chore(version): Bump 2.39.1 to 2.39.2 (#2585)

Co-authored-by: Josiah Clumont <josiah.clumont@portainer.io>

.eslintignore

@@ -0,0 +1,3 @@
+node_modules/
+dist/
+test/

.eslintrc.yml

@@ -0,0 +1,164 @@
+env:
+  browser: true
+  jquery: true
+  node: true
+  es6: true
+
+globals:
+  angular: true
+
+extends:
+  - 'eslint:recommended'
+  - 'plugin:storybook/recommended'
+  - 'plugin:import/typescript'
+  - prettier
+
+plugins:
+  - import
+
+parserOptions:
+  ecmaVersion: latest
+  sourceType: module
+  project: './tsconfig.json'
+  ecmaFeatures:
+    modules: true
+
+rules:
+  no-console: error
+  no-alert: error
+  no-control-regex: 'off'
+  no-empty: warn
+  no-empty-function: warn
+  no-useless-escape: 'off'
+  import/named: error
+  import/order:
+    [
+      'error',
+      {
+        pathGroups:
+          [
+            { pattern: '@@/**', group: 'internal', position: 'after' },
+            { pattern: '@/**', group: 'internal' },
+            { pattern: '{Kubernetes,Portainer,Agent,Azure,Docker}/**', group: 'internal' },
+          ],
+        groups: ['builtin', 'external', 'internal', 'parent', 'sibling', 'index'],
+        pathGroupsExcludedImportTypes: ['internal'],
+      },
+    ]
+  no-restricted-imports:
+    - error
+    - patterns:
+        - group:
+            - '@/react/test-utils/*'
+          message: 'These utils are just for test files'
+
+settings:
+  'import/resolver':
+    alias:
+      map:
+        - ['@@', './app/react/components']
+        - ['@', './app']
+      extensions: ['.js', '.ts', '.tsx']
+    typescript: true
+    node: true
+
+overrides:
+  - files:
+      - app/**/*.ts{,x}
+    parserOptions:
+      project: './tsconfig.json'
+    parser: '@typescript-eslint/parser'
+    plugins:
+      - '@typescript-eslint'
+      - 'regex'
+    extends:
+      - airbnb
+      - airbnb-typescript
+      - 'plugin:eslint-comments/recommended'
+      - 'plugin:react-hooks/recommended'
+      - 'plugin:react/jsx-runtime'
+      - 'plugin:@typescript-eslint/recommended'
+      - 'plugin:@typescript-eslint/eslint-recommended'
+      - 'plugin:promise/recommended'
+      - 'plugin:storybook/recommended'
+      - prettier # should be last
+    settings:
+      react:
+        version: 'detect'
+
+    rules:
+      no-console: error
+      import/order:
+        [
+          'error',
+          {
+            pathGroups: [{ pattern: '@@/**', group: 'internal', position: 'after' }, { pattern: '@/**', group: 'internal' }],
+            groups: ['builtin', 'external', 'internal', 'parent', 'sibling', 'index'],
+            'newlines-between': 'always',
+          },
+        ]
+      no-plusplus: off
+      func-style: [error, 'declaration']
+      import/prefer-default-export: off
+      no-use-before-define: 'off'
+      '@typescript-eslint/no-use-before-define': ['error', { functions: false, 'allowNamedExports': true }]
+      no-shadow: 'off'
+      '@typescript-eslint/no-shadow': off
+      jsx-a11y/no-autofocus: warn
+      react/forbid-prop-types: off
+      react/require-default-props: off
+      react/no-array-index-key: off
+      no-underscore-dangle: off
+      react/jsx-filename-extension: [0]
+      import/no-extraneous-dependencies: ['error', { devDependencies: true }]
+      '@typescript-eslint/explicit-module-boundary-types': off
+      '@typescript-eslint/no-unused-vars': 'error'
+      '@typescript-eslint/no-explicit-any': 'error'
+      '@typescript-eslint/switch-exhaustiveness-check': 'error'
+      'consistent-return': 'off'
+      'default-case': off
+      'jsx-a11y/label-has-associated-control':
+        - error
+        - assert: either
+          controlComponents:
+            - Input
+            - Checkbox
+      'jsx-a11y/control-has-associated-label': off
+      'react/function-component-definition': ['error', { 'namedComponents': 'function-declaration' }]
+      'react/jsx-no-bind': off
+      'no-await-in-loop': 'off'
+      'react/jsx-no-useless-fragment': ['error', { allowExpressions: true }]
+      'regex/invalid': ['error', [{ 'regex': '<Icon icon="(.*)"', 'message': 'Please directly import the `lucide-react` icon instead of using the string' }]]
+      '@typescript-eslint/no-restricted-imports':
+        - error
+        - patterns:
+            - group:
+                - '@/react/test-utils/*'
+              message: 'These utils are just for test files'
+    overrides: # allow props spreading for hoc files
+      - files:
+          - app/**/with*.ts{,x}
+        rules:
+          'react/jsx-props-no-spreading': off
+  - files:
+      - app/**/*.test.*
+    plugins:
+      - '@vitest'
+    extends:
+      - 'plugin:@vitest/legacy-recommended'
+    env:
+      '@vitest/env': true
+    rules:
+      'react/jsx-no-constructed-context-values': off
+      '@typescript-eslint/no-restricted-imports': off
+      no-restricted-imports: off
+      'react/jsx-props-no-spreading': off
+      '@vitest/no-conditional-expect': warn
+  - files:
+      - app/**/*.stories.*
+    rules:
+      'no-alert': off
+      '@typescript-eslint/no-restricted-imports': off
+      no-restricted-imports: off
+      'react/jsx-props-no-spreading': off
+      'storybook/no-renderer-packages': off

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -94,19 +94,12 @@ body:
       description: We only provide support for current versions of Portainer as per the lifecycle policy linked above. If you are on an older version of Portainer we recommend [updating first](https://docs.portainer.io/start/upgrade) in case your bug has already been fixed.
       multiple: false
       options:
-        - '2.41.1'
-        - '2.41.0'
-        - '2.40.0'
-        - '2.39.2'
-        - '2.39.1'
-        - '2.39.0'
         - '2.38.1'
         - '2.38.0'
         - '2.37.0'
         - '2.36.0'
         - '2.35.0'
         - '2.34.0'
-        - '2.33.8'
         - '2.33.7'
         - '2.33.6'
         - '2.33.5'
@@ -115,7 +108,42 @@ body:
         - '2.33.2'
         - '2.33.1'
         - '2.33.0'
-
+        - '2.32.0'
+        - '2.31.3'
+        - '2.31.2'
+        - '2.31.1'
+        - '2.31.0'
+        - '2.30.1'
+        - '2.30.0'
+        - '2.29.2'
+        - '2.29.1'
+        - '2.29.0'
+        - '2.28.1'
+        - '2.28.0'
+        - '2.27.9'
+        - '2.27.8'
+        - '2.27.7'
+        - '2.27.6'
+        - '2.27.5'
+        - '2.27.4'
+        - '2.27.3'
+        - '2.27.2'
+        - '2.27.1'
+        - '2.27.0'
+        - '2.26.1'
+        - '2.26.0'
+        - '2.25.1'
+        - '2.25.0'
+        - '2.24.1'
+        - '2.24.0'
+        - '2.23.0'
+        - '2.22.0'
+        - '2.21.5'
+        - '2.21.4'
+        - '2.21.3'
+        - '2.21.2'
+        - '2.21.1'
+        - '2.21.0'
     validations:
       required: true
 

.golangci-forward.yaml

@@ -8,6 +8,9 @@ linters:
       forbid:
         - pattern: ^dataservices.DataStore.(EdgeGroup|EdgeJob|EdgeStack|EndpointRelation|Endpoint|GitCredential|Registry|ResourceControl|Role|Settings|Snapshot|SSLSettings|Stack|Tag|User)$
           msg: Use a transaction instead
-        - pattern: ^(filepath|path)\.Join$
-          msg: Use filesystem.JoinPaths() from github.com/portainer/portainer/api/filesystem to prevent path traversal attacks
       analyze-types: true
+  exclusions:
+    rules:
+      - path: _test\.go
+        linters:
+          - forbidigo

.golangci.yaml

@@ -54,28 +54,8 @@ linters:
               desc: github.com/ProtonMail/go-crypto/openpgp is not allowed because of FIPS mode
             - pkg: github.com/cosi-project/runtime
               desc: github.com/cosi-project/runtime is not allowed because of FIPS mode
-            - pkg: gopkg.in/yaml.v2
-              desc: use go.yaml.in/yaml/v3 instead
             - pkg: gopkg.in/yaml.v3
               desc: use go.yaml.in/yaml/v3 instead
-            - pkg: github.com/golang-jwt/jwt/v4
-              desc: use github.com/golang-jwt/jwt/v5 instead
-            - pkg: github.com/mitchellh/mapstructure
-              desc: use github.com/go-viper/mapstructure/v2 instead
-            - pkg: gopkg.in/alecthomas/kingpin.v2
-              desc: use github.com/alecthomas/kingpin/v2 instead
-            - pkg: github.com/jcmturner/gokrb5$
-              desc: use github.com/jcmturner/gokrb5/v8 instead
-            - pkg: github.com/gofrs/uuid
-              desc: use github.com/google/uuid
-            - pkg: github.com/Masterminds/semver$
-              desc: use github.com/Masterminds/semver/v3
-            - pkg: github.com/blang/semver
-              desc: use github.com/Masterminds/semver/v3
-            - pkg: github.com/coreos/go-semver
-              desc: use github.com/Masterminds/semver/v3
-            - pkg: github.com/hashicorp/go-version
-              desc: use github.com/Masterminds/semver/v3
     forbidigo:
       forbid:
         - pattern: ^tls\.Config$

.prettierrc

@@ -5,18 +5,21 @@
   "trailingComma": "es5",
   "overrides": [
     {
-      "files": ["*.html"],
+      "files": [
+        "*.html"
+      ],
       "options": {
         "parser": "angular"
       }
     },
     {
-      "files": ["*.{j,t}sx", "*.ts"],
+      "files": [
+        "*.{j,t}sx",
+        "*.ts"
+      ],
       "options": {
         "printWidth": 80
       }
     }
-  ],
-  "plugins": ["prettier-plugin-tailwindcss"],
-  "tailwindFunctions": ["clsx"]
-}
+  ]
+}

.storybook/main.ts

@@ -1,21 +1,15 @@
-// This file has been automatically migrated to valid ESM format by Storybook.
-import { fileURLToPath } from 'node:url';
-import { createRequire } from 'node:module';
-import path, { dirname } from 'path';
+import path from 'path';
 
 import { StorybookConfig } from '@storybook/react-webpack5';
 
 import { Configuration } from 'webpack';
 import postcss from 'postcss';
 
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-const require = createRequire(import.meta.url);
-
 const config: StorybookConfig = {
   stories: ['../app/**/*.stories.@(ts|tsx)'],
   addons: [
     '@storybook/addon-links',
+    '@storybook/addon-essentials',
     '@storybook/addon-webpack5-compiler-swc',
     '@chromatic-com/storybook',
     {
@@ -50,7 +44,6 @@ const config: StorybookConfig = {
         ],
       },
     },
-    '@storybook/addon-docs',
   ],
   webpackFinal: (config) => {
     const rules = config?.module?.rules || [];
@@ -103,7 +96,12 @@ const config: StorybookConfig = {
   },
   staticDirs: ['./public'],
   typescript: {
-    reactDocgen: 'react-docgen',
+    reactDocgen: 'react-docgen-typescript',
+    reactDocgenTypescriptOptions: {
+      compilerOptions: {
+        outDir: path.resolve(__dirname, '..', 'dist/public'),
+      },
+    },
   },
   framework: {
     name: '@storybook/react-webpack5',

.storybook/preview.tsx

@@ -1,10 +1,9 @@
-import { useEffect } from 'react';
 import '../app/assets/css';
 import { pushStateLocationPlugin, UIRouter } from '@uirouter/react';
 import { initialize as initMSW, mswLoader } from 'msw-storybook-addon';
 import { handlers } from '../app/setup-tests/server-handlers';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
-import { Preview } from '@storybook/react-webpack5';
+import { Preview } from '@storybook/react';
 
 initMSW(
   {
@@ -27,50 +26,15 @@ const testQueryClient = new QueryClient({
 });
 
 const preview: Preview = {
-  globalTypes: {
-    theme: {
-      description: 'Portainer color theme',
-      toolbar: {
-        title: 'Theme',
-        icon: 'paintbrush',
-        items: [
-          { value: 'light', title: 'Light', icon: 'sun' },
-          { value: 'dark', title: 'Dark', icon: 'moon' },
-          { value: 'highcontrast', title: 'High Contrast', icon: 'eye' },
-        ],
-        dynamicTitle: true,
-      },
-    },
-  },
-  initialGlobals: {
-    theme: 'light',
-  },
-  decorators: (Story, context) => {
-    const theme = context.globals.theme;
-
-    useEffect(() => {
-      if (theme === 'light') {
-        document.documentElement.removeAttribute('theme');
-      } else {
-        document.documentElement.setAttribute('theme', theme);
-      }
-    }, [theme]);
-
-    return (
-      <QueryClientProvider client={testQueryClient}>
-        <UIRouter plugins={[pushStateLocationPlugin]}>
-          <Story />
-        </UIRouter>
-      </QueryClientProvider>
-    );
-  },
+  decorators: (Story) => (
+    <QueryClientProvider client={testQueryClient}>
+      <UIRouter plugins={[pushStateLocationPlugin]}>
+        <Story />
+      </UIRouter>
+    </QueryClientProvider>
+  ),
   loaders: [mswLoader],
   parameters: {
-    options: {
-      storySort: {
-        order: ['Design System', 'Components', '*'],
-      },
-    },
     controls: {
       matchers: {
         color: /(background|color)$/i,

