.
      multiple: false
      options:
-        - '2.41.1'
-        - '2.41.0'
-        - '2.40.0'
-        - '2.39.2'
-        - '2.39.1'
-        - '2.39.0'
-        - '2.38.1'
-        - '2.38.0'
        - '2.37.0'
        - '2.36.0'
        - '2.35.0'
        - '2.34.0'
-        - '2.33.8'
-        - '2.33.7'
        - '2.33.6'
        - '2.33.5'
        - '2.33.4'
@@ -115,7 +105,42 @@ body:
        - '2.33.2'
        - '2.33.1'
        - '2.33.0'
-
+        - '2.32.0'
+        - '2.31.3'
+        - '2.31.2'
+        - '2.31.1'
+        - '2.31.0'
+        - '2.30.1'
+        - '2.30.0'
+        - '2.29.2'
+        - '2.29.1'
+        - '2.29.0'
+        - '2.28.1'
+        - '2.28.0'
+        - '2.27.9'
+        - '2.27.8'
+        - '2.27.7'
+        - '2.27.6'
+        - '2.27.5'
+        - '2.27.4'
+        - '2.27.3'
+        - '2.27.2'
+        - '2.27.1'
+        - '2.27.0'
+        - '2.26.1'
+        - '2.26.0'
+        - '2.25.1'
+        - '2.25.0'
+        - '2.24.1'
+        - '2.24.0'
+        - '2.23.0'
+        - '2.22.0'
+        - '2.21.5'
+        - '2.21.4'
+        - '2.21.3'
+        - '2.21.2'
+        - '2.21.1'
+        - '2.21.0'
    validations:
      required: true

@@ -6,8 +6,11 @@ linters:
  settings:
    forbidigo:
      forbid:
-        - pattern: ^dataservices.DataStore.(EdgeGroup|EdgeJob|EdgeStack|EndpointRelation|Endpoint|GitCredential|Registry|ResourceControl|Role|Settings|Snapshot|SSLSettings|Stack|Tag|User)$
+        - pattern: ^dataservices.DataStore.(EdgeGroup|EdgeJob|EdgeStack|EndpointRelation|Endpoint|GitCredential|Registry|ResourceControl|Role|Settings|Snapshot|Stack|Tag|User)$
          msg: Use a transaction instead
-        - pattern: ^(filepath|path)\.Join$
-          msg: Use filesystem.JoinPaths() from github.com/portainer/portainer/api/filesystem to prevent path traversal attacks
      analyze-types: true
+  exclusions:
+    rules:
+      - path: _test\.go
+        linters:
+          - forbidigo
@@ -54,28 +54,8 @@ linters:
              desc: github.com/ProtonMail/go-crypto/openpgp is not allowed because of FIPS mode
            - pkg: github.com/cosi-project/runtime
              desc: github.com/cosi-project/runtime is not allowed because of FIPS mode
-            - pkg: gopkg.in/yaml.v2
-              desc: use go.yaml.in/yaml/v3 instead
            - pkg: gopkg.in/yaml.v3
              desc: use go.yaml.in/yaml/v3 instead
-            - pkg: github.com/golang-jwt/jwt/v4
-              desc: use github.com/golang-jwt/jwt/v5 instead
-            - pkg: github.com/mitchellh/mapstructure
-              desc: use github.com/go-viper/mapstructure/v2 instead
-            - pkg: gopkg.in/alecthomas/kingpin.v2
-              desc: use github.com/alecthomas/kingpin/v2 instead
-            - pkg: github.com/jcmturner/gokrb5$
-              desc: use github.com/jcmturner/gokrb5/v8 instead
-            - pkg: github.com/gofrs/uuid
-              desc: use github.com/google/uuid
-            - pkg: github.com/Masterminds/semver$
-              desc: use github.com/Masterminds/semver/v3
-            - pkg: github.com/blang/semver
-              desc: use github.com/Masterminds/semver/v3
-            - pkg: github.com/coreos/go-semver
-              desc: use github.com/Masterminds/semver/v3
-            - pkg: github.com/hashicorp/go-version
-              desc: use github.com/Masterminds/semver/v3
    forbidigo:
      forbid:
        - pattern: ^tls\.Config$
@@ -1,3 +1,2 @@
 dist
-api/datastore/test_data
-coverage
+api/datastore/test_data
@@ -5,18 +5,21 @@
  "trailingComma": "es5",
  "overrides": [
    {
-      "files": ["*.html"],
+      "files": [
+        "*.html"
+      ],
      "options": {
        "parser": "angular"
      }
    },
    {
-      "files": ["*.{j,t}sx", "*.ts"],
+      "files": [
+        "*.{j,t}sx",
+        "*.ts"
+      ],
      "options": {
        "printWidth": 80
      }
    }
-  ],
-  "plugins": ["prettier-plugin-tailwindcss"],
-  "tailwindFunctions": ["clsx"]
-}
+  ]
+}
@@ -1,56 +1,30 @@
-// This file has been automatically migrated to valid ESM format by Storybook.
-import { fileURLToPath } from 'node:url';
-import { createRequire } from 'node:module';
-import path, { dirname } from 'path';
-
 import { StorybookConfig } from '@storybook/react-webpack5';

+import TsconfigPathsPlugin from 'tsconfig-paths-webpack-plugin';
 import { Configuration } from 'webpack';
 import postcss from 'postcss';

-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-const require = createRequire(import.meta.url);
-
 const config: StorybookConfig = {
  stories: ['../app/**/*.stories.@(ts|tsx)'],
  addons: [
    '@storybook/addon-links',
-    '@storybook/addon-webpack5-compiler-swc',
-    '@chromatic-com/storybook',
+    '@storybook/addon-essentials',
    {
-      name: '@storybook/addon-styling-webpack',
-
+      name: '@storybook/addon-styling',
      options: {
-        rules: [
-          {
-            test: /\.css$/,
-            sideEffects: true,
-            use: [
-              require.resolve('style-loader'),
-              {
-                loader: require.resolve('css-loader'),
-                options: {
-                  importLoaders: 1,
-                  modules: {
-                    localIdentName: '[path][name]__[local]',
-                    auto: true,
-                    exportLocalsConvention: 'camelCaseOnly',
-                  },
-                },
-              },
-              {
-                loader: require.resolve('postcss-loader'),
-                options: {
-                  implementation: postcss,
-                },
-              },
-            ],
+        cssLoaderOptions: {
+          importLoaders: 1,
+          modules: {
+            localIdentName: '[path][name]__[local]',
+            auto: true,
+            exportLocalsConvention: 'camelCaseOnly',
          },
-        ],
+        },
+        postCss: {
+          implementation: postcss,
+        },
      },
    },
-    '@storybook/addon-docs',
  ],
  webpackFinal: (config) => {
    const rules = config?.module?.rules || [];
@@ -93,7 +67,12 @@ const config: StorybookConfig = {
      ...config,
      resolve: {
        ...config.resolve,
-        tsconfig: path.resolve(__dirname, '..', 'tsconfig.json'),
+        plugins: [
+          ...(config.resolve?.plugins || []),
+          new TsconfigPathsPlugin({
+            extensions: config.resolve?.extensions,
+          }),
+        ],
      },
      module: {
        ...config.module,
@@ -103,13 +82,12 @@ const config: StorybookConfig = {
  },
  staticDirs: ['./public'],
  typescript: {
-    reactDocgen: 'react-docgen',
+    reactDocgen: 'react-docgen-typescript',
  },
  framework: {
    name: '@storybook/react-webpack5',
    options: {},
  },
-  docs: {},
 };

 export default config;
@@ -1,10 +1,9 @@
-import { useEffect } from 'react';
 import '../app/assets/css';
+import React from 'react';
 import { pushStateLocationPlugin, UIRouter } from '@uirouter/react';
 import { initialize as initMSW, mswLoader } from 'msw-storybook-addon';
 import { handlers } from '../app/setup-tests/server-handlers';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
-import { Preview } from '@storybook/react-webpack5';

 initMSW(
  {
@@ -22,65 +21,31 @@ initMSW(
  handlers
 );

+export const parameters = {
+  actions: { argTypesRegex: '^on[A-Z].*' },
+  controls: {
+    matchers: {
+      color: /(background|color)$/i,
+      date: /Date$/,
+    },
+  },
+  msw: {
+    handlers,
+  },
+};
+
 const testQueryClient = new QueryClient({
  defaultOptions: { queries: { retry: false } },
 });

-const preview: Preview = {
-  globalTypes: {
-    theme: {
-      description: 'Portainer color theme',
-      toolbar: {
-        title: 'Theme',
-        icon: 'paintbrush',
-        items: [
-          { value: 'light', title: 'Light', icon: 'sun' },
-          { value: 'dark', title: 'Dark', icon: 'moon' },
-          { value: 'highcontrast', title: 'High Contrast', icon: 'eye' },
-        ],
-        dynamicTitle: true,
-      },
-    },
-  },
-  initialGlobals: {
-    theme: 'light',
-  },
-  decorators: (Story, context) => {
-    const theme = context.globals.theme;
+export const decorators = [
+  (Story) => (
+    <QueryClientProvider client={testQueryClient}>
+      <UIRouter plugins={[pushStateLocationPlugin]}>
+        <Story />
+      </UIRouter>
+    </QueryClientProvider>
+  ),
+];

-    useEffect(() => {
-      if (theme === 'light') {
-        document.documentElement.removeAttribute('theme');
-      } else {
-        document.documentElement.setAttribute('theme', theme);
-      }
-    }, [theme]);
-
-    return (
-      <QueryClientProvider client={testQueryClient}>
-        <UIRouter plugins={[pushStateLocationPlugin]}>
-          <Story />
-        </UIRouter>
-      </QueryClientProvider>
-    );
-  },
-  loaders: [mswLoader],
-  parameters: {
-    options: {
-      storySort: {
-        order: ['Design System', 'Components', '*'],
-      },
-    },
-    controls: {
-      matchers: {
-        color: /(background|color)$/i,
-        date: /Date$/,
-      },
-    },
-    msw: {
-      handlers,
-    },
-  },
-};
-
-export default preview;
+export const loaders = [mswLoader];
@@ -2,26 +2,26 @@
 /* tslint:disable */

 /**
- * Mock Service Worker.
+ * Mock Service Worker (2.0.11).
 * @see https://github.com/mswjs/msw
 * - Please do NOT modify this file.
+ * - Please do NOT serve this file on production.
 */

-const PACKAGE_VERSION = '2.12.10';
-const INTEGRITY_CHECKSUM = '4db4a41e972cec1b64cc569c66952d82';
+const INTEGRITY_CHECKSUM = 'c5f7f8e188b673ea4e677df7ea3c5a39';
 const IS_MOCKED_RESPONSE = Symbol('isMockedResponse');
 const activeClientIds = new Set();

-addEventListener('install', function () {
+self.addEventListener('install', function () {
  self.skipWaiting();
 });

-addEventListener('activate', function (event) {
+self.addEventListener('activate', function (event) {
  event.waitUntil(self.clients.claim());
 });

-addEventListener('message', async function (event) {
-  const clientId = Reflect.get(event.source || {}, 'id');
+self.addEventListener('message', async function (event) {
+  const clientId = event.source.id;

  if (!clientId || !self.clients) {
    return;
@@ -48,10 +48,7 @@ addEventListener('message', async function (event) {
    case 'INTEGRITY_CHECK_REQUEST': {
      sendToClient(client, {
        type: 'INTEGRITY_CHECK_RESPONSE',
-        payload: {
-          packageVersion: PACKAGE_VERSION,
-          checksum: INTEGRITY_CHECKSUM,
-        },
+        payload: INTEGRITY_CHECKSUM,
      });
      break;
    }
@@ -61,16 +58,16 @@ addEventListener('message', async function (event) {

      sendToClient(client, {
        type: 'MOCKING_ENABLED',
-        payload: {
-          client: {
-            id: client.id,
-            frameType: client.frameType,
-          },
-        },
+        payload: true,
      });
      break;
    }

+    case 'MOCK_DEACTIVATE': {
+      activeClientIds.delete(clientId);
+      break;
+    }
+
    case 'CLIENT_CLOSED': {
      activeClientIds.delete(clientId);

@@ -88,91 +85,72 @@ addEventListener('message', async function (event) {
  }
 });

-addEventListener('fetch', function (event) {
-  const requestInterceptedAt = Date.now();
+self.addEventListener('fetch', function (event) {
+  const { request } = event;

  // Bypass navigation requests.
-  if (event.request.mode === 'navigate') {
+  if (request.mode === 'navigate') {
    return;
  }

  // Opening the DevTools triggers the "only-if-cached" request
  // that cannot be handled by the worker. Bypass such requests.
-  if (event.request.cache === 'only-if-cached' && event.request.mode !== 'same-origin') {
+  if (request.cache === 'only-if-cached' && request.mode !== 'same-origin') {
    return;
  }

  // Bypass all requests when there are no active clients.
  // Prevents the self-unregistered worked from handling requests
-  // after it's been terminated (still remains active until the next reload).
+  // after it's been deleted (still remains active until the next reload).
  if (activeClientIds.size === 0) {
    return;
  }

+  // Generate unique request ID.
  const requestId = crypto.randomUUID();
-  event.respondWith(handleRequest(event, requestId, requestInterceptedAt));
+  event.respondWith(handleRequest(event, requestId));
 });

-/**
- * @param {FetchEvent} event
- * @param {string} requestId
- * @param {number} requestInterceptedAt
- */
-async function handleRequest(event, requestId, requestInterceptedAt) {
+async function handleRequest(event, requestId) {
  const client = await resolveMainClient(event);
-  const requestCloneForEvents = event.request.clone();
-  const response = await getResponse(event, client, requestId, requestInterceptedAt);
+  const response = await getResponse(event, client, requestId);

  // Send back the response clone for the "response:*" life-cycle events.
  // Ensure MSW is active and ready to handle the message, otherwise
  // this message will pend indefinitely.
  if (client && activeClientIds.has(client.id)) {
-    const serializedRequest = await serializeRequest(requestCloneForEvents);
+    (async function () {
+      const responseClone = response.clone();

-    // Clone the response so both the client and the library could consume it.
-    const responseClone = response.clone();
-
-    sendToClient(
-      client,
-      {
-        type: 'RESPONSE',
-        payload: {
-          isMockedResponse: IS_MOCKED_RESPONSE in response,
-          request: {
-            id: requestId,
-            ...serializedRequest,
-          },
-          response: {
+      sendToClient(
+        client,
+        {
+          type: 'RESPONSE',
+          payload: {
+            requestId,
+            isMockedResponse: IS_MOCKED_RESPONSE in response,
            type: responseClone.type,
            status: responseClone.status,
            statusText: responseClone.statusText,
-            headers: Object.fromEntries(responseClone.headers.entries()),
            body: responseClone.body,
+            headers: Object.fromEntries(responseClone.headers.entries()),
          },
        },
-      },
-      responseClone.body ? [serializedRequest.body, responseClone.body] : []
-    );
+        [responseClone.body]
+      );
+    })();
  }

  return response;
 }

-/**
- * Resolve the main client for the given event.
- * Client that issues a request doesn't necessarily equal the client
- * that registered the worker. It's with the latter the worker should
- * communicate with during the response resolving phase.
- * @param {FetchEvent} event
- * @returns {Promise<Client | undefined>}
- */
+// Resolve the main client for the given event.
+// Client that issues a request doesn't necessarily equal the client
+// that registered the worker. It's with the latter the worker should
+// communicate with during the response resolving phase.
 async function resolveMainClient(event) {
  const client = await self.clients.get(event.clientId);

-  if (activeClientIds.has(event.clientId)) {
-    return client;
-  }
-
  if (client?.frameType === 'top-level') {
    return client;
  }
@@ -193,37 +171,20 @@ async function resolveMainClient(event) {
    });
 }

-/**
- * @param {FetchEvent} event
- * @param {Client | undefined} client
- * @param {string} requestId
- * @param {number} requestInterceptedAt
- * @returns {Promise<Response>}
- */
-async function getResponse(event, client, requestId, requestInterceptedAt) {
+async function getResponse(event, client, requestId) {
+  const { request } = event;
+
  // Clone the request because it might've been already used
  // (i.e. its body has been read and sent to the client).
-  const requestClone = event.request.clone();
+  const requestClone = request.clone();

  function passthrough() {
-    // Cast the request headers to a new Headers instance
-    // so the headers can be manipulated with.
-    const headers = new Headers(requestClone.headers);
+    const headers = Object.fromEntries(requestClone.headers.entries());

-    // Remove the "accept" header value that marked this request as passthrough.
-    // This prevents request alteration and also keeps it compliant with the
-    // user-defined CORS policies.
-    const acceptHeader = headers.get('accept');
-    if (acceptHeader) {
-      const values = acceptHeader.split(',').map((value) => value.trim());
-      const filteredValues = values.filter((value) => value !== 'msw/passthrough');
-
-      if (filteredValues.length > 0) {
-        headers.set('accept', filteredValues.join(', '));
-      } else {
-        headers.delete('accept');
-      }
-    }
+    // Remove internal MSW request header so the passthrough request
+    // complies with any potential CORS preflight checks on the server.
+    // Some servers forbid unknown request headers.
+    delete headers['x-msw-intention'];

    return fetch(requestClone, { headers });
  }
@@ -241,19 +202,37 @@ async function getResponse(event, client, requestId, requestInterceptedAt) {
    return passthrough();
  }

+  // Bypass requests with the explicit bypass header.
+  // Such requests can be issued by "ctx.fetch()".
+  const mswIntention = request.headers.get('x-msw-intention');
+  if (['bypass', 'passthrough'].includes(mswIntention)) {
+    return passthrough();
+  }
+
  // Notify the client that a request has been intercepted.
-  const serializedRequest = await serializeRequest(event.request);
+  const requestBuffer = await request.arrayBuffer();
  const clientMessage = await sendToClient(
    client,
    {
      type: 'REQUEST',
      payload: {
        id: requestId,
-        interceptedAt: requestInterceptedAt,
-        ...serializedRequest,
+        url: request.url,
+        mode: request.mode,
+        method: request.method,
+        headers: Object.fromEntries(request.headers.entries()),
+        cache: request.cache,
+        credentials: request.credentials,
+        destination: request.destination,
+        integrity: request.integrity,
+        redirect: request.redirect,
+        referrer: request.referrer,
+        referrerPolicy: request.referrerPolicy,
+        body: requestBuffer,
+        keepalive: request.keepalive,
      },
    },
-    [serializedRequest.body]
+    [requestBuffer]
  );

  switch (clientMessage.type) {
@@ -261,7 +240,7 @@ async function getResponse(event, client, requestId, requestInterceptedAt) {
      return respondWithMock(clientMessage.data);
    }

-    case 'PASSTHROUGH': {
+    case 'MOCK_NOT_FOUND': {
      return passthrough();
    }
  }
@@ -269,12 +248,6 @@ async function getResponse(event, client, requestId, requestInterceptedAt) {
  return passthrough();
 }

-/**
- * @param {Client} client
- * @param {any} message
- * @param {Array<Transferable>} transferrables
- * @returns {Promise<any>}
- */
 function sendToClient(client, message, transferrables = []) {
  return new Promise((resolve, reject) => {
    const channel = new MessageChannel();
@@ -287,15 +260,11 @@ function sendToClient(client, message, transferrables = []) {
      resolve(event.data);
    };

-    client.postMessage(message, [channel.port2, ...transferrables.filter(Boolean)]);
+    client.postMessage(message, [channel.port2].concat(transferrables.filter(Boolean)));
  });
 }

-/**
- * @param {Response} response
- * @returns {Response}
- */
-function respondWithMock(response) {
+async function respondWithMock(response) {
  // Setting response status code to 0 is a no-op.
  // However, when responding with a "Response.error()", the produced Response
  // instance will have status code set to 0. Since it's not possible to create
@@ -313,24 +282,3 @@ function respondWithMock(response) {

  return mockedResponse;
 }
-
-/**
- * @param {Request} request
- */
-async function serializeRequest(request) {
-  return {
-    url: request.url,
-    mode: request.mode,
-    method: request.method,
-    headers: Object.fromEntries(request.headers.entries()),
-    cache: request.cache,
-    credentials: request.credentials,
-    destination: request.destination,
-    integrity: request.integrity,
-    redirect: request.redirect,
-    referrer: request.referrer,
-    referrerPolicy: request.referrerPolicy,
-    body: await request.arrayBuffer(),
-    keepalive: request.keepalive,
-  };
-}
@@ -1,59 +0,0 @@
-# Portainer Community Edition
-
-Open-source container management platform with full Docker and Kubernetes support.
-
-## Project Structure
-
-For a detailed breakdown of frontend and backend directory layout, feature locations, and common development tasks, see [docs/guidelines/project-structure.md](../../docs/guidelines/project-structure.md).
-
-## Frontend Guidelines
-
- [docs/guidelines/frontend-conventions.md](../../docs/guidelines/frontend-conventions.md) — component structure, React Query patterns, shared components, forms, theming
- [docs/guidelines/typescript-conventions.md](../../docs/guidelines/typescript-conventions.md) — types, anti-patterns, union types, named constants
- [docs/guidelines/frontend-unit-testing.md](../../docs/guidelines/frontend-unit-testing.md) — Vitest, React Testing Library
-
-## Backend Guidelines
-
- [docs/guidelines/go-conventions.md](../../docs/guidelines/go-conventions.md) — error handling, naming, testing, code style
- [docs/guidelines/server-architecture.md](../../docs/guidelines/server-architecture.md) — Clean Architecture layers, transactions, CE/EE sharing patterns
- [docs/guidelines/logging.md](../../docs/guidelines/logging.md) — zerolog usage, log levels, message style
- [docs/guidelines/backend-code-reusability.md](../../docs/guidelines/backend-code-reusability.md) — how CE and EE share backend code
-
-## Package Manager
-
- **PNPM** 10+ (for frontend)
- **Go** 1.26.1 (for backend)
-
-## Build Commands
-
-```bash
-# Full build
-make build              # Build both client and server
-make build-client       # Build React/AngularJS frontend
-make build-server       # Build Go binary
-make build-image        # Build Docker image
-
-# Development
-make dev                # Run both in dev mode
-make dev-client         # Start webpack-dev-server (port 8999)
-make dev-server         # Run containerized Go server
-
-# Frontend
-pnpm dev            # Webpack dev server
-pnpm build          # Build frontend with webpack
-pnpm typecheck      # Run typecheck for frontend (with tsc)
-pnpm lint           # lint frontend (with eslint)
-pnpm test           # test frontend (with vitest)
-pnpm format         # format frontend (with prettier)
-
-# Testing
-make test               # All tests (backend + frontend)
-make test-server        # Backend tests only
-make lint               # Lint all code
-make format             # Format code
-```
-
-## Development Servers
-
- Frontend: http://localhost:8999
- Backend: http://localhost:9000 (HTTP) / https://localhost:9443 (HTTPS)
@@ -3,9 +3,8 @@ ENV=development
 WEBPACK_CONFIG=webpack/webpack.$(ENV).js
 TAG=local

-SWAG=go run github.com/swaggo/swag/cmd/swag@v1.16.6
-GOTESTSUM_VERSION?=v1.13.0
-GOTESTSUM=go run gotest.tools/gotestsum@$(GOTESTSUM_VERSION)
+SWAG=go run github.com/swaggo/swag/cmd/swag@v1.16.2
+GOTESTSUM=go run gotest.tools/gotestsum@latest

 # Don't change anything below this line unless you know what you're doing
 .DEFAULT_GOAL := help
@@ -36,8 +35,8 @@ build-storybook: ## Build and serve the storybook files
 .PHONY: deps server-deps client-deps tidy
 deps: server-deps client-deps ## Download all client and server build dependancies

-## This is empty because the pipeline requires it but ce has no server deps
 server-deps: init-dist ## Download dependant server binaries
+	@./build/download_binaries.sh $(PLATFORM) $(ARCH)

 client-deps: ## Install client dependencies
 	pnpm install
@@ -58,10 +57,8 @@ test: test-server test-client ## Run all tests
 test-client: ## Run client tests
 	pnpm run test $(ARGS) --coverage

-TEST_PACKAGES?=./...
-
 test-server:	## Run server tests
-	$(GOTESTSUM) --format pkgname-and-test-fails --format-hide-empty-pkg --hide-summary skipped -- -cover -covermode=atomic -coverprofile=coverage.out $(TEST_PACKAGES)
+	$(GOTESTSUM) --format pkgname-and-test-fails --format-hide-empty-pkg --hide-summary skipped -- -cover -covermode=atomic -coverprofile=coverage.out ./...

 ##@ Dev
 .PHONY: dev dev-client dev-server
@@ -108,20 +105,13 @@ dev-extension: build-server build-client ## Run the extension in development mod
 ##@ Docs
 .PHONY: docs-build docs-validate docs-clean docs-validate-clean
 docs-build: init-dist ## Build docs
-	go mod download
+	go mod download -x
 	cd api && $(SWAG) init -o "../dist/docs" -ot "yaml" -g ./http/handler/handler.go --parseDependency --parseInternal --parseDepth 2 -p pascalcase --markdownFiles ./

 docs-validate: docs-build ## Validate docs
 	pnpm swagger2openapi --warnOnly dist/docs/swagger.yaml -o dist/docs/openapi.yaml
 	pnpm swagger-cli validate dist/docs/openapi.yaml

-.PHONY: docs-serve
-docs-serve: docs-build ## Serve docs locally with Swagger UI on port 8080
-	docker run -p 8080:8080 \
-		-e SWAGGER_JSON=/foo/swagger.yaml \
-		-v $(PWD)/dist/docs:/foo \
-		swaggerapi/swagger-ui
-
 ##@ Helpers
 .PHONY: help
 help:  ## Display this help
@@ -4,13 +4,13 @@

 Portainer maintains both Short-Term Support (STS) and Long-Term Support (LTS) versions in accordance with our official [Portainer Lifecycle Policy](https://docs.portainer.io/start/lifecycle).

-| Version Type             | Support Status                              |
-| ------------------------ | ------------------------------------------- |
-| LTS (Long-Term Support)  | Supported for critical security fixes       |
+| Version Type | Support Status |
+| --- | --- |
+| LTS (Long-Term Support) | Supported for critical security fixes |
 | STS (Short-Term Support) | Supported until the next STS or LTS release |
-| Legacy / EOL             | Not supported                               |
+| Legacy / EOL | Not supported |

-For a detailed breakdown of current versions and their specific End of Life (EOL) dates,
+For a detailed breakdown of current versions and their specific End of Life (EOL) dates, 
 please refer to the [Portainer Lifecycle Policy](https://docs.portainer.io/start/lifecycle).