.storybook/public/mockServiceWorker.js

@@ -2,26 +2,26 @@
 /* tslint:disable */
 
 /**
- * Mock Service Worker.
+ * Mock Service Worker (2.0.11).
  * @see https://github.com/mswjs/msw
  * - Please do NOT modify this file.
+ * - Please do NOT serve this file on production.
  */
 
-const PACKAGE_VERSION = '2.12.10';
-const INTEGRITY_CHECKSUM = '4db4a41e972cec1b64cc569c66952d82';
+const INTEGRITY_CHECKSUM = 'c5f7f8e188b673ea4e677df7ea3c5a39';
 const IS_MOCKED_RESPONSE = Symbol('isMockedResponse');
 const activeClientIds = new Set();
 
-addEventListener('install', function () {
+self.addEventListener('install', function () {
   self.skipWaiting();
 });
 
-addEventListener('activate', function (event) {
+self.addEventListener('activate', function (event) {
   event.waitUntil(self.clients.claim());
 });
 
-addEventListener('message', async function (event) {
-  const clientId = Reflect.get(event.source || {}, 'id');
+self.addEventListener('message', async function (event) {
+  const clientId = event.source.id;
 
   if (!clientId || !self.clients) {
     return;
@@ -48,10 +48,7 @@ addEventListener('message', async function (event) {
     case 'INTEGRITY_CHECK_REQUEST': {
       sendToClient(client, {
         type: 'INTEGRITY_CHECK_RESPONSE',
-        payload: {
-          packageVersion: PACKAGE_VERSION,
-          checksum: INTEGRITY_CHECKSUM,
-        },
+        payload: INTEGRITY_CHECKSUM,
       });
       break;
     }
@@ -61,16 +58,16 @@ addEventListener('message', async function (event) {
 
       sendToClient(client, {
         type: 'MOCKING_ENABLED',
-        payload: {
-          client: {
-            id: client.id,
-            frameType: client.frameType,
-          },
-        },
+        payload: true,
       });
       break;
     }
 
+    case 'MOCK_DEACTIVATE': {
+      activeClientIds.delete(clientId);
+      break;
+    }
+
     case 'CLIENT_CLOSED': {
       activeClientIds.delete(clientId);
 
@@ -88,91 +85,72 @@ addEventListener('message', async function (event) {
   }
 });
 
-addEventListener('fetch', function (event) {
-  const requestInterceptedAt = Date.now();
+self.addEventListener('fetch', function (event) {
+  const { request } = event;
 
   // Bypass navigation requests.
-  if (event.request.mode === 'navigate') {
+  if (request.mode === 'navigate') {
     return;
   }
 
   // Opening the DevTools triggers the "only-if-cached" request
   // that cannot be handled by the worker. Bypass such requests.
-  if (event.request.cache === 'only-if-cached' && event.request.mode !== 'same-origin') {
+  if (request.cache === 'only-if-cached' && request.mode !== 'same-origin') {
     return;
   }
 
   // Bypass all requests when there are no active clients.
   // Prevents the self-unregistered worked from handling requests
-  // after it's been terminated (still remains active until the next reload).
+  // after it's been deleted (still remains active until the next reload).
   if (activeClientIds.size === 0) {
     return;
   }
 
+  // Generate unique request ID.
   const requestId = crypto.randomUUID();
-  event.respondWith(handleRequest(event, requestId, requestInterceptedAt));
+  event.respondWith(handleRequest(event, requestId));
 });
 
-/**
- * @param {FetchEvent} event
- * @param {string} requestId
- * @param {number} requestInterceptedAt
- */
-async function handleRequest(event, requestId, requestInterceptedAt) {
+async function handleRequest(event, requestId) {
   const client = await resolveMainClient(event);
-  const requestCloneForEvents = event.request.clone();
-  const response = await getResponse(event, client, requestId, requestInterceptedAt);
+  const response = await getResponse(event, client, requestId);
 
   // Send back the response clone for the "response:*" life-cycle events.
   // Ensure MSW is active and ready to handle the message, otherwise
   // this message will pend indefinitely.
   if (client && activeClientIds.has(client.id)) {
-    const serializedRequest = await serializeRequest(requestCloneForEvents);
+    (async function () {
+      const responseClone = response.clone();
 
-    // Clone the response so both the client and the library could consume it.
-    const responseClone = response.clone();
-
-    sendToClient(
-      client,
-      {
-        type: 'RESPONSE',
-        payload: {
-          isMockedResponse: IS_MOCKED_RESPONSE in response,
-          request: {
-            id: requestId,
-            ...serializedRequest,
-          },
-          response: {
+      sendToClient(
+        client,
+        {
+          type: 'RESPONSE',
+          payload: {
+            requestId,
+            isMockedResponse: IS_MOCKED_RESPONSE in response,
             type: responseClone.type,
             status: responseClone.status,
             statusText: responseClone.statusText,
-            headers: Object.fromEntries(responseClone.headers.entries()),
             body: responseClone.body,
+            headers: Object.fromEntries(responseClone.headers.entries()),
           },
         },
-      },
-      responseClone.body ? [serializedRequest.body, responseClone.body] : []
-    );
+        [responseClone.body]
+      );
+    })();
   }
 
   return response;
 }
 
-/**
- * Resolve the main client for the given event.
- * Client that issues a request doesn't necessarily equal the client
- * that registered the worker. It's with the latter the worker should
- * communicate with during the response resolving phase.
- * @param {FetchEvent} event
- * @returns {Promise<Client | undefined>}
- */
+// Resolve the main client for the given event.
+// Client that issues a request doesn't necessarily equal the client
+// that registered the worker. It's with the latter the worker should
+// communicate with during the response resolving phase.
 async function resolveMainClient(event) {
   const client = await self.clients.get(event.clientId);
 
-  if (activeClientIds.has(event.clientId)) {
-    return client;
-  }
-
   if (client?.frameType === 'top-level') {
     return client;
   }
@@ -193,37 +171,20 @@ async function resolveMainClient(event) {
     });
 }
 
-/**
- * @param {FetchEvent} event
- * @param {Client | undefined} client
- * @param {string} requestId
- * @param {number} requestInterceptedAt
- * @returns {Promise<Response>}
- */
-async function getResponse(event, client, requestId, requestInterceptedAt) {
+async function getResponse(event, client, requestId) {
+  const { request } = event;
+
   // Clone the request because it might've been already used
   // (i.e. its body has been read and sent to the client).
-  const requestClone = event.request.clone();
+  const requestClone = request.clone();
 
   function passthrough() {
-    // Cast the request headers to a new Headers instance
-    // so the headers can be manipulated with.
-    const headers = new Headers(requestClone.headers);
+    const headers = Object.fromEntries(requestClone.headers.entries());
 
-    // Remove the "accept" header value that marked this request as passthrough.
-    // This prevents request alteration and also keeps it compliant with the
-    // user-defined CORS policies.
-    const acceptHeader = headers.get('accept');
-    if (acceptHeader) {
-      const values = acceptHeader.split(',').map((value) => value.trim());
-      const filteredValues = values.filter((value) => value !== 'msw/passthrough');
-
-      if (filteredValues.length > 0) {
-        headers.set('accept', filteredValues.join(', '));
-      } else {
-        headers.delete('accept');
-      }
-    }
+    // Remove internal MSW request header so the passthrough request
+    // complies with any potential CORS preflight checks on the server.
+    // Some servers forbid unknown request headers.
+    delete headers['x-msw-intention'];
 
     return fetch(requestClone, { headers });
   }
@@ -241,19 +202,37 @@ async function getResponse(event, client, requestId, requestInterceptedAt) {
     return passthrough();
   }
 
+  // Bypass requests with the explicit bypass header.
+  // Such requests can be issued by "ctx.fetch()".
+  const mswIntention = request.headers.get('x-msw-intention');
+  if (['bypass', 'passthrough'].includes(mswIntention)) {
+    return passthrough();
+  }
+
   // Notify the client that a request has been intercepted.
-  const serializedRequest = await serializeRequest(event.request);
+  const requestBuffer = await request.arrayBuffer();
   const clientMessage = await sendToClient(
     client,
     {
       type: 'REQUEST',
       payload: {
         id: requestId,
-        interceptedAt: requestInterceptedAt,
-        ...serializedRequest,
+        url: request.url,
+        mode: request.mode,
+        method: request.method,
+        headers: Object.fromEntries(request.headers.entries()),
+        cache: request.cache,
+        credentials: request.credentials,
+        destination: request.destination,
+        integrity: request.integrity,
+        redirect: request.redirect,
+        referrer: request.referrer,
+        referrerPolicy: request.referrerPolicy,
+        body: requestBuffer,
+        keepalive: request.keepalive,
       },
     },
-    [serializedRequest.body]
+    [requestBuffer]
   );
 
   switch (clientMessage.type) {
@@ -261,7 +240,7 @@ async function getResponse(event, client, requestId, requestInterceptedAt) {
       return respondWithMock(clientMessage.data);
     }
 
-    case 'PASSTHROUGH': {
+    case 'MOCK_NOT_FOUND': {
       return passthrough();
     }
   }
@@ -269,12 +248,6 @@ async function getResponse(event, client, requestId, requestInterceptedAt) {
   return passthrough();
 }
 
-/**
- * @param {Client} client
- * @param {any} message
- * @param {Array<Transferable>} transferrables
- * @returns {Promise<any>}
- */
 function sendToClient(client, message, transferrables = []) {
   return new Promise((resolve, reject) => {
     const channel = new MessageChannel();
@@ -287,15 +260,11 @@ function sendToClient(client, message, transferrables = []) {
       resolve(event.data);
     };
 
-    client.postMessage(message, [channel.port2, ...transferrables.filter(Boolean)]);
+    client.postMessage(message, [channel.port2].concat(transferrables.filter(Boolean)));
   });
 }
 
-/**
- * @param {Response} response
- * @returns {Response}
- */
-function respondWithMock(response) {
+async function respondWithMock(response) {
   // Setting response status code to 0 is a no-op.
   // However, when responding with a "Response.error()", the produced Response
   // instance will have status code set to 0. Since it's not possible to create
@@ -313,24 +282,3 @@ function respondWithMock(response) {
 
   return mockedResponse;
 }
-
-/**
- * @param {Request} request
- */
-async function serializeRequest(request) {
-  return {
-    url: request.url,
-    mode: request.mode,
-    method: request.method,
-    headers: Object.fromEntries(request.headers.entries()),
-    cache: request.cache,
-    credentials: request.credentials,
-    destination: request.destination,
-    integrity: request.integrity,
-    redirect: request.redirect,
-    referrer: request.referrer,
-    referrerPolicy: request.referrerPolicy,
-    body: await request.arrayBuffer(),
-    keepalive: request.keepalive,
-  };
-}

CLAUDE.md

@@ -2,27 +2,16 @@
 
 Open-source container management platform with full Docker and Kubernetes support.
 
-## Project Structure
+see also:
 
-For a detailed breakdown of frontend and backend directory layout, feature locations, and common development tasks, see [docs/guidelines/project-structure.md](../../docs/guidelines/project-structure.md).
-
-## Frontend Guidelines
-
-- [docs/guidelines/frontend-conventions.md](../../docs/guidelines/frontend-conventions.md) — component structure, React Query patterns, shared components, forms, theming
-- [docs/guidelines/typescript-conventions.md](../../docs/guidelines/typescript-conventions.md) — types, anti-patterns, union types, named constants
-- [docs/guidelines/frontend-unit-testing.md](../../docs/guidelines/frontend-unit-testing.md) — Vitest, React Testing Library
-
-## Backend Guidelines
-
-- [docs/guidelines/go-conventions.md](../../docs/guidelines/go-conventions.md) — error handling, naming, testing, code style
-- [docs/guidelines/server-architecture.md](../../docs/guidelines/server-architecture.md) — Clean Architecture layers, transactions, CE/EE sharing patterns
-- [docs/guidelines/logging.md](../../docs/guidelines/logging.md) — zerolog usage, log levels, message style
-- [docs/guidelines/backend-code-reusability.md](../../docs/guidelines/backend-code-reusability.md) — how CE and EE share backend code
+- docs/guidelines/server-architecture.md
+- docs/guidelines/go-conventions.md
+- docs/guidelines/typescript-conventions.md
 
 ## Package Manager
 
 - **PNPM** 10+ (for frontend)
-- **Go** 1.26.1 (for backend)
+- **Go** 1.25.8 (for backend)
 
 ## Build Commands
 

Makefile

@@ -3,7 +3,7 @@ ENV=development
 WEBPACK_CONFIG=webpack/webpack.$(ENV).js
 TAG=local
 
-SWAG=go run github.com/swaggo/swag/cmd/swag@v1.16.6
+SWAG=go run github.com/swaggo/swag/cmd/swag@v1.16.2
 GOTESTSUM_VERSION?=v1.13.0
 GOTESTSUM=go run gotest.tools/gotestsum@$(GOTESTSUM_VERSION)
 
@@ -36,8 +36,8 @@ build-storybook: ## Build and serve the storybook files
 .PHONY: deps server-deps client-deps tidy
 deps: server-deps client-deps ## Download all client and server build dependancies
 
-## This is empty because the pipeline requires it but ce has no server deps
 server-deps: init-dist ## Download dependant server binaries
+	@./build/download_binaries.sh $(PLATFORM) $(ARCH)
 
 client-deps: ## Install client dependencies
 	pnpm install
@@ -108,20 +108,13 @@ dev-extension: build-server build-client ## Run the extension in development mod
 ##@ Docs
 .PHONY: docs-build docs-validate docs-clean docs-validate-clean
 docs-build: init-dist ## Build docs
-	go mod download
+	go mod download -x
 	cd api && $(SWAG) init -o "../dist/docs" -ot "yaml" -g ./http/handler/handler.go --parseDependency --parseInternal --parseDepth 2 -p pascalcase --markdownFiles ./
 
 docs-validate: docs-build ## Validate docs
 	pnpm swagger2openapi --warnOnly dist/docs/swagger.yaml -o dist/docs/openapi.yaml
 	pnpm swagger-cli validate dist/docs/openapi.yaml
 
-.PHONY: docs-serve
-docs-serve: docs-build ## Serve docs locally with Swagger UI on port 8080
-	docker run -p 8080:8080 \
-		-e SWAGGER_JSON=/foo/swagger.yaml \
-		-v $(PWD)/dist/docs:/foo \
-		swaggerapi/swagger-ui
-
 ##@ Helpers
 .PHONY: help
 help:  ## Display this help

SECURITY.md

@@ -4,13 +4,13 @@
 
 Portainer maintains both Short-Term Support (STS) and Long-Term Support (LTS) versions in accordance with our official [Portainer Lifecycle Policy](https://docs.portainer.io/start/lifecycle).
 
-| Version Type             | Support Status                              |
-| ------------------------ | ------------------------------------------- |
-| LTS (Long-Term Support)  | Supported for critical security fixes       |
+| Version Type | Support Status |
+| --- | --- |
+| LTS (Long-Term Support) | Supported for critical security fixes |
 | STS (Short-Term Support) | Supported until the next STS or LTS release |
-| Legacy / EOL             | Not supported                               |
+| Legacy / EOL | Not supported |
 
-For a detailed breakdown of current versions and their specific End of Life (EOL) dates,
+For a detailed breakdown of current versions and their specific End of Life (EOL) dates, 
 please refer to the [Portainer Lifecycle Policy](https://docs.portainer.io/start/lifecycle).
 
 ## Reporting a Vulnerability
@@ -21,19 +21,15 @@ The Portainer team takes the security of our products seriously. If you believe
 
 ### Disclosure Process
 
-1. **Report**: You can report in one of two ways:
-
-   - **GitHub**: Use the **Report a vulnerability** button on the **Security** tab of this repository.
-
-   - **Email**: Send your findings to security@portainer.io.
+1. **Report**: Email your findings to security@portainer.io.
 
 2. **Details**: To help us verify the issue, please include:
 
-   - A description of the vulnerability and its potential impact.
+    - A description of the vulnerability and its potential impact.
 
-   - Step-by-step instructions to reproduce the issue (e.g. proof-of-concept code, scripts, or screenshots).
+    - Step-by-step instructions to reproduce the issue (e.g. proof-of-concept code, scripts, or screenshots).
 
-   - The version of the software and the environment in which it was found.
+    - The version of the software and the environment in which it was found.
 
 3. **Acknowledge**: We will acknowledge receipt of your report and provide an initial assessment.
 
@@ -51,6 +47,7 @@ If you follow the responsible disclosure process, we will:
 
 - Give credit for the discovery (if desired) once the fix is public.
 
+
 We will make every effort to promptly address any security weaknesses. Security advisories and fixes will be published through GitHub Security Advisories and other channels as needed.
 
 Thank you for helping keep Portainer and our community secure.

__mocks__/@reach/menu-button.tsx

@@ -1,118 +0,0 @@
-import {
-  Children,
-  useState,
-  useEffect,
-  useRef,
-  useContext,
-  createContext,
-  ReactNode,
-} from 'react';
-
-type MenuCtxType = {
-  isOpen: boolean;
-  setOpen: (v: boolean) => void;
-  menuRef: React.RefObject<HTMLDivElement>;
-  label: string;
-  setLabel: (v: string) => void;
-};
-
-const MenuCtx = createContext<MenuCtxType | null>(null);
-
-export function Menu({ children }: { children?: ReactNode }) {
-  const [isOpen, setOpen] = useState(false);
-  const [label, setLabel] = useState('');
-  const menuRef = useRef<HTMLDivElement>(null);
-
-  useEffect(() => {
-    function handleDocDown(e: MouseEvent) {
-      const target = e.target as Node | null;
-      if (
-        isOpen &&
-        menuRef.current &&
-        target &&
-        !menuRef.current.contains(target)
-      ) {
-        setOpen(false);
-      }
-    }
-
-    document.addEventListener('mousedown', handleDocDown);
-    return () => document.removeEventListener('mousedown', handleDocDown);
-  }, [isOpen]);
-
-  return (
-    <MenuCtx.Provider value={{ isOpen, setOpen, menuRef, label, setLabel }}>
-      <div ref={menuRef}>{children}</div>
-    </MenuCtx.Provider>
-  );
-}
-
-export function MenuButton({
-  children,
-  onClick: externalOnClick,
-  ...props
-}: {
-  children?: ReactNode;
-  onClick?: () => void;
-  [key: string]: unknown;
-}) {
-  const ctx = useContext(MenuCtx);
-
-  useEffect(() => {
-    const firstText = Children.toArray(children).find(
-      (c) => typeof c === 'string'
-    );
-    if (firstText) ctx?.setLabel(firstText as string);
-  });
-
-  function handleClick() {
-    externalOnClick?.();
-    ctx?.setOpen(!ctx.isOpen);
-  }
-
-  return (
-    <button type="button" onClick={handleClick} {...props}>
-      {children}
-    </button>
-  );
-}
-
-export function MenuList({
-  children,
-  className,
-}: {
-  children?: ReactNode;
-  className?: string;
-}) {
-  const ctx = useContext(MenuCtx);
-  if (!ctx?.isOpen) return null;
-  return (
-    <div role="menu" aria-label={ctx.label || undefined} className={className}>
-      {children}
-    </div>
-  );
-}
-
-export function MenuItem({
-  children,
-  onSelect,
-  className,
-}: {
-  children?: ReactNode;
-  onSelect?: () => void;
-  className?: string;
-}) {
-  const ctx = useContext(MenuCtx);
-
-  function handleClick() {
-    onSelect?.();
-    ctx?.setOpen(false);
-  }
-
-  return (
-    // eslint-disable-next-line jsx-a11y/click-events-have-key-events, jsx-a11y/interactive-supports-focus
-    <div role="menuitem" onClick={handleClick} className={className}>
-      {children}
-    </div>
-  );
-}

api/adminmonitor/admin_monitor.go

@@ -19,22 +19,24 @@ const RedirectReasonAdminInitTimeout string = "AdminInitTimeout"
 type Monitor struct {
 	timeout           time.Duration
 	datastore         dataservices.DataStore
+	shutdownCtx       context.Context
 	cancellationFunc  context.CancelFunc
 	mu                sync.RWMutex
 	adminInitDisabled bool
 }
 
 // New creates a monitor that when started will wait for the timeout duration and then shutdown the application unless it has been initialized.
-func New(timeout time.Duration, datastore dataservices.DataStore) *Monitor {
+func New(timeout time.Duration, datastore dataservices.DataStore, shutdownCtx context.Context) *Monitor {
 	return &Monitor{
 		timeout:           timeout,
 		datastore:         datastore,
+		shutdownCtx:       shutdownCtx,
 		adminInitDisabled: false,
 	}
 }
 
-// Start starts the monitor. The monitor will stop when ctx is cancelled, or when Stop is called.
-func (m *Monitor) Start(ctx context.Context) {
+// Starts starts the monitor. Active monitor could be stopped or shuttted down by cancelling the shutdown context.
+func (m *Monitor) Start() {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
@@ -42,7 +44,7 @@ func (m *Monitor) Start(ctx context.Context) {
 		return
 	}
 
-	cancellationCtx, cancellationFunc := context.WithCancel(ctx)
+	cancellationCtx, cancellationFunc := context.WithCancel(context.Background())
 	m.cancellationFunc = cancellationFunc
 
 	go func() {
@@ -67,6 +69,8 @@ func (m *Monitor) Start(ctx context.Context) {
 			}
 		case <-cancellationCtx.Done():
 			log.Debug().Msg("canceling initialization monitor")
+		case <-m.shutdownCtx.Done():
+			log.Debug().Msg("shutting down initialization monitor")
 		}
 	}()
 }

api/adminmonitor/admin_monitor_test.go

@@ -1,8 +1,8 @@
 package adminmonitor
 
 import (
+	"context"
 	"testing"
-	"testing/synctest"
 	"time"
 
 	portainer "github.com/portainer/portainer/api"
@@ -11,28 +11,21 @@ import (
 )
 
 func Test_stopWithoutStarting(t *testing.T) {
-	t.Parallel()
-	monitor := New(1*time.Minute, nil)
+	monitor := New(1*time.Minute, nil, nil)
 	monitor.Stop()
 }
 
 func Test_stopCouldBeCalledMultipleTimes(t *testing.T) {
-	t.Parallel()
-	monitor := New(1*time.Minute, nil)
+	monitor := New(1*time.Minute, nil, nil)
 	monitor.Stop()
 	monitor.Stop()
 }
 
 func Test_startOrStopCouldBeCalledMultipleTimesConcurrently(t *testing.T) {
-	t.Parallel()
-	synctest.Test(t, test_startOrStopCouldBeCalledMultipleTimesConcurrently)
-}
+	monitor := New(1*time.Minute, nil, context.Background())
 
-func test_startOrStopCouldBeCalledMultipleTimesConcurrently(t *testing.T) {
-	monitor := New(1*time.Minute, nil)
-
-	go monitor.Start(t.Context())
-	monitor.Start(t.Context())
+	go monitor.Start()
+	monitor.Start()
 
 	go monitor.Stop()
 	monitor.Stop()
@@ -41,9 +34,8 @@ func test_startOrStopCouldBeCalledMultipleTimesConcurrently(t *testing.T) {
 }
 
 func Test_canStopStartedMonitor(t *testing.T) {
-	t.Parallel()
-	monitor := New(1*time.Minute, nil)
-	monitor.Start(t.Context())
+	monitor := New(1*time.Minute, nil, context.Background())
+	monitor.Start()
 	assert.NotNil(t, monitor.cancellationFunc, "cancellation function is missing in started monitor")
 
 	monitor.Stop()
@@ -51,12 +43,11 @@ func Test_canStopStartedMonitor(t *testing.T) {
 }
 
 func Test_start_shouldDisableInstanceAfterTimeout_ifNotInitialized(t *testing.T) {
-	t.Parallel()
 	timeout := 10 * time.Millisecond
 
 	datastore := i.NewDatastore(i.WithUsers([]portainer.User{}))
-	monitor := New(timeout, datastore)
-	monitor.Start(t.Context())
+	monitor := New(timeout, datastore, context.Background())
+	monitor.Start()
 
 	<-time.After(20 * timeout)
 	assert.True(t, monitor.WasInstanceDisabled(), "monitor should have been timeout and instance is disabled")

api/agent/version_test.go

@@ -1,119 +0,0 @@
-package agent
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"strconv"
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-
-	"github.com/stretchr/testify/require"
-)
-
-func tlsServer(t *testing.T, handler http.HandlerFunc) *httptest.Server {
-	t.Helper()
-	srv := httptest.NewTLSServer(handler)
-	t.Cleanup(srv.Close)
-
-	return srv
-}
-
-func TestGetAgentVersionAndPlatform_Success(t *testing.T) {
-	t.Parallel()
-
-	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set(portainer.PortainerAgentHeader, "2.19.0")
-		w.Header().Set(portainer.HTTPResponseAgentPlatform, "1")
-		w.WriteHeader(http.StatusNoContent)
-	})
-
-	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
-	platform, version, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
-	require.NoError(t, err)
-	require.Equal(t, portainer.AgentPlatformDocker, platform)
-	require.Equal(t, "2.19.0", version)
-}
-
-func TestGetAgentVersionAndPlatform_NonOKStatus(t *testing.T) {
-	t.Parallel()
-
-	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusUnauthorized)
-	})
-
-	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
-	_, _, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
-	require.Error(t, err)
-}
-
-func TestGetAgentVersionAndPlatform_MissingVersionHeader(t *testing.T) {
-	t.Parallel()
-
-	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set(portainer.HTTPResponseAgentPlatform, "1")
-		w.WriteHeader(http.StatusNoContent)
-	})
-
-	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
-	_, _, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
-	require.Error(t, err)
-}
-
-func TestGetAgentVersionAndPlatform_MissingPlatformHeader(t *testing.T) {
-	t.Parallel()
-
-	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set(portainer.PortainerAgentHeader, "2.19.0")
-		w.WriteHeader(http.StatusNoContent)
-	})
-
-	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
-	_, _, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
-	require.Error(t, err)
-}
-
-func TestGetAgentVersionAndPlatform_InvalidPlatformZero(t *testing.T) {
-	t.Parallel()
-
-	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set(portainer.PortainerAgentHeader, "2.19.0")
-		w.Header().Set(portainer.HTTPResponseAgentPlatform, "0")
-		w.WriteHeader(http.StatusNoContent)
-	})
-
-	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
-	_, _, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
-	require.Error(t, err)
-}
-
-func TestGetAgentVersionAndPlatform_NonNumericPlatform(t *testing.T) {
-	t.Parallel()
-
-	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set(portainer.PortainerAgentHeader, "2.19.0")
-		w.Header().Set(portainer.HTTPResponseAgentPlatform, "docker")
-		w.WriteHeader(http.StatusNoContent)
-	})
-
-	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
-	_, _, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
-	require.Error(t, err)
-}
-
-func TestGetAgentVersionAndPlatform_PingPathAppended(t *testing.T) {
-	t.Parallel()
-
-	var gotPath string
-	srv := tlsServer(t, func(w http.ResponseWriter, r *http.Request) {
-		gotPath = r.URL.Path
-		w.Header().Set(portainer.PortainerAgentHeader, "2.19.0")
-		w.Header().Set(portainer.HTTPResponseAgentPlatform, strconv.Itoa(int(portainer.AgentPlatformKubernetes)))
-		w.WriteHeader(http.StatusNoContent)
-	})
-
-	tlsCfg := srv.Client().Transport.(*http.Transport).TLSClientConfig
-	_, _, err := GetAgentVersionAndPlatform(srv.URL, tlsCfg)
-	require.NoError(t, err)
-	require.Equal(t, "/ping", gotPath)
-}