 ## Reporting a Vulnerability
@@ -21,19 +21,15 @@ The Portainer team takes the security of our products seriously. If you believe

 ### Disclosure Process

-1. **Report**: You can report in one of two ways:
-
-   - **GitHub**: Use the **Report a vulnerability** button on the **Security** tab of this repository.
-
-   - **Email**: Send your findings to security@portainer.io.
+1. **Report**: Email your findings to security@portainer.io.

 2. **Details**: To help us verify the issue, please include:

-   - A description of the vulnerability and its potential impact.
+    - A description of the vulnerability and its potential impact.

-   - Step-by-step instructions to reproduce the issue (e.g. proof-of-concept code, scripts, or screenshots).
+    - Step-by-step instructions to reproduce the issue (e.g. proof-of-concept code, scripts, or screenshots).

-   - The version of the software and the environment in which it was found.
+    - The version of the software and the environment in which it was found.

 3. **Acknowledge**: We will acknowledge receipt of your report and provide an initial assessment.

@@ -51,6 +47,7 @@ If you follow the responsible disclosure process, we will:

 - Give credit for the discovery (if desired) once the fix is public.

+
 We will make every effort to promptly address any security weaknesses. Security advisories and fixes will be published through GitHub Security Advisories and other channels as needed.

 Thank you for helping keep Portainer and our community secure.
@@ -1,118 +0,0 @@
-import {
-  Children,
-  useState,
-  useEffect,
-  useRef,
-  useContext,
-  createContext,
-  ReactNode,
-} from 'react';
-
-type MenuCtxType = {
-  isOpen: boolean;
-  setOpen: (v: boolean) => void;
-  menuRef: React.RefObject<HTMLDivElement>;
-  label: string;
-  setLabel: (v: string) => void;
-};
-
-const MenuCtx = createContext<MenuCtxType | null>(null);
-
-export function Menu({ children }: { children?: ReactNode }) {
-  const [isOpen, setOpen] = useState(false);
-  const [label, setLabel] = useState('');
-  const menuRef = useRef<HTMLDivElement>(null);
-
-  useEffect(() => {
-    function handleDocDown(e: MouseEvent) {
-      const target = e.target as Node | null;
-      if (
-        isOpen &&
-        menuRef.current &&
-        target &&
-        !menuRef.current.contains(target)
-      ) {
-        setOpen(false);
-      }
-    }
-
-    document.addEventListener('mousedown', handleDocDown);
-    return () => document.removeEventListener('mousedown', handleDocDown);
-  }, [isOpen]);
-
-  return (
-    <MenuCtx.Provider value={{ isOpen, setOpen, menuRef, label, setLabel }}>
-      <div ref={menuRef}>{children}</div>
-    </MenuCtx.Provider>
-  );
-}
-
-export function MenuButton({
-  children,
-  onClick: externalOnClick,
-  ...props
-}: {
-  children?: ReactNode;
-  onClick?: () => void;
-  [key: string]: unknown;
-}) {
-  const ctx = useContext(MenuCtx);
-
-  useEffect(() => {
-    const firstText = Children.toArray(children).find(
-      (c) => typeof c === 'string'
-    );
-    if (firstText) ctx?.setLabel(firstText as string);
-  });
-
-  function handleClick() {
-    externalOnClick?.();
-    ctx?.setOpen(!ctx.isOpen);
-  }
-
-  return (
-    <button type="button" onClick={handleClick} {...props}>
-      {children}
-    </button>
-  );
-}
-
-export function MenuList({
-  children,
-  className,
-}: {
-  children?: ReactNode;
-  className?: string;
-}) {
-  const ctx = useContext(MenuCtx);
-  if (!ctx?.isOpen) return null;
-  return (
-    <div role="menu" aria-label={ctx.label || undefined} className={className}>
-      {children}
-    </div>
-  );
-}
-
-export function MenuItem({
-  children,
-  onSelect,
-  className,
-}: {
-  children?: ReactNode;
-  onSelect?: () => void;
-  className?: string;
-}) {
-  const ctx = useContext(MenuCtx);
-
-  function handleClick() {
-    onSelect?.();
-    ctx?.setOpen(false);
-  }
-
-  return (
-    // eslint-disable-next-line jsx-a11y/click-events-have-key-events, jsx-a11y/interactive-supports-focus
-    <div role="menuitem" onClick={handleClick} className={className}>
-      {children}
-    </div>
-  );
-}
@@ -19,22 +19,24 @@ const RedirectReasonAdminInitTimeout string = "AdminInitTimeout"
 type Monitor struct {
 	timeout           time.Duration
 	datastore         dataservices.DataStore
+	shutdownCtx       context.Context
 	cancellationFunc  context.CancelFunc
 	mu                sync.RWMutex
 	adminInitDisabled bool
 }

 // New creates a monitor that when started will wait for the timeout duration and then shutdown the application unless it has been initialized.
-func New(timeout time.Duration, datastore dataservices.DataStore) *Monitor {
+func New(timeout time.Duration, datastore dataservices.DataStore, shutdownCtx context.Context) *Monitor {
 	return &Monitor{
 		timeout:           timeout,
 		datastore:         datastore,
+		shutdownCtx:       shutdownCtx,
 		adminInitDisabled: false,
 	}
 }

-// Start starts the monitor. The monitor will stop when ctx is cancelled, or when Stop is called.
-func (m *Monitor) Start(ctx context.Context) {
+// Starts starts the monitor. Active monitor could be stopped or shuttted down by cancelling the shutdown context.
+func (m *Monitor) Start() {
 	m.mu.Lock()
 	defer m.mu.Unlock()

@@ -42,7 +44,7 @@ func (m *Monitor) Start(ctx context.Context) {
 		return
 	}

-	cancellationCtx, cancellationFunc := context.WithCancel(ctx)
+	cancellationCtx, cancellationFunc := context.WithCancel(context.Background())
 	m.cancellationFunc = cancellationFunc

 	go func() {
@@ -67,6 +69,8 @@ func (m *Monitor) Start(ctx context.Context) {
 			}
 		case <-cancellationCtx.Done():
 			log.Debug().Msg("canceling initialization monitor")
+		case <-m.shutdownCtx.Done():
+			log.Debug().Msg("shutting down initialization monitor")
 		}
 	}()
 }
@@ -1,8 +1,8 @@
 package adminmonitor

 import (
+	"context"
 	"testing"
-	"testing/synctest"
 	"time"

 	portainer "github.com/portainer/portainer/api"
@@ -11,28 +11,21 @@ import (
 )

 func Test_stopWithoutStarting(t *testing.T) {
-	t.Parallel()
-	monitor := New(1*time.Minute, nil)
+	monitor := New(1*time.Minute, nil, nil)
 	monitor.Stop()
 }

 func Test_stopCouldBeCalledMultipleTimes(t *testing.T) {
-	t.Parallel()
-	monitor := New(1*time.Minute, nil)
+	monitor := New(1*time.Minute, nil, nil)
 	monitor.Stop()
 	monitor.Stop()
 }

 func Test_startOrStopCouldBeCalledMultipleTimesConcurrently(t *testing.T) {
-	t.Parallel()
-	synctest.Test(t, test_startOrStopCouldBeCalledMultipleTimesConcurrently)
-}
+	monitor := New(1*time.Minute, nil, context.Background())

-func test_startOrStopCouldBeCalledMultipleTimesConcurrently(t *testing.T) {
-	monitor := New(1*time.Minute, nil)
-
-	go monitor.Start(t.Context())
-	monitor.Start(t.Context())
+	go monitor.Start()
+	monitor.Start()

 	go monitor.Stop()
 	monitor.Stop()
@@ -41,9 +34,8 @@ func test_startOrStopCouldBeCalledMultipleTimesConcurrently(t *testing.T) {
 }

 func Test_canStopStartedMonitor(t *testing.T) {
-	t.Parallel()
-	monitor := New(1*time.Minute, nil)
-	monitor.Start(t.Context())
+	monitor := New(1*time.Minute, nil, context.Background())
+	monitor.Start()
 	assert.NotNil(t, monitor.cancellationFunc, "cancellation function is missing in started monitor")

 	monitor.Stop()
@@ -51,12 +43,11 @@ func Test_canStopStartedMonitor(t *testing.T) {
 }

 func Test_start_shouldDisableInstanceAfterTimeout_ifNotInitialized(t *testing.T) {
-	t.Parallel()
 	timeout := 10 * time.Millisecond

 	datastore := i.NewDatastore(i.WithUsers([]portainer.User{}))
-	monitor := New(timeout, datastore)
-	monitor.Start(t.Context())
+	monitor := New(timeout, datastore, context.Background())
+	monitor.Start()

 	<-time.After(20 * timeout)
 	assert.True(t, monitor.WasInstanceDisabled(), "monitor should have been timeout and instance is disabled")
@@ -1,119 +0,0 @@
-package agent
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"strconv"
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-
-	"github.com/stretchr/testify/require"
-)
-
-func tlsServer(t *testing.T, handler http.HandlerFunc) *httptest.Server {
-	t.Helper()
-	srv := httptest.NewTLSServer(handler)
-	t.Cleanup(srv.Close)
-
-	return srv
-}
-
-func TestGetAgentVersionAndPlatform_Success(t *testing.T) {
-	t.Parallel()
-
-	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set(portainer.PortainerAgentHeader, "2.19.0")
-		w.Header().Set(portainer.HTTPResponseAgentPlatform, "1")
-		w.WriteHeader(http.StatusNoContent)
-	})
-
-	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
-	platform, version, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
-	require.NoError(t, err)
-	require.Equal(t, portainer.AgentPlatformDocker, platform)
-	require.Equal(t, "2.19.0", version)
-}
-
-func TestGetAgentVersionAndPlatform_NonOKStatus(t *testing.T) {
-	t.Parallel()
-
-	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusUnauthorized)
-	})
-
-	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
-	_, _, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
-	require.Error(t, err)
-}
-
-func TestGetAgentVersionAndPlatform_MissingVersionHeader(t *testing.T) {
-	t.Parallel()
-
-	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set(portainer.HTTPResponseAgentPlatform, "1")
-		w.WriteHeader(http.StatusNoContent)
-	})
-
-	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
-	_, _, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
-	require.Error(t, err)
-}
-
-func TestGetAgentVersionAndPlatform_MissingPlatformHeader(t *testing.T) {
-	t.Parallel()
-
-	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set(portainer.PortainerAgentHeader, "2.19.0")
-		w.WriteHeader(http.StatusNoContent)
-	})
-
-	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
-	_, _, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
-	require.Error(t, err)
-}
-
-func TestGetAgentVersionAndPlatform_InvalidPlatformZero(t *testing.T) {
-	t.Parallel()
-
-	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set(portainer.PortainerAgentHeader, "2.19.0")
-		w.Header().Set(portainer.HTTPResponseAgentPlatform, "0")
-		w.WriteHeader(http.StatusNoContent)
-	})
-
-	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
-	_, _, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
-	require.Error(t, err)
-}
-
-func TestGetAgentVersionAndPlatform_NonNumericPlatform(t *testing.T) {
-	t.Parallel()
-
-	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set(portainer.PortainerAgentHeader, "2.19.0")
-		w.Header().Set(portainer.HTTPResponseAgentPlatform, "docker")
-		w.WriteHeader(http.StatusNoContent)
-	})
-
-	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
-	_, _, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
-	require.Error(t, err)
-}
-
-func TestGetAgentVersionAndPlatform_PingPathAppended(t *testing.T) {
-	t.Parallel()
-
-	var gotPath string
-	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
-		gotPath = r.URL.Path
-		w.Header().Set(portainer.PortainerAgentHeader, "2.19.0")
-		w.Header().Set(portainer.HTTPResponseAgentPlatform, strconv.Itoa(int(portainer.AgentPlatformKubernetes)))
-		w.WriteHeader(http.StatusNoContent)
-	})
-
-	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
-	_, _, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
-	require.NoError(t, err)
-	require.Equal(t, "/ping", gotPath)
-}
@@ -0,0 +1,64 @@
+Portainer API is an HTTP API served by Portainer. It is used by the Portainer UI and everything you can do with the UI can be done using the HTTP API.
+Examples are available at https://documentation.portainer.io/api/api-examples/
+You can find out more about Portainer at [http://portainer.io](http://portainer.io) and get some support on [Slack](http://portainer.io/slack/).
+
+# Authentication
+
+Most of the API environments(endpoints) require to be authenticated as well as some level of authorization to be used.
+Portainer API uses JSON Web Token to manage authentication and thus requires you to provide a token in the **Authorization** header of each request
+with the **Bearer** authentication mechanism.
+
+Example:
+
+```
+Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwidXNlcm5hbWUiOiJhZG1pbiIsInJvbGUiOjEsImV4cCI6MTQ5OTM3NjE1NH0.NJ6vE8FY1WG6jsRQzfMqeatJ4vh2TWAeeYfDhP71YEE
+```
+
+# Security
+
+Each API environment(endpoint) has an associated access policy, it is documented in the description of each environment(endpoint).
+
+Different access policies are available:
+
+- Public access
+- Authenticated access
+- Restricted access
+- Administrator access
+
+### Public access
+
+No authentication is required to access the environments(endpoints) with this access policy.
+
+### Authenticated access
+
+Authentication is required to access the environments(endpoints) with this access policy.
+
+### Restricted access
+
+Authentication is required to access the environments(endpoints) with this access policy.
+Extra-checks might be added to ensure access to the resource is granted. Returned data might also be filtered.
+
+### Administrator access
+
+Authentication as well as an administrator role are required to access the environments(endpoints) with this access policy.
+
+# Execute Docker requests
+
+Portainer **DO NOT** expose specific environments(endpoints) to manage your Docker resources (create a container, remove a volume, etc...).
+
+Instead, it acts as a reverse-proxy to the Docker HTTP API. This means that you can execute Docker requests **via** the Portainer HTTP API.
+
+To do so, you can use the `/endpoints/{id}/docker` Portainer API environment(endpoint) (which is not documented below due to Swagger limitations). This environment(endpoint) has a restricted access policy so you still need to be authenticated to be able to query this environment(endpoint). Any query on this environment(endpoint) will be proxied to the Docker API of the associated environment(endpoint) (requests and responses objects are the same as documented in the Docker API).
+
+# Private Registry
+
+Using private registry, you will need to pass a based64 encoded JSON string ‘{"registryId":\<registryID value\>}’ inside the Request Header. The parameter name is "X-Registry-Auth".
+\<registryID value\> - The registry ID where the repository was created.
+
+Example:
+
+```
+eyJyZWdpc3RyeUlkIjoxfQ==
+```
+
+**NOTE**: You can find more information on how to query the Docker API in the [Docker official documentation](https://docs.docker.com/engine/api/v1.30/) as well as in [this Portainer example](https://documentation.portainer.io/api/api-examples/).
@@ -1,61 +0,0 @@
-The Portainer API is an HTTP API served by Portainer. It is used by the Portainer UI, and anything you can do in the UI can also be done via the HTTP API.
-
-API examples are available in the [Portainer documentation](https://documentation.portainer.io/api/api-examples/)
-
-You can find out more about Portainer [on our website](http://portainer.io) and get some support on [Slack](http://portainer.io/slack/).
-
-# Authentication
-
-Most of the API endpoints require authentication, as well as some level of authorization.
-Portainer uses JSON Web Tokens to manage authentication. You must provide a token in the **Authorization** header of each request using the **Bearer** scheme.
-
-Example:
-
-```
-Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwidXNlcm5hbWUiOiJhZG1pbiIsInJvbGUiOjEsImV4cCI6MTQ5OTM3NjE1NH0.NJ6vE8FY1WG6jsRQzfMqeatJ4vh2TWAeeYfDhP71YEE
-```
-
-# Security
-
-Each API endpoint has an associated access policy, documented in its description.
-
-The following policies are available:
-
- Public access
- Authenticated access
- Restricted access
- Administrator access
-
-### Public access
-
-No authentication is required.
-
-### Authenticated access
-
-Authentication is required.
-
-### Restricted access
-
-Authentication is required. Additional checks may apply to verify access to the resource, and returned data may be filtered.
-
-### Administrator access
-
-Authentication and an administrator role are both required.
-
-# Execute Docker requests
-
-Portainer does not expose dedicated endpoints for managing Docker resources (create a container, remove a volume, etc).
-
-Instead, it acts as a reverse-proxy to the Docker HTTP API, allowing you to execute Docker requests via the Portainer HTTP API.
-
-To do so, use the `/endpoints/{id}/docker` endpoint. Note that this endpoint is not documented below due to Swagger limitations. It has a restricted access policy, so authentication is still required. Any request made to this endpoint is proxied to the Docker API of the associated environment - request and response objects are identical to those in the [Docker official documentation](https://docs.docker.com/engine/api).
-
-# Private Registry
-
-When using a private registry, include a Base64-encoded JSON string in the request header. The header parameter name is `X-Registry-Auth` and the value should encode the following structure: ‘{"registryId":\<registryId\>}’ where `<registryId>` is the ID of the registry where the repository was created.
- 
-Example encoded value:
-
-```
-eyJyZWdpc3RyeUlkIjoxfQ==
-```
@@ -7,7 +7,6 @@ import (
 )

 func Test_generateRandomKey(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)

 	tests := []struct {
@@ -71,7 +71,7 @@ func (c *ApiKeyCache[T]) InvalidateUserKeyCache(userId portainer.UserID) bool {
 	for _, k := range c.cache.Keys() {
 		user, _, _ := c.Get(k.(string))
 		if c.userCmpFn(user, userId) {
-			present = c.cache.Remove(k) || present
+			present = c.cache.Remove(k)
 		}
 	}

@@ -8,7 +8,6 @@ import (
 )

 func Test_apiKeyCacheGet(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)

 	keyCache := NewAPIKeyCache(10, compareUser)
@@ -44,7 +43,6 @@ func Test_apiKeyCacheGet(t *testing.T) {
 }

 func Test_apiKeyCacheSet(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)

 	keyCache := NewAPIKeyCache(10, compareUser)
@@ -70,7 +68,6 @@ func Test_apiKeyCacheSet(t *testing.T) {
 }

 func Test_apiKeyCacheDelete(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)

 	keyCache := NewAPIKeyCache(10, compareUser)
@@ -90,7 +87,6 @@ func Test_apiKeyCacheDelete(t *testing.T) {
 }

 func Test_apiKeyCacheLRU(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)

 	tests := []struct {
@@ -152,7 +148,6 @@ func Test_apiKeyCacheLRU(t *testing.T) {
 }

 func Test_apiKeyCacheInvalidateUserKeyCache(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)

 	keyCache := NewAPIKeyCache(10, compareUser)
@@ -17,13 +17,11 @@ import (
 )

 func Test_SatisfiesAPIKeyServiceInterface(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 	is.Implements((*APIKeyService)(nil), NewAPIKeyService(nil, nil))
 }

 func Test_GenerateApiKey(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)

 	_, store := datastore.MustNewTestStore(t, true, true)
@@ -77,7 +75,6 @@ func Test_GenerateApiKey(t *testing.T) {
 }

 func Test_GetAPIKey(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)

 	_, store := datastore.MustNewTestStore(t, true, true)
@@ -97,7 +94,6 @@ func Test_GetAPIKey(t *testing.T) {
 }

 func Test_GetAPIKeys(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)

 	_, store := datastore.MustNewTestStore(t, true, true)
@@ -118,7 +114,6 @@ func Test_GetAPIKeys(t *testing.T) {
 }

 func Test_GetDigestUserAndKey(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)

 	_, store := datastore.MustNewTestStore(t, true, true)
@@ -154,7 +149,6 @@ func Test_GetDigestUserAndKey(t *testing.T) {
 }

 func Test_UpdateAPIKey(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)

 	_, store := datastore.MustNewTestStore(t, true, true)
@@ -203,7 +197,6 @@ func Test_UpdateAPIKey(t *testing.T) {
 }

 func Test_DeleteAPIKey(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)

 	_, store := datastore.MustNewTestStore(t, true, true)
@@ -244,7 +237,6 @@ func Test_DeleteAPIKey(t *testing.T) {
 }

 func Test_InvalidateUserKeyCache(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)

 	_, store := datastore.MustNewTestStore(t, true, true)
@@ -10,7 +10,6 @@ import (
 	"path/filepath"
 	"strings"

-	"github.com/portainer/portainer/api/filesystem"
 	"github.com/portainer/portainer/api/logs"
 )

@@ -109,7 +108,7 @@ func ExtractTarGz(r io.Reader, outputDirPath string) error {
 		case tar.TypeDir:
 			// skip, dir will be created with a file
 		case tar.TypeReg:
-			p := filesystem.JoinPaths(outputDirPath, header.Name)
+			p := filepath.Clean(filepath.Join(outputDirPath, header.Name))
 			if err := os.MkdirAll(filepath.Dir(p), 0o744); err != nil {
 				return fmt.Errorf("Failed to extract dir %s", filepath.Dir(p))
 			}
@@ -1,14 +1,12 @@
 package archive

 import (
-	"archive/tar"
-	"compress/gzip"
 	"os"
 	"os/exec"
+	"path"
 	"path/filepath"
 	"testing"

-	"github.com/portainer/portainer/api/filesystem"
 	"github.com/rs/zerolog/log"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -33,25 +31,24 @@ func listFiles(dir string) []string {
 }

 func Test_shouldCreateArchive(t *testing.T) {
-	t.Parallel()
 	tmpdir := t.TempDir()
 	content := []byte("content")

-	err := os.WriteFile(filesystem.JoinPaths(tmpdir, "outer"), content, 0600)
+	err := os.WriteFile(path.Join(tmpdir, "outer"), content, 0600)
 	require.NoError(t, err)

-	err = os.MkdirAll(filesystem.JoinPaths(tmpdir, "dir"), 0700)
+	err = os.MkdirAll(path.Join(tmpdir, "dir"), 0700)
 	require.NoError(t, err)

-	err = os.WriteFile(filesystem.JoinPaths(tmpdir, "dir", ".dotfile"), content, 0600)
+	err = os.WriteFile(path.Join(tmpdir, "dir", ".dotfile"), content, 0600)
 	require.NoError(t, err)

-	err = os.WriteFile(filesystem.JoinPaths(tmpdir, "dir", "inner"), content, 0600)
+	err = os.WriteFile(path.Join(tmpdir, "dir", "inner"), content, 0600)
 	require.NoError(t, err)

 	gzPath, err := TarGzDir(tmpdir)
 	require.NoError(t, err)
-	assert.Equal(t, filesystem.JoinPaths(tmpdir, filepath.Base(tmpdir)+".tar.gz"), gzPath)
+	assert.Equal(t, filepath.Join(tmpdir, filepath.Base(tmpdir)+".tar.gz"), gzPath)

 	extractionDir := t.TempDir()
 	cmd := exec.Command("tar", "-xzf", gzPath, "-C", extractionDir)
@@ -61,7 +58,7 @@ func Test_shouldCreateArchive(t *testing.T) {
 	extractedFiles := listFiles(extractionDir)

 	wasExtracted := func(p string) {
-		fullpath := filesystem.JoinPaths(extractionDir, p)
+		fullpath := path.Join(extractionDir, p)
 		assert.Contains(t, extractedFiles, fullpath)
 		copyContent, err := os.ReadFile(fullpath)
 		require.NoError(t, err)
@@ -74,25 +71,24 @@ func Test_shouldCreateArchive(t *testing.T) {
 }

 func Test_shouldCreateArchive2(t *testing.T) {
-	t.Parallel()
 	tmpdir := t.TempDir()
 	content := []byte("content")

-	err := os.WriteFile(filesystem.JoinPaths(tmpdir, "outer"), content, 0600)
+	err := os.WriteFile(path.Join(tmpdir, "outer"), content, 0600)
 	require.NoError(t, err)

-	err = os.MkdirAll(filesystem.JoinPaths(tmpdir, "dir"), 0700)
+	err = os.MkdirAll(path.Join(tmpdir, "dir"), 0700)
 	require.NoError(t, err)

-	err = os.WriteFile(filesystem.JoinPaths(tmpdir, "dir", ".dotfile"), content, 0600)
+	err = os.WriteFile(path.Join(tmpdir, "dir", ".dotfile"), content, 0600)
 	require.NoError(t, err)

-	err = os.WriteFile(filesystem.JoinPaths(tmpdir, "dir", "inner"), content, 0600)
+	err = os.WriteFile(path.Join(tmpdir, "dir", "inner"), content, 0600)
 	require.NoError(t, err)

 	gzPath, err := TarGzDir(tmpdir)
 	require.NoError(t, err)
-	assert.Equal(t, filesystem.JoinPaths(tmpdir, filepath.Base(tmpdir)+".tar.gz"), gzPath)
+	assert.Equal(t, filepath.Join(tmpdir, filepath.Base(tmpdir)+".tar.gz"), gzPath)

 	extractionDir := t.TempDir()
 	r, _ := os.Open(gzPath)
@@ -102,7 +98,7 @@ func Test_shouldCreateArchive2(t *testing.T) {
 	extractedFiles := listFiles(extractionDir)

 	wasExtracted := func(p string) {
-		fullpath := filesystem.JoinPaths(extractionDir, p)
+		fullpath := path.Join(extractionDir, p)
 		assert.Contains(t, extractedFiles, fullpath)
 		copyContent, _ := os.ReadFile(fullpath)
 		assert.Equal(t, content, copyContent)
@@ -112,57 +108,3 @@ func Test_shouldCreateArchive2(t *testing.T) {
 	wasExtracted("dir/inner")
 	wasExtracted("dir/.dotfile")
 }
-
-func TestExtractTarGzPathTraversal(t *testing.T) {
-	t.Parallel()
-	testDir := t.TempDir()
-
-	// Create an evil file with a path traversal attempt
-	tarPath := filesystem.JoinPaths(testDir, "evil.tar.gz")
-
-	evilFile, err := os.Create(tarPath)
-	require.NoError(t, err)
-
-	gzWriter := gzip.NewWriter(evilFile)
-	tarWriter := tar.NewWriter(gzWriter)
-
-	content := []byte("evil content")
-
-	header := &tar.Header{
-		Name:     "../evil.txt",
-		Mode:     0600,
-		Size:     int64(len(content)),
-		Typeflag: tar.TypeReg,
-	}
-
-	err = tarWriter.WriteHeader(header)
-	require.NoError(t, err)
-
-	_, err = tarWriter.Write(content)
-	require.NoError(t, err)
-
-	err = tarWriter.Close()
-	require.NoError(t, err)
-
-	err = gzWriter.Close()
-	require.NoError(t, err)
-
-	err = evilFile.Close()
-	require.NoError(t, err)
-
-	// Attempt to extract the evil file
-	extractionDir := filesystem.JoinPaths(testDir, "extraction")
-	err = os.Mkdir(extractionDir, 0700)
-	require.NoError(t, err)
-
-	tarFile, err := os.Open(tarPath)
-	require.NoError(t, err)
-
-	// Check that the file didn't escape
-	err = ExtractTarGz(tarFile, extractionDir)
-	require.NoError(t, err)
-	require.NoFileExists(t, filesystem.JoinPaths(testDir, "evil.txt"))
-
-	err = tarFile.Close()
-	require.NoError(t, err)
-}
@@ -1,16 +1,14 @@
 package archive

 import (
+	"path/filepath"
 	"testing"