api/api-description.md

@@ -0,0 +1,64 @@
+Portainer API is an HTTP API served by Portainer. It is used by the Portainer UI and everything you can do with the UI can be done using the HTTP API.
+Examples are available at https://documentation.portainer.io/api/api-examples/
+You can find out more about Portainer at [http://portainer.io](http://portainer.io) and get some support on [Slack](http://portainer.io/slack/).
+
+# Authentication
+
+Most of the API environments(endpoints) require to be authenticated as well as some level of authorization to be used.
+Portainer API uses JSON Web Token to manage authentication and thus requires you to provide a token in the **Authorization** header of each request
+with the **Bearer** authentication mechanism.
+
+Example:
+
+```
+Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwidXNlcm5hbWUiOiJhZG1pbiIsInJvbGUiOjEsImV4cCI6MTQ5OTM3NjE1NH0.NJ6vE8FY1WG6jsRQzfMqeatJ4vh2TWAeeYfDhP71YEE
+```
+
+# Security
+
+Each API environment(endpoint) has an associated access policy, it is documented in the description of each environment(endpoint).
+
+Different access policies are available:
+
+- Public access
+- Authenticated access
+- Restricted access
+- Administrator access
+
+### Public access
+
+No authentication is required to access the environments(endpoints) with this access policy.
+
+### Authenticated access
+
+Authentication is required to access the environments(endpoints) with this access policy.
+
+### Restricted access
+
+Authentication is required to access the environments(endpoints) with this access policy.
+Extra-checks might be added to ensure access to the resource is granted. Returned data might also be filtered.
+
+### Administrator access
+
+Authentication as well as an administrator role are required to access the environments(endpoints) with this access policy.
+
+# Execute Docker requests
+
+Portainer **DO NOT** expose specific environments(endpoints) to manage your Docker resources (create a container, remove a volume, etc...).
+
+Instead, it acts as a reverse-proxy to the Docker HTTP API. This means that you can execute Docker requests **via** the Portainer HTTP API.
+
+To do so, you can use the `/endpoints/{id}/docker` Portainer API environment(endpoint) (which is not documented below due to Swagger limitations). This environment(endpoint) has a restricted access policy so you still need to be authenticated to be able to query this environment(endpoint). Any query on this environment(endpoint) will be proxied to the Docker API of the associated environment(endpoint) (requests and responses objects are the same as documented in the Docker API).
+
+# Private Registry
+
+Using private registry, you will need to pass a based64 encoded JSON string ‘{"registryId":\<registryID value\>}’ inside the Request Header. The parameter name is "X-Registry-Auth".
+\<registryID value\> - The registry ID where the repository was created.
+
+Example:
+
+```
+eyJyZWdpc3RyeUlkIjoxfQ==
+```
+
+**NOTE**: You can find more information on how to query the Docker API in the [Docker official documentation](https://docs.docker.com/engine/api/v1.30/) as well as in [this Portainer example](https://documentation.portainer.io/api/api-examples/).

api/api.md

@@ -1,61 +0,0 @@
-The Portainer API is an HTTP API served by Portainer. It is used by the Portainer UI, and anything you can do in the UI can also be done via the HTTP API.
-
-API examples are available in the [Portainer documentation](https://documentation.portainer.io/api/api-examples/)
-
-You can find out more about Portainer [on our website](http://portainer.io) and get some support on [Slack](http://portainer.io/slack/).
-
-# Authentication
-
-Most of the API endpoints require authentication, as well as some level of authorization.
-Portainer uses JSON Web Tokens to manage authentication. You must provide a token in the **Authorization** header of each request using the **Bearer** scheme.
-
-Example:
-
-```
-Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwidXNlcm5hbWUiOiJhZG1pbiIsInJvbGUiOjEsImV4cCI6MTQ5OTM3NjE1NH0.NJ6vE8FY1WG6jsRQzfMqeatJ4vh2TWAeeYfDhP71YEE
-```
-
-# Security
-
-Each API endpoint has an associated access policy, documented in its description.
-
-The following policies are available:
-
-- Public access
-- Authenticated access
-- Restricted access
-- Administrator access
-
-### Public access
-
-No authentication is required.
-
-### Authenticated access
-
-Authentication is required.
-
-### Restricted access
-
-Authentication is required. Additional checks may apply to verify access to the resource, and returned data may be filtered.
-
-### Administrator access
-
-Authentication and an administrator role are both required.
-
-# Execute Docker requests
-
-Portainer does not expose dedicated endpoints for managing Docker resources (create a container, remove a volume, etc).
-
-Instead, it acts as a reverse-proxy to the Docker HTTP API, allowing you to execute Docker requests via the Portainer HTTP API.
-
-To do so, use the `/endpoints/{id}/docker` endpoint. Note that this endpoint is not documented below due to Swagger limitations. It has a restricted access policy, so authentication is still required. Any request made to this endpoint is proxied to the Docker API of the associated environment - request and response objects are identical to those in the [Docker official documentation](https://docs.docker.com/engine/api).
-
-# Private Registry
-
-When using a private registry, include a Base64-encoded JSON string in the request header. The header parameter name is `X-Registry-Auth` and the value should encode the following structure: ‘{"registryId":\<registryId\>}’ where `<registryId>` is the ID of the registry where the repository was created.
- 
-Example encoded value:
-
-```
-eyJyZWdpc3RyeUlkIjoxfQ==
-```

api/apikey/apikey_test.go

@@ -7,7 +7,6 @@ import (
 )
 
 func Test_generateRandomKey(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 
 	tests := []struct {

api/apikey/cache.go

@@ -71,7 +71,7 @@ func (c *ApiKeyCache[T]) InvalidateUserKeyCache(userId portainer.UserID) bool {
 	for _, k := range c.cache.Keys() {
 		user, _, _ := c.Get(k.(string))
 		if c.userCmpFn(user, userId) {
-			present = c.cache.Remove(k) || present
+			present = c.cache.Remove(k)
 		}
 	}
 

api/apikey/cache_test.go

@@ -8,7 +8,6 @@ import (
 )
 
 func Test_apiKeyCacheGet(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 
 	keyCache := NewAPIKeyCache(10, compareUser)
@@ -44,7 +43,6 @@ func Test_apiKeyCacheGet(t *testing.T) {
 }
 
 func Test_apiKeyCacheSet(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 
 	keyCache := NewAPIKeyCache(10, compareUser)
@@ -70,7 +68,6 @@ func Test_apiKeyCacheSet(t *testing.T) {
 }
 
 func Test_apiKeyCacheDelete(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 
 	keyCache := NewAPIKeyCache(10, compareUser)
@@ -90,7 +87,6 @@ func Test_apiKeyCacheDelete(t *testing.T) {
 }
 
 func Test_apiKeyCacheLRU(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 
 	tests := []struct {
@@ -152,7 +148,6 @@ func Test_apiKeyCacheLRU(t *testing.T) {
 }
 
 func Test_apiKeyCacheInvalidateUserKeyCache(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 
 	keyCache := NewAPIKeyCache(10, compareUser)

api/apikey/service_test.go

@@ -17,13 +17,11 @@ import (
 )
 
 func Test_SatisfiesAPIKeyServiceInterface(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 	is.Implements((*APIKeyService)(nil), NewAPIKeyService(nil, nil))
 }
 
 func Test_GenerateApiKey(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 
 	_, store := datastore.MustNewTestStore(t, true, true)
@@ -77,7 +75,6 @@ func Test_GenerateApiKey(t *testing.T) {
 }
 
 func Test_GetAPIKey(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 
 	_, store := datastore.MustNewTestStore(t, true, true)
@@ -97,7 +94,6 @@ func Test_GetAPIKey(t *testing.T) {
 }
 
 func Test_GetAPIKeys(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 
 	_, store := datastore.MustNewTestStore(t, true, true)
@@ -118,7 +114,6 @@ func Test_GetAPIKeys(t *testing.T) {
 }
 
 func Test_GetDigestUserAndKey(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 
 	_, store := datastore.MustNewTestStore(t, true, true)
@@ -154,7 +149,6 @@ func Test_GetDigestUserAndKey(t *testing.T) {
 }
 
 func Test_UpdateAPIKey(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 
 	_, store := datastore.MustNewTestStore(t, true, true)
@@ -203,7 +197,6 @@ func Test_UpdateAPIKey(t *testing.T) {
 }
 
 func Test_DeleteAPIKey(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 
 	_, store := datastore.MustNewTestStore(t, true, true)
@@ -244,7 +237,6 @@ func Test_DeleteAPIKey(t *testing.T) {
 }
 
 func Test_InvalidateUserKeyCache(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 
 	_, store := datastore.MustNewTestStore(t, true, true)

api/archive/targz_test.go

@@ -5,6 +5,7 @@ import (
 	"compress/gzip"
 	"os"
 	"os/exec"
+	"path"
 	"path/filepath"
 	"testing"
 
@@ -33,25 +34,24 @@ func listFiles(dir string) []string {
 }
 
 func Test_shouldCreateArchive(t *testing.T) {
-	t.Parallel()
 	tmpdir := t.TempDir()
 	content := []byte("content")
 
-	err := os.WriteFile(filesystem.JoinPaths(tmpdir, "outer"), content, 0600)
+	err := os.WriteFile(path.Join(tmpdir, "outer"), content, 0600)
 	require.NoError(t, err)
 
-	err = os.MkdirAll(filesystem.JoinPaths(tmpdir, "dir"), 0700)
+	err = os.MkdirAll(path.Join(tmpdir, "dir"), 0700)
 	require.NoError(t, err)
 
-	err = os.WriteFile(filesystem.JoinPaths(tmpdir, "dir", ".dotfile"), content, 0600)
+	err = os.WriteFile(path.Join(tmpdir, "dir", ".dotfile"), content, 0600)
 	require.NoError(t, err)
 
-	err = os.WriteFile(filesystem.JoinPaths(tmpdir, "dir", "inner"), content, 0600)
+	err = os.WriteFile(path.Join(tmpdir, "dir", "inner"), content, 0600)
 	require.NoError(t, err)
 
 	gzPath, err := TarGzDir(tmpdir)
 	require.NoError(t, err)
-	assert.Equal(t, filesystem.JoinPaths(tmpdir, filepath.Base(tmpdir)+".tar.gz"), gzPath)
+	assert.Equal(t, filepath.Join(tmpdir, filepath.Base(tmpdir)+".tar.gz"), gzPath)
 
 	extractionDir := t.TempDir()
 	cmd := exec.Command("tar", "-xzf", gzPath, "-C", extractionDir)
@@ -61,7 +61,7 @@ func Test_shouldCreateArchive(t *testing.T) {
 	extractedFiles := listFiles(extractionDir)
 
 	wasExtracted := func(p string) {
-		fullpath := filesystem.JoinPaths(extractionDir, p)
+		fullpath := path.Join(extractionDir, p)
 		assert.Contains(t, extractedFiles, fullpath)
 		copyContent, err := os.ReadFile(fullpath)
 		require.NoError(t, err)
@@ -74,25 +74,24 @@ func Test_shouldCreateArchive(t *testing.T) {
 }
 
 func Test_shouldCreateArchive2(t *testing.T) {
-	t.Parallel()
 	tmpdir := t.TempDir()
 	content := []byte("content")
 
-	err := os.WriteFile(filesystem.JoinPaths(tmpdir, "outer"), content, 0600)
+	err := os.WriteFile(path.Join(tmpdir, "outer"), content, 0600)
 	require.NoError(t, err)
 
-	err = os.MkdirAll(filesystem.JoinPaths(tmpdir, "dir"), 0700)
+	err = os.MkdirAll(path.Join(tmpdir, "dir"), 0700)
 	require.NoError(t, err)
 
-	err = os.WriteFile(filesystem.JoinPaths(tmpdir, "dir", ".dotfile"), content, 0600)
+	err = os.WriteFile(path.Join(tmpdir, "dir", ".dotfile"), content, 0600)
 	require.NoError(t, err)
 
-	err = os.WriteFile(filesystem.JoinPaths(tmpdir, "dir", "inner"), content, 0600)
+	err = os.WriteFile(path.Join(tmpdir, "dir", "inner"), content, 0600)
 	require.NoError(t, err)
 
 	gzPath, err := TarGzDir(tmpdir)
 	require.NoError(t, err)
-	assert.Equal(t, filesystem.JoinPaths(tmpdir, filepath.Base(tmpdir)+".tar.gz"), gzPath)
+	assert.Equal(t, filepath.Join(tmpdir, filepath.Base(tmpdir)+".tar.gz"), gzPath)
 
 	extractionDir := t.TempDir()
 	r, _ := os.Open(gzPath)
@@ -102,7 +101,7 @@ func Test_shouldCreateArchive2(t *testing.T) {
 	extractedFiles := listFiles(extractionDir)
 
 	wasExtracted := func(p string) {
-		fullpath := filesystem.JoinPaths(extractionDir, p)
+		fullpath := path.Join(extractionDir, p)
 		assert.Contains(t, extractedFiles, fullpath)
 		copyContent, _ := os.ReadFile(fullpath)
 		assert.Equal(t, content, copyContent)
@@ -114,7 +113,6 @@ func Test_shouldCreateArchive2(t *testing.T) {
 }
 
 func TestExtractTarGzPathTraversal(t *testing.T) {
-	t.Parallel()
 	testDir := t.TempDir()
 
 	// Create an evil file with a path traversal attempt

api/archive/zip_test.go

@@ -1,16 +1,14 @@
 package archive
 
 import (
+	"path/filepath"
 	"testing"
 
-	"github.com/portainer/portainer/api/filesystem"
-
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func TestUnzipFile(t *testing.T) {
-	t.Parallel()
 	dir := t.TempDir()
 	/*
 		Archive structure.
@@ -25,8 +23,8 @@ func TestUnzipFile(t *testing.T) {
 
 	require.NoError(t, err)
 	archiveDir := dir + "/sample_archive"
-	assert.FileExists(t, filesystem.JoinPaths(archiveDir, "0.txt"))
-	assert.FileExists(t, filesystem.JoinPaths(archiveDir, "0", "1.txt"))
-	assert.FileExists(t, filesystem.JoinPaths(archiveDir, "0", "1", "2.txt"))
+	assert.FileExists(t, filepath.Join(archiveDir, "0.txt"))
+	assert.FileExists(t, filepath.Join(archiveDir, "0", "1.txt"))
+	assert.FileExists(t, filepath.Join(archiveDir, "0", "1", "2.txt"))
 
 }

api/aws/ecr/parse_endpoints_test.go

@@ -5,7 +5,6 @@ import (
 )
 
 func TestParseECREndpoint(t *testing.T) {
-	t.Parallel()
 	tests := []struct {
 		name      string
 		url       string

api/backup/backup_test.go

@@ -1,274 +0,0 @@
-package backup
-
-import (
-	"bytes"
-	"context"
-	"io"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/portainer/portainer/api/archive"
-	"github.com/portainer/portainer/api/crypto"
-	"github.com/portainer/portainer/api/datastore"
-	"github.com/portainer/portainer/api/filesystem"
-	"github.com/portainer/portainer/api/http/offlinegate"
-	"github.com/portainer/portainer/pkg/fips"
-
-	"github.com/stretchr/testify/require"
-)
-
-func init() {
-	fips.InitFIPS(false)
-}
-
-func TestGetRestoreSourcePath_DBAtRoot(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	err := os.WriteFile(filesystem.JoinPaths(dir, "portainer.db"), []byte("db"), 0o600)
-	require.NoError(t, err)
-
-	result, err := getRestoreSourcePath(dir)
-	require.NoError(t, err)
-	require.Equal(t, dir, result)
-}
-
-func TestGetRestoreSourcePath_EncryptedDBAtRoot(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	err := os.WriteFile(filesystem.JoinPaths(dir, "portainer.edb"), []byte("db"), 0o600)
-	require.NoError(t, err)
-
-	result, err := getRestoreSourcePath(dir)
-	require.NoError(t, err)
-	require.Equal(t, dir, result)
-}
-
-func TestGetRestoreSourcePath_DBInSubdirectory(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	sub := filesystem.JoinPaths(dir, "backup-2024-01-01")
-	err := os.Mkdir(sub, 0o700)
-	require.NoError(t, err)
-
-	err = os.WriteFile(filesystem.JoinPaths(sub, "portainer.db"), []byte("db"), 0o600)
-	require.NoError(t, err)
-
-	result, err := getRestoreSourcePath(dir)
-	require.NoError(t, err)
-	require.Equal(t, sub, result)
-}
-
-func TestGetRestoreSourcePath_NoDBFile(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	err := os.WriteFile(filesystem.JoinPaths(dir, "other.file"), []byte("data"), 0o600)
-	require.NoError(t, err)
-
-	result, err := getRestoreSourcePath(dir)
-	require.NoError(t, err)
-	require.Equal(t, dir, result)
-}
-
-func TestGetRestoreSourcePath_EmptyDir(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-
-	result, err := getRestoreSourcePath(dir)
-	require.NoError(t, err)
-	require.Equal(t, dir, result)
-}
-
-func TestEncryptDecrypt_RoundTrip(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	plaintext := []byte("sensitive portainer backup data")
-
-	srcPath := filesystem.JoinPaths(dir, "archive.tar.gz")
-	err := os.WriteFile(srcPath, plaintext, 0o600)
-	require.NoError(t, err)
-
-	encryptedPath, err := encrypt(srcPath, "mysecretpassword")
-	require.NoError(t, err)
-	require.Equal(t, srcPath+".encrypted", encryptedPath)
-
-	encryptedData, err := os.ReadFile(encryptedPath)
-	require.NoError(t, err)
-
-	decryptedReader, err := crypto.AesDecrypt(bytes.NewReader(encryptedData), []byte("mysecretpassword"))
-	require.NoError(t, err)
-
-	decrypted, err := io.ReadAll(decryptedReader)
-	require.NoError(t, err)
-	require.Equal(t, plaintext, decrypted)
-}
-
-func TestEncryptDecrypt_WrongPassword(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-
-	srcPath := filesystem.JoinPaths(dir, "archive.tar.gz")
-	err := os.WriteFile(srcPath, []byte("data"), 0o600)
-	require.NoError(t, err)
-
-	encryptedPath, err := encrypt(srcPath, "correctpassword")
-	require.NoError(t, err)
-
-	encryptedData, err := os.ReadFile(encryptedPath)
-	require.NoError(t, err)
-
-	_, err = crypto.AesDecrypt(bytes.NewReader(encryptedData), []byte("wrongpassword"))
-	require.Error(t, err)
-}
-
-func TestCreateBackupArchive_NoPassword(t *testing.T) {
-	t.Parallel()
-
-	_, store := datastore.MustNewTestStore(t, true, false)
-	storePath := store.GetConnection().GetStorePath()
-	gate := offlinegate.NewOfflineGate()
-
-	archivePath, err := CreateBackupArchive("", gate, store, storePath)
-	require.NoError(t, err)
-
-	f, err := os.Open(archivePath)
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		err := f.Close()
-		require.NoError(t, err)
-	})
-
-	extractDir := t.TempDir()
-	err = archive.ExtractTarGz(f, extractDir)
-	require.NoError(t, err)
-
-	dbFound := false
-	err = filepath.Walk(extractDir, func(path string, info os.FileInfo, err error) error {
-		if err != nil {
-			return err
-		}
-		if info.Name() == "portainer.db" {
-			dbFound = true
-		}
-
-		return nil
-	})
-	require.NoError(t, err)
-	require.True(t, dbFound, "archive should contain portainer.db")
-}
-
-func TestCreateBackupArchive_WithPassword(t *testing.T) {
-	t.Parallel()
-
-	_, store := datastore.MustNewTestStore(t, true, false)
-	storePath := store.GetConnection().GetStorePath()
-	gate := offlinegate.NewOfflineGate()
-
-	archivePath, err := CreateBackupArchive("backup-secret", gate, store, storePath)
-	require.NoError(t, err)
-	require.Contains(t, archivePath, ".encrypted")
-
-	encryptedData, err := os.ReadFile(archivePath)
-	require.NoError(t, err)
-
-	decryptedReader, err := crypto.AesDecrypt(bytes.NewReader(encryptedData), []byte("backup-secret"))
-	require.NoError(t, err)
-
-	extractDir := t.TempDir()
-	err = archive.ExtractTarGz(decryptedReader, extractDir)
-	require.NoError(t, err)
-
-	dbFound := false
-	err = filepath.Walk(extractDir, func(path string, info os.FileInfo, err error) error {
-		if err != nil {
-			return err
-		}
-		if info.Name() == "portainer.db" {
-			dbFound = true
-		}
-
-		return nil
-	})
-	require.NoError(t, err)
-	require.True(t, dbFound, "decrypted archive should contain portainer.db")
-}
-
-func TestRestoreArchive_NoPassword(t *testing.T) {
-	t.Parallel()
-
-	_, store1 := datastore.MustNewTestStore(t, true, false)
-	storePath1 := store1.GetConnection().GetStorePath()
-	gate := offlinegate.NewOfflineGate()
-
-	archivePath, err := CreateBackupArchive("", gate, store1, storePath1)
-	require.NoError(t, err)
-
-	archiveData, err := os.ReadFile(archivePath)
-	require.NoError(t, err)
-
-	_, store2 := datastore.MustNewTestStore(t, true, false)
-	storePath2 := store2.GetConnection().GetStorePath()
-
-	ctx, cancel := context.WithCancel(t.Context())
-	err = RestoreArchive(bytes.NewReader(archiveData), "", storePath2, gate, store2, cancel)
-	require.NoError(t, err)
-
-	require.ErrorIs(t, ctx.Err(), context.Canceled)
-
-	_, err = os.Stat(filesystem.JoinPaths(storePath2, "portainer.db"))
-	require.NoError(t, err)
-}
-
-func TestRestoreArchive_WithPassword(t *testing.T) {
-	t.Parallel()
-
-	_, store1 := datastore.MustNewTestStore(t, true, false)
-	storePath1 := store1.GetConnection().GetStorePath()
-	gate := offlinegate.NewOfflineGate()
-
-	archivePath, err := CreateBackupArchive("restore-secret", gate, store1, storePath1)
-	require.NoError(t, err)
-
-	archiveData, err := os.ReadFile(archivePath)
-	require.NoError(t, err)
-
-	_, store2 := datastore.MustNewTestStore(t, true, false)
-	storePath2 := store2.GetConnection().GetStorePath()
-
-	ctx, cancel := context.WithCancel(t.Context())
-	err = RestoreArchive(bytes.NewReader(archiveData), "restore-secret", storePath2, gate, store2, cancel)
-	require.NoError(t, err)
-
-	require.ErrorIs(t, ctx.Err(), context.Canceled)
-
-	_, err = os.Stat(filesystem.JoinPaths(storePath2, "portainer.db"))
-	require.NoError(t, err)
-}
-
-func TestRestoreArchive_WrongPassword(t *testing.T) {
-	t.Parallel()
-
-	_, store1 := datastore.MustNewTestStore(t, true, false)
-	storePath1 := store1.GetConnection().GetStorePath()
-	gate := offlinegate.NewOfflineGate()
-
-	archivePath, err := CreateBackupArchive("correct-password", gate, store1, storePath1)
-	require.NoError(t, err)
-
-	archiveData, err := os.ReadFile(archivePath)
-	require.NoError(t, err)
-
-	_, store2 := datastore.MustNewTestStore(t, true, false)
-	storePath2 := store2.GetConnection().GetStorePath()
-
-	_, cancel := context.WithCancel(t.Context())
-	err = RestoreArchive(bytes.NewReader(archiveData), "wrong-password", storePath2, gate, store2, cancel)
-	require.Error(t, err)
-}

api/chisel/crypto/crypto_test.go

@@ -6,7 +6,6 @@ import (
 )
 
 func TestGenerateGo119CompatibleKey(t *testing.T) {
-	t.Parallel()
 	type args struct {
 		seed string
 	}

api/chisel/service.go

@@ -11,7 +11,6 @@ import (
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/http/proxy"
-	"github.com/portainer/portainer/pkg/schedule"
 
 	chserver "github.com/jpillora/chisel/server"
 	"github.com/jpillora/chisel/share/ccrypto"
@@ -234,18 +233,27 @@ func (service *Service) startTunnelVerificationLoop() {
 		Float64("check_interval_seconds", tunnelCleanupInterval.Seconds()).
 		Msg("starting tunnel management process")
 
-	schedule.RunOnInterval(service.shutdownCtx, tunnelCleanupInterval, service.checkTunnels, func() {
-		log.Debug().Msg("shutting down tunnel service")
+	ticker := time.NewTicker(tunnelCleanupInterval)
 
-		if err := service.StopTunnelServer(); err != nil {
-			log.Debug().Err(err).Msg("stopped tunnel service")
+	for {
+		select {
+		case <-ticker.C:
+			service.checkTunnels()
+		case <-service.shutdownCtx.Done():
+			log.Debug().Msg("shutting down tunnel service")
+
+			if err := service.StopTunnelServer(); err != nil {
+				log.Debug().Err(err).Msg("stopped tunnel service")
+			}
+
+			ticker.Stop()
+			return
 		}
-	})
+	}
 }
 
-// checkTunnels finds tunnels that need snapshots and processes them one at a time.
-// For active tunnels missing an initial snapshot, it takes one without closing the tunnel.
-// For tunnels idle past activeTimeout, it snapshots and closes them.
+// checkTunnels finds the first tunnel that has not had any activity recently
+// and attempts to take a snapshot, then closes it and returns
 func (service *Service) checkTunnels() {
 	service.mu.RLock()
 
@@ -256,32 +264,12 @@ func (service *Service) checkTunnels() {
 			Float64("last_activity_seconds", elapsed.Seconds()).
 			Msg("environment tunnel monitoring")
 