-	"github.com/portainer/portainer/api/filesystem"
-
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

 func TestUnzipFile(t *testing.T) {
-	t.Parallel()
 	dir := t.TempDir()
 	/*
 		Archive structure.
@@ -25,8 +23,8 @@ func TestUnzipFile(t *testing.T) {

 	require.NoError(t, err)
 	archiveDir := dir + "/sample_archive"
-	assert.FileExists(t, filesystem.JoinPaths(archiveDir, "0.txt"))
-	assert.FileExists(t, filesystem.JoinPaths(archiveDir, "0", "1.txt"))
-	assert.FileExists(t, filesystem.JoinPaths(archiveDir, "0", "1", "2.txt"))
+	assert.FileExists(t, filepath.Join(archiveDir, "0.txt"))
+	assert.FileExists(t, filepath.Join(archiveDir, "0", "1.txt"))
+	assert.FileExists(t, filepath.Join(archiveDir, "0", "1", "2.txt"))

 }
@@ -8,8 +8,8 @@ import (
 	"time"
 )

-func (s *Service) GetEncodedAuthorizationToken(ctx context.Context) (token *string, expiry *time.Time, err error) {
-	getAuthorizationTokenOutput, err := s.client.GetAuthorizationToken(ctx, nil)
+func (s *Service) GetEncodedAuthorizationToken() (token *string, expiry *time.Time, err error) {
+	getAuthorizationTokenOutput, err := s.client.GetAuthorizationToken(context.TODO(), nil)
 	if err != nil {
 		return
 	}
@@ -27,8 +27,8 @@ func (s *Service) GetEncodedAuthorizationToken(ctx context.Context) (token *stri
 	return
 }

-func (s *Service) GetAuthorizationToken(ctx context.Context) (token *string, expiry *time.Time, err error) {
-	tokenEncodedStr, expiry, err := s.GetEncodedAuthorizationToken(ctx)
+func (s *Service) GetAuthorizationToken() (token *string, expiry *time.Time, err error) {
+	tokenEncodedStr, expiry, err := s.GetEncodedAuthorizationToken()
 	if err != nil {
 		return
 	}
@@ -5,7 +5,6 @@ import (
 )

 func TestParseECREndpoint(t *testing.T) {
-	t.Parallel()
 	tests := []struct {
 		name      string
 		url       string
@@ -1,274 +0,0 @@
-package backup
-
-import (
-	"bytes"
-	"context"
-	"io"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/portainer/portainer/api/archive"
-	"github.com/portainer/portainer/api/crypto"
-	"github.com/portainer/portainer/api/datastore"
-	"github.com/portainer/portainer/api/filesystem"
-	"github.com/portainer/portainer/api/http/offlinegate"
-	"github.com/portainer/portainer/pkg/fips"
-
-	"github.com/stretchr/testify/require"
-)
-
-func init() {
-	fips.InitFIPS(false)
-}
-
-func TestGetRestoreSourcePath_DBAtRoot(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	err := os.WriteFile(filesystem.JoinPaths(dir, "portainer.db"), []byte("db"), 0o600)
-	require.NoError(t, err)
-
-	result, err := getRestoreSourcePath(dir)
-	require.NoError(t, err)
-	require.Equal(t, dir, result)
-}
-
-func TestGetRestoreSourcePath_EncryptedDBAtRoot(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	err := os.WriteFile(filesystem.JoinPaths(dir, "portainer.edb"), []byte("db"), 0o600)
-	require.NoError(t, err)
-
-	result, err := getRestoreSourcePath(dir)
-	require.NoError(t, err)
-	require.Equal(t, dir, result)
-}
-
-func TestGetRestoreSourcePath_DBInSubdirectory(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	sub := filesystem.JoinPaths(dir, "backup-2024-01-01")
-	err := os.Mkdir(sub, 0o700)
-	require.NoError(t, err)
-
-	err = os.WriteFile(filesystem.JoinPaths(sub, "portainer.db"), []byte("db"), 0o600)
-	require.NoError(t, err)
-
-	result, err := getRestoreSourcePath(dir)
-	require.NoError(t, err)
-	require.Equal(t, sub, result)
-}
-
-func TestGetRestoreSourcePath_NoDBFile(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	err := os.WriteFile(filesystem.JoinPaths(dir, "other.file"), []byte("data"), 0o600)
-	require.NoError(t, err)
-
-	result, err := getRestoreSourcePath(dir)
-	require.NoError(t, err)
-	require.Equal(t, dir, result)
-}
-
-func TestGetRestoreSourcePath_EmptyDir(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-
-	result, err := getRestoreSourcePath(dir)
-	require.NoError(t, err)
-	require.Equal(t, dir, result)
-}
-
-func TestEncryptDecrypt_RoundTrip(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	plaintext := []byte("sensitive portainer backup data")
-
-	srcPath := filesystem.JoinPaths(dir, "archive.tar.gz")
-	err := os.WriteFile(srcPath, plaintext, 0o600)
-	require.NoError(t, err)
-
-	encryptedPath, err := encrypt(srcPath, "mysecretpassword")
-	require.NoError(t, err)
-	require.Equal(t, srcPath+".encrypted", encryptedPath)
-
-	encryptedData, err := os.ReadFile(encryptedPath)
-	require.NoError(t, err)
-
-	decryptedReader, err := crypto.AesDecrypt(bytes.NewReader(encryptedData), []byte("mysecretpassword"))
-	require.NoError(t, err)
-
-	decrypted, err := io.ReadAll(decryptedReader)
-	require.NoError(t, err)
-	require.Equal(t, plaintext, decrypted)
-}
-
-func TestEncryptDecrypt_WrongPassword(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-
-	srcPath := filesystem.JoinPaths(dir, "archive.tar.gz")
-	err := os.WriteFile(srcPath, []byte("data"), 0o600)
-	require.NoError(t, err)
-
-	encryptedPath, err := encrypt(srcPath, "correctpassword")
-	require.NoError(t, err)
-
-	encryptedData, err := os.ReadFile(encryptedPath)
-	require.NoError(t, err)
-
-	_, err = crypto.AesDecrypt(bytes.NewReader(encryptedData), []byte("wrongpassword"))
-	require.Error(t, err)
-}
-
-func TestCreateBackupArchive_NoPassword(t *testing.T) {
-	t.Parallel()
-
-	_, store := datastore.MustNewTestStore(t, true, false)
-	storePath := store.GetConnection().GetStorePath()
-	gate := offlinegate.NewOfflineGate()
-
-	archivePath, err := CreateBackupArchive("", gate, store, storePath)
-	require.NoError(t, err)
-
-	f, err := os.Open(archivePath)
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		err := f.Close()
-		require.NoError(t, err)
-	})
-
-	extractDir := t.TempDir()
-	err = archive.ExtractTarGz(f, extractDir)
-	require.NoError(t, err)
-
-	dbFound := false
-	err = filepath.Walk(extractDir, func(path string, info os.FileInfo, err error) error {
-		if err != nil {
-			return err
-		}
-		if info.Name() == "portainer.db" {
-			dbFound = true
-		}
-
-		return nil
-	})
-	require.NoError(t, err)
-	require.True(t, dbFound, "archive should contain portainer.db")
-}
-
-func TestCreateBackupArchive_WithPassword(t *testing.T) {
-	t.Parallel()
-
-	_, store := datastore.MustNewTestStore(t, true, false)
-	storePath := store.GetConnection().GetStorePath()
-	gate := offlinegate.NewOfflineGate()
-
-	archivePath, err := CreateBackupArchive("backup-secret", gate, store, storePath)
-	require.NoError(t, err)
-	require.Contains(t, archivePath, ".encrypted")
-
-	encryptedData, err := os.ReadFile(archivePath)
-	require.NoError(t, err)
-
-	decryptedReader, err := crypto.AesDecrypt(bytes.NewReader(encryptedData), []byte("backup-secret"))
-	require.NoError(t, err)
-
-	extractDir := t.TempDir()
-	err = archive.ExtractTarGz(decryptedReader, extractDir)
-	require.NoError(t, err)
-
-	dbFound := false
-	err = filepath.Walk(extractDir, func(path string, info os.FileInfo, err error) error {
-		if err != nil {
-			return err
-		}
-		if info.Name() == "portainer.db" {
-			dbFound = true
-		}
-
-		return nil
-	})
-	require.NoError(t, err)
-	require.True(t, dbFound, "decrypted archive should contain portainer.db")
-}
-
-func TestRestoreArchive_NoPassword(t *testing.T) {
-	t.Parallel()
-
-	_, store1 := datastore.MustNewTestStore(t, true, false)
-	storePath1 := store1.GetConnection().GetStorePath()
-	gate := offlinegate.NewOfflineGate()
-
-	archivePath, err := CreateBackupArchive("", gate, store1, storePath1)
-	require.NoError(t, err)
-
-	archiveData, err := os.ReadFile(archivePath)
-	require.NoError(t, err)
-
-	_, store2 := datastore.MustNewTestStore(t, true, false)
-	storePath2 := store2.GetConnection().GetStorePath()
-
-	ctx, cancel := context.WithCancel(t.Context())
-	err = RestoreArchive(bytes.NewReader(archiveData), "", storePath2, gate, store2, cancel)
-	require.NoError(t, err)
-
-	require.ErrorIs(t, ctx.Err(), context.Canceled)
-
-	_, err = os.Stat(filesystem.JoinPaths(storePath2, "portainer.db"))
-	require.NoError(t, err)
-}
-
-func TestRestoreArchive_WithPassword(t *testing.T) {
-	t.Parallel()
-
-	_, store1 := datastore.MustNewTestStore(t, true, false)
-	storePath1 := store1.GetConnection().GetStorePath()
-	gate := offlinegate.NewOfflineGate()
-
-	archivePath, err := CreateBackupArchive("restore-secret", gate, store1, storePath1)
-	require.NoError(t, err)
-
-	archiveData, err := os.ReadFile(archivePath)
-	require.NoError(t, err)
-
-	_, store2 := datastore.MustNewTestStore(t, true, false)
-	storePath2 := store2.GetConnection().GetStorePath()
-
-	ctx, cancel := context.WithCancel(t.Context())
-	err = RestoreArchive(bytes.NewReader(archiveData), "restore-secret", storePath2, gate, store2, cancel)
-	require.NoError(t, err)
-
-	require.ErrorIs(t, ctx.Err(), context.Canceled)
-
-	_, err = os.Stat(filesystem.JoinPaths(storePath2, "portainer.db"))
-	require.NoError(t, err)
-}
-
-func TestRestoreArchive_WrongPassword(t *testing.T) {
-	t.Parallel()
-
-	_, store1 := datastore.MustNewTestStore(t, true, false)
-	storePath1 := store1.GetConnection().GetStorePath()
-	gate := offlinegate.NewOfflineGate()
-
-	archivePath, err := CreateBackupArchive("correct-password", gate, store1, storePath1)
-	require.NoError(t, err)
-
-	archiveData, err := os.ReadFile(archivePath)
-	require.NoError(t, err)
-
-	_, store2 := datastore.MustNewTestStore(t, true, false)
-	storePath2 := store2.GetConnection().GetStorePath()
-
-	_, cancel := context.WithCancel(t.Context())
-	err = RestoreArchive(bytes.NewReader(archiveData), "wrong-password", storePath2, gate, store2, cancel)
-	require.Error(t, err)
-}
@@ -6,7 +6,6 @@ import (
 )

 func TestGenerateGo119CompatibleKey(t *testing.T) {
-	t.Parallel()
 	type args struct {
 		seed string
 	}
@@ -11,7 +11,6 @@ import (
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/http/proxy"
-	"github.com/portainer/portainer/pkg/schedule"

 	chserver "github.com/jpillora/chisel/server"
 	"github.com/jpillora/chisel/share/ccrypto"
@@ -234,18 +233,27 @@ func (service *Service) startTunnelVerificationLoop() {
 		Float64("check_interval_seconds", tunnelCleanupInterval.Seconds()).
 		Msg("starting tunnel management process")

-	schedule.RunOnInterval(service.shutdownCtx, tunnelCleanupInterval, service.checkTunnels, func() {
-		log.Debug().Msg("shutting down tunnel service")
+	ticker := time.NewTicker(tunnelCleanupInterval)

-		if err := service.StopTunnelServer(); err != nil {
-			log.Debug().Err(err).Msg("stopped tunnel service")
+	for {
+		select {
+		case <-ticker.C:
+			service.checkTunnels()
+		case <-service.shutdownCtx.Done():
+			log.Debug().Msg("shutting down tunnel service")
+
+			if err := service.StopTunnelServer(); err != nil {
+				log.Debug().Err(err).Msg("stopped tunnel service")
+			}
+
+			ticker.Stop()
+			return
 		}
-	})
+	}
 }

-// checkTunnels finds tunnels that need snapshots and processes them one at a time.
-// For active tunnels missing an initial snapshot, it takes one without closing the tunnel.
-// For tunnels idle past activeTimeout, it snapshots and closes them.
+// checkTunnels finds the first tunnel that has not had any activity recently
+// and attempts to take a snapshot, then closes it and returns
 func (service *Service) checkTunnels() {
 	service.mu.RLock()

@@ -256,32 +264,12 @@ func (service *Service) checkTunnels() {
 			Float64("last_activity_seconds", elapsed.Seconds()).
 			Msg("environment tunnel monitoring")

-		tunnelPort := tunnel.Port
-
-		if !tunnel.HasSnapshot && elapsed < activeTimeout {
-			service.mu.RUnlock()
-
-			if endpointHasSnapshot(service.dataStore, endpointID) {
-				service.markSnapshotTaken(endpointID)
-
-				return
-			}
-
-			log.Debug().
-				Int("endpoint_id", int(endpointID)).
-				Msg("taking initial snapshot for active Edge environment")
-
-			if service.snapshotAndLog(endpointID, tunnelPort) {
-				service.markSnapshotTaken(endpointID)
-			}
-
-			return
-		}
-
 		if tunnel.Status == portainer.EdgeAgentManagementRequired && elapsed < activeTimeout {
 			continue
 		}

+		tunnelPort := tunnel.Port
+
 		service.mu.RUnlock()

 		log.Debug().
@@ -290,7 +278,13 @@ func (service *Service) checkTunnels() {
 			Float64("timeout_seconds", activeTimeout.Seconds()).
 			Msg("last activity timeout exceeded")

-		service.snapshotAndLog(endpointID, tunnelPort)
+		if err := service.snapshotEnvironment(endpointID, tunnelPort); err != nil {
+			log.Error().
+				Int("endpoint_id", int(endpointID)).
+				Err(err).
+				Msg("unable to snapshot Edge environment")
+		}
+
 		service.close(endpointID)

 		return
@@ -299,28 +293,6 @@ func (service *Service) checkTunnels() {
 	service.mu.RUnlock()
 }

-func (service *Service) snapshotAndLog(endpointID portainer.EndpointID, tunnelPort int) bool {
-	if err := service.snapshotEnvironment(endpointID, tunnelPort); err != nil {
-		log.Error().
-			Int("endpoint_id", int(endpointID)).
-			Err(err).
-			Msg("unable to snapshot Edge environment")
-
-		return false
-	}
-
-	return true
-}
-
-func (service *Service) markSnapshotTaken(endpointID portainer.EndpointID) {
-	service.mu.Lock()
-	defer service.mu.Unlock()
-
-	if tun, ok := service.activeTunnels[endpointID]; ok {
-		tun.HasSnapshot = true
-	}
-}
-
 func (service *Service) snapshotEnvironment(endpointID portainer.EndpointID, tunnelPort int) error {
 	endpoint, err := service.dataStore.Endpoint().Endpoint(endpointID)
 	if err != nil {
@@ -2,7 +2,6 @@ package chisel

 import (
 	"context"
-	"errors"
 	"net"
 	"net/http"
 	"testing"
@@ -19,38 +18,15 @@ func init() {
 	fips.InitFIPS(false)
 }

-type mockSnapshotService struct {
-	snapshotFn func(endpoint *portainer.Endpoint) error
-}
-
-func (m *mockSnapshotService) Start(_ context.Context) {}
-
-func (m *mockSnapshotService) SetSnapshotInterval(_ string) error { return nil }
-
-func (m *mockSnapshotService) SnapshotEndpoint(endpoint *portainer.Endpoint) error {
-	if m.snapshotFn != nil {
-		return m.snapshotFn(endpoint)
-	}
-
-	return nil
-}
-
-func (m *mockSnapshotService) FillSnapshotData(_ *portainer.Endpoint, _ bool) error { return nil }
-
-func newEdgeEndpoint(id portainer.EndpointID) *portainer.Endpoint {
-	return &portainer.Endpoint{
-		ID:          id,
+func TestPingAgentPanic(t *testing.T) {
+	endpoint := &portainer.Endpoint{
+		ID:          1,
 		EdgeID:      "test-edge-id",
 		Type:        portainer.EdgeAgentOnDockerEnvironment,
 		UserTrusted: true,
 	}
-}

-func TestPingAgentPanic(t *testing.T) {
-	t.Parallel()
-	endpoint := newEdgeEndpoint(1)
-
-	_, store := datastore.MustNewTestStore(t, false, true)
+	_, store := datastore.MustNewTestStore(t, true, true)

 	s := NewService(store, nil, nil)

@@ -78,143 +54,6 @@ func TestPingAgentPanic(t *testing.T) {
 	s.activeTunnels[endpoint.ID].Port = ln.Addr().(*net.TCPAddr).Port

 	require.Error(t, s.pingAgent(endpoint.ID))
-	require.NoError(t, srv.Shutdown(t.Context()))
+	require.NoError(t, srv.Shutdown(context.Background()))
 	require.ErrorIs(t, <-errCh, http.ErrServerClosed)
 }
-
-func TestOpenDefaultsHasSnapshotToFalse(t *testing.T) {
-	t.Parallel()
-
-	endpoint := newEdgeEndpoint(1)
-	_, store := datastore.MustNewTestStore(t, false, true)
-
-	s := NewService(store, nil, nil)
-
-	err := s.Open(endpoint)
-	require.NoError(t, err)
-
-	require.False(t, s.activeTunnels[endpoint.ID].HasSnapshot)
-}
-
-func TestCheckTunnelsSetsHasSnapshotWhenSnapshotExists(t *testing.T) {
-	t.Parallel()
-
-	endpoint := newEdgeEndpoint(2)
-	_, store := datastore.MustNewTestStore(t, false, true)
-
-	err := store.Endpoint().Create(endpoint)
-	require.NoError(t, err)
-
-	snap := &portainer.Snapshot{
-		EndpointID: endpoint.ID,
-		Docker:     &portainer.DockerSnapshot{},
-	}
-	err = store.Snapshot().Create(snap)
-	require.NoError(t, err)
-
-	s := NewService(store, nil, nil)
-	s.activeTunnels[endpoint.ID] = &portainer.TunnelDetails{
-		Status:       portainer.EdgeAgentManagementRequired,
-		Port:         50003,
-		LastActivity: time.Now(),
-	}
-
-	s.checkTunnels()
-
-	require.NotNil(t, s.activeTunnels[endpoint.ID], "tunnel must remain open")
-	require.True(t, s.activeTunnels[endpoint.ID].HasSnapshot)
-}
-
-func TestCheckTunnelsSnapshotsActiveEnvironmentAndKeepsTunnelAlive(t *testing.T) {
-	t.Parallel()
-
-	endpoint := newEdgeEndpoint(3)
-	_, store := datastore.MustNewTestStore(t, false, true)
-
-	err := store.Endpoint().Create(endpoint)
-	require.NoError(t, err)
-
-	snapshotCalled := false
-	svc := &mockSnapshotService{
-		snapshotFn: func(_ *portainer.Endpoint) error {
-			snapshotCalled = true
-
-			return nil
-		},
-	}
-
-	s := NewService(store, nil, nil)
-	s.snapshotService = svc
-	s.activeTunnels[endpoint.ID] = &portainer.TunnelDetails{
-		Status:       portainer.EdgeAgentManagementRequired,
-		Port:         50000,
-		LastActivity: time.Now(),
-	}
-
-	s.checkTunnels()
-
-	require.True(t, snapshotCalled)
-	require.NotNil(t, s.activeTunnels[endpoint.ID], "tunnel must remain open after snapshot")
-	require.True(t, s.activeTunnels[endpoint.ID].HasSnapshot)
-}
-
-func TestCheckTunnelsKeepsHasSnapshotFalseOnSnapshotFailure(t *testing.T) {
-	t.Parallel()
-
-	endpoint := newEdgeEndpoint(4)
-	_, store := datastore.MustNewTestStore(t, false, true)
-
-	err := store.Endpoint().Create(endpoint)
-	require.NoError(t, err)
-
-	svc := &mockSnapshotService{
-		snapshotFn: func(_ *portainer.Endpoint) error {
-			return errors.New("snapshot failed")
-		},
-	}
-
-	s := NewService(store, nil, nil)
-	s.snapshotService = svc
-	s.activeTunnels[endpoint.ID] = &portainer.TunnelDetails{
-		Status:       portainer.EdgeAgentManagementRequired,
-		Port:         50001,
-		LastActivity: time.Now(),
-	}
-
-	s.checkTunnels()
-
-	require.NotNil(t, s.activeTunnels[endpoint.ID], "tunnel must remain open after failed snapshot")
-	require.False(t, s.activeTunnels[endpoint.ID].HasSnapshot, "HasSnapshot must stay false after failure")
-}
-
-func TestCheckTunnelsClosesIdleTunnelAndSnapshots(t *testing.T) {
-	t.Parallel()
-
-	endpoint := newEdgeEndpoint(5)
-	_, store := datastore.MustNewTestStore(t, false, true)
-
-	err := store.Endpoint().Create(endpoint)
-	require.NoError(t, err)
-
-	snapshotCalled := false
-	svc := &mockSnapshotService{
-		snapshotFn: func(_ *portainer.Endpoint) error {
-			snapshotCalled = true
-
-			return nil
-		},
-	}
-
-	s := NewService(store, nil, nil)
-	s.snapshotService = svc
-	s.activeTunnels[endpoint.ID] = &portainer.TunnelDetails{
-		Status:       portainer.EdgeAgentManagementRequired,
-		Port:         50002,
-		LastActivity: time.Now().Add(-(activeTimeout + time.Second)),
-	}
-
-	s.checkTunnels()
-
-	require.True(t, snapshotCalled)
-	require.Nil(t, s.activeTunnels[endpoint.ID], "tunnel must be closed after idle timeout")
-}
@@ -9,7 +9,6 @@ import (
 	"time"

 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/internal/edge"
 	"github.com/portainer/portainer/api/internal/edge/cache"
 	"github.com/portainer/portainer/api/internal/endpointutils"
@@ -238,18 +237,3 @@ func encryptCredentials(username, password, key string) (string, error) {

 	return base64.RawStdEncoding.EncodeToString(encryptedCredentials), nil
 }
-
-func endpointHasSnapshot(dataStore dataservices.DataStore, endpointID portainer.EndpointID) bool {
-	var hasSnapshot bool
-	_ = dataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
-		s, err := tx.Snapshot().Read(endpointID)
-		if err != nil {
-			return err
-		}
-
-		hasSnapshot = s.Docker != nil || s.Kubernetes != nil
-		return nil
-	})
-
-	return hasSnapshot
-}
@@ -28,7 +28,6 @@ func (s *testStore) Settings() dataservices.SettingsService {
 }

 func TestGetUnusedPort(t *testing.T) {
-	t.Parallel()
 	testCases := []struct {
 		name            string
 		existingTunnels map[portainer.EndpointID]*portainer.TunnelDetails
@@ -32,7 +32,7 @@ func CLIFlags() *portainer.CLIFlags {
 		Assets:                    kingpin.Flag("assets", "Path to the assets").Default(defaultAssetsDirectory).Short('a').String(),
 		Data:                      kingpin.Flag("data", "Path to the folder where the data is stored").Default(defaultDataDirectory).Short('d').String(),
 		EndpointURL:               kingpin.Flag("host", "Environment URL").Short('H').String(),
-		FeatureFlags:              kingpin.Flag("feat", "List of feature flags").Envar(portainer.FeatureFlagEnvVar).Strings(),
+		FeatureFlags:              kingpin.Flag("feat", "List of feature flags").Strings(),
 		EnableEdgeComputeFeatures: kingpin.Flag("edge-compute", "Enable Edge Compute features").Bool(),
 		NoAnalytics:               kingpin.Flag("no-analytics", "Disable Analytics in app (deprecated)").Bool(),
 		TLSSkipVerify:             kingpin.Flag("tlsskipverify", "Disable TLS server verification").Default(defaultTLSSkipVerify).Bool(),
@@ -94,20 +94,13 @@ func (Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
 	flags.TLSKey = tlsKeyFlag.String()
 	flags.TLSCacert = kingpin.Flag("tlscacert", "Path to the CA").Default(defaultTLSCACertPath).String()

-	var hasKubectlShellImageFlag bool
-	kubectlShellImageFlag := kingpin.Flag(
+	flags.KubectlShellImage = kingpin.Flag(
 		"kubectl-shell-image",
 		"Kubectl shell image",
-	).Envar(portainer.KubectlShellImageEnvVar).
-		Default(portainer.DefaultKubectlShellImage).
-		IsSetByUser(&hasKubectlShellImageFlag)
-	flags.KubectlShellImage = kubectlShellImageFlag.String()
+	).Envar(portainer.KubectlShellImageEnvVar).Default(portainer.DefaultKubectlShellImage).String()

 	kingpin.Parse()