-		tunnelPort := tunnel.Port
-
-		if !tunnel.HasSnapshot && elapsed < activeTimeout {
-			service.mu.RUnlock()
-
-			if endpointHasSnapshot(service.dataStore, endpointID) {
-				service.markSnapshotTaken(endpointID)
-
-				return
-			}
-
-			log.Debug().
-				Int("endpoint_id", int(endpointID)).
-				Msg("taking initial snapshot for active Edge environment")
-
-			if service.snapshotAndLog(endpointID, tunnelPort) {
-				service.markSnapshotTaken(endpointID)
-			}
-
-			return
-		}
-
 		if tunnel.Status == portainer.EdgeAgentManagementRequired && elapsed < activeTimeout {
 			continue
 		}
 
+		tunnelPort := tunnel.Port
+
 		service.mu.RUnlock()
 
 		log.Debug().
@@ -290,7 +278,13 @@ func (service *Service) checkTunnels() {
 			Float64("timeout_seconds", activeTimeout.Seconds()).
 			Msg("last activity timeout exceeded")
 
-		service.snapshotAndLog(endpointID, tunnelPort)
+		if err := service.snapshotEnvironment(endpointID, tunnelPort); err != nil {
+			log.Error().
+				Int("endpoint_id", int(endpointID)).
+				Err(err).
+				Msg("unable to snapshot Edge environment")
+		}
+
 		service.close(endpointID)
 
 		return
@@ -299,28 +293,6 @@ func (service *Service) checkTunnels() {
 	service.mu.RUnlock()
 }
 
-func (service *Service) snapshotAndLog(endpointID portainer.EndpointID, tunnelPort int) bool {
-	if err := service.snapshotEnvironment(endpointID, tunnelPort); err != nil {
-		log.Error().
-			Int("endpoint_id", int(endpointID)).
-			Err(err).
-			Msg("unable to snapshot Edge environment")
-
-		return false
-	}
-
-	return true
-}
-
-func (service *Service) markSnapshotTaken(endpointID portainer.EndpointID) {
-	service.mu.Lock()
-	defer service.mu.Unlock()
-
-	if tun, ok := service.activeTunnels[endpointID]; ok {
-		tun.HasSnapshot = true
-	}
-}
-
 func (service *Service) snapshotEnvironment(endpointID portainer.EndpointID, tunnelPort int) error {
 	endpoint, err := service.dataStore.Endpoint().Endpoint(endpointID)
 	if err != nil {

api/chisel/service_test.go

@@ -2,7 +2,6 @@ package chisel
 
 import (
 	"context"
-	"errors"
 	"net"
 	"net/http"
 	"testing"
@@ -19,38 +18,15 @@ func init() {
 	fips.InitFIPS(false)
 }
 
-type mockSnapshotService struct {
-	snapshotFn func(endpoint *portainer.Endpoint) error
-}
-
-func (m *mockSnapshotService) Start(_ context.Context) {}
-
-func (m *mockSnapshotService) SetSnapshotInterval(_ string) error { return nil }
-
-func (m *mockSnapshotService) SnapshotEndpoint(endpoint *portainer.Endpoint) error {
-	if m.snapshotFn != nil {
-		return m.snapshotFn(endpoint)
-	}
-
-	return nil
-}
-
-func (m *mockSnapshotService) FillSnapshotData(_ *portainer.Endpoint, _ bool) error { return nil }
-
-func newEdgeEndpoint(id portainer.EndpointID) *portainer.Endpoint {
-	return &portainer.Endpoint{
-		ID:          id,
+func TestPingAgentPanic(t *testing.T) {
+	endpoint := &portainer.Endpoint{
+		ID:          1,
 		EdgeID:      "test-edge-id",
 		Type:        portainer.EdgeAgentOnDockerEnvironment,
 		UserTrusted: true,
 	}
-}
 
-func TestPingAgentPanic(t *testing.T) {
-	t.Parallel()
-	endpoint := newEdgeEndpoint(1)
-
-	_, store := datastore.MustNewTestStore(t, false, true)
+	_, store := datastore.MustNewTestStore(t, true, true)
 
 	s := NewService(store, nil, nil)
 
@@ -78,143 +54,6 @@ func TestPingAgentPanic(t *testing.T) {
 	s.activeTunnels[endpoint.ID].Port = ln.Addr().(*net.TCPAddr).Port
 
 	require.Error(t, s.pingAgent(endpoint.ID))
-	require.NoError(t, srv.Shutdown(t.Context()))
+	require.NoError(t, srv.Shutdown(context.Background()))
 	require.ErrorIs(t, <-errCh, http.ErrServerClosed)
 }
-
-func TestOpenDefaultsHasSnapshotToFalse(t *testing.T) {
-	t.Parallel()
-
-	endpoint := newEdgeEndpoint(1)
-	_, store := datastore.MustNewTestStore(t, false, true)
-
-	s := NewService(store, nil, nil)
-
-	err := s.Open(endpoint)
-	require.NoError(t, err)
-
-	require.False(t, s.activeTunnels[endpoint.ID].HasSnapshot)
-}
-
-func TestCheckTunnelsSetsHasSnapshotWhenSnapshotExists(t *testing.T) {
-	t.Parallel()
-
-	endpoint := newEdgeEndpoint(2)
-	_, store := datastore.MustNewTestStore(t, false, true)
-
-	err := store.Endpoint().Create(endpoint)
-	require.NoError(t, err)
-
-	snap := &portainer.Snapshot{
-		EndpointID: endpoint.ID,
-		Docker:     &portainer.DockerSnapshot{},
-	}
-	err = store.Snapshot().Create(snap)
-	require.NoError(t, err)
-
-	s := NewService(store, nil, nil)
-	s.activeTunnels[endpoint.ID] = &portainer.TunnelDetails{
-		Status:       portainer.EdgeAgentManagementRequired,
-		Port:         50003,
-		LastActivity: time.Now(),
-	}
-
-	s.checkTunnels()
-
-	require.NotNil(t, s.activeTunnels[endpoint.ID], "tunnel must remain open")
-	require.True(t, s.activeTunnels[endpoint.ID].HasSnapshot)
-}
-
-func TestCheckTunnelsSnapshotsActiveEnvironmentAndKeepsTunnelAlive(t *testing.T) {
-	t.Parallel()
-
-	endpoint := newEdgeEndpoint(3)
-	_, store := datastore.MustNewTestStore(t, false, true)
-
-	err := store.Endpoint().Create(endpoint)
-	require.NoError(t, err)
-
-	snapshotCalled := false
-	svc := &mockSnapshotService{
-		snapshotFn: func(_ *portainer.Endpoint) error {
-			snapshotCalled = true
-
-			return nil
-		},
-	}
-
-	s := NewService(store, nil, nil)
-	s.snapshotService = svc
-	s.activeTunnels[endpoint.ID] = &portainer.TunnelDetails{
-		Status:       portainer.EdgeAgentManagementRequired,
-		Port:         50000,
-		LastActivity: time.Now(),
-	}
-
-	s.checkTunnels()
-
-	require.True(t, snapshotCalled)
-	require.NotNil(t, s.activeTunnels[endpoint.ID], "tunnel must remain open after snapshot")
-	require.True(t, s.activeTunnels[endpoint.ID].HasSnapshot)
-}
-
-func TestCheckTunnelsKeepsHasSnapshotFalseOnSnapshotFailure(t *testing.T) {
-	t.Parallel()
-
-	endpoint := newEdgeEndpoint(4)
-	_, store := datastore.MustNewTestStore(t, false, true)
-
-	err := store.Endpoint().Create(endpoint)
-	require.NoError(t, err)
-
-	svc := &mockSnapshotService{
-		snapshotFn: func(_ *portainer.Endpoint) error {
-			return errors.New("snapshot failed")
-		},
-	}
-
-	s := NewService(store, nil, nil)
-	s.snapshotService = svc
-	s.activeTunnels[endpoint.ID] = &portainer.TunnelDetails{
-		Status:       portainer.EdgeAgentManagementRequired,
-		Port:         50001,
-		LastActivity: time.Now(),
-	}
-
-	s.checkTunnels()
-
-	require.NotNil(t, s.activeTunnels[endpoint.ID], "tunnel must remain open after failed snapshot")
-	require.False(t, s.activeTunnels[endpoint.ID].HasSnapshot, "HasSnapshot must stay false after failure")
-}
-
-func TestCheckTunnelsClosesIdleTunnelAndSnapshots(t *testing.T) {
-	t.Parallel()
-
-	endpoint := newEdgeEndpoint(5)
-	_, store := datastore.MustNewTestStore(t, false, true)
-
-	err := store.Endpoint().Create(endpoint)
-	require.NoError(t, err)
-
-	snapshotCalled := false
-	svc := &mockSnapshotService{
-		snapshotFn: func(_ *portainer.Endpoint) error {
-			snapshotCalled = true
-
-			return nil
-		},
-	}
-
-	s := NewService(store, nil, nil)
-	s.snapshotService = svc
-	s.activeTunnels[endpoint.ID] = &portainer.TunnelDetails{
-		Status:       portainer.EdgeAgentManagementRequired,
-		Port:         50002,
-		LastActivity: time.Now().Add(-(activeTimeout + time.Second)),
-	}
-
-	s.checkTunnels()
-
-	require.True(t, snapshotCalled)
-	require.Nil(t, s.activeTunnels[endpoint.ID], "tunnel must be closed after idle timeout")
-}

api/chisel/tunnel.go

@@ -9,7 +9,6 @@ import (
 	"time"
 
 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/internal/edge"
 	"github.com/portainer/portainer/api/internal/edge/cache"
 	"github.com/portainer/portainer/api/internal/endpointutils"
@@ -238,18 +237,3 @@ func encryptCredentials(username, password, key string) (string, error) {
 
 	return base64.RawStdEncoding.EncodeToString(encryptedCredentials), nil
 }
-
-func endpointHasSnapshot(dataStore dataservices.DataStore, endpointID portainer.EndpointID) bool {
-	var hasSnapshot bool
-	_ = dataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
-		s, err := tx.Snapshot().Read(endpointID)
-		if err != nil {
-			return err
-		}
-
-		hasSnapshot = s.Docker != nil || s.Kubernetes != nil
-		return nil
-	})
-
-	return hasSnapshot
-}

api/chisel/tunnel_test.go

@@ -28,7 +28,6 @@ func (s *testStore) Settings() dataservices.SettingsService {
 }
 
 func TestGetUnusedPort(t *testing.T) {
-	t.Parallel()
 	testCases := []struct {
 		name            string
 		existingTunnels map[portainer.EndpointID]*portainer.TunnelDetails

api/cli/cli.go

@@ -32,7 +32,7 @@ func CLIFlags() *portainer.CLIFlags {
 		Assets:                    kingpin.Flag("assets", "Path to the assets").Default(defaultAssetsDirectory).Short('a').String(),
 		Data:                      kingpin.Flag("data", "Path to the folder where the data is stored").Default(defaultDataDirectory).Short('d').String(),
 		EndpointURL:               kingpin.Flag("host", "Environment URL").Short('H').String(),
-		FeatureFlags:              kingpin.Flag("feat", "List of feature flags").Envar(portainer.FeatureFlagEnvVar).Strings(),
+		FeatureFlags:              kingpin.Flag("feat", "List of feature flags").Strings(),
 		EnableEdgeComputeFeatures: kingpin.Flag("edge-compute", "Enable Edge Compute features").Bool(),
 		NoAnalytics:               kingpin.Flag("no-analytics", "Disable Analytics in app (deprecated)").Bool(),
 		TLSSkipVerify:             kingpin.Flag("tlsskipverify", "Disable TLS server verification").Default(defaultTLSSkipVerify).Bool(),
@@ -159,11 +159,11 @@ func (Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
 func (Service) ValidateFlags(flags *portainer.CLIFlags) error {
 	displayDeprecationWarnings(flags)
 
-	if err := ValidateEndpointURL(*flags.EndpointURL); err != nil {
+	if err := validateEndpointURL(*flags.EndpointURL); err != nil {
 		return err
 	}
 
-	if err := ValidateSnapshotInterval(*flags.SnapshotInterval); err != nil {
+	if err := validateSnapshotInterval(*flags.SnapshotInterval); err != nil {
 		return err
 	}
 
@@ -180,7 +180,7 @@ func displayDeprecationWarnings(flags *portainer.CLIFlags) {
 	}
 }
 
-func ValidateEndpointURL(endpointURL string) error {
+func validateEndpointURL(endpointURL string) error {
 	if endpointURL == "" {
 		return nil
 	}
@@ -205,7 +205,7 @@ func ValidateEndpointURL(endpointURL string) error {
 	return nil
 }
 
-func ValidateSnapshotInterval(snapshotInterval string) error {
+func validateSnapshotInterval(snapshotInterval string) error {
 	if snapshotInterval == "" {
 		return nil
 	}

api/cmd/portainer/main.go

@@ -7,7 +7,6 @@ import (
 	"os"
 	"path"
 	"strings"
-	"time"
 
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/apikey"
@@ -26,6 +25,7 @@ import (
 	"github.com/portainer/portainer/api/exec"
 	"github.com/portainer/portainer/api/filesystem"
 	"github.com/portainer/portainer/api/git"
+	"github.com/portainer/portainer/api/hostmanagement/openamt"
 	"github.com/portainer/portainer/api/http"
 	"github.com/portainer/portainer/api/http/proxy"
 	kubeproxy "github.com/portainer/portainer/api/http/proxy/factory/kubernetes"
@@ -51,11 +51,11 @@ import (
 	"github.com/portainer/portainer/pkg/featureflags"
 	"github.com/portainer/portainer/pkg/fips"
 	"github.com/portainer/portainer/pkg/libhelm"
+	libhelmtypes "github.com/portainer/portainer/pkg/libhelm/types"
 	"github.com/portainer/portainer/pkg/libstack/compose"
-	libswarm "github.com/portainer/portainer/pkg/libstack/swarm"
 	"github.com/portainer/portainer/pkg/validate"
 