-	_, kubectlShellImageEnvVarSet := os.LookupEnv(portainer.KubectlShellImageEnvVar)
-	flags.KubectlShellImageSet = hasKubectlShellImageFlag || kubectlShellImageEnvVarSet
-
 	if !filepath.IsAbs(*flags.Assets) {
 		ex, err := os.Executable()
 		if err != nil {
@@ -159,11 +152,11 @@ func (Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
 func (Service) ValidateFlags(flags *portainer.CLIFlags) error {
 	displayDeprecationWarnings(flags)

-	if err := ValidateEndpointURL(*flags.EndpointURL); err != nil {
+	if err := validateEndpointURL(*flags.EndpointURL); err != nil {
 		return err
 	}

-	if err := ValidateSnapshotInterval(*flags.SnapshotInterval); err != nil {
+	if err := validateSnapshotInterval(*flags.SnapshotInterval); err != nil {
 		return err
 	}

@@ -180,7 +173,7 @@ func displayDeprecationWarnings(flags *portainer.CLIFlags) {
 	}
 }

-func ValidateEndpointURL(endpointURL string) error {
+func validateEndpointURL(endpointURL string) error {
 	if endpointURL == "" {
 		return nil
 	}
@@ -205,7 +198,7 @@ func ValidateEndpointURL(endpointURL string) error {
 	return nil
 }

-func ValidateSnapshotInterval(snapshotInterval string) error {
+func validateSnapshotInterval(snapshotInterval string) error {
 	if snapshotInterval == "" {
 		return nil
 	}
@@ -6,7 +6,6 @@ import (
 	"strings"
 	"testing"

-	portainer "github.com/portainer/portainer/api"
 	zerolog "github.com/rs/zerolog/log"
 	"github.com/stretchr/testify/require"
 )
@@ -27,59 +26,6 @@ func TestOptionParser(t *testing.T) {
 	require.True(t, *opts.EnableEdgeComputeFeatures)
 }

-func TestParseKubectlShellImageFlag(t *testing.T) {
-	tests := []struct {
-		name                         string
-		args                         []string
-		envVars                      map[string]string
-		expectedKubectlShellImageSet bool
-		expectedKubectlShellFlag     string
-	}{
-		{
-			name:                         "no flag, no env var",
-			expectedKubectlShellImageSet: false,
-			expectedKubectlShellFlag:     portainer.DefaultKubectlShellImage,
-		},
-		{
-			name:                         "explicit flag",
-			args:                         []string{"portainer", "--kubectl-shell-image=myimage:v2"},
-			expectedKubectlShellImageSet: true,
-			expectedKubectlShellFlag:     "myimage:v2",
-		},
-		{
-			name:                         "env var",
-			envVars:                      map[string]string{portainer.KubectlShellImageEnvVar: "myimage:v3"},
-			expectedKubectlShellImageSet: true,
-			expectedKubectlShellFlag:     "myimage:v3",
-		},
-		{
-			name:                         "both env var and flag set",
-			args:                         []string{"portainer", "--kubectl-shell-image=myimage:v2"},
-			envVars:                      map[string]string{portainer.KubectlShellImageEnvVar: "myimage:v3"},
-			expectedKubectlShellImageSet: true,
-			expectedKubectlShellFlag:     "myimage:v2",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			if tc.args == nil {
-				tc.args = []string{"portainer"}
-			}
-			setOsArgs(t, tc.args)
-
-			for k, v := range tc.envVars {
-				t.Setenv(k, v)
-			}
-
-			flags, err := Service{}.ParseFlags("test-version")
-			require.NoError(t, err)
-			require.Equal(t, tc.expectedKubectlShellImageSet, flags.KubectlShellImageSet)
-			require.Equal(t, tc.expectedKubectlShellFlag, *flags.KubectlShellImage)
-		})
-	}
-}
-
 func TestParseTLSFlags(t *testing.T) {
 	testCases := []struct {
 		name                string
@@ -7,7 +7,6 @@ import (
 	"os"
 	"path"
 	"strings"
-	"time"

 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/apikey"
@@ -26,6 +25,7 @@ import (
 	"github.com/portainer/portainer/api/exec"
 	"github.com/portainer/portainer/api/filesystem"
 	"github.com/portainer/portainer/api/git"
+	"github.com/portainer/portainer/api/hostmanagement/openamt"
 	"github.com/portainer/portainer/api/http"
 	"github.com/portainer/portainer/api/http/proxy"
 	kubeproxy "github.com/portainer/portainer/api/http/proxy/factory/kubernetes"
@@ -51,11 +51,11 @@ import (
 	"github.com/portainer/portainer/pkg/featureflags"
 	"github.com/portainer/portainer/pkg/fips"
 	"github.com/portainer/portainer/pkg/libhelm"
+	libhelmtypes "github.com/portainer/portainer/pkg/libhelm/types"
 	"github.com/portainer/portainer/pkg/libstack/compose"
-	libswarm "github.com/portainer/portainer/pkg/libstack/swarm"
 	"github.com/portainer/portainer/pkg/validate"

-	"github.com/google/uuid"
+	"github.com/gofrs/uuid"
 	"github.com/rs/zerolog/log"
 )

@@ -119,7 +119,7 @@ func initDataStore(flags *portainer.CLIFlags, secretKey []byte, fileService port
 	}

 	if isNew {
-		instanceId, err := uuid.NewRandom()
+		instanceId, err := uuid.NewV4()
 		if err != nil {
 			log.Fatal().Err(err).Msg("failed generating instance id")
 		}
@@ -174,6 +174,10 @@ func initKubernetesDeployer(kubernetesTokenCacheManager *kubeproxy.TokenCacheMan
 	return exec.NewKubernetesDeployer(kubernetesTokenCacheManager, kubernetesClientFactory, dataStore, reverseTunnelService, signatureService, proxyManager)
 }

+func initHelmPackageManager() (libhelmtypes.HelmPackageManager, error) {
+	return libhelm.NewHelmPackageManager()
+}
+
 func initAPIKeyService(datastore dataservices.DataStore) apikey.APIKeyService {
 	return apikey.NewAPIKeyService(datastore.APIKeyRepository(), datastore.User())
 }
@@ -212,12 +216,13 @@ func initSnapshotService(
 	dataStore dataservices.DataStore,
 	dockerClientFactory *dockerclient.ClientFactory,
 	kubernetesClientFactory *kubecli.ClientFactory,
+	shutdownCtx context.Context,
 	pendingActionsService *pendingactions.PendingActionsService,
 ) (portainer.SnapshotService, error) {
 	dockerSnapshotter := docker.NewSnapshotter(dockerClientFactory)
 	kubernetesSnapshotter := kubernetes.NewSnapshotter(kubernetesClientFactory)

-	snapshotService, err := snapshot.NewService(snapshotIntervalFromFlag, dataStore, dockerSnapshotter, kubernetesSnapshotter, pendingActionsService)
+	snapshotService, err := snapshot.NewService(snapshotIntervalFromFlag, dataStore, dockerSnapshotter, kubernetesSnapshotter, shutdownCtx, pendingActionsService)
 	if err != nil {
 		return nil, err
 	}
@@ -243,10 +248,6 @@ func updateSettingsFromFlags(dataStore dataservices.DataStore, flags *portainer.
 	settings.EnableEdgeComputeFeatures = cmp.Or(*flags.EnableEdgeComputeFeatures, settings.EnableEdgeComputeFeatures)
 	settings.TemplatesURL = cmp.Or(*flags.Templates, settings.TemplatesURL)

-	if flags.KubectlShellImageSet {
-		settings.KubectlShellImage = *flags.KubectlShellImage
-	}
-
 	if *flags.Labels != nil {
 		settings.BlackListedLabels = *flags.Labels
 	}
@@ -337,7 +338,9 @@ func loadEncryptionSecretKey(keyfilename string) []byte {
 	return hash[:]
 }

-func buildServer(flags *portainer.CLIFlags, shutdownCtx context.Context, shutdownTrigger context.CancelFunc) portainer.Server {
+func buildServer(flags *portainer.CLIFlags) portainer.Server {
+	shutdownCtx, shutdownTrigger := context.WithCancel(context.Background())
+
 	if flags.FeatureFlags != nil {
 		featureflags.Parse(*flags.FeatureFlags, portainer.SupportedFeatureFlags)
 	}
@@ -347,7 +350,7 @@ func buildServer(flags *portainer.CLIFlags, shutdownCtx context.Context, shutdow
 		// validate if the trusted origins are valid urls
 		for origin := range strings.SplitSeq(*flags.TrustedOrigins, ",") {
 			if !validate.IsTrustedOrigin(origin) {
-				log.Fatal().Str("trusted_origin", origin).Msg("invalid trusted origin: must be scheme://host or scheme://host:port (e.g. https://example.com)")
+				log.Fatal().Str("trusted_origin", origin).Msg("invalid url for trusted origin. Please check the trusted origins flag.")
 			}

 			trustedOrigins = append(trustedOrigins, origin)
@@ -397,6 +400,9 @@ func buildServer(flags *portainer.CLIFlags, shutdownCtx context.Context, shutdow

 	gitService := git.NewService(shutdownCtx)

+	// Setting insecureSkipVerify to true to preserve the old behaviour.
+	openAMTService := openamt.NewService(true)
+
 	cryptoService := crypto.Service{}

 	signatureService := initDigitalSignatureService()
@@ -437,11 +443,16 @@ func buildServer(flags *portainer.CLIFlags, shutdownCtx context.Context, shutdow

 	reverseTunnelService.ProxyManager = proxyManager

+	dockerConfigPath := fileService.GetDockerConfigPath()
+
 	composeDeployer := compose.NewComposeDeployer()

-	composeStackManager := exec.NewComposeStackManager(composeDeployer, proxyManager)
+	composeStackManager := exec.NewComposeStackManager(composeDeployer, proxyManager, dataStore)

-	swarmStackManager := exec.NewSwarmStackManager(libswarm.NewSwarmDeployer(), proxyManager)
+	swarmStackManager, err := exec.NewSwarmStackManager(*flags.Assets, dockerConfigPath, signatureService, fileService, reverseTunnelService, dataStore)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed initializing swarm stack manager")
+	}

 	kubernetesDeployer := initKubernetesDeployer(kubernetesTokenCacheManager, kubernetesClientFactory, dataStore, reverseTunnelService, signatureService, proxyManager)

@@ -450,16 +461,19 @@ func buildServer(flags *portainer.CLIFlags, shutdownCtx context.Context, shutdow
 	pendingActionsService.RegisterHandler(actions.DeletePortainerK8sRegistrySecrets, handlers.NewHandlerDeleteRegistrySecrets(authorizationService, dataStore, kubernetesClientFactory))
 	pendingActionsService.RegisterHandler(actions.PostInitMigrateEnvironment, handlers.NewHandlerPostInitMigrateEnvironment(authorizationService, dataStore, kubernetesClientFactory, dockerClientFactory, *flags.Assets, kubernetesDeployer))

-	snapshotService, err := initSnapshotService(*flags.SnapshotInterval, dataStore, dockerClientFactory, kubernetesClientFactory, pendingActionsService)
+	snapshotService, err := initSnapshotService(*flags.SnapshotInterval, dataStore, dockerClientFactory, kubernetesClientFactory, shutdownCtx, pendingActionsService)
 	if err != nil {
 		log.Fatal().Err(err).Msg("failed initializing snapshot service")
 	}

-	snapshotService.Start(shutdownCtx)
+	snapshotService.Start()

 	proxyManager.NewProxyFactory(dataStore, signatureService, reverseTunnelService, dockerClientFactory, kubernetesClientFactory, kubernetesTokenCacheManager, gitService, snapshotService, jwtService)

-	helmPackageManager := libhelm.NewHelmPackageManager()
+	helmPackageManager, err := initHelmPackageManager()
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed initializing helm package manager")
+	}

 	applicationStatus := initStatus(instanceID)

@@ -525,7 +539,10 @@ func buildServer(flags *portainer.CLIFlags, shutdownCtx context.Context, shutdow
 		log.Fatal().Msg("failed to fetch SSL settings from DB")
 	}

-	platformService := platform.NewService(dataStore)
+	platformService, err := platform.NewService(dataStore)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed initializing platform service")
+	}

 	upgradeService, err := upgrade.NewService(
 		*flags.Assets,
@@ -555,13 +572,6 @@ func buildServer(flags *portainer.CLIFlags, shutdownCtx context.Context, shutdow
 		log.Fatal().Err(err).Msg("failure during post init migrations")
 	}

-	if err := dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		return recoverStaleDeployingStacks(tx)
-	}); err != nil {
-		log.Info().Err(err).
-			Msg("Error recovering stale deploying stacks")
-	}
-
 	return &http.Server{
 		AuthorizationService:        authorizationService,
 		ReverseTunnelService:        reverseTunnelService,
@@ -584,6 +594,7 @@ func buildServer(flags *portainer.CLIFlags, shutdownCtx context.Context, shutdow
 		LDAPService:                 ldapService,
 		OAuthService:                oauthService,
 		GitService:                  gitService,
+		OpenAMTService:              openAMTService,
 		ProxyManager:                proxyManager,
 		KubernetesTokenCacheManager: kubernetesTokenCacheManager,
 		KubeClusterAccessService:    kubeClusterAccessService,
@@ -593,6 +604,7 @@ func buildServer(flags *portainer.CLIFlags, shutdownCtx context.Context, shutdow
 		DockerClientFactory:         dockerClientFactory,
 		KubernetesClientFactory:     kubernetesClientFactory,
 		Scheduler:                   scheduler,
+		ShutdownCtx:                 shutdownCtx,
 		ShutdownTrigger:             shutdownTrigger,
 		StackDeployer:               stackDeployer,
 		UpgradeService:              upgradeService,
@@ -614,8 +626,7 @@ func main() {
 	logs.SetLoggingMode(*flags.LogMode)

 	for {
-		shutdownCtx, shutdownTrigger := context.WithCancel(context.Background())
-		server := buildServer(flags, shutdownCtx, shutdownTrigger)
+		server := buildServer(flags)

 		log.Info().
 			Str("version", portainer.APIVersion).
@@ -627,44 +638,8 @@ func main() {
 			Str("go_version", build.GoVersion).
 			Msg("starting Portainer")

-		err := server.Start(shutdownCtx)
+		err := server.Start()

 		log.Info().Err(err).Msg("HTTP server exited")
 	}
 }
-
-// recoverStaleDeployingStacks resets any stack that was left in the Deploying state
-// (e.g. because the server was restarted mid-deployment) to the Error state so the
-// user can retry.
-func recoverStaleDeployingStacks(tx dataservices.DataStoreTx) error {
-	stacks, err := tx.Stack().ReadAll(func(s portainer.Stack) bool {
-		return s.Status == portainer.StackStatusDeploying
-	})
-	if err != nil {
-		return err
-	}
-
-	for _, stack := range stacks {
-		stack.Status = portainer.StackStatusError
-		stack.DeploymentStatus = append(stack.DeploymentStatus, portainer.StackDeploymentStatus{
-			Status:  portainer.StackStatusError,
-			Time:    time.Now().Unix(),
-			Message: "Deployment interrupted by server restart",
-		})
-
-		if err := tx.Stack().Update(stack.ID, &stack); err != nil {
-			log.Warn().Err(err).
-				Int("stack_id", int(stack.ID)).
-				Str("context", "RecoverStaleDeployingStacks").
-				Msg("Unable to recover stale deploying stack")
-			continue
-		}
-		log.Debug().
-			Int("stack_id", int(stack.ID)).
-			Str("stack_name", stack.Name).
-			Str("context", "RecoverStaleDeployingStacks").
-			Msg("Recovered stale deploying stack to error state")
-	}
-
-	return nil
-}
@@ -2,12 +2,9 @@ package main

 import (
 	"os"
+	"path"
 	"testing"

-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/filesystem"
-	"github.com/portainer/portainer/api/internal/testhelpers"
-
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -15,15 +12,14 @@ import (
 const secretFileName = "secret.txt"

 func createPasswordFile(t *testing.T, secretPath, password string) string {
-	err := os.WriteFile(secretPath, []byte(password), 0o600)
+	err := os.WriteFile(secretPath, []byte(password), 0600)
 	require.NoError(t, err)
 	return secretPath
 }

 func TestLoadEncryptionSecretKey(t *testing.T) {
-	t.Parallel()
 	tempDir := t.TempDir()
-	secretPath := filesystem.JoinPaths(tempDir, secretFileName)
+	secretPath := path.Join(tempDir, secretFileName)

 	// first pointing to file that does not exist, gives nil hash (no encryption)
 	encryptionKey := loadEncryptionSecretKey(secretPath)
@@ -42,67 +38,7 @@ func TestLoadEncryptionSecretKey(t *testing.T) {
 	require.Len(t, encryptionKey, 32)
 }

-func TestUpdateSettingsFromFlags_KubectlShellImage(t *testing.T) {
-	const existingImage = "existing-image:v1"
-	const newImage = "new-image:v2"
-
-	emptyString := ""
-	falseBool := false
-	var emptyLabels []portainer.Pair
-
-	tests := []struct {
-		name                      string
-		imageSet                  bool
-		flagImage                 string
-		expectedKubectlShellImage string
-	}{
-		{
-			name:                      "flag not set — DB image unchanged",
-			imageSet:                  false,
-			flagImage:                 portainer.DefaultKubectlShellImage,
-			expectedKubectlShellImage: existingImage,
-		},
-		{
-			name:                      "flag set — DB image updated",
-			imageSet:                  true,
-			flagImage:                 newImage,
-			expectedKubectlShellImage: newImage,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			store := testhelpers.NewDatastore(
-				testhelpers.WithSettingsService(&portainer.Settings{
-					KubectlShellImage: existingImage,
-				}),
-				testhelpers.WithSSLSettingsService(&portainer.SSLSettings{}),
-			)
-
-			flags := &portainer.CLIFlags{
-				SnapshotInterval:          &emptyString,
-				Logo:                      &emptyString,
-				EnableEdgeComputeFeatures: &falseBool,
-				Templates:                 &emptyString,
-				Labels:                    &emptyLabels,
-				HTTPDisabled:              &falseBool,
-				HTTPEnabled:               &falseBool,
-			}
-			flags.KubectlShellImage = &tc.flagImage
-			flags.KubectlShellImageSet = tc.imageSet
-
-			err := updateSettingsFromFlags(store, flags)
-			require.NoError(t, err)
-
-			settings, err := store.Settings().Settings()
-			require.NoError(t, err)
-			require.Equal(t, tc.expectedKubectlShellImage, settings.KubectlShellImage)
-		})
-	}
-}
-
 func TestDBSecretPath(t *testing.T) {
-	t.Parallel()
 	tests := []struct {
 		keyFilenameFlag string
 		expected        string
@@ -1,149 +0,0 @@
-package concurrent
-
-import (
-	"context"
-	"errors"
-	"sync/atomic"
-	"testing"
-	"testing/synctest"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestRun_AllSucceed(t *testing.T) {
-	t.Parallel()
-
-	fn1 := func(ctx context.Context) (any, error) { return "one", nil }
-	fn2 := func(ctx context.Context) (any, error) { return "two", nil }
-	fn3 := func(ctx context.Context) (any, error) { return "three", nil }
-
-	results, err := Run(t.Context(), 0, fn1, fn2, fn3)
-
-	require.NoError(t, err)
-	require.Len(t, results, 3)
-
-	values := make([]string, 0, len(results))
-	for _, r := range results {
-		values = append(values, r.Result.(string))
-	}
-	require.ElementsMatch(t, []string{"one", "two", "three"}, values)
-}
-
-func TestRun_OneError(t *testing.T) {
-	t.Parallel()
-
-	sentinel := errors.New("task failed")
-
-	fn1 := func(ctx context.Context) (any, error) { return "ok", nil }
-	fn2 := func(ctx context.Context) (any, error) { return nil, sentinel }
-
-	_, err := Run(t.Context(), 0, fn1, fn2)
-
-	require.ErrorIs(t, err, sentinel)
-}
-
-func TestRun_NoTasks(t *testing.T) {
-	t.Parallel()
-
-	results, err := Run(t.Context(), 0)
-
-	require.NoError(t, err)
-	require.Empty(t, results)
-}
-
-func TestRun_MaxConcurrency(t *testing.T) {
-	t.Parallel()
-
-	const numTasks = 10
-	var peak atomic.Int32
-	var active atomic.Int32
-
-	task := func(ctx context.Context) (any, error) {
-		current := active.Add(1)
-		if current > peak.Load() {
-			peak.Store(current)
-		}
-
-		time.Sleep(10 * time.Millisecond)
-		active.Add(-1)
-
-		return nil, nil
-	}
-
-	tasks := make([]Func, numTasks)
-	for i := range tasks {
-		tasks[i] = task
-	}
-
-	synctest.Test(t, func(t *testing.T) {
-		results, err := Run(t.Context(), 3, tasks...)
-		require.NoError(t, err)
-		require.Len(t, results, numTasks)
-		require.LessOrEqual(t, peak.Load(), int32(3))
-	})
-}
-
-func TestRun_ZeroConcurrencyUsesAllTasks(t *testing.T) {
-	t.Parallel()
-
-	const numTasks = 5
-	var peak atomic.Int32
-	var active atomic.Int32
-
-	task := func(ctx context.Context) (any, error) {
-		current := active.Add(1)
-		if current > peak.Load() {
-			peak.Store(current)
-		}
-
-		time.Sleep(20 * time.Millisecond)
-		active.Add(-1)
-
-		return nil, nil
-	}
-
-	tasks := make([]Func, numTasks)
-	for i := range tasks {
-		tasks[i] = task
-	}
-
-	synctest.Test(t, func(t *testing.T) {
-		results, err := Run(t.Context(), 0, tasks...)
-		require.NoError(t, err)
-		require.Len(t, results, numTasks)
-		require.Equal(t, int32(numTasks), peak.Load())
-	})
-}
-
-func TestRun_ContextCancelledBeforeStart(t *testing.T) {
-	t.Parallel()
-
-	ctx, cancel := context.WithCancel(t.Context())
-	cancel()
-
-	called := atomic.Bool{}
-	fn := func(ctx context.Context) (any, error) {
-		called.Store(true)
-		return nil, ctx.Err()
-	}
-
-	_, err := Run(ctx, 1, fn, fn, fn)
-	require.Error(t, err)
-}
-
-func TestRun_ContextPassedToTasks(t *testing.T) {
-	t.Parallel()
-
-	type key struct{}
-	ctx := context.WithValue(t.Context(), key{}, "testvalue")
-
-	fn := func(ctx context.Context) (any, error) {
-		return ctx.Value(key{}), nil
-	}
-
-	results, err := Run(ctx, 0, fn)
-
-	require.NoError(t, err)
-	require.Equal(t, "testvalue", results[0].Result)
-}
@@ -6,9 +6,9 @@ import (
 	"io"
 	"math/rand"
 	"os"
+	"path/filepath"
 	"testing"

-	"github.com/portainer/portainer/api/filesystem"
 	"github.com/portainer/portainer/api/logs"
 	"github.com/portainer/portainer/pkg/fips"

@@ -42,9 +42,9 @@ func Test_encryptAndDecrypt_withTheSamePassword(t *testing.T) {
 		tmpdir := t.TempDir()

 		var (
-			originFilePath    = filesystem.JoinPaths(tmpdir, "origin")
-			encryptedFilePath = filesystem.JoinPaths(tmpdir, "encrypted")
-			decryptedFilePath = filesystem.JoinPaths(tmpdir, "decrypted")
+			originFilePath    = filepath.Join(tmpdir, "origin")
+			encryptedFilePath = filepath.Join(tmpdir, "encrypted")
+			decryptedFilePath = filepath.Join(tmpdir, "decrypted")
 		)

 		content := randBytes(1024*1024*100 + 523)
@@ -141,16 +141,15 @@ func Test_encryptAndDecrypt_withTheSamePassword(t *testing.T) {
 }

 func Test_encryptAndDecrypt_withStrongPassphrase(t *testing.T) {
-	t.Parallel()
 	const passphrase = "A strong passphrase with special characters: !@#$%^&*()_+"

 	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc) {
 		tmpdir := t.TempDir()

 		var (
-			originFilePath    = filesystem.JoinPaths(tmpdir, "origin2")
-			encryptedFilePath = filesystem.JoinPaths(tmpdir, "encrypted2")
-			decryptedFilePath = filesystem.JoinPaths(tmpdir, "decrypted2")
+			originFilePath    = filepath.Join(tmpdir, "origin2")
+			encryptedFilePath = filepath.Join(tmpdir, "encrypted2")
+			decryptedFilePath = filepath.Join(tmpdir, "decrypted2")
 		)

 		content := randBytes(500)
@@ -201,14 +200,13 @@ func Test_encryptAndDecrypt_withStrongPassphrase(t *testing.T) {
 }

 func Test_encryptAndDecrypt_withTheSamePasswordSmallFile(t *testing.T) {
-	t.Parallel()
 	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc) {
 		tmpdir := t.TempDir()

 		var (
-			originFilePath    = filesystem.JoinPaths(tmpdir, "origin2")
-			encryptedFilePath = filesystem.JoinPaths(tmpdir, "encrypted2")
-			decryptedFilePath = filesystem.JoinPaths(tmpdir, "decrypted2")
+			originFilePath    = filepath.Join(tmpdir, "origin2")
+			encryptedFilePath = filepath.Join(tmpdir, "encrypted2")
+			decryptedFilePath = filepath.Join(tmpdir, "decrypted2")
 		)

 		content := randBytes(500)
@@ -259,14 +257,13 @@ func Test_encryptAndDecrypt_withTheSamePasswordSmallFile(t *testing.T) {
 }

 func Test_encryptAndDecrypt_withEmptyPassword(t *testing.T) {
-	t.Parallel()
 	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc) {
 		tmpdir := t.TempDir()

 		var (
-			originFilePath    = filesystem.JoinPaths(tmpdir, "origin")
-			encryptedFilePath = filesystem.JoinPaths(tmpdir, "encrypted")
-			decryptedFilePath = filesystem.JoinPaths(tmpdir, "decrypted")
+			originFilePath    = filepath.Join(tmpdir, "origin")
+			encryptedFilePath = filepath.Join(tmpdir, "encrypted")
+			decryptedFilePath = filepath.Join(tmpdir, "decrypted")
 		)

 		content := randBytes(1024 * 50)
@@ -317,14 +314,13 @@ func Test_encryptAndDecrypt_withEmptyPassword(t *testing.T) {
 }

 func Test_decryptWithDifferentPassphrase_shouldProduceWrongResult(t *testing.T) {
-	t.Parallel()
 	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc) {
 		tmpdir := t.TempDir()

 		var (
-			originFilePath    = filesystem.JoinPaths(tmpdir, "origin")
-			encryptedFilePath = filesystem.JoinPaths(tmpdir, "encrypted")
-			decryptedFilePath = filesystem.JoinPaths(tmpdir, "decrypted")
+			originFilePath    = filepath.Join(tmpdir, "origin")
+			encryptedFilePath = filepath.Join(tmpdir, "encrypted")
+			decryptedFilePath = filepath.Join(tmpdir, "decrypted")
 		)

 		content := randBytes(1034)
@@ -389,7 +385,6 @@ func legacyAesEncrypt(input io.Reader, output io.Writer, passphrase []byte) erro
 }

 func Test_hasEncryptedHeader(t *testing.T) {
-	t.Parallel()
 	tests := []struct {
 		name     string
 		data     []byte
@@ -7,7 +7,6 @@ import (
 )

 func TestCreateSignature(t *testing.T) {
-	t.Parallel()
 	var s = NewECDSAService("secret")

 	privKey, pubKey, err := s.GenerateKeyPair()
@@ -7,7 +7,6 @@ import (
 )

 func TestService_Hash(t *testing.T) {
-	t.Parallel()
 	var s = Service{}

 	type args struct {
@@ -56,7 +55,6 @@ func TestService_Hash(t *testing.T) {
 }

 func TestHash(t *testing.T) {
-	t.Parallel()
 	s := Service{}

 	hash, err := s.Hash("Passw0rd!")
@@ -92,9 +92,7 @@ func CreateTLSConfigurationFromDisk(config portainer.TLSConfiguration) (*tls.Con
 }

 func createTLSConfigurationFromDisk(fipsEnabled bool, config portainer.TLSConfiguration) (*tls.Config, error) { //nolint:forbidigo
-	if !config.TLS && fipsEnabled {
-		return nil, fips.ErrTLSRequired
-	} else if !config.TLS {
+	if !config.TLS {
 		return nil, nil
 	}

@@ -10,7 +10,6 @@ import (
 )

 func TestCreateTLSConfiguration(t *testing.T) {
-	t.Parallel()
 	// InsecureSkipVerify = false
 	config := CreateTLSConfiguration(false)
 	require.Equal(t, config.MinVersion, uint16(tls.VersionTLS12)) //nolint:forbidigo
@@ -23,7 +22,6 @@ func TestCreateTLSConfiguration(t *testing.T) {
 }

 func TestCreateTLSConfigurationFIPS(t *testing.T) {
-	t.Parallel()
 	fips := true

 	fipsCipherSuites := []uint16{
@@ -44,7 +42,6 @@ func TestCreateTLSConfigurationFIPS(t *testing.T) {
 }

 func TestCreateTLSConfigurationFromBytes(t *testing.T) {
-	t.Parallel()
 	// No TLS
 	config, err := CreateTLSConfigurationFromBytes(false, nil, nil, nil, false, false)
 	require.NoError(t, err)
@@ -62,7 +59,6 @@ func TestCreateTLSConfigurationFromBytes(t *testing.T) {
 }

 func TestCreateTLSConfigurationFromDisk(t *testing.T) {
-	t.Parallel()
 	// No TLS
 	config, err := CreateTLSConfigurationFromDisk(portainer.TLSConfiguration{})
 	require.NoError(t, err)
@@ -78,7 +74,6 @@ func TestCreateTLSConfigurationFromDisk(t *testing.T) {
 }

 func TestCreateTLSConfigurationFromDiskFIPS(t *testing.T) {
-	t.Parallel()
 	fips := true

 	// Skipping TLS verifications cannot be done in FIPS mode
@@ -2,6 +2,7 @@ package boltdb

 import (
 	"os"
+	"path"
 	"testing"

 	"github.com/portainer/portainer/api/filesystem"
@@ -12,7 +13,6 @@ import (
 )

 func Test_NeedsEncryptionMigration(t *testing.T) {
-	t.Parallel()
 	// Test the specific scenarios mentioned in NeedsEncryptionMigration

 	// i.e.
@@ -96,7 +96,7 @@ func Test_NeedsEncryptionMigration(t *testing.T) {

 			if tc.dbname == "both" {
 				// Special case.  If portainer.db and portainer.edb exist.
-				dbFile1 := filesystem.JoinPaths(connection.Path, DatabaseFileName)
+				dbFile1 := path.Join(connection.Path, DatabaseFileName)
 				f, _ := os.Create(dbFile1)

 				err := f.Close()
@@ -107,7 +107,7 @@ func Test_NeedsEncryptionMigration(t *testing.T) {
 					require.NoError(t, err)
 				}()

-				dbFile2 := filesystem.JoinPaths(connection.Path, EncryptedDatabaseFileName)
+				dbFile2 := path.Join(connection.Path, EncryptedDatabaseFileName)
 				f, _ = os.Create(dbFile2)

 				err = f.Close()
@@ -118,7 +118,7 @@ func Test_NeedsEncryptionMigration(t *testing.T) {
 					require.NoError(t, err)
 				}()
 			} else if tc.dbname != "" {
-				dbFile := filesystem.JoinPaths(connection.Path, tc.dbname)
+				dbFile := path.Join(connection.Path, tc.dbname)
 				f, _ := os.Create(dbFile)

 				err := f.Close()
@@ -143,7 +143,6 @@ func Test_NeedsEncryptionMigration(t *testing.T) {
 }

 func TestDBCompaction(t *testing.T) {
-	t.Parallel()
 	db := &DbConnection{Path: t.TempDir()}

 	err := db.Open()
@@ -45,12 +45,12 @@ func (connection *DbConnection) UnmarshalObject(data []byte, object any) error {
 		}
 	}

-	if err := json.Unmarshal(data, object); err != nil {
+	if e := json.Unmarshal(data, object); e != nil {
 		// Special case for the VERSION bucket. Here we're not using json
 		// So we need to return it as a string
 		s, ok := object.(*string)
 		if !ok {
-			return errors.Wrap(err, "Failed unmarshalling object")
+			return errors.Wrap(err, e.Error())
 		}

 		*s = string(data)
@@ -10,14 +10,14 @@ import (
 	"io"
 	"testing"

-	"github.com/google/uuid"
+	"github.com/gofrs/uuid"
 	"github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

 const (
-	jsonobject = `{"LogoURL":"","BlackListedLabels":[],"AuthenticationMethod":1,"InternalAuthSettings": {"RequiredPasswordLength": 12}"LDAPSettings":{"AnonymousMode":true,"ReaderDN":"","URL":"","TLSConfig":{"TLS":false,"TLSSkipVerify":false},"StartTLS":false,"SearchSettings":[{"BaseDN":"","Filter":"","UserNameAttribute":""}],"GroupSearchSettings":[{"GroupBaseDN":"","GroupFilter":"","GroupAttribute":""}],"AutoCreateUsers":true},"OAuthSettings":{"ClientID":"","AccessTokenURI":"","AuthorizationURI":"","ResourceURI":"","RedirectURI":"","UserIdentifier":"","Scopes":"","OAuthAutoCreateUsers":false,"DefaultTeamID":0,"SSO":true,"LogoutURI":"","KubeSecretKey":"j0zLVtY/lAWBk62ByyF0uP80SOXaitsABP0TTJX8MhI="},"FeatureFlagSettings":{},"SnapshotInterval":"5m","TemplatesURL":"https://raw.githubusercontent.com/portainer/templates/master/templates-2.0.json","EdgeAgentCheckinInterval":5,"EnableEdgeComputeFeatures":false,"UserSessionTimeout":"8h","KubeconfigExpiry":"0","HelmRepositoryURL":"https://charts.bitnami.com/bitnami","KubectlShellImage":"portainer/kubectl-shell","DisplayDonationHeader":false,"DisplayExternalContributors":false,"EnableHostManagementFeatures":false,"AllowVolumeBrowserForRegularUsers":false,"AllowBindMountsForRegularUsers":false,"AllowPrivilegedModeForRegularUsers":false,"AllowHostNamespaceForRegularUsers":false,"AllowStackManagementForRegularUsers":false,"AllowDeviceMappingForRegularUsers":false,"AllowContainerCapabilitiesForRegularUsers":false}`
+	jsonobject = `{"LogoURL":"","BlackListedLabels":[],"AuthenticationMethod":1,"InternalAuthSettings": {"RequiredPasswordLength": 12}"LDAPSettings":{"AnonymousMode":true,"ReaderDN":"","URL":"","TLSConfig":{"TLS":false,"TLSSkipVerify":false},"StartTLS":false,"SearchSettings":[{"BaseDN":"","Filter":"","UserNameAttribute":""}],"GroupSearchSettings":[{"GroupBaseDN":"","GroupFilter":"","GroupAttribute":""}],"AutoCreateUsers":true},"OAuthSettings":{"ClientID":"","AccessTokenURI":"","AuthorizationURI":"","ResourceURI":"","RedirectURI":"","UserIdentifier":"","Scopes":"","OAuthAutoCreateUsers":false,"DefaultTeamID":0,"SSO":true,"LogoutURI":"","KubeSecretKey":"j0zLVtY/lAWBk62ByyF0uP80SOXaitsABP0TTJX8MhI="},"OpenAMTConfiguration":{"Enabled":false,"MPSServer":"","MPSUser":"","MPSPassword":"","MPSToken":"","CertFileContent":"","CertFileName":"","CertFilePassword":"","DomainName":""},"FeatureFlagSettings":{},"SnapshotInterval":"5m","TemplatesURL":"https://raw.githubusercontent.com/portainer/templates/master/templates-2.0.json","EdgeAgentCheckinInterval":5,"EnableEdgeComputeFeatures":false,"UserSessionTimeout":"8h","KubeconfigExpiry":"0","HelmRepositoryURL":"https://charts.bitnami.com/bitnami","KubectlShellImage":"portainer/kubectl-shell","DisplayDonationHeader":false,"DisplayExternalContributors":false,"EnableHostManagementFeatures":false,"AllowVolumeBrowserForRegularUsers":false,"AllowBindMountsForRegularUsers":false,"AllowPrivilegedModeForRegularUsers":false,"AllowHostNamespaceForRegularUsers":false,"AllowStackManagementForRegularUsers":false,"AllowDeviceMappingForRegularUsers":false,"AllowContainerCapabilitiesForRegularUsers":false}`
 	passphrase = "my secret key"
 )

@@ -27,10 +27,9 @@ func secretToEncryptionKey(passphrase string) []byte {
 }

 func Test_MarshalObjectUnencrypted(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)

-	uuid := uuid.New()
+	uuid := uuid.Must(uuid.NewV4())

 	tests := []struct {
 		object   any
@@ -102,7 +101,6 @@ func Test_MarshalObjectUnencrypted(t *testing.T) {
 }

 func Test_UnMarshalObjectUnencrypted(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)

 	// Based on actual data entering and what we expect out of the function
@@ -144,7 +142,6 @@ func Test_UnMarshalObjectUnencrypted(t *testing.T) {
 }

 func Test_ObjectMarshallingEncrypted(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)

 	// Based on actual data entering and what we expect out of the function
@@ -187,7 +184,6 @@ func Test_ObjectMarshallingEncrypted(t *testing.T) {
 }

 func Test_NonceSources(t *testing.T) {
-	t.Parallel()
 	// ensure that the new go 1.24 NewGCMWithRandomNonce works correctly with
 	// the old way of creating and including the nonce

@@ -18,7 +18,6 @@ type testStruct struct {
 }

 func TestTxs(t *testing.T) {
-	t.Parallel()
 	conn := DbConnection{Path: t.TempDir()}

 	err := conn.Open()
@@ -10,7 +10,6 @@ import (
 )

 func TestNewDatabase(t *testing.T) {
-	t.Parallel()
 	dbPath := filesystem.JoinPaths(t.TempDir(), "test.db")
 	connection, err := NewDatabase("boltdb", dbPath, nil, false)
 	require.NoError(t, err)
@@ -51,7 +51,6 @@ func (m mockConnection) ConvertToKey(v int) []byte {
 	return []byte(strconv.Itoa(v))
 }
 func TestReadAll(t *testing.T) {
-	t.Parallel()
 	service := BaseDataService[testObject, int]{
 		Bucket:     "testBucket",
 		Connection: mockConnection{store: make(map[int]testObject)},
@@ -9,8 +9,7 @@ import (
 )

 func TestCustomTemplateCreate(t *testing.T) {
-	t.Parallel()
-	_, ds := datastore.MustNewTestStore(t, false, false)
+	_, ds := datastore.MustNewTestStore(t, true, false)
 	require.NotNil(t, ds)

 	require.NoError(t, ds.CustomTemplate().Create(&portainer.CustomTemplate{ID: 1}))
@@ -10,8 +10,7 @@ import (
 )

 func TestCustomTemplateCreateTx(t *testing.T) {
-	t.Parallel()
-	_, ds := datastore.MustNewTestStore(t, false, false)
+	_, ds := datastore.MustNewTestStore(t, true, false)
 	require.NotNil(t, ds)

 	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
@@ -11,7 +11,6 @@ import (
 )

 func TestUpdate(t *testing.T) {
-	t.Parallel()
 	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
 	err := conn.Open()
 	require.NoError(t, err)
@@ -119,19 +119,6 @@ func (service *Service) Endpoints() ([]portainer.Endpoint, error) {
 	return endpoints, nil
 }

-// ReadAll retrieves all the elements that satisfy all the provided predicates.
-func (service *Service) ReadAll(predicates ...func(endpoint portainer.Endpoint) bool) ([]portainer.Endpoint, error) {
-	var endpoints []portainer.Endpoint
-	var err error
-
-	err = service.connection.ViewTx(func(tx portainer.Transaction) error {
-		endpoints, err = service.Tx(tx).ReadAll(predicates...)
-		return err
-	})
-
-	return endpoints, err
-}
-
 // EndpointIDByEdgeID returns the EndpointID from the given EdgeID using an in-memory index
 func (service *Service) EndpointIDByEdgeID(edgeID string) (portainer.EndpointID, bool) {
 	service.mu.RLock()
@@ -89,11 +89,6 @@ func (service ServiceTx) Endpoints() ([]portainer.Endpoint, error) {
 	)
 }

-// ReadAll retrieves all the elements that satisfy all the provided predicates.
-func (service ServiceTx) ReadAll(predicates ...func(endpoint portainer.Endpoint) bool) ([]portainer.Endpoint, error) {
-	return dataservices.BaseDataServiceTx[portainer.Endpoint, portainer.EndpointID]{Bucket: BucketName, Connection: service.service.connection, Tx: service.tx}.ReadAll(predicates...)
-}
-
 func (service ServiceTx) EndpointIDByEdgeID(edgeID string) (portainer.EndpointID, bool) {
 	log.Error().Str("func", "EndpointIDByEdgeID").Msg("cannot be called inside a transaction")

@@ -28,9 +28,6 @@ func (service *Service) BucketName() string {
 func (service *Service) RegisterUpdateStackFunction(
 	updateFuncTx func(portainer.Transaction, portainer.EdgeStackID, func(*portainer.EdgeStack)) error,
 ) {
-	service.mu.Lock()
-	defer service.mu.Unlock()
-
 	service.updateStackFnTx = updateFuncTx
 }

@@ -13,7 +13,6 @@ import (
 )

 func TestUpdateRelation(t *testing.T) {
-	t.Parallel()
 	const endpointID = 1
 	const edgeStackID1 = 1
 	const edgeStackID2 = 2
@@ -107,7 +106,6 @@ func TestUpdateRelation(t *testing.T) {
 }

 func TestAddEndpointRelationsForEdgeStack(t *testing.T) {
-	t.Parallel()
 	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
 	err := conn.Open()
 	require.NoError(t, err)
@@ -127,7 +125,6 @@ func TestAddEndpointRelationsForEdgeStack(t *testing.T) {
 }

 func TestEndpointRelations(t *testing.T) {
-	t.Parallel()
 	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
 	err := conn.Open()
 	require.NoError(t, err)
@@ -6,7 +6,7 @@ import (

 var (
 	ErrObjectNotFound     = errors.New("object not found inside the database")
-	ErrWrongDBEdition     = errors.New("the Portainer database is set for Portainer Business Edition, please follow the instructions in our documentation to downgrade it: https://docs.portainer.io/faqs/upgrading/can-i-downgrade-from-portainer-business-to-portainer-ce")
+	ErrWrongDBEdition     = errors.New("the Portainer database is set for Portainer Business Edition, please follow the instructions in our documentation to downgrade it: https://documentation.portainer.io/v2.0-be/downgrade/be-to-ce/")
 	ErrDBImportFailed     = errors.New("importing backup failed")
 	ErrDatabaseIsUpdating = errors.New("database is currently in updating state. Failed prior upgrade. Please restore from backup or delete the database and restart Portainer")
 )
@@ -102,9 +102,6 @@ type (

 	// EndpointService represents a service for managing environment(endpoint) data
 	EndpointService interface {
-		// partial dataservices.BaseCRUD[portainer.Endpoint, portainer.EndpointID]
-		ReadAll(predicates ...func(endpoint portainer.Endpoint) bool) ([]portainer.Endpoint, error)
-
 		Endpoint(ID portainer.EndpointID) (*portainer.Endpoint, error)
 		EndpointIDByEdgeID(edgeID string) (portainer.EndpointID, bool)
 		EndpointsByTeamID(teamID portainer.TeamID) ([]portainer.Endpoint, error)
@@ -10,7 +10,6 @@ import (
 )

 func TestDeleteByEndpoint(t *testing.T) {
-	t.Parallel()
 	_, store := datastore.MustNewTestStore(t, false, false)

 	// Create Endpoint 1
@@ -31,13 +31,6 @@ func NewService(connection portainer.Connection) (*Service, error) {
 	}, nil
 }

-func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
-	return ServiceTx{
-		service: service,
-		tx:      tx,
-	}
-}
-
 // Settings retrieve the ssl settings object.
 func (service *Service) Settings() (*portainer.SSLSettings, error) {
 	var settings portainer.SSLSettings
@@ -1,31 +0,0 @@
-package ssl
-
-import (
-	portainer "github.com/portainer/portainer/api"
-)
-
-type ServiceTx struct {
-	service *Service
-	tx      portainer.Transaction
-}
-
-func (service ServiceTx) BucketName() string {
-	return BucketName
-}
-
-// Settings retrieve the settings object.
-func (service ServiceTx) Settings() (*portainer.SSLSettings, error) {
-	var settings portainer.SSLSettings
-
-	err := service.tx.GetObject(BucketName, []byte(key), &settings)
-	if err != nil {
-		return nil, err
-	}
-
-	return &settings, nil
-}
-
-// UpdateSettings persists a Settings object.
-func (service ServiceTx) UpdateSettings(settings *portainer.SSLSettings) error {
-	return service.tx.UpdateObject(BucketName, []byte(key), settings)
-}
@@ -8,13 +8,13 @@ import (
 	"github.com/portainer/portainer/api/datastore"
 	"github.com/portainer/portainer/api/filesystem"

-	"github.com/google/uuid"
+	"github.com/gofrs/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

 func newGuidString(t *testing.T) string {
-	uuid, err := uuid.NewRandom()
+	uuid, err := uuid.NewV4()
 	require.NoError(t, err)

 	return uuid.String()
@@ -27,11 +27,10 @@ type stackBuilder struct {
 }

 func TestService_StackByWebhookID(t *testing.T) {
-	t.Parallel()
 	if testing.Short() {
 		t.Skip("skipping test in short mode. Normally takes ~1s to run.")
 	}
-	_, store := datastore.MustNewTestStore(t, false, true)
+	_, store := datastore.MustNewTestStore(t, true, true)

 	b := stackBuilder{t: t, store: store}
 	b.createNewStack(newGuidString(t))
@@ -85,11 +84,10 @@ func (b *stackBuilder) createNewStack(webhookID string) portainer.Stack {
 }

 func Test_RefreshableStacks(t *testing.T) {
-	t.Parallel()
 	if testing.Short() {
 		t.Skip("skipping test in short mode. Normally takes ~1s to run.")
 	}
-	_, store := datastore.MustNewTestStore(t, false, true)
+	_, store := datastore.MustNewTestStore(t, true, true)

 	staticStack := portainer.Stack{ID: 1}
 	stackWithWebhook := portainer.Stack{ID: 2, AutoUpdate: &portainer.AutoUpdateSettings{Webhook: "webhook"}}
@@ -3,7 +3,6 @@ package tests
 import (
 	"testing"

-	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices/errors"
 	"github.com/portainer/portainer/api/datastore"

@@ -11,29 +10,9 @@ import (
 	"github.com/stretchr/testify/require"
 )

-type teamBuilder struct {
-	t     *testing.T
-	count int
-	store *datastore.Store
-}
-
-func (b *teamBuilder) createNew(name string) *portainer.Team {
-	b.count++
-	team := &portainer.Team{
-		ID:   portainer.TeamID(b.count),
-		Name: name,
-	}
-
-	err := b.store.Team().Create(team)
-	assert.NoError(b.t, err)
-
-	return team
-}
-
 func Test_teamByName(t *testing.T) {
-	t.Parallel()
 	t.Run("When store is empty should return ErrObjectNotFound", func(t *testing.T) {
-		_, store := datastore.MustNewTestStore(t, false, true)
+		_, store := datastore.MustNewTestStore(t, true, true)

 		_, err := store.Team().TeamByName("name")
 		require.ErrorIs(t, err, errors.ErrObjectNotFound)
@@ -41,7 +20,7 @@ func Test_teamByName(t *testing.T) {
 	})

 	t.Run("When there is no object with the same name should return ErrObjectNotFound", func(t *testing.T) {
-		_, store := datastore.MustNewTestStore(t, false, true)
+		_, store := datastore.MustNewTestStore(t, true, true)

 		teamBuilder := teamBuilder{
 			t:     t,
@@ -56,7 +35,7 @@ func Test_teamByName(t *testing.T) {
 	})

 	t.Run("When there is an object with the same name should return the object", func(t *testing.T) {
-		_, store := datastore.MustNewTestStore(t, false, true)
+		_, store := datastore.MustNewTestStore(t, true, true)

 		teamBuilder := teamBuilder{
 			t:     t,
@@ -0,0 +1,28 @@
+package tests
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/stretchr/testify/assert"
+)
+
+type teamBuilder struct {
+	t     *testing.T
+	count int
+	store *datastore.Store
+}
+
+func (b *teamBuilder) createNew(name string) *portainer.Team {
+	b.count++
+	team := &portainer.Team{
+		ID:   portainer.TeamID(b.count),
+		Name: name,
+	}
+
+	err := b.store.Team().Create(team)
+	assert.NoError(b.t, err)
+
+	return team
+}
@@ -13,7 +13,6 @@ import (
 )

 func TestStoreCreation(t *testing.T) {
-	t.Parallel()
 	_, store := MustNewTestStore(t, true, true)
 	require.NotNil(t, store)

@@ -32,7 +31,6 @@ func TestStoreCreation(t *testing.T) {
 }

 func TestBackup(t *testing.T) {
-	t.Parallel()
 	_, store := MustNewTestStore(t, true, true)
 	backupFileName := store.backupFilename()
 	t.Run("Backup should create "+backupFileName, func(t *testing.T) {
@@ -54,7 +52,6 @@ func TestBackup(t *testing.T) {
 }

 func TestRestore(t *testing.T) {
-	t.Parallel()
 	_, store := MustNewTestStore(t, true, false)

 	t.Run("Basic Restore", func(t *testing.T) {
@@ -96,7 +93,6 @@ func TestRestore(t *testing.T) {
 }

 func TestBackupDBFile(t *testing.T) {
-	t.Parallel()
 	_, store := MustNewTestStore(t, true, false)

 	t.Run("creates backup file without managing connection state", func(t *testing.T) {
@@ -126,7 +122,6 @@ func TestBackupDBFile(t *testing.T) {
 }

 func TestBackupDBFileUsesCorrectPath(t *testing.T) {
-	t.Parallel()
 	_, store := MustNewTestStore(t, true, false)

 	t.Run("backs up unencrypted db when encrypted flag is false", func(t *testing.T) {
@@ -29,7 +29,6 @@ const (
 // TestStoreFull an eventually comprehensive set of tests for the Store.
 // The idea is what we write to the store, we should read back.
 func TestStoreFull(t *testing.T) {
-	t.Parallel()
 	_, store := MustNewTestStore(t, true, true)

 	testCases := map[string]func(t *testing.T){
@@ -59,7 +59,6 @@ func (store *Store) checkOrCreateDefaultSettings() error {
 			KubectlShellImage:        *store.flags.KubectlShellImage,

 			IsDockerDesktopExtension: isDDExtention,
-			EnforceEdgeID:            true,
 		}

 		return store.SettingsService.UpdateSettings(defaultSettings)
@@ -6,18 +6,18 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"path/filepath"
 	"testing"

+	"github.com/Masterminds/semver"
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/database/boltdb"
 	"github.com/portainer/portainer/api/database/models"
 	"github.com/portainer/portainer/api/datastore/migrator"
-	"github.com/portainer/portainer/api/filesystem"
+	"github.com/stretchr/testify/require"

-	"github.com/Masterminds/semver/v3"
 	"github.com/google/go-cmp/cmp"
 	"github.com/rs/zerolog/log"
-	"github.com/stretchr/testify/require"
 )

 func TestMigrateData(t *testing.T) {
@@ -174,7 +174,6 @@ func TestMigrateData(t *testing.T) {
 }

 func TestRollback(t *testing.T) {
-	t.Parallel()
 	t.Run("Rollback should restore upgrade after backup", func(t *testing.T) {
 		version := "2.11"

@@ -325,7 +324,7 @@ func migrateDBTestHelper(t *testing.T, srcPath, wantPath string, overrideInstanc