-	"github.com/google/uuid"
+	"github.com/gofrs/uuid"
 	"github.com/rs/zerolog/log"
 )
 
@@ -119,7 +119,7 @@ func initDataStore(flags *portainer.CLIFlags, secretKey []byte, fileService port
 	}
 
 	if isNew {
-		instanceId, err := uuid.NewRandom()
+		instanceId, err := uuid.NewV4()
 		if err != nil {
 			log.Fatal().Err(err).Msg("failed generating instance id")
 		}
@@ -174,6 +174,10 @@ func initKubernetesDeployer(kubernetesTokenCacheManager *kubeproxy.TokenCacheMan
 	return exec.NewKubernetesDeployer(kubernetesTokenCacheManager, kubernetesClientFactory, dataStore, reverseTunnelService, signatureService, proxyManager)
 }
 
+func initHelmPackageManager() (libhelmtypes.HelmPackageManager, error) {
+	return libhelm.NewHelmPackageManager()
+}
+
 func initAPIKeyService(datastore dataservices.DataStore) apikey.APIKeyService {
 	return apikey.NewAPIKeyService(datastore.APIKeyRepository(), datastore.User())
 }
@@ -212,12 +216,13 @@ func initSnapshotService(
 	dataStore dataservices.DataStore,
 	dockerClientFactory *dockerclient.ClientFactory,
 	kubernetesClientFactory *kubecli.ClientFactory,
+	shutdownCtx context.Context,
 	pendingActionsService *pendingactions.PendingActionsService,
 ) (portainer.SnapshotService, error) {
 	dockerSnapshotter := docker.NewSnapshotter(dockerClientFactory)
 	kubernetesSnapshotter := kubernetes.NewSnapshotter(kubernetesClientFactory)
 
-	snapshotService, err := snapshot.NewService(snapshotIntervalFromFlag, dataStore, dockerSnapshotter, kubernetesSnapshotter, pendingActionsService)
+	snapshotService, err := snapshot.NewService(snapshotIntervalFromFlag, dataStore, dockerSnapshotter, kubernetesSnapshotter, shutdownCtx, pendingActionsService)
 	if err != nil {
 		return nil, err
 	}
@@ -337,7 +342,9 @@ func loadEncryptionSecretKey(keyfilename string) []byte {
 	return hash[:]
 }
 
-func buildServer(flags *portainer.CLIFlags, shutdownCtx context.Context, shutdownTrigger context.CancelFunc) portainer.Server {
+func buildServer(flags *portainer.CLIFlags) portainer.Server {
+	shutdownCtx, shutdownTrigger := context.WithCancel(context.Background())
+
 	if flags.FeatureFlags != nil {
 		featureflags.Parse(*flags.FeatureFlags, portainer.SupportedFeatureFlags)
 	}
@@ -347,7 +354,7 @@ func buildServer(flags *portainer.CLIFlags, shutdownCtx context.Context, shutdow
 		// validate if the trusted origins are valid urls
 		for origin := range strings.SplitSeq(*flags.TrustedOrigins, ",") {
 			if !validate.IsTrustedOrigin(origin) {
-				log.Fatal().Str("trusted_origin", origin).Msg("invalid trusted origin: must be scheme://host or scheme://host:port (e.g. https://example.com)")
+				log.Fatal().Str("trusted_origin", origin).Msg("invalid url for trusted origin. Please check the trusted origins flag.")
 			}
 
 			trustedOrigins = append(trustedOrigins, origin)
@@ -397,6 +404,9 @@ func buildServer(flags *portainer.CLIFlags, shutdownCtx context.Context, shutdow
 
 	gitService := git.NewService(shutdownCtx)
 
+	// Setting insecureSkipVerify to true to preserve the old behaviour.
+	openAMTService := openamt.NewService(true)
+
 	cryptoService := crypto.Service{}
 
 	signatureService := initDigitalSignatureService()
@@ -437,11 +447,16 @@ func buildServer(flags *portainer.CLIFlags, shutdownCtx context.Context, shutdow
 
 	reverseTunnelService.ProxyManager = proxyManager
 
+	dockerConfigPath := fileService.GetDockerConfigPath()
+
 	composeDeployer := compose.NewComposeDeployer()
 
-	composeStackManager := exec.NewComposeStackManager(composeDeployer, proxyManager)
+	composeStackManager := exec.NewComposeStackManager(composeDeployer, proxyManager, dataStore)
 
-	swarmStackManager := exec.NewSwarmStackManager(libswarm.NewSwarmDeployer(), proxyManager)
+	swarmStackManager, err := exec.NewSwarmStackManager(*flags.Assets, dockerConfigPath, signatureService, fileService, reverseTunnelService, dataStore)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed initializing swarm stack manager")
+	}
 
 	kubernetesDeployer := initKubernetesDeployer(kubernetesTokenCacheManager, kubernetesClientFactory, dataStore, reverseTunnelService, signatureService, proxyManager)
 
@@ -450,16 +465,19 @@ func buildServer(flags *portainer.CLIFlags, shutdownCtx context.Context, shutdow
 	pendingActionsService.RegisterHandler(actions.DeletePortainerK8sRegistrySecrets, handlers.NewHandlerDeleteRegistrySecrets(authorizationService, dataStore, kubernetesClientFactory))
 	pendingActionsService.RegisterHandler(actions.PostInitMigrateEnvironment, handlers.NewHandlerPostInitMigrateEnvironment(authorizationService, dataStore, kubernetesClientFactory, dockerClientFactory, *flags.Assets, kubernetesDeployer))
 
-	snapshotService, err := initSnapshotService(*flags.SnapshotInterval, dataStore, dockerClientFactory, kubernetesClientFactory, pendingActionsService)
+	snapshotService, err := initSnapshotService(*flags.SnapshotInterval, dataStore, dockerClientFactory, kubernetesClientFactory, shutdownCtx, pendingActionsService)
 	if err != nil {
 		log.Fatal().Err(err).Msg("failed initializing snapshot service")
 	}
 
-	snapshotService.Start(shutdownCtx)
+	snapshotService.Start()
 
 	proxyManager.NewProxyFactory(dataStore, signatureService, reverseTunnelService, dockerClientFactory, kubernetesClientFactory, kubernetesTokenCacheManager, gitService, snapshotService, jwtService)
 
-	helmPackageManager := libhelm.NewHelmPackageManager()
+	helmPackageManager, err := initHelmPackageManager()
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed initializing helm package manager")
+	}
 
 	applicationStatus := initStatus(instanceID)
 
@@ -525,7 +543,10 @@ func buildServer(flags *portainer.CLIFlags, shutdownCtx context.Context, shutdow
 		log.Fatal().Msg("failed to fetch SSL settings from DB")
 	}
 
-	platformService := platform.NewService(dataStore)
+	platformService, err := platform.NewService(dataStore)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed initializing platform service")
+	}
 
 	upgradeService, err := upgrade.NewService(
 		*flags.Assets,
@@ -555,13 +576,6 @@ func buildServer(flags *portainer.CLIFlags, shutdownCtx context.Context, shutdow
 		log.Fatal().Err(err).Msg("failure during post init migrations")
 	}
 
-	if err := dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		return recoverStaleDeployingStacks(tx)
-	}); err != nil {
-		log.Info().Err(err).
-			Msg("Error recovering stale deploying stacks")
-	}
-
 	return &http.Server{
 		AuthorizationService:        authorizationService,
 		ReverseTunnelService:        reverseTunnelService,
@@ -584,6 +598,7 @@ func buildServer(flags *portainer.CLIFlags, shutdownCtx context.Context, shutdow
 		LDAPService:                 ldapService,
 		OAuthService:                oauthService,
 		GitService:                  gitService,
+		OpenAMTService:              openAMTService,
 		ProxyManager:                proxyManager,
 		KubernetesTokenCacheManager: kubernetesTokenCacheManager,
 		KubeClusterAccessService:    kubeClusterAccessService,
@@ -593,6 +608,7 @@ func buildServer(flags *portainer.CLIFlags, shutdownCtx context.Context, shutdow
 		DockerClientFactory:         dockerClientFactory,
 		KubernetesClientFactory:     kubernetesClientFactory,
 		Scheduler:                   scheduler,
+		ShutdownCtx:                 shutdownCtx,
 		ShutdownTrigger:             shutdownTrigger,
 		StackDeployer:               stackDeployer,
 		UpgradeService:              upgradeService,
@@ -614,8 +630,7 @@ func main() {
 	logs.SetLoggingMode(*flags.LogMode)
 
 	for {
-		shutdownCtx, shutdownTrigger := context.WithCancel(context.Background())
-		server := buildServer(flags, shutdownCtx, shutdownTrigger)
+		server := buildServer(flags)
 
 		log.Info().
 			Str("version", portainer.APIVersion).
@@ -627,44 +642,8 @@ func main() {
 			Str("go_version", build.GoVersion).
 			Msg("starting Portainer")
 
-		err := server.Start(shutdownCtx)
+		err := server.Start()
 
 		log.Info().Err(err).Msg("HTTP server exited")
 	}
 }
-
-// recoverStaleDeployingStacks resets any stack that was left in the Deploying state
-// (e.g. because the server was restarted mid-deployment) to the Error state so the
-// user can retry.
-func recoverStaleDeployingStacks(tx dataservices.DataStoreTx) error {
-	stacks, err := tx.Stack().ReadAll(func(s portainer.Stack) bool {
-		return s.Status == portainer.StackStatusDeploying
-	})
-	if err != nil {
-		return err
-	}
-
-	for _, stack := range stacks {
-		stack.Status = portainer.StackStatusError
-		stack.DeploymentStatus = append(stack.DeploymentStatus, portainer.StackDeploymentStatus{
-			Status:  portainer.StackStatusError,
-			Time:    time.Now().Unix(),
-			Message: "Deployment interrupted by server restart",
-		})
-
-		if err := tx.Stack().Update(stack.ID, &stack); err != nil {
-			log.Warn().Err(err).
-				Int("stack_id", int(stack.ID)).
-				Str("context", "RecoverStaleDeployingStacks").
-				Msg("Unable to recover stale deploying stack")
-			continue
-		}
-		log.Debug().
-			Int("stack_id", int(stack.ID)).
-			Str("stack_name", stack.Name).
-			Str("context", "RecoverStaleDeployingStacks").
-			Msg("Recovered stale deploying stack to error state")
-	}
-
-	return nil
-}

api/cmd/portainer/main_test.go

@@ -2,10 +2,10 @@ package main
 
 import (
 	"os"
+	"path"
 	"testing"
 
 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/filesystem"
 	"github.com/portainer/portainer/api/internal/testhelpers"
 
 	"github.com/stretchr/testify/assert"
@@ -21,9 +21,8 @@ func createPasswordFile(t *testing.T, secretPath, password string) string {
 }
 
 func TestLoadEncryptionSecretKey(t *testing.T) {
-	t.Parallel()
 	tempDir := t.TempDir()
-	secretPath := filesystem.JoinPaths(tempDir, secretFileName)
+	secretPath := path.Join(tempDir, secretFileName)
 
 	// first pointing to file that does not exist, gives nil hash (no encryption)
 	encryptionKey := loadEncryptionSecretKey(secretPath)
@@ -102,7 +101,6 @@ func TestUpdateSettingsFromFlags_KubectlShellImage(t *testing.T) {
 }
 
 func TestDBSecretPath(t *testing.T) {
-	t.Parallel()
 	tests := []struct {
 		keyFilenameFlag string
 		expected        string