 	// Compare the result we got with the one we wanted.
 	if diff := cmp.Diff(wantJSON, gotJSON); diff != "" {
-		gotPath := filesystem.JoinPaths(os.TempDir(), "portainer-migrator-test-fail.json")
+		gotPath := filepath.Join(os.TempDir(), "portainer-migrator-test-fail.json")
 		err = os.WriteFile(
 			gotPath,
 			gotJSON,
@@ -26,7 +26,6 @@ func setup(store *Store) error {
 }

 func TestMigrateSettings(t *testing.T) {
-	t.Parallel()
 	_, store := MustNewTestStore(t, false, true)

 	err := setup(store)
@@ -12,7 +12,6 @@ import (
 )

 func TestMigrateStackEntryPoint(t *testing.T) {
-	t.Parallel()
 	_, store := MustNewTestStore(t, false, true)

 	stackService := store.Stack()
@@ -12,7 +12,6 @@ import (
 )

 func TestMigrateEdgeGroupEndpointsToRoars_2_33_0Idempotency(t *testing.T) {
-	t.Parallel()
 	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
 	err := conn.Open()
 	require.NoError(t, err)
@@ -1,206 +0,0 @@
-package migrator
-
-import (
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/database/boltdb"
-	"github.com/portainer/portainer/api/dataservices/endpoint"
-	"github.com/portainer/portainer/api/dataservices/pendingactions"
-	"github.com/portainer/portainer/api/dataservices/registry"
-	"github.com/portainer/portainer/api/logs"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestMigrateRegistryAccessSASecrets_2_40_0(t *testing.T) {
-	t.Parallel()
-	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
-	err := conn.Open()
-	require.NoError(t, err)
-	defer logs.CloseAndLogErr(conn)
-
-	registryService, err := registry.NewService(conn)
-	require.NoError(t, err)
-
-	endpointService, err := endpoint.NewService(conn)
-	require.NoError(t, err)
-
-	pendingActionsService, err := pendingactions.NewService(conn)
-	require.NoError(t, err)
-
-	t.Run("sets MigrateRegistrySASecrets flag for k8s endpoints with registry access", func(t *testing.T) {
-		k8sEndpoint := &portainer.Endpoint{
-			ID:   1,
-			Name: "k8s-cluster",
-			Type: portainer.AgentOnKubernetesEnvironment,
-		}
-		dockerEndpoint := &portainer.Endpoint{
-			ID:   2,
-			Name: "docker-standalone",
-			Type: portainer.DockerEnvironment,
-		}
-
-		err := conn.CreateObjectWithId(endpoint.BucketName, int(k8sEndpoint.ID), k8sEndpoint)
-		require.NoError(t, err)
-		err = conn.CreateObjectWithId(endpoint.BucketName, int(dockerEndpoint.ID), dockerEndpoint)
-		require.NoError(t, err)
-
-		reg := &portainer.Registry{
-			ID:   1,
-			Name: "test-registry",
-			RegistryAccesses: portainer.RegistryAccesses{
-				k8sEndpoint.ID: portainer.RegistryAccessPolicies{
-					Namespaces: []string{"default", "production"},
-				},
-				dockerEndpoint.ID: portainer.RegistryAccessPolicies{
-					Namespaces: []string{"ignored"},
-				},
-			},
-		}
-
-		err = conn.CreateObjectWithId(registry.BucketName, int(reg.ID), reg)
-		require.NoError(t, err)
-
-		m := NewMigrator(&MigratorParameters{
-			RegistryService:       registryService,
-			EndpointService:       endpointService,
-			PendingActionsService: pendingActionsService,
-		})
-
-		err = m.migrateRegistryAccessSASecrets_2_40_0()
-		require.NoError(t, err)
-
-		updatedK8sEndpoint, err := endpointService.Endpoint(k8sEndpoint.ID)
-		require.NoError(t, err)
-		assert.True(t, updatedK8sEndpoint.PostInitMigrations.MigrateRegistrySASecrets, "should have set MigrateRegistrySASecrets flag for k8s endpoint")
-
-		updatedDockerEndpoint, err := endpointService.Endpoint(dockerEndpoint.ID)
-		require.NoError(t, err)
-		assert.False(t, updatedDockerEndpoint.PostInitMigrations.MigrateRegistrySASecrets, "should not have set MigrateRegistrySASecrets flag for docker endpoint")
-	})
-
-	t.Run("skips endpoints with empty namespaces", func(t *testing.T) {
-		conn2 := &boltdb.DbConnection{Path: t.TempDir()}
-		err := conn2.Open()
-		require.NoError(t, err)
-		defer logs.CloseAndLogErr(conn2)
-
-		registryService2, _ := registry.NewService(conn2)
-		endpointService2, _ := endpoint.NewService(conn2)
-		pendingActionsService2, _ := pendingactions.NewService(conn2)
-
-		k8sEndpoint := &portainer.Endpoint{
-			ID:   10,
-			Name: "k8s-cluster",
-			Type: portainer.AgentOnKubernetesEnvironment,
-		}
-		err = conn2.CreateObjectWithId(endpoint.BucketName, int(k8sEndpoint.ID), k8sEndpoint)
-		require.NoError(t, err)
-
-		reg := &portainer.Registry{
-			ID:   10,
-			Name: "empty-registry",
-			RegistryAccesses: portainer.RegistryAccesses{
-				k8sEndpoint.ID: portainer.RegistryAccessPolicies{
-					Namespaces: []string{},
-				},
-			},
-		}
-		err = conn2.CreateObjectWithId(registry.BucketName, int(reg.ID), reg)
-		require.NoError(t, err)
-
-		m := NewMigrator(&MigratorParameters{
-			RegistryService:       registryService2,
-			EndpointService:       endpointService2,
-			PendingActionsService: pendingActionsService2,
-		})
-
-		err = m.migrateRegistryAccessSASecrets_2_40_0()
-		require.NoError(t, err)
-
-		allPAs, err := pendingActionsService2.ReadAll()
-		require.NoError(t, err)
-		assert.Empty(t, allPAs, "should not create pending actions for empty namespaces")
-	})
-
-	t.Run("skips non-existent endpoints", func(t *testing.T) {
-		conn3 := &boltdb.DbConnection{Path: t.TempDir()}
-		err := conn3.Open()
-		require.NoError(t, err)
-		defer logs.CloseAndLogErr(conn3)
-
-		registryService3, _ := registry.NewService(conn3)
-		endpointService3, _ := endpoint.NewService(conn3)
-		pendingActionsService3, _ := pendingactions.NewService(conn3)
-
-		reg := &portainer.Registry{
-			ID:   20,
-			Name: "orphan-registry",
-			RegistryAccesses: portainer.RegistryAccesses{
-				999: portainer.RegistryAccessPolicies{
-					Namespaces: []string{"default"},
-				},
-			},
-		}
-		err = conn3.CreateObjectWithId(registry.BucketName, int(reg.ID), reg)
-		require.NoError(t, err)
-
-		m := NewMigrator(&MigratorParameters{
-			RegistryService:       registryService3,
-			EndpointService:       endpointService3,
-			PendingActionsService: pendingActionsService3,
-		})
-
-		err = m.migrateRegistryAccessSASecrets_2_40_0()
-		require.NoError(t, err)
-
-		allPAs, err := pendingActionsService3.ReadAll()
-		require.NoError(t, err)
-		assert.Empty(t, allPAs, "should not create pending actions for non-existent endpoints")
-	})
-
-	t.Run("idempotent - running twice creates duplicate actions but doesn't error", func(t *testing.T) {
-		conn4 := &boltdb.DbConnection{Path: t.TempDir()}
-		err := conn4.Open()
-		require.NoError(t, err)
-		defer logs.CloseAndLogErr(conn4)
-
-		registryService4, _ := registry.NewService(conn4)
-		endpointService4, _ := endpoint.NewService(conn4)
-		pendingActionsService4, _ := pendingactions.NewService(conn4)
-
-		k8sEndpoint := &portainer.Endpoint{
-			ID:   30,
-			Name: "k8s-cluster",
-			Type: portainer.AgentOnKubernetesEnvironment,
-		}
-		err = conn4.CreateObjectWithId(endpoint.BucketName, int(k8sEndpoint.ID), k8sEndpoint)
-		require.NoError(t, err)
-
-		reg := &portainer.Registry{
-			ID:   30,
-			Name: "test-registry",
-			RegistryAccesses: portainer.RegistryAccesses{
-				k8sEndpoint.ID: portainer.RegistryAccessPolicies{
-					Namespaces: []string{"default"},
-				},
-			},
-		}
-		err = conn4.CreateObjectWithId(registry.BucketName, int(reg.ID), reg)
-		require.NoError(t, err)
-
-		m := NewMigrator(&MigratorParameters{
-			RegistryService:       registryService4,
-			EndpointService:       endpointService4,
-			PendingActionsService: pendingActionsService4,
-		})
-
-		err = m.migrateRegistryAccessSASecrets_2_40_0()
-		require.NoError(t, err)
-
-		err = m.migrateRegistryAccessSASecrets_2_40_0()
-		require.NoError(t, err)
-	})
-}
@@ -7,7 +7,7 @@ import (
 	"github.com/pkg/errors"
 	portainer "github.com/portainer/portainer/api"

-	"github.com/Masterminds/semver/v3"
+	"github.com/Masterminds/semver"
 	"github.com/rs/zerolog/log"
 )

@@ -95,7 +95,7 @@ func (m *Migrator) NeedsMigration() bool {

 	// In this particular instance we should log a fatal error
 	if m.CurrentDBEdition() != portainer.PortainerCE {
-		log.Fatal().Msg("the Portainer database is set for Portainer Business Edition, please follow the instructions in our documentation to downgrade it: https://docs.portainer.io/faqs/upgrading/can-i-downgrade-from-portainer-business-to-portainer-ce")
+		log.Fatal().Msg("the Portainer database is set for Portainer Business Edition, please follow the instructions in our documentation to downgrade it: https://documentation.portainer.io/v2.0-be/downgrade/be-to-ce/")

 		return false
 	}
@@ -1,58 +0,0 @@
-package migrator
-
-import (
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/internal/endpointutils"
-	"github.com/rs/zerolog/log"
-)
-
-// migrateRegistryAccessSASecrets_2_40_0 marks Kubernetes endpoints that have
-// registry access configured so that imagePullSecrets can be added to their
-// default ServiceAccounts during the post-init migration phase (when cluster
-// access is available).
-func (m *Migrator) migrateRegistryAccessSASecrets_2_40_0() error {
-	log.Info().Msg("migrating registry access service account secrets")
-
-	registries, err := m.registryService.ReadAll()
-	if err != nil {
-		return err
-	}
-
-	endpoints, err := m.endpointService.Endpoints()
-	if err != nil {
-		return err
-	}
-
-	// Collect the IDs of endpoints that have at least one registry with
-	// non-empty namespace access - these need the SA imagePullSecrets migration.
-	needsMigration := make(map[portainer.EndpointID]bool)
-	for _, registry := range registries {
-		for endpointID, access := range registry.RegistryAccesses {
-			if len(access.Namespaces) > 0 {
-				needsMigration[endpointID] = true
-			}
-		}
-	}
-
-	for i := range endpoints {
-		endpoint := &endpoints[i]
-
-		if !endpointutils.IsKubernetesEndpoint(endpoint) {
-			continue
-		}
-
-		if !needsMigration[endpoint.ID] {
-			continue
-		}
-
-		endpoint.PostInitMigrations.MigrateRegistrySASecrets = true
-		if err := m.endpointService.UpdateEndpoint(endpoint.ID, endpoint); err != nil {
-			log.Warn().
-				Err(err).
-				Int("endpointID", int(endpoint.ID)).
-				Msg("failed to set registry SA secret migration flag for endpoint")
-		}
-	}
-
-	return nil
-}
@@ -29,7 +29,7 @@ import (
 	"github.com/portainer/portainer/api/dataservices/version"
 	"github.com/portainer/portainer/api/internal/authorization"

-	"github.com/Masterminds/semver/v3"
+	"github.com/Masterminds/semver"
 	"github.com/rs/zerolog/log"
 )

@@ -258,8 +258,6 @@ func (m *Migrator) initMigrations() {

 	m.addMigrations("2.33.1", m.migrateEdgeGroupEndpointsToRoars_2_33_0)

-	m.addMigrations("2.40.0", m.migrateRegistryAccessSASecrets_2_40_0)
-
 	// WARNING: do not change migrations that have already been released!

 	// Add new migrations above...
@@ -14,7 +14,6 @@ type cleanNAPWithOverridePolicies struct {
 }

 func Test_ConvertCleanNAPWithOverridePoliciesPayload(t *testing.T) {
-	t.Parallel()
 	t.Run("test ConvertCleanNAPWithOverridePoliciesPayload", func(t *testing.T) {

 		_, store := MustNewTestStore(t, true, false)
@@ -1,10 +1,8 @@
 package postinit

 import (
-	"cmp"
 	"context"
 	"fmt"
-	"slices"

 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/client"
@@ -12,7 +10,6 @@ import (
 	"github.com/portainer/portainer/api/dataservices"
 	dockerClient "github.com/portainer/portainer/api/docker/client"
 	"github.com/portainer/portainer/api/internal/endpointutils"
-	"github.com/portainer/portainer/api/internal/registryutils"
 	"github.com/portainer/portainer/api/kubernetes/cli"
 	"github.com/portainer/portainer/api/logs"
 	"github.com/portainer/portainer/api/pendingactions/actions"
@@ -47,65 +44,40 @@ func NewPostInitMigrator(

 // PostInitMigrate will run all post-init migrations, which require docker/kube clients for all edge or non-edge environments
 func (postInitMigrator *PostInitMigrator) PostInitMigrate() error {
-	var environments []portainer.Endpoint
+	environments, err := postInitMigrator.dataStore.Endpoint().Endpoints()
+	if err != nil {
+		log.Error().Err(err).Msg("Error getting environments")
+		return err
+	}

-	if err := postInitMigrator.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		var err error
-		if environments, err = tx.Endpoint().ReadAll(func(endpoint portainer.Endpoint) bool {
-			return endpoints.HasDirectConnectivity(&endpoint)
-		}); err != nil {
-			return fmt.Errorf("failed to retrieve environments: %w", err)
-		}
-
-		var pendingActions []portainer.PendingAction
-		if pendingActions, err = tx.PendingActions().ReadAll(func(action portainer.PendingAction) bool {
-			return action.Action == actions.PostInitMigrateEnvironment
-		}); err != nil {
-			return fmt.Errorf("failed to retrieve pending actions: %w", err)
-		}
-
-		// Sort for the binary search in createPostInitMigrationPendingAction()
-		slices.SortFunc(pendingActions, func(a, b portainer.PendingAction) int {
-			return cmp.Compare(a.EndpointID, b.EndpointID)
-		})
-
-		for _, environment := range environments {
-			if !endpoints.IsEdgeEndpoint(&environment) {
+	for _, environment := range environments {
+		// edge environments will run after the server starts, in pending actions
+		if endpoints.IsEdgeEndpoint(&environment) {
+			// Skip edge environments that do not have direct connectivity
+			if !endpoints.HasDirectConnectivity(&environment) {
 				continue
 			}

-			// Edge environments will run after the server starts, in pending actions
 			log.Info().
 				Int("endpoint_id", int(environment.ID)).
 				Msg("adding pending action 'PostInitMigrateEnvironment' for environment")

-			if err := postInitMigrator.createPostInitMigrationPendingAction(tx, environment.ID, pendingActions); err != nil {
+			if err := postInitMigrator.createPostInitMigrationPendingAction(environment.ID); err != nil {
 				log.Error().
 					Err(err).
 					Int("endpoint_id", int(environment.ID)).
 					Msg("error creating pending action for environment")
 			}
+		} else {
+			// Non-edge environments will run before the server starts.
+			if err := postInitMigrator.MigrateEnvironment(&environment); err != nil {
+				log.Error().
+					Err(err).
+					Int("endpoint_id", int(environment.ID)).
+					Msg("error running post-init migrations for non-edge environment")
+			}
 		}

-		return err
-	}); err != nil {
-		log.Error().Err(err).Msg("error running post-init migrations")
-
-		return err
-	}
-
-	for _, environment := range environments {
-		if endpoints.IsEdgeEndpoint(&environment) {
-			continue
-		}
-
-		// Non-edge environments will run before the server starts.
-		if err := postInitMigrator.MigrateEnvironment(&environment); err != nil {
-			log.Error().
-				Err(err).
-				Int("endpoint_id", int(environment.ID)).
-				Msg("error running post-init migrations for non-edge environment")
-		}
 	}

 	return nil
@@ -113,79 +85,59 @@ func (postInitMigrator *PostInitMigrator) PostInitMigrate() error {

 // try to create a post init migration pending action. If it already exists, do nothing
 // this function exists for readability, not reusability
-// pending actions must be passed in ascending order by endpoint ID
-func (postInitMigrator *PostInitMigrator) createPostInitMigrationPendingAction(tx dataservices.DataStoreTx, environmentID portainer.EndpointID, pendingActions []portainer.PendingAction) error {
+func (postInitMigrator *PostInitMigrator) createPostInitMigrationPendingAction(environmentID portainer.EndpointID) error {
 	action := portainer.PendingAction{
 		EndpointID: environmentID,
 		Action:     actions.PostInitMigrateEnvironment,
 	}

-	if _, found := slices.BinarySearchFunc(pendingActions, environmentID, func(e portainer.PendingAction, id portainer.EndpointID) int {
-		return cmp.Compare(e.EndpointID, id)
-	}); found {
-		log.Debug().
-			Str("action", action.Action).
-			Int("endpoint_id", int(action.EndpointID)).
-			Msg("pending action already exists for environment, skipping...")
-
-		return nil
+	pendingActions, err := postInitMigrator.dataStore.PendingActions().ReadAll()
+	if err != nil {
+		return fmt.Errorf("failed to retrieve pending actions: %w", err)
 	}

-	return tx.PendingActions().Create(&action)
+	for _, dba := range pendingActions {
+		if dba.EndpointID == action.EndpointID && dba.Action == action.Action {
+			log.Debug().
+				Str("action", action.Action).
+				Int("endpoint_id", int(action.EndpointID)).
+				Msg("pending action already exists for environment, skipping...")
+			return nil
+		}
+	}
+
+	return postInitMigrator.dataStore.PendingActions().Create(&action)
 }

 // MigrateEnvironment runs migrations on a single environment
 func (migrator *PostInitMigrator) MigrateEnvironment(environment *portainer.Endpoint) error {
-	log.Info().
-		Int("endpoint_id", int(environment.ID)).
-		Msg("executing post init migration for environment")
+	log.Info().Msgf("Executing post init migration for environment %d", environment.ID)

 	switch {
 	case endpointutils.IsKubernetesEndpoint(environment):
 		// get the kubeclient for the environment, and skip all kube migrations if there's an error
 		kubeclient, err := migrator.kubeFactory.GetPrivilegedKubeClient(environment)
 		if err != nil {
-			log.Error().
-				Err(err).
-				Int("endpoint_id", int(environment.ID)).
-				Msg("error creating kubeclient for environment")
-
+			log.Error().Err(err).Msgf("Error creating kubeclient for environment: %d", environment.ID)
 			return err
 		}

-		// If one environment fails, it is logged and the next migration runs. The error is returned at the end and handled by pending actions
-		var latestErr error
-		kubernetesMigrations := []func() error{
-			func() error { return migrator.MigrateIngresses(*environment, kubeclient) },
-			func() error { return migrator.MigrateRegistrySASecrets(*environment, kubeclient) },
+		// if one environment fails, it is logged and the next migration runs. The error is returned at the end and handled by pending actions
+		if err := migrator.MigrateIngresses(*environment, kubeclient); err != nil {
+			return err
 		}

-		for _, migration := range kubernetesMigrations {
-			if err := migration(); err != nil {
-				latestErr = err
-			}
-		}
-
-		return latestErr
+		return nil
 	case endpointutils.IsDockerEndpoint(environment):
 		// get the docker client for the environment, and skip all docker migrations if there's an error
 		dockerClient, err := migrator.dockerFactory.CreateClient(environment, "", nil)
 		if err != nil {
-			log.Error().
-				Err(err).
-				Int("endpoint_id", int(environment.ID)).
-				Msg("error creating docker client for environment")
-
+			log.Error().Err(err).Msgf("Error creating docker client for environment: %d", environment.ID)
 			return err
 		}
 		defer logs.CloseAndLogErr(dockerClient)

 		if err := migrator.MigrateGPUs(*environment, dockerClient); err != nil {
-			log.Error().
-				Err(err).
-				Int("endpoint_id", int(environment.ID)).
-				Msg("error migrating GPUs for environment")
-
 			return err
 		}
 	}
@@ -193,73 +145,18 @@ func (migrator *PostInitMigrator) MigrateEnvironment(environment *portainer.Endp
 	return nil
 }

-func (migrator *PostInitMigrator) MigrateRegistrySASecrets(environment portainer.Endpoint, kubeclient *cli.KubeClient) error {
-	if !environment.PostInitMigrations.MigrateRegistrySASecrets {
-		return nil
-	}
-
-	log.Debug().
-		Int("endpoint_id", int(environment.ID)).
-		Msg("migrating registry SA secrets for environment")
-
-	return migrator.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		env, err := tx.Endpoint().Endpoint(environment.ID)
-		if err != nil {
-			return err
-		}
-
-		if !env.PostInitMigrations.MigrateRegistrySASecrets {
-			return nil
-		}
-
-		registries, err := tx.Registry().ReadAll()
-		if err != nil {
-			return err
-		}
-
-		for _, registry := range registries {
-			access, ok := registry.RegistryAccesses[env.ID]
-			if !ok || len(access.Namespaces) == 0 {
-				continue
-			}
-
-			secretName := registryutils.RegistrySecretName(registry.ID)
-			for _, namespace := range access.Namespaces {
-				if err := kubeclient.AddImagePullSecretToServiceAccount(namespace, "default", secretName); err != nil {
-					log.Warn().
-						Err(err).
-						Int("endpoint_id", int(env.ID)).
-						Str("namespace", namespace).
-						Str("secret", secretName).
-						Msg("failed to add imagePullSecret to service account during registry SA secret migration")
-				}
-			}
-		}
-
-		env.PostInitMigrations.MigrateRegistrySASecrets = false
-		return tx.Endpoint().UpdateEndpoint(env.ID, env)
-	})
-}
-
 func (migrator *PostInitMigrator) MigrateIngresses(environment portainer.Endpoint, kubeclient *cli.KubeClient) error {
 	// Early exit if we do not need to migrate!
 	if !environment.PostInitMigrations.MigrateIngresses {
 		return nil
 	}
+	log.Debug().Msgf("Migrating ingresses for environment %d", environment.ID)

-	log.Debug().
-		Int("endpoint_id", int(environment.ID)).
-		Msg("migrating ingresses for environment")
-
-	if err := migrator.kubeFactory.MigrateEndpointIngresses(&environment, migrator.dataStore, kubeclient); err != nil {
-		log.Error().
-			Err(err).
-			Int("endpoint_id", int(environment.ID)).
-			Msg("error migrating ingresses for environment")
-
+	err := migrator.kubeFactory.MigrateEndpointIngresses(&environment, migrator.dataStore, kubeclient)
+	if err != nil {
+		log.Error().Err(err).Msgf("Error migrating ingresses for environment %d", environment.ID)
 		return err
 	}
-
 	return nil
 }

@@ -269,42 +166,29 @@ func (migrator *PostInitMigrator) MigrateGPUs(e portainer.Endpoint, dockerClient
 	return migrator.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
 		environment, err := tx.Endpoint().Endpoint(e.ID)
 		if err != nil {
-			log.Error().
-				Err(err).
-				Int("endpoint_id", int(e.ID)).
-				Msg("error getting environment")
-
+			log.Error().Err(err).Msgf("Error getting environment %d", e.ID)
 			return err
 		}
-
 		// Early exit if we do not need to migrate!
 		if !environment.PostInitMigrations.MigrateGPUs {
 			return nil
 		}
+		log.Debug().Msgf("Migrating GPUs for environment %d", e.ID)

-		log.Debug().
-			Int("endpoint_id", int(e.ID)).
-			Msg("migrating GPUs for environment")
-
-		// Get all containers
+		// get all containers
 		containers, err := dockerClient.ContainerList(context.Background(), container.ListOptions{All: true})
 		if err != nil {
-			log.Error().
-				Err(err).
-				Int("endpoint_id", int(environment.ID)).
-				Msg("failed to list containers for environment")
-
+			log.Error().Err(err).Msgf("failed to list containers for environment %d", environment.ID)
 			return err
 		}

-		// Check for a gpu on each container. If even one GPU is found, set EnableGPUManagement to true for the whole environment
+		// check for a gpu on each container. If even one GPU is found, set EnableGPUManagement to true for the whole environment
 	containersLoop:
 		for _, container := range containers {
 			// https://www.sobyte.net/post/2022-10/go-docker/ has nice documentation on the docker client with GPUs
 			containerDetails, err := dockerClient.ContainerInspect(context.Background(), container.ID)
 			if err != nil {
 				log.Error().Err(err).Msg("failed to inspect container")
-
 				continue
 			}

@@ -318,14 +202,10 @@ func (migrator *PostInitMigrator) MigrateGPUs(e portainer.Endpoint, dockerClient
 			}
 		}

-		// Set the MigrateGPUs flag to false so we don't run this again
+		// set the MigrateGPUs flag to false so we don't run this again
 		environment.PostInitMigrations.MigrateGPUs = false
 		if err := tx.Endpoint().UpdateEndpoint(environment.ID, environment); err != nil {
-			log.Error().
-				Err(err).
-				Int("endpoint_id", int(environment.ID)).
-				Msg("error updating EnableGPUManagement flag for environment")
-
+			log.Error().Err(err).Msgf("Error updating EnableGPUManagement flag for environment %d", environment.ID)
 			return err
 		}

@@ -18,7 +18,6 @@ import (
 )

 func TestMigrateGPUs(t *testing.T) {
-	t.Parallel()
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if strings.HasSuffix(r.URL.Path, "/containers/json") {
 			containerSummary := []container.Summary{{ID: "container1"}}
@@ -80,7 +79,6 @@ func TestMigrateGPUs(t *testing.T) {
 }

 func TestPostInitMigrate_PendingActionsCreated(t *testing.T) {
-	t.Parallel()
 	tests := []struct {
 		name                   string
 		existingPendingActions []*portainer.PendingAction
@@ -74,9 +74,7 @@ func (tx *StoreTx) Snapshot() dataservices.SnapshotService {
 	return tx.store.SnapshotService.Tx(tx.tx)
 }