api/concurrent/concurrent_test.go

@@ -1,149 +0,0 @@
-package concurrent
-
-import (
-	"context"
-	"errors"
-	"sync/atomic"
-	"testing"
-	"testing/synctest"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestRun_AllSucceed(t *testing.T) {
-	t.Parallel()
-
-	fn1 := func(ctx context.Context) (any, error) { return "one", nil }
-	fn2 := func(ctx context.Context) (any, error) { return "two", nil }
-	fn3 := func(ctx context.Context) (any, error) { return "three", nil }
-
-	results, err := Run(t.Context(), 0, fn1, fn2, fn3)
-
-	require.NoError(t, err)
-	require.Len(t, results, 3)
-
-	values := make([]string, 0, len(results))
-	for _, r := range results {
-		values = append(values, r.Result.(string))
-	}
-	require.ElementsMatch(t, []string{"one", "two", "three"}, values)
-}
-
-func TestRun_OneError(t *testing.T) {
-	t.Parallel()
-
-	sentinel := errors.New("task failed")
-
-	fn1 := func(ctx context.Context) (any, error) { return "ok", nil }
-	fn2 := func(ctx context.Context) (any, error) { return nil, sentinel }
-
-	_, err := Run(t.Context(), 0, fn1, fn2)
-
-	require.ErrorIs(t, err, sentinel)
-}
-
-func TestRun_NoTasks(t *testing.T) {
-	t.Parallel()
-
-	results, err := Run(t.Context(), 0)
-
-	require.NoError(t, err)
-	require.Empty(t, results)
-}
-
-func TestRun_MaxConcurrency(t *testing.T) {
-	t.Parallel()
-
-	const numTasks = 10
-	var peak atomic.Int32
-	var active atomic.Int32
-
-	task := func(ctx context.Context) (any, error) {
-		current := active.Add(1)
-		if current > peak.Load() {
-			peak.Store(current)
-		}
-
-		time.Sleep(10 * time.Millisecond)
-		active.Add(-1)
-
-		return nil, nil
-	}
-
-	tasks := make([]Func, numTasks)
-	for i := range tasks {
-		tasks[i] = task
-	}
-
-	synctest.Test(t, func(t *testing.T) {
-		results, err := Run(t.Context(), 3, tasks...)
-		require.NoError(t, err)
-		require.Len(t, results, numTasks)
-		require.LessOrEqual(t, peak.Load(), int32(3))
-	})
-}
-
-func TestRun_ZeroConcurrencyUsesAllTasks(t *testing.T) {
-	t.Parallel()
-
-	const numTasks = 5
-	var peak atomic.Int32
-	var active atomic.Int32
-
-	task := func(ctx context.Context) (any, error) {
-		current := active.Add(1)
-		if current > peak.Load() {
-			peak.Store(current)
-		}
-
-		time.Sleep(20 * time.Millisecond)
-		active.Add(-1)
-
-		return nil, nil
-	}
-
-	tasks := make([]Func, numTasks)
-	for i := range tasks {
-		tasks[i] = task
-	}
-
-	synctest.Test(t, func(t *testing.T) {
-		results, err := Run(t.Context(), 0, tasks...)
-		require.NoError(t, err)
-		require.Len(t, results, numTasks)
-		require.Equal(t, int32(numTasks), peak.Load())
-	})
-}
-
-func TestRun_ContextCancelledBeforeStart(t *testing.T) {
-	t.Parallel()
-
-	ctx, cancel := context.WithCancel(t.Context())
-	cancel()
-
-	called := atomic.Bool{}
-	fn := func(ctx context.Context) (any, error) {
-		called.Store(true)
-		return nil, ctx.Err()
-	}
-
-	_, err := Run(ctx, 1, fn, fn, fn)
-	require.Error(t, err)
-}
-
-func TestRun_ContextPassedToTasks(t *testing.T) {
-	t.Parallel()
-
-	type key struct{}
-	ctx := context.WithValue(t.Context(), key{}, "testvalue")
-
-	fn := func(ctx context.Context) (any, error) {
-		return ctx.Value(key{}), nil
-	}
-
-	results, err := Run(ctx, 0, fn)
-
-	require.NoError(t, err)
-	require.Equal(t, "testvalue", results[0].Result)
-}

api/crypto/aes_test.go

@@ -6,9 +6,9 @@ import (
 	"io"
 	"math/rand"
 	"os"
+	"path/filepath"
 	"testing"
 
-	"github.com/portainer/portainer/api/filesystem"
 	"github.com/portainer/portainer/api/logs"
 	"github.com/portainer/portainer/pkg/fips"
 
@@ -42,9 +42,9 @@ func Test_encryptAndDecrypt_withTheSamePassword(t *testing.T) {
 		tmpdir := t.TempDir()
 
 		var (
-			originFilePath    = filesystem.JoinPaths(tmpdir, "origin")
-			encryptedFilePath = filesystem.JoinPaths(tmpdir, "encrypted")
-			decryptedFilePath = filesystem.JoinPaths(tmpdir, "decrypted")
+			originFilePath    = filepath.Join(tmpdir, "origin")
+			encryptedFilePath = filepath.Join(tmpdir, "encrypted")
+			decryptedFilePath = filepath.Join(tmpdir, "decrypted")
 		)
 
 		content := randBytes(1024*1024*100 + 523)
@@ -141,16 +141,15 @@ func Test_encryptAndDecrypt_withTheSamePassword(t *testing.T) {
 }
 
 func Test_encryptAndDecrypt_withStrongPassphrase(t *testing.T) {
-	t.Parallel()
 	const passphrase = "A strong passphrase with special characters: !@#$%^&*()_+"
 
 	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc) {
 		tmpdir := t.TempDir()
 
 		var (
-			originFilePath    = filesystem.JoinPaths(tmpdir, "origin2")
-			encryptedFilePath = filesystem.JoinPaths(tmpdir, "encrypted2")
-			decryptedFilePath = filesystem.JoinPaths(tmpdir, "decrypted2")
+			originFilePath    = filepath.Join(tmpdir, "origin2")
+			encryptedFilePath = filepath.Join(tmpdir, "encrypted2")
+			decryptedFilePath = filepath.Join(tmpdir, "decrypted2")
 		)
 
 		content := randBytes(500)
@@ -201,14 +200,13 @@ func Test_encryptAndDecrypt_withStrongPassphrase(t *testing.T) {
 }
 
 func Test_encryptAndDecrypt_withTheSamePasswordSmallFile(t *testing.T) {
-	t.Parallel()
 	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc) {
 		tmpdir := t.TempDir()
 
 		var (
-			originFilePath    = filesystem.JoinPaths(tmpdir, "origin2")
-			encryptedFilePath = filesystem.JoinPaths(tmpdir, "encrypted2")
-			decryptedFilePath = filesystem.JoinPaths(tmpdir, "decrypted2")
+			originFilePath    = filepath.Join(tmpdir, "origin2")
+			encryptedFilePath = filepath.Join(tmpdir, "encrypted2")
+			decryptedFilePath = filepath.Join(tmpdir, "decrypted2")
 		)
 
 		content := randBytes(500)
@@ -259,14 +257,13 @@ func Test_encryptAndDecrypt_withTheSamePasswordSmallFile(t *testing.T) {
 }
 
 func Test_encryptAndDecrypt_withEmptyPassword(t *testing.T) {
-	t.Parallel()
 	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc) {
 		tmpdir := t.TempDir()
 
 		var (
-			originFilePath    = filesystem.JoinPaths(tmpdir, "origin")
-			encryptedFilePath = filesystem.JoinPaths(tmpdir, "encrypted")
-			decryptedFilePath = filesystem.JoinPaths(tmpdir, "decrypted")
+			originFilePath    = filepath.Join(tmpdir, "origin")
+			encryptedFilePath = filepath.Join(tmpdir, "encrypted")
+			decryptedFilePath = filepath.Join(tmpdir, "decrypted")
 		)
 
 		content := randBytes(1024 * 50)
@@ -317,14 +314,13 @@ func Test_encryptAndDecrypt_withEmptyPassword(t *testing.T) {
 }
 
 func Test_decryptWithDifferentPassphrase_shouldProduceWrongResult(t *testing.T) {
-	t.Parallel()
 	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc) {
 		tmpdir := t.TempDir()
 
 		var (
-			originFilePath    = filesystem.JoinPaths(tmpdir, "origin")
-			encryptedFilePath = filesystem.JoinPaths(tmpdir, "encrypted")
-			decryptedFilePath = filesystem.JoinPaths(tmpdir, "decrypted")
+			originFilePath    = filepath.Join(tmpdir, "origin")
+			encryptedFilePath = filepath.Join(tmpdir, "encrypted")
+			decryptedFilePath = filepath.Join(tmpdir, "decrypted")
 		)
 
 		content := randBytes(1034)
@@ -389,7 +385,6 @@ func legacyAesEncrypt(input io.Reader, output io.Writer, passphrase []byte) erro
 }
 
 func Test_hasEncryptedHeader(t *testing.T) {
-	t.Parallel()
 	tests := []struct {
 		name     string
 		data     []byte

api/crypto/ecdsa_test.go

@@ -7,7 +7,6 @@ import (
 )
 
 func TestCreateSignature(t *testing.T) {
-	t.Parallel()
 	var s = NewECDSAService("secret")
 
 	privKey, pubKey, err := s.GenerateKeyPair()

api/crypto/hash_test.go

@@ -7,7 +7,6 @@ import (
 )
 
 func TestService_Hash(t *testing.T) {
-	t.Parallel()
 	var s = Service{}
 
 	type args struct {
@@ -56,7 +55,6 @@ func TestService_Hash(t *testing.T) {
 }
 
 func TestHash(t *testing.T) {
-	t.Parallel()
 	s := Service{}
 
 	hash, err := s.Hash("Passw0rd!")

api/crypto/tls_test.go

@@ -10,7 +10,6 @@ import (
 )
 
 func TestCreateTLSConfiguration(t *testing.T) {
-	t.Parallel()
 	// InsecureSkipVerify = false
 	config := CreateTLSConfiguration(false)
 	require.Equal(t, config.MinVersion, uint16(tls.VersionTLS12)) //nolint:forbidigo
@@ -23,7 +22,6 @@ func TestCreateTLSConfiguration(t *testing.T) {
 }
 
 func TestCreateTLSConfigurationFIPS(t *testing.T) {
-	t.Parallel()
 	fips := true
 
 	fipsCipherSuites := []uint16{
@@ -44,7 +42,6 @@ func TestCreateTLSConfigurationFIPS(t *testing.T) {
 }
 
 func TestCreateTLSConfigurationFromBytes(t *testing.T) {
-	t.Parallel()
 	// No TLS
 	config, err := CreateTLSConfigurationFromBytes(false, nil, nil, nil, false, false)
 	require.NoError(t, err)
@@ -62,7 +59,6 @@ func TestCreateTLSConfigurationFromBytes(t *testing.T) {
 }
 
 func TestCreateTLSConfigurationFromDisk(t *testing.T) {
-	t.Parallel()
 	// No TLS
 	config, err := CreateTLSConfigurationFromDisk(portainer.TLSConfiguration{})
 	require.NoError(t, err)
@@ -78,7 +74,6 @@ func TestCreateTLSConfigurationFromDisk(t *testing.T) {
 }
 
 func TestCreateTLSConfigurationFromDiskFIPS(t *testing.T) {
-	t.Parallel()
 	fips := true
 
 	// Skipping TLS verifications cannot be done in FIPS mode

api/database/boltdb/db_test.go

@@ -2,6 +2,7 @@ package boltdb
 
 import (
 	"os"
+	"path"
 	"testing"
 
 	"github.com/portainer/portainer/api/filesystem"
@@ -12,7 +13,6 @@ import (
 )
 
 func Test_NeedsEncryptionMigration(t *testing.T) {
-	t.Parallel()
 	// Test the specific scenarios mentioned in NeedsEncryptionMigration
 
 	// i.e.
@@ -96,7 +96,7 @@ func Test_NeedsEncryptionMigration(t *testing.T) {
 
 			if tc.dbname == "both" {
 				// Special case.  If portainer.db and portainer.edb exist.
-				dbFile1 := filesystem.JoinPaths(connection.Path, DatabaseFileName)
+				dbFile1 := path.Join(connection.Path, DatabaseFileName)
 				f, _ := os.Create(dbFile1)
 
 				err := f.Close()
@@ -107,7 +107,7 @@ func Test_NeedsEncryptionMigration(t *testing.T) {
 					require.NoError(t, err)
 				}()
 
-				dbFile2 := filesystem.JoinPaths(connection.Path, EncryptedDatabaseFileName)
+				dbFile2 := path.Join(connection.Path, EncryptedDatabaseFileName)
 				f, _ = os.Create(dbFile2)
 
 				err = f.Close()
@@ -118,7 +118,7 @@ func Test_NeedsEncryptionMigration(t *testing.T) {
 					require.NoError(t, err)
 				}()
 			} else if tc.dbname != "" {
-				dbFile := filesystem.JoinPaths(connection.Path, tc.dbname)
+				dbFile := path.Join(connection.Path, tc.dbname)
 				f, _ := os.Create(dbFile)
 
 				err := f.Close()
@@ -143,7 +143,6 @@ func Test_NeedsEncryptionMigration(t *testing.T) {
 }
 
 func TestDBCompaction(t *testing.T) {
-	t.Parallel()
 	db := &DbConnection{Path: t.TempDir()}
 
 	err := db.Open()

api/database/boltdb/json_test.go

@@ -10,14 +10,14 @@ import (
 	"io"
 	"testing"
 
-	"github.com/google/uuid"
+	"github.com/gofrs/uuid"
 	"github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 const (
-	jsonobject = `{"LogoURL":"","BlackListedLabels":[],"AuthenticationMethod":1,"InternalAuthSettings": {"RequiredPasswordLength": 12}"LDAPSettings":{"AnonymousMode":true,"ReaderDN":"","URL":"","TLSConfig":{"TLS":false,"TLSSkipVerify":false},"StartTLS":false,"SearchSettings":[{"BaseDN":"","Filter":"","UserNameAttribute":""}],"GroupSearchSettings":[{"GroupBaseDN":"","GroupFilter":"","GroupAttribute":""}],"AutoCreateUsers":true},"OAuthSettings":{"ClientID":"","AccessTokenURI":"","AuthorizationURI":"","ResourceURI":"","RedirectURI":"","UserIdentifier":"","Scopes":"","OAuthAutoCreateUsers":false,"DefaultTeamID":0,"SSO":true,"LogoutURI":"","KubeSecretKey":"j0zLVtY/lAWBk62ByyF0uP80SOXaitsABP0TTJX8MhI="},"FeatureFlagSettings":{},"SnapshotInterval":"5m","TemplatesURL":"https://raw.githubusercontent.com/portainer/templates/master/templates-2.0.json","EdgeAgentCheckinInterval":5,"EnableEdgeComputeFeatures":false,"UserSessionTimeout":"8h","KubeconfigExpiry":"0","HelmRepositoryURL":"https://charts.bitnami.com/bitnami","KubectlShellImage":"portainer/kubectl-shell","DisplayDonationHeader":false,"DisplayExternalContributors":false,"EnableHostManagementFeatures