-func (tx *StoreTx) SSLSettings() dataservices.SSLSettingsService {
-	return tx.store.SSLSettingsService.Tx(tx.tx)
-}
+func (tx *StoreTx) SSLSettings() dataservices.SSLSettingsService { return nil }

 func (tx *StoreTx) Stack() dataservices.StackService {
 	return tx.store.StackService.Tx(tx.tx)
@@ -80,8 +80,7 @@
      "Name": "local",
      "PostInitMigrations": {
        "MigrateGPUs": true,
-        "MigrateIngresses": true,
-        "MigrateRegistrySASecrets": false
+        "MigrateIngresses": true
      },
      "PublicURL": "",
      "SecuritySettings": {
@@ -90,7 +89,6 @@
        "allowDeviceMappingForRegularUsers": true,
        "allowHostNamespaceForRegularUsers": true,
        "allowPrivilegedModeForRegularUsers": true,
-        "allowSecurityOptForRegularUsers": false,
        "allowStackManagementForRegularUsers": true,
        "allowSysctlSettingForRegularUsers": false,
        "allowVolumeBrowserForRegularUsers": false,
@@ -607,7 +605,6 @@
    "EnableEdgeComputeFeatures": false,
    "EnforceEdgeID": false,
    "FeatureFlagSettings": null,
-    "ForceSecureCookies": false,
    "GlobalDeploymentOptions": {
      "hideStacksFunctionality": false
    },
@@ -616,7 +613,7 @@
      "RequiredPasswordLength": 12
    },
    "KubeconfigExpiry": "0",
-    "KubectlShellImage": "portainer/kubectl-shell:2.42.0",
+    "KubectlShellImage": "portainer/kubectl-shell:2.38.0",
    "LDAPSettings": {
      "AnonymousMode": true,
      "AutoCreateUsers": true,
@@ -661,7 +658,18 @@
    "SnapshotInterval": "5m",
    "TemplatesURL": "",
    "TrustOnFirstConnect": false,
-    "UserSessionTimeout": "8h"
+    "UserSessionTimeout": "8h",
+    "openAMTConfiguration": {
+      "certFileContent": "",
+      "certFileName": "",
+      "certFilePassword": "",
+      "domainName": "",
+      "enabled": false,
+      "mpsPassword": "",
+      "mpsServer": "",
+      "mpsToken": "",
+      "mpsUser": ""
+    }
  },
  "snapshots": [
    {
@@ -798,7 +806,6 @@
      "AutoUpdate": null,
      "CreatedBy": "",
      "CreationDate": 0,
-      "DeploymentStartStatus": 0,
      "EndpointId": 1,
      "EntryPoint": "docker/alpine37-compose.yml",
      "Env": [],
@@ -821,7 +828,6 @@
      "AutoUpdate": null,
      "CreatedBy": "",
      "CreationDate": 0,
-      "DeploymentStartStatus": 0,
      "EndpointId": 1,
      "EntryPoint": "docker-compose.yml",
      "Env": [],
@@ -844,7 +850,6 @@
      "AutoUpdate": null,
      "CreatedBy": "",
      "CreationDate": 0,
-      "DeploymentStartStatus": 0,
      "EndpointId": 1,
      "EntryPoint": "docker-compose.yml",
      "Env": [],
@@ -937,7 +942,7 @@
    }
  ],
  "version": {
-    "VERSION": "{\"SchemaVersion\":\"2.42.0\",\"MigratorCount\":0,\"Edition\":1,\"InstanceID\":\"463d5c47-0ea5-4aca-85b1-405ceefee254\"}"
+    "VERSION": "{\"SchemaVersion\":\"2.38.0\",\"MigratorCount\":0,\"Edition\":1,\"InstanceID\":\"463d5c47-0ea5-4aca-85b1-405ceefee254\"}"
  },
  "webhooks": null
 }
@@ -10,7 +10,6 @@ import (
 )

 func TestHttpClient(t *testing.T) {
-	t.Parallel()
 	fips.InitFIPS(false)

 	// Valid TLS configuration
@@ -10,7 +10,7 @@ import (
 	"github.com/portainer/portainer/api/docker/images"
 	"github.com/portainer/portainer/api/logs"

-	"github.com/Masterminds/semver/v3"
+	"github.com/Masterminds/semver"
 	"github.com/docker/docker/api/types"
 	dockercontainer "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/network"
@@ -21,12 +21,14 @@ import (
 type ContainerService struct {
 	factory   *dockerclient.ClientFactory
 	dataStore dataservices.DataStore
+	sr        *serviceRestore
 }

 func NewContainerService(factory *dockerclient.ClientFactory, dataStore dataservices.DataStore) *ContainerService {
 	return &ContainerService{
 		factory:   factory,
 		dataStore: dataStore,
+		sr:        &serviceRestore{},
 	}
 }

@@ -139,14 +141,11 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 			initialNetwork.EndpointsConfig[name] = network
 		}
 	}
+	c.sr.enable()
+	defer c.sr.close()
+	defer c.sr.restore()

-	restore := true
-
-	defer func() {
-		if !restore {
-			return
-		}
-
+	c.sr.push(func() {
 		log.Debug().Str("container_id", containerId).Str("container", container.Name).Msg("restoring the container")
 		if err := cli.ContainerRename(ctx, containerId, container.Name); err != nil {
 			log.Warn().Err(err).Msg("failure to rename container")
@@ -161,7 +160,7 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 		if err := cli.ContainerStart(ctx, containerId, dockercontainer.StartOptions{}); err != nil {
 			log.Warn().Err(err).Msg("failure to start container")
 		}
-	}()
+	})

 	log.Debug().Str("container", strings.Split(container.Name, "/")[1]).Msg("starting to create a new container")

@@ -180,15 +179,8 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 	}

 	create, err := cli.ContainerCreate(ctx, container.Config, container.HostConfig, &initialNetwork, nil, container.Name)
-	if err != nil {
-		return nil, errors.Wrap(err, "create container error")
-	}
-
-	defer func() {
-		if !restore {
-			return
-		}

+	c.sr.push(func() {
 		log.Debug().Str("container_id", create.ID).Msg("removing the new container")

 		if err := cli.ContainerStop(ctx, create.ID, dockercontainer.StopOptions{}); err != nil {
@@ -198,7 +190,11 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 		if err := cli.ContainerRemove(ctx, create.ID, dockercontainer.RemoveOptions{}); err != nil {
 			log.Warn().Err(err).Msg("failure to remove container")
 		}
-	}()
+	})
+
+	if err != nil {
+		return nil, errors.Wrap(err, "create container error")
+	}

 	newContainerId := create.ID

@@ -228,7 +224,7 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 	log.Debug().Str("container_id", containerId).Msg("starting to remove the old container")
 	_ = cli.ContainerRemove(ctx, containerId, dockercontainer.RemoveOptions{})

-	restore = false
+	c.sr.disable()

 	newContainer, _, err := cli.ContainerInspectWithRaw(ctx, newContainerId, true)
 	if err != nil {
@@ -237,3 +233,51 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End

 	return &newContainer, nil
 }
+
+type serviceRestore struct {
+	restoreC chan struct{}
+	fs       []func()
+}
+
+func (sr *serviceRestore) enable() {
+	sr.restoreC = make(chan struct{}, 1)
+	sr.fs = make([]func(), 0)
+	sr.restoreC <- struct{}{}
+}
+
+func (sr *serviceRestore) disable() {
+	select {
+	case <-sr.restoreC:
+	default:
+	}
+}
+
+func (sr *serviceRestore) push(f func()) {
+	sr.fs = append(sr.fs, f)
+}
+
+func (sr *serviceRestore) restore() {
+	select {
+	case <-sr.restoreC:
+		l := len(sr.fs)
+		if l > 0 {
+			for i := l - 1; i >= 0; i-- {
+				sr.fs[i]()
+			}
+		}
+	default:
+	}
+}
+
+func (sr *serviceRestore) close() {
+	if sr == nil || sr.restoreC == nil {
+		return
+	}
+
+	select {
+	case <-sr.restoreC:
+	default:
+	}
+
+	close(sr.restoreC)
+}
@@ -8,7 +8,6 @@ import (
 )

 func TestApplyVersionConstraint(t *testing.T) {
-	t.Parallel()
 	initialNet := network.NetworkingConfig{
 		EndpointsConfig: map[string]*network.EndpointSettings{
 			"key1": {
@@ -8,7 +8,6 @@ import (
 )

 func TestParseLocalImage(t *testing.T) {
-	t.Parallel()
 	// Test with a regular image

 	img, err := ParseLocalImage(image.InspectResponse{
@@ -8,7 +8,6 @@ import (
 )

 func TestImageParser(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)

 	// portainer/portainer-ee
@@ -63,7 +62,6 @@ func TestImageParser(t *testing.T) {
 }

 func TestUpdateParsedImage(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)

 	// gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2
@@ -10,7 +10,6 @@ import (
 )

 func TestFindBestMatchNeedAuthRegistry(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)

 	t.Run("", func(t *testing.T) {
@@ -89,11 +89,11 @@ func FigureOut(statuses []Status) Status {
 		return Preparing
 	}

-	if slices.Contains(statuses, Outdated) {
+	if contains(statuses, Outdated) {
 		return Outdated
-	} else if slices.Contains(statuses, Processing) {
+	} else if contains(statuses, Processing) {
 		return Processing
-	} else if slices.Contains(statuses, Error) {
+	} else if contains(statuses, Error) {
 		return Error
 	}

@@ -275,6 +275,14 @@ func EvictImageStatus(resourceID string) {
 	statusCache.Delete(resourceID)
 }

+func contains(statuses []Status, status Status) bool {
+	if len(statuses) == 0 {
+		return false
+	}
+
+	return slices.Contains(statuses, status)
+}
+
 func allMatch(statuses []Status, status Status) bool {
 	if len(statuses) == 0 {
 		return false
@@ -6,7 +6,6 @@ import (
 	"strings"
 	"sync"

-	"github.com/containerd/containerd/errdefs"
 	"github.com/docker/docker/api/types/container"
 )

@@ -36,10 +35,8 @@ func CalculateContainerStats(ctx context.Context, cli DockerClient, isSwarm bool
 	var aggErr error
 	var aggMu sync.Mutex

-	var processedCount int
 	for i := range containers {
 		id := containers[i].ID
-
 		semaphore <- struct{}{}
 		wg.Go(func() {
 			defer func() { <-semaphore }()
@@ -47,17 +44,8 @@ func CalculateContainerStats(ctx context.Context, cli DockerClient, isSwarm bool
 			containerInspection, err := cli.ContainerInspect(ctx, id)
 			stat := ContainerStats{}
 			if err != nil {
-				if errdefs.IsNotFound(err) {
-					// An edge case is reported that Docker can list containers with no names,
-					// but when inspecting a container with specific ID and it is not found.
-					// In this case, we can safely ignore the error.
-					// ref@https://linear.app/portainer/issue/BE-12567/500-error-when-loading-docker-dashboard-in-portainer
-					return
-				}
-
 				aggMu.Lock()
 				aggErr = errors.Join(aggErr, err)
-				processedCount++
 				aggMu.Unlock()
 				return
 			}
@@ -68,7 +56,6 @@ func CalculateContainerStats(ctx context.Context, cli DockerClient, isSwarm bool
 			stopped += stat.Stopped
 			healthy += stat.Healthy
 			unhealthy += stat.Unhealthy
-			processedCount++
 			mu.Unlock()
 		})
 	}
@@ -80,7 +67,7 @@ func CalculateContainerStats(ctx context.Context, cli DockerClient, isSwarm bool
 		Stopped:   stopped,
 		Healthy:   healthy,
 		Unhealthy: unhealthy,
-		Total:     processedCount,
+		Total:     len(containers),
 	}, aggErr
 }

@@ -3,11 +3,9 @@ package stats
 import (
 	"context"
 	"errors"
-	"fmt"
 	"testing"
 	"time"

-	"github.com/containerd/containerd/errdefs"
 	"github.com/docker/docker/api/types/container"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
@@ -25,7 +23,6 @@ func (m *MockDockerClient) ContainerInspect(ctx context.Context, containerID str
 }

 func TestCalculateContainerStats(t *testing.T) {
-	t.Parallel()
 	mockClient := new(MockDockerClient)

 	// Test containers - using enough containers to test concurrent processing
@@ -40,7 +37,6 @@ func TestCalculateContainerStats(t *testing.T) {
 		{ID: "container8"},
 		{ID: "container9"},
 		{ID: "container10"},
-		{ID: "container11"},
 	}

 	// Setup mock expectations with different container states to test various scenarios
@@ -62,6 +58,7 @@ func TestCalculateContainerStats(t *testing.T) {
 		{"container10", container.StateDead, nil, ContainerStats{Running: 0, Stopped: 1, Healthy: 0, Unhealthy: 0}},
 	}

+	expected := ContainerStats{}
 	// Setup mock expectations for all containers with artificial delays to simulate real Docker calls
 	for _, state := range containerStates {
 		mockClient.On("ContainerInspect", mock.Anything, state.id).Return(container.InspectResponse{
@@ -71,23 +68,27 @@ func TestCalculateContainerStats(t *testing.T) {
 					Health: state.health,
 				},
 			},
-		}, nil).After(30 * time.Millisecond) // Simulate 30ms Docker API call
-	}
+		}, nil).After(50 * time.Millisecond) // Simulate 50ms Docker API call

-	// Setup mock expectation for a container that returns NotFound error
-	mockClient.On("ContainerInspect", mock.Anything, "container11").Return(container.InspectResponse{}, fmt.Errorf("No such container: %w", errdefs.ErrNotFound)).After(50 * time.Millisecond)
+		expected.Running += state.expected.Running
+		expected.Stopped += state.expected.Stopped
+		expected.Healthy += state.expected.Healthy
+		expected.Unhealthy += state.expected.Unhealthy
+		expected.Total++
+	}

 	// Call the function and measure time
 	startTime := time.Now()
-	stats, err := CalculateContainerStats(t.Context(), mockClient, false, containers)
+	stats, err := CalculateContainerStats(context.Background(), mockClient, false, containers)
 	require.NoError(t, err, "failed to calculate container stats")
 	duration := time.Since(startTime)

 	// Assert results
-	assert.Equal(t, 6, stats.Running)
-	assert.Equal(t, 4, stats.Stopped)
-	assert.Equal(t, 2, stats.Healthy)
-	assert.Equal(t, 2, stats.Unhealthy)
+	assert.Equal(t, expected, stats)
+	assert.Equal(t, expected.Running, stats.Running)
+	assert.Equal(t, expected.Stopped, stats.Stopped)
+	assert.Equal(t, expected.Healthy, stats.Healthy)
+	assert.Equal(t, expected.Unhealthy, stats.Unhealthy)
 	assert.Equal(t, 10, stats.Total)

 	// Verify concurrent processing by checking that all mock calls were made
@@ -106,7 +107,6 @@ func TestCalculateContainerStats(t *testing.T) {
 }

 func TestCalculateContainerStatsAllErrors(t *testing.T) {
-	t.Parallel()
 	mockClient := new(MockDockerClient)

 	// Test containers
@@ -120,7 +120,7 @@ func TestCalculateContainerStatsAllErrors(t *testing.T) {
 	mockClient.On("ContainerInspect", mock.Anything, "container2").Return(container.InspectResponse{}, errors.New("permission denied"))

 	// Call the function
-	stats, err := CalculateContainerStats(t.Context(), mockClient, false, containers)
+	stats, err := CalculateContainerStats(context.Background(), mockClient, false, containers)

 	// Assert that an error was returned
 	require.Error(t, err, "should return error when all containers fail to inspect")
@@ -142,7 +142,6 @@ func TestCalculateContainerStatsAllErrors(t *testing.T) {
 }

 func TestGetContainerStatus(t *testing.T) {
-	t.Parallel()
 	testCases := []struct {
 		name     string
 		state    *container.State
@@ -235,7 +234,6 @@ func TestGetContainerStatus(t *testing.T) {
 }

 func TestCalculateContainerStatsForSwarm(t *testing.T) {
-	t.Parallel()
 	containers := []container.Summary{
 		{State: "running"},
 		{State: "running", Status: "Up 5 minutes (healthy)"},
@@ -54,9 +54,6 @@ type (
 		// Used only for EE
 		AlwaysCloneGitRepoForRelativePath bool

-		// Whether the edge stack supports per device configs
-		SupportPerDeviceConfigs bool
-
 		// Mount point for relative path
 		FilesystemPath string
 		// Used only for EE
@@ -80,9 +77,6 @@ type (
 		// CreatedByUserId is the user ID that created this stack
 		// Used for adding labels to Kubernetes manifests
 		CreatedByUserId string
-
-		// HelmConfig represents the Helm configuration for an edge stack
-		HelmConfig portainer.HelmConfig
 	}

 	DeployerOptionsPayload struct {
@@ -1,79 +1,5 @@
 package exec

-import (
-	"fmt"
-	"regexp"
-	"strings"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/http/proxy"
-	"github.com/portainer/portainer/api/http/proxy/factory"
-	"github.com/portainer/portainer/api/internal/registryutils"
-
-	"github.com/docker/cli/cli/config/types"
-	"github.com/rs/zerolog/log"
-)
+import "regexp"

 var stackNameNormalizeRegex = regexp.MustCompile("[^-_a-z0-9]+")
-
-func normalizeStackName(name string) string {
-	return stackNameNormalizeRegex.ReplaceAllString(strings.ToLower(name), "")
-}
-
-// fetchEndpointProxy returns the Docker host URL for the given endpoint.
-// For remote endpoints it creates a local proxy that handles TLS termination and
-// Portainer agent header injection; for local unix/npipe sockets no proxy is needed.
-func fetchEndpointProxy(proxyManager *proxy.Manager, endpoint *portainer.Endpoint) (string, *factory.ProxyServer, error) {
-	if strings.HasPrefix(endpoint.URL, "unix://") || strings.HasPrefix(endpoint.URL, "npipe://") {
-		return "", nil, nil
-	}
-
-	proxy, err := proxyManager.CreateAgentProxyServer(endpoint)
-	if err != nil {
-		return "", nil, err
-	}
-
-	return fmt.Sprintf("tcp://127.0.0.1:%d", proxy.Port), proxy, nil
-}
-
-// portainerRegistriesToAuthConfigs converts registries to Docker auth configs.
-// Callers must ensure ECR tokens are valid before calling this function (e.g. via
-// registryutils.ValidateRegistriesECRTokens with a real DataStoreTx). This function
-// intentionally performs no DB writes to avoid write-lock contention when called inside
-// an active BoltDB write transaction.
-func portainerRegistriesToAuthConfigs(registries []portainer.Registry) []types.AuthConfig {
-	var authConfigs []types.AuthConfig
-
-	for _, r := range registries {
-		ac := types.AuthConfig{
-			Username:      r.Username,
-			Password:      r.Password,
-			ServerAddress: r.URL,
-		}
-
-		if r.Authentication {
-			var err error
-
-			ac.Username, ac.Password, err = getEffectiveRegUsernamePassword(&r)
-			if err != nil {
-				continue
-			}
-		}
-
-		authConfigs = append(authConfigs, ac)
-	}
-
-	return authConfigs
-}
-
-func getEffectiveRegUsernamePassword(registry *portainer.Registry) (string, string, error) {
-	username, password, err := registryutils.GetRegEffectiveCredential(registry)
-	if err != nil {
-		log.Warn().
-			Err(err).
-			Str("RegistryName", registry.Name).
-			Msg("Failed to get effective credential. Skip logging with this registry.")
-	}
-
-	return username, password, err
-}
@@ -6,25 +6,35 @@ import (
 	"io"
 	"os"
 	"path"
+	"strings"

 	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/api/http/proxy/factory"
+	"github.com/portainer/portainer/api/internal/registryutils"
 	"github.com/portainer/portainer/api/logs"
 	"github.com/portainer/portainer/api/stacks/stackutils"
 	"github.com/portainer/portainer/pkg/libstack"
+
+	"github.com/docker/cli/cli/config/types"
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
 )

 // ComposeStackManager is a wrapper for docker-compose binary
 type ComposeStackManager struct {
 	deployer     libstack.Deployer
 	proxyManager *proxy.Manager
+	dataStore    dataservices.DataStore
 }

 // NewComposeStackManager returns a Compose stack manager
-func NewComposeStackManager(deployer libstack.Deployer, proxyManager *proxy.Manager) *ComposeStackManager {
+func NewComposeStackManager(deployer libstack.Deployer, proxyManager *proxy.Manager, dataStore dataservices.DataStore) *ComposeStackManager {
 	return &ComposeStackManager{
 		deployer:     deployer,
 		proxyManager: proxyManager,
+		dataStore:    dataStore,
 	}
 }

@@ -35,9 +45,9 @@ func (manager *ComposeStackManager) ComposeSyntaxMaxVersion() string {

 // Up builds, (re)creates and starts containers in the background. Wraps `docker-compose up -d` command
 func (manager *ComposeStackManager) Up(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, options portainer.ComposeUpOptions) error {
-	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	url, proxy, err := manager.fetchEndpointProxy(endpoint)
 	if err != nil {
-		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+		return errors.Wrap(err, "failed to fetch environment proxy")
 	}

 	if proxy != nil {
@@ -46,32 +56,29 @@ func (manager *ComposeStackManager) Up(ctx context.Context, stack *portainer.Sta

 	envFilePath, err := createEnvFile(stack)
 	if err != nil {
-		return fmt.Errorf("failed to create env file: %w", err)
+		return errors.Wrap(err, "failed to create env file")
 	}

 	filePaths := stackutils.GetStackFilePaths(stack, true)
-	if err = manager.deployer.Deploy(ctx, filePaths, libstack.DeployOptions{
+	err = manager.deployer.Deploy(ctx, filePaths, libstack.DeployOptions{
 		Options: libstack.Options{
 			WorkingDir:  stack.ProjectPath,
 			EnvFilePath: envFilePath,
 			Host:        url,
 			ProjectName: stack.Name,
-			Registries:  portainerRegistriesToAuthConfigs(options.Registries),
+			Registries:  portainerRegistriesToAuthConfigs(manager.dataStore, options.Registries),
 		},
 		ForceRecreate:        options.ForceRecreate,
 		AbortOnContainerExit: options.AbortOnContainerExit,
-		RemoveOrphans:        options.Prune,
-	}); err != nil {
-		return fmt.Errorf("failed to deploy a stack: %w", err)
-	}
-	return nil
+	})
+	return errors.Wrap(err, "failed to deploy a stack")
 }

 // Run runs a one-off command on a service. Wraps `docker-compose run` command
 func (manager *ComposeStackManager) Run(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, serviceName string, options portainer.ComposeRunOptions) error {
-	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	url, proxy, err := manager.fetchEndpointProxy(endpoint)
 	if err != nil {
-		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+		return errors.Wrap(err, "failed to fetch environment proxy")
 	}

 	if proxy != nil {
@@ -80,78 +87,86 @@ func (manager *ComposeStackManager) Run(ctx context.Context, stack *portainer.St

 	envFilePath, err := createEnvFile(stack)
 	if err != nil {
-		return fmt.Errorf("failed to create env file: %w", err)
+		return errors.Wrap(err, "failed to create env file")
 	}

 	filePaths := stackutils.GetStackFilePaths(stack, true)
-	if err = manager.deployer.Run(ctx, filePaths, serviceName, libstack.RunOptions{
+	err = manager.deployer.Run(ctx, filePaths, serviceName, libstack.RunOptions{
 		Options: libstack.Options{
 			WorkingDir:  stack.ProjectPath,
 			EnvFilePath: envFilePath,
 			Host:        url,
 			ProjectName: stack.Name,
-			Registries:  portainerRegistriesToAuthConfigs(options.Registries),
+			Registries:  portainerRegistriesToAuthConfigs(manager.dataStore, options.Registries),
 		},
 		Remove:   options.Remove,
 		Args:     options.Args,
 		Detached: options.Detached,
-	}); err != nil {
-		return fmt.Errorf("failed to deploy a stack: %w", err)
-	}
-	return nil
+	})
+	return errors.Wrap(err, "failed to deploy a stack")
 }

 // Down stops and removes containers, networks, images, and volumes
 func (manager *ComposeStackManager) Down(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint) error {
-	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	url, proxy, err := manager.fetchEndpointProxy(endpoint)
 	if err != nil {
-		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+		return err
 	} else if proxy != nil {
 		defer proxy.Close()
 	}

-	if err = manager.deployer.Remove(ctx, stack.Name, nil, libstack.RemoveOptions{
+	err = manager.deployer.Remove(ctx, stack.Name, nil, libstack.RemoveOptions{
 		Options: libstack.Options{
 			WorkingDir: "",
 			Host:       url,
 		},
-	}); err != nil {
-		return fmt.Errorf("failed to remove a stack: %w", err)
-	}
-	return nil
+	})
+
+	return errors.Wrap(err, "failed to remove a stack")
 }

 // Pull an image associated with a service defined in a docker-compose.yml or docker-stack.yml file,
 // but does not start containers based on those images.
 func (manager *ComposeStackManager) Pull(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, options portainer.ComposeOptions) error {
-	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	url, proxy, err := manager.fetchEndpointProxy(endpoint)
 	if err != nil {
-		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+		return err
 	} else if proxy != nil {
 		defer proxy.Close()
 	}

 	envFilePath, err := createEnvFile(stack)
 	if err != nil {
-		return fmt.Errorf("failed to create env file: %w", err)
+		return errors.Wrap(err, "failed to create env file")
 	}

 	filePaths := stackutils.GetStackFilePaths(stack, true)
-	if err = manager.deployer.Pull(ctx, filePaths, libstack.Options{
+	err = manager.deployer.Pull(ctx, filePaths, libstack.Options{
 		WorkingDir:  stack.ProjectPath,
 		EnvFilePath: envFilePath,
 		Host:        url,
 		ProjectName: stack.Name,
-		Registries:  portainerRegistriesToAuthConfigs(options.Registries),
-	}); err != nil {
-		return fmt.Errorf("failed to pull images of the stack: %w", err)
-	}
-	return nil
+		Registries:  portainerRegistriesToAuthConfigs(manager.dataStore, options.Registries),
+	})
+	return errors.Wrap(err, "failed to pull images of the stack")
 }

 // NormalizeStackName returns a new stack name with unsupported characters replaced
 func (manager *ComposeStackManager) NormalizeStackName(name string) string {
-	return normalizeStackName(name)
+	return stackNameNormalizeRegex.ReplaceAllString(strings.ToLower(name), "")
+}
+
+func (manager *ComposeStackManager) fetchEndpointProxy(endpoint *portainer.Endpoint) (string, *factory.ProxyServer, error) {
+	if strings.HasPrefix(endpoint.URL, "unix://") || strings.HasPrefix(endpoint.URL, "npipe://") {
+		return "", nil, nil
+	}
+
+	proxy, err := manager.proxyManager.CreateAgentProxyServer(endpoint)
+	if err != nil {
+		return "", nil, err
+	}
+
+	return fmt.Sprintf("tcp://127.0.0.1:%d", proxy.Port), proxy, nil
 }

 // createEnvFile creates a file that would hold both "in-place" and default environment variables.
@@ -162,7 +177,7 @@ func createEnvFile(stack *portainer.Stack) (string, error) {
 	}

 	envFilePath := path.Join(stack.ProjectPath, "stack.env")
-	envfile, err := os.OpenFile(envFilePath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)
+	envfile, err := os.OpenFile(envFilePath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
 	if err != nil {
 		return "", err
 	}
@@ -213,3 +228,49 @@ func copyConfigEnvVars(w io.Writer, envs []portainer.Pair) error {

 	return nil
 }
+
+func portainerRegistriesToAuthConfigs(tx dataservices.DataStoreTx, registries []portainer.Registry) []types.AuthConfig {
+	var authConfigs []types.AuthConfig
+
+	for _, r := range registries {
+		ac := types.AuthConfig{
+			Username:      r.Username,
+			Password:      r.Password,
+			ServerAddress: r.URL,
+		}
+
+		if r.Authentication {
+			var err error
+
+			ac.Username, ac.Password, err = getEffectiveRegUsernamePassword(tx, &r)
+			if err != nil {
+				continue
+			}
+		}
+
+		authConfigs = append(authConfigs, ac)
+	}
+
+	return authConfigs
+}
+
+func getEffectiveRegUsernamePassword(tx dataservices.DataStoreTx, registry *portainer.Registry) (string, string, error) {
+	if err := registryutils.EnsureRegTokenValid(tx, registry); err != nil {
+		log.Warn().
+			Err(err).
+			Str("RegistryName", registry.Name).
+			Msg("Failed to validate registry token. Skip logging with this registry.")
+
+		return "", "", err
+	}
+
+	username, password, err := registryutils.GetRegEffectiveCredential(registry)
+	if err != nil {
+		log.Warn().
+			Err(err).
+			Str("RegistryName", registry.Name).
+			Msg("Failed to get effective credential. Skip logging with this registry.")
+	}
+
+	return username, password, err
+}
@@ -1,13 +1,14 @@
 package exec

 import (
+	"context"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 	"testing"

 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/filesystem"
 	"github.com/portainer/portainer/pkg/libstack/compose"
 	"github.com/portainer/portainer/pkg/testhelpers"
 	"github.com/stretchr/testify/require"
@@ -25,7 +26,7 @@ const composedContainerName = "compose_wrapper_test"
 func setup(t *testing.T) (*portainer.Stack, *portainer.Endpoint) {
 	dir := t.TempDir()
 	composeFileName := "compose_wrapper_test.yml"
-	f, err := os.Create(filesystem.JoinPaths(dir, composeFileName))
+	f, err := os.Create(filepath.Join(dir, composeFileName))
 	require.NoError(t, err)

 	_, err = f.WriteString(composeFile)
@@ -41,16 +42,17 @@ func setup(t *testing.T) (*portainer.Stack, *portainer.Endpoint) {
 }

 func Test_UpAndDown(t *testing.T) {
-	t.Parallel()
 	testhelpers.IntegrationTest(t)

 	stack, endpoint := setup(t)

 	deployer := compose.NewComposeDeployer()

-	w := NewComposeStackManager(deployer, nil)
+	w := NewComposeStackManager(deployer, nil, nil)

-	if err := w.Up(t.Context(), stack, endpoint, portainer.ComposeUpOptions{}); err != nil {
+	ctx := context.TODO()
+
+	if err := w.Up(ctx, stack, endpoint, portainer.ComposeUpOptions{}); err != nil {
 		t.Fatalf("Error calling docker-compose up: %s", err)
 	}

@@ -58,7 +60,7 @@ func Test_UpAndDown(t *testing.T) {
 		t.Fatal("container should exist")
 	}

-	if err := w.Down(t.Context(), stack, endpoint); err != nil {
+	if err := w.Down(ctx, stack, endpoint); err != nil {
 		t.Fatalf("Error calling docker-compose down: %s", err)
 	}

@@ -3,18 +3,17 @@ package exec
 import (
 	"io"
 	"os"
+	"path"
+	"path/filepath"
 	"testing"
-	"time"

 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/filesystem"

 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

 func Test_createEnvFile(t *testing.T) {
-	t.Parallel()
 	dir := t.TempDir()

 	tests := []struct {
@@ -57,9 +56,9 @@ func Test_createEnvFile(t *testing.T) {
 			result, _ := createEnvFile(tt.stack)

 			if tt.expected != "" {
-				assert.Equal(t, filesystem.JoinPaths(tt.stack.ProjectPath, "stack.env"), result)
+				assert.Equal(t, filepath.Join(tt.stack.ProjectPath, "stack.env"), result)

-				f, _ := os.Open(filesystem.JoinPaths(dir, "stack.env"))
+				f, _ := os.Open(path.Join(dir, "stack.env"))
 				content, _ := io.ReadAll(f)

 				assert.Equal(t, tt.expected, string(content))
@@ -71,9 +70,8 @@ func Test_createEnvFile(t *testing.T) {
 }

 func Test_createEnvFile_mergesDefultAndInplaceEnvVars(t *testing.T) {
-	t.Parallel()
 	dir := t.TempDir()
-	err := os.WriteFile(filesystem.JoinPaths(dir, ".env"), []byte("VAR1=VAL1\nVAR2=VAL2\n"), 0600)
+	err := os.WriteFile(path.Join(dir, ".env"), []byte("VAR1=VAL1\nVAR2=VAL2\n"), 0600)
 	require.NoError(t, err)

 	stack := &portainer.Stack{
@@ -84,11 +82,11 @@ func Test_createEnvFile_mergesDefultAndInplaceEnvVars(t *testing.T) {
 		},
 	}
 	result, err := createEnvFile(stack)
-	assert.Equal(t, filesystem.JoinPaths(stack.ProjectPath, "stack.env"), result)
+	assert.Equal(t, filepath.Join(stack.ProjectPath, "stack.env"), result)
 	require.NoError(t, err)
-	assert.FileExists(t, filesystem.JoinPaths(dir, "stack.env"))
+	assert.FileExists(t, path.Join(dir, "stack.env"))

-	f, err := os.Open(filesystem.JoinPaths(dir, "stack.env"))
+	f, err := os.Open(path.Join(dir, "stack.env"))
 	require.NoError(t, err)

 	content, err := io.ReadAll(f)
@@ -96,74 +94,3 @@ func Test_createEnvFile_mergesDefultAndInplaceEnvVars(t *testing.T) {

 	assert.Equal(t, []byte("VAR1=VAL1\nVAR2=VAL2\n\nVAR1=NEW_VAL1\nVAR3=VAL3\n"), content)
 }
-
-func Test_portainerRegistriesToAuthConfigs(t *testing.T) {
-	t.Parallel()
-
-	t.Run("returns empty slice for empty input", func(t *testing.T) {
-		t.Parallel()
-		result := portainerRegistriesToAuthConfigs([]portainer.Registry{})
-		require.Nil(t, result)
-	})
-
-	t.Run("uses registry URL, username and password for non-authenticated registry", func(t *testing.T) {
-		t.Parallel()
-		registries := []portainer.Registry{
-			{URL: "registry.example.com", Username: "user", Password: "pass", Authentication: false},
-		}
-		result := portainerRegistriesToAuthConfigs(registries)
-		require.Len(t, result, 1)
-		require.Equal(t, "registry.example.com", result[0].ServerAddress)
-		require.Equal(t, "user", result[0].Username)
-		require.Equal(t, "pass", result[0].Password)
-	})
-
-	t.Run("uses username and password for authenticated non-ECR registry", func(t *testing.T) {
-		t.Parallel()
-		registries := []portainer.Registry{
-			{URL: "registry.example.com", Username: "user", Password: "pass", Authentication: true, Type: portainer.CustomRegistry},
-		}
-		result := portainerRegistriesToAuthConfigs(registries)
-		require.Len(t, result, 1)
-		require.Equal(t, "user", result[0].Username)
-		require.Equal(t, "pass", result[0].Password)
-	})
-
-	t.Run("parses ECR access token for authenticated ECR registry with valid token", func(t *testing.T) {
-		t.Parallel()
-		registries := []portainer.Registry{
-			{
-				URL:               "123456789.dkr.ecr.us-east-1.amazonaws.com",
-				Username:          "AKIAIOSFODNN7EXAMPLE",
-				Password:          "secretkey",
-				Authentication:    true,
-				Type:              portainer.EcrRegistry,
-				Ecr:               portainer.EcrData{Region: "us-east-1"},
-				AccessToken:       "AWS:ecr-password",
-				AccessTokenExpiry: time.Now().Add(time.Hour).Unix(),
-			},
-		}
-		result := portainerRegistriesToAuthConfigs(registries)
-		require.Len(t, result, 1)
-		require.Equal(t, "AWS", result[0].Username)
-		require.Equal(t, "ecr-password", result[0].Password)
-	})
-
-	t.Run("includes valid registries and skips ones with credential errors", func(t *testing.T) {
-		t.Parallel()
-		registries := []portainer.Registry{
-			{URL: "valid.example.com", Username: "user", Password: "pass", Authentication: false},
-			{
-				URL:               "123456789.dkr.ecr.us-east-1.amazonaws.com",
-				Authentication:    true,
-				Type:              portainer.EcrRegistry,
-				Ecr:               portainer.EcrData{Region: "us-east-1"},
-				AccessToken:       "no-colon-token",
-				AccessTokenExpiry: time.Now().Add(time.Hour).Unix(),
-			},
-		}
-		result := portainerRegistriesToAuthConfigs(registries)
-		require.Len(t, result, 1)
-		require.Equal(t, "valid.example.com", result[0].ServerAddress)
-	})
-}
@@ -1,8 +1,6 @@
 package exectest

 import (
-	"context"
-
 	portainer "github.com/portainer/portainer/api"
 )

@@ -15,14 +13,14 @@ func NewKubernetesDeployer() *kubernetesMockDeployer {
 	return &kubernetesMockDeployer{}
 }

-func (deployer *kubernetesMockDeployer) Deploy(_ context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
+func (deployer *kubernetesMockDeployer) Deploy(userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
 	return "", nil
 }

-func (deployer *kubernetesMockDeployer) Remove(_ context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
+func (deployer *kubernetesMockDeployer) Remove(userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
 	return "", nil
 }

-func (deployer *kubernetesMockDeployer) Restart(_ context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
+func (deployer *kubernetesMockDeployer) Restart(userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
 	return "", nil
 }
@@ -76,16 +76,16 @@ func (deployer *KubernetesDeployer) getToken(userID portainer.UserID, endpoint *
 }

 // Deploy upserts Kubernetes resources defined in manifest(s)
-func (deployer *KubernetesDeployer) Deploy(ctx context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
-	return deployer.command(ctx, "apply", userID, endpoint, resources, namespace)
+func (deployer *KubernetesDeployer) Deploy(userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
+	return deployer.command("apply", userID, endpoint, resources, namespace)
 }

 // Remove deletes Kubernetes resources defined in manifest(s)
-func (deployer *KubernetesDeployer) Remove(ctx context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
-	return deployer.command(ctx, "delete", userID, endpoint, resources, namespace)
+func (deployer *KubernetesDeployer) Remove(userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
+	return deployer.command("delete", userID, endpoint, resources, namespace)
 }

-func (deployer *KubernetesDeployer) command(ctx context.Context, operation string, userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
+func (deployer *KubernetesDeployer) command(operation string, userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
 	token, err := deployer.getToken(userID, endpoint, endpoint.Type == portainer.KubernetesLocalEnvironment)
 	if err != nil {
 		return "", errors.Wrap(err, "failed generating a user token")
@@ -112,7 +112,7 @@ func (deployer *KubernetesDeployer) command(ctx context.Context, operation strin

 	operations := map[string]func(context.Context, []string) (string, error){
 		"apply":  client.ApplyDynamic,
-		"delete": client.DeleteDynamic,
+		"delete": client.Delete,
 	}

 	operationFunc, ok := operations[operation]
@@ -120,7 +120,7 @@ func (deployer *KubernetesDeployer) command(ctx context.Context, operation strin
 		return "", errors.Errorf("unsupported operation: %s", operation)
 	}

-	output, err := operationFunc(ctx, resources)
+	output, err := operationFunc(context.Background(), resources)
 	if err != nil {
 		return "", errors.Wrapf(err, "failed to execute kubectl %s command", operation)
 	}
@@ -57,7 +57,6 @@ func testExecuteKubectlOperation(client *mockKubectlClient, operation string, ma
 }

 func TestExecuteKubectlOperation_Apply_Success(t *testing.T) {
-	t.Parallel()
 	called := false
 	mockClient := &mockKubectlClient{
 		applyFunc: func(ctx context.Context, files []string) error {
@@ -75,7 +74,6 @@ func TestExecuteKubectlOperation_Apply_Success(t *testing.T) {
 }

 func TestExecuteKubectlOperation_Apply_Error(t *testing.T) {
-	t.Parallel()
 	expectedErr := errors.New("kubectl apply failed")
 	called := false
 	mockClient := &mockKubectlClient{
@@ -95,7 +93,6 @@ func TestExecuteKubectlOperation_Apply_Error(t *testing.T) {
 }

 func TestExecuteKubectlOperation_Delete_Success(t *testing.T) {
-	t.Parallel()
 	called := false
 	mockClient := &mockKubectlClient{
 		deleteFunc: func(ctx context.Context, files []string) error {
@@ -113,7 +110,6 @@ func TestExecuteKubectlOperation_Delete_Success(t *testing.T) {
 }

 func TestExecuteKubectlOperation_Delete_Error(t *testing.T) {
-	t.Parallel()
 	expectedErr := errors.New("kubectl delete failed")
 	called := false
 	mockClient := &mockKubectlClient{
@@ -133,7 +129,6 @@ func TestExecuteKubectlOperation_Delete_Error(t *testing.T) {
 }

 func TestExecuteKubectlOperation_RolloutRestart_Success(t *testing.T) {
-	t.Parallel()
 	called := false
 	mockClient := &mockKubectlClient{
 		rolloutRestartFunc: func(ctx context.Context, resources []string) error {
@@ -151,7 +146,6 @@ func TestExecuteKubectlOperation_RolloutRestart_Success(t *testing.T) {
 }

 func TestExecuteKubectlOperation_RolloutRestart_Error(t *testing.T) {
-	t.Parallel()
 	expectedErr := errors.New("kubectl rollout restart failed")
 	called := false
 	mockClient := &mockKubectlClient{
@@ -171,7 +165,6 @@ func TestExecuteKubectlOperation_RolloutRestart_Error(t *testing.T) {
 }

 func TestExecuteKubectlOperation_UnsupportedOperation(t *testing.T) {
-	t.Parallel()
 	mockClient := &mockKubectlClient{}

 	err := testExecuteKubectlOperation(mockClient, "unsupported", []string{})
@@ -1,93 +1,247 @@
 package exec

 import (
-	"context"
-	"fmt"
+	"bytes"
+	"errors"
+	"os"
+	"os/exec"
+	"path"
+	"runtime"
+	"strings"

 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/stacks/stackutils"
-	"github.com/portainer/portainer/pkg/libstack/swarm"
+
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
 )

 // SwarmStackManager represents a service for managing stacks.
 type SwarmStackManager struct {
-	deployer     swarm.Deployer
-	proxyManager *proxy.Manager
+	binaryPath           string
+	configPath           string
+	signatureService     portainer.DigitalSignatureService
+	fileService          portainer.FileService
+	reverseTunnelService portainer.ReverseTunnelService
+	dataStore            dataservices.DataStore
 }

-// NewSwarmStackManager creates a new SwarmStackManager.
+// NewSwarmStackManager initializes a new SwarmStackManager service.
+// It also updates the configuration of the Docker CLI binary.
 func NewSwarmStackManager(
-	deployer swarm.Deployer,
-	proxyManager *proxy.Manager,
-) *SwarmStackManager {
-	return &SwarmStackManager{
-		deployer:     deployer,
-		proxyManager: proxyManager,
+	binaryPath, configPath string,
+	signatureService portainer.DigitalSignatureService,
+	fileService portainer.FileService,
+	reverseTunnelService portainer.ReverseTunnelService,
+	datastore dataservices.DataStore,
+) (*SwarmStackManager, error) {
+	manager := &SwarmStackManager{
+		binaryPath:           binaryPath,
+		configPath:           configPath,
+		signatureService:     signatureService,
+		fileService:          fileService,
+		reverseTunnelService: reverseTunnelService,
+		dataStore:            datastore,
 	}
+
+	if err := manager.updateDockerCLIConfiguration(manager.configPath); err != nil {
+		return nil, err
+	}
+
+	return manager, nil
 }

-// Deploy creates or updates a Docker Swarm stack.
-func (manager *SwarmStackManager) Deploy(
-	ctx context.Context,
-	stack *portainer.Stack,
-	prune bool,
-	pullImage bool,
-	endpoint *portainer.Endpoint,
-	registries []portainer.Registry,
-) error {
-	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+// Login executes the docker login command against a list of registries (including DockerHub).
+func (manager *SwarmStackManager) Login(registries []portainer.Registry, endpoint *portainer.Endpoint) error {
+	command, args, err := manager.prepareDockerCommandAndArgs(manager.binaryPath, manager.configPath, endpoint)
 	if err != nil {
-		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+		return err
 	}

-	if proxy != nil {
-		defer proxy.Close()
+	for _, registry := range registries {
+		if registry.Authentication {
+			username, password, err := getEffectiveRegUsernamePassword(manager.dataStore, &registry)
+			if err != nil {
+				continue
+			}
+
+			registryArgs := append(args, "login", "--username", username, "--password", password, registry.URL)
+			if err := runCommandAndCaptureStdErr(command, registryArgs, nil, ""); err != nil {
+				log.Warn().
+					Err(err).
+					Str("RegistryName", registry.Name).
+					Msg("Failed to login.")
+			}
+		}
 	}

+	return nil
+}
+
+// Logout executes the docker logout command.
+func (manager *SwarmStackManager) Logout(endpoint *portainer.Endpoint) error {
+	command, args, err := manager.prepareDockerCommandAndArgs(manager.binaryPath, manager.configPath, endpoint)
+	if err != nil {
+		return err
+	}
+
+	args = append(args, "logout")
+
+	return runCommandAndCaptureStdErr(command, args, nil, "")
+}
+
+// Deploy executes the docker stack deploy command.
+func (manager *SwarmStackManager) Deploy(stack *portainer.Stack, prune bool, pullImage bool, endpoint *portainer.Endpoint) error {
 	filePaths := stackutils.GetStackFilePaths(stack, true)
-
-	env := make([]string, 0, len(stack.Env))
-	for _, ev := range stack.Env {
-		env = append(env, ev.Name+"="+ev.Value)
-	}
-
-	return manager.deployer.Deploy(context.TODO(), filePaths, swarm.DeployOptions{
-		Options: swarm.Options{
-			ProjectName: stack.Name,
-			Host:        url,
-			Env:         env,
-			WorkingDir:  stack.ProjectPath,
-			Registries:  portainerRegistriesToAuthConfigs(registries),
-		},
-		RemoveOrphans: prune,
-		PullImage:     pullImage,
-	})
-}
-
-// Remove deletes all resources belonging to a Swarm stack.
-func (manager *SwarmStackManager) Remove(
-	ctx context.Context,
-	stack *portainer.Stack,
-	endpoint *portainer.Endpoint,
-) error {
-	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	command, args, err := manager.prepareDockerCommandAndArgs(manager.binaryPath, manager.configPath, endpoint)
 	if err != nil {
-		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+		return err
 	}

-	if proxy != nil {
-		defer proxy.Close()
+	if prune {
+		args = append(args, "stack", "deploy", "--prune", "--with-registry-auth")
+	} else {
+		args = append(args, "stack", "deploy", "--with-registry-auth")
 	}

-	return manager.deployer.Remove(context.TODO(), stack.Name, swarm.RemoveOptions{
-		Options: swarm.Options{
-			Host: url,
-		},
-	})
+	if !pullImage {
+		args = append(args, "--resolve-image=never")
+	}
+
+	args = configureFilePaths(args, filePaths)
+	args = append(args, stack.Name)
+
+	env := make([]string, 0)
+	for _, envvar := range stack.Env {
+		env = append(env, envvar.Name+"="+envvar.Value)
+	}
+
+	return runCommandAndCaptureStdErr(command, args, env, stack.ProjectPath)
+}
+
+// Remove executes the docker stack rm command.
+func (manager *SwarmStackManager) Remove(stack *portainer.Stack, endpoint *portainer.Endpoint) error {
+	command, args, err := manager.prepareDockerCommandAndArgs(manager.binaryPath, manager.configPath, endpoint)
+	if err != nil {
+		return err
+	}
+
+	args = append(args, "stack", "rm", "--detach=false", stack.Name)
+
+	return runCommandAndCaptureStdErr(command, args, nil, "")
+}
+
+func runCommandAndCaptureStdErr(command string, args []string, env []string, workingDir string) error {
+	var stderr bytes.Buffer
+
+	cmd := exec.Command(command, args...)
+	cmd.Stderr = &stderr
+
+	if workingDir != "" {
+		cmd.Dir = workingDir
+	}
+
+	if env != nil {
+		cmd.Env = os.Environ()
+		cmd.Env = append(cmd.Env, env...)
+	}
+
+	if err := cmd.Run(); err != nil {
+		return errors.New(stderr.String())
+	}
+
+	return nil
+}
+
+func (manager *SwarmStackManager) prepareDockerCommandAndArgs(binaryPath, configPath string, endpoint *portainer.Endpoint) (string, []string, error) {
+	// Assume Linux as a default
+	command := path.Join(binaryPath, "docker")
+
+	if runtime.GOOS == "windows" {
+		command = path.Join(binaryPath, "docker.exe")
+	}
+
+	args := make([]string, 0)
+	args = append(args, "--config", configPath)
+
+	endpointURL := endpoint.URL
+	if endpoint.Type == portainer.EdgeAgentOnDockerEnvironment {
+		tunnelAddr, err := manager.reverseTunnelService.TunnelAddr(endpoint)
+		if err != nil {
+			return "", nil, err
+		}
+
+		endpointURL = "tcp://" + tunnelAddr
+	}
+
+	args = append(args, "-H", endpointURL)
+
+	if endpoint.TLSConfig.TLS {
+		args = append(args, "--tls")
+
+		if !endpoint.TLSConfig.TLSSkipVerify {
+			args = append(args, "--tlsverify", "--tlscacert", endpoint.TLSConfig.TLSCACertPath)
+		} else {
+			args = append(args, "--tlscacert", "")
+		}
+
+		if endpoint.TLSConfig.TLSCertPath != "" && endpoint.TLSConfig.TLSKeyPath != "" {
+			args = append(args, "--tlscert", endpoint.TLSConfig.TLSCertPath, "--tlskey", endpoint.TLSConfig.TLSKeyPath)
+		}
+	}
+
+	return command, args, nil
+}
+
+func (manager *SwarmStackManager) updateDockerCLIConfiguration(configPath string) error {
+	configFilePath := path.Join(configPath, "config.json")
+
+	config, err := manager.retrieveConfigurationFromDisk(configFilePath)
+	if err != nil {
+		log.Warn().Err(err).Msg("unable to retrieve the Swarm configuration from disk, proceeding without it")
+	}
+
+	signature, err := manager.signatureService.CreateSignature(portainer.PortainerAgentSignatureMessage)
+	if err != nil {
+		return err
+	}
+
+	if config["HttpHeaders"] == nil {
+		config["HttpHeaders"] = make(map[string]any)
+	}
+
+	headersObject := config["HttpHeaders"].(map[string]any)
+	headersObject["X-PortainerAgent-ManagerOperation"] = "1"
+	headersObject["X-PortainerAgent-Signature"] = signature
+	headersObject["X-PortainerAgent-PublicKey"] = manager.signatureService.EncodedPublicKey()
+
+	return manager.fileService.WriteJSONToFile(configFilePath, config)
+}
+
+func (manager *SwarmStackManager) retrieveConfigurationFromDisk(path string) (map[string]any, error) {
+	var config map[string]any
+
+	raw, err := manager.fileService.GetFileContent(path, "")
+	if err != nil {
+		return make(map[string]any), nil
+	}
+
+	if err := json.Unmarshal(raw, &config); err != nil {
+		return nil, err
+	}
+
+	return config, nil
 }

-// NormalizeStackName returns a new stack name with unsupported characters replaced.
 func (manager *SwarmStackManager) NormalizeStackName(name string) string {
-	return normalizeStackName(name)
+	return stackNameNormalizeRegex.ReplaceAllString(strings.ToLower(name), "")
+}
+
+func configureFilePaths(args []string, filePaths []string) []string {
+	for _, path := range filePaths {
+		args = append(args, "--compose-file", path)
+	}
+
+	return args
 }
@@ -0,0 +1,43 @@
+package exec
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestConfigFilePaths(t *testing.T) {
+	args := []string{"stack", "deploy", "--with-registry-auth"}
+	filePaths := []string{"dir/file", "dir/file-two", "dir/file-three"}
+	expected := []string{"stack", "deploy", "--with-registry-auth", "--compose-file", "dir/file", "--compose-file", "dir/file-two", "--compose-file", "dir/file-three"}
+	output := configureFilePaths(args, filePaths)
+	assert.ElementsMatch(t, expected, output, "wrong output file paths")
+}
+
+func TestPrepareDockerCommandAndArgs(t *testing.T) {
+	binaryPath := "/test/dist"
+	configPath := "/test/config"
+	manager := &SwarmStackManager{
+		binaryPath: binaryPath,
+		configPath: configPath,
+	}
+
+	endpoint := &portainer.Endpoint{
+		URL: "tcp://test:9000",
+		TLSConfig: portainer.TLSConfiguration{
+			TLS:           true,
+			TLSSkipVerify: true,
+		},
+	}
+
+	command, args, err := manager.prepareDockerCommandAndArgs(binaryPath, configPath, endpoint)
+	require.NoError(t, err)
+
+	expectedCommand := "/test/dist/docker"
+	expectedArgs := []string{"--config", "/test/config", "-H", "tcp://test:9000", "--tls", "--tlscacert", ""}
+
+	require.Equal(t, expectedCommand, command)
+	require.Equal(t, expectedArgs, args)
+}
--- a/Show More
+++ b/Show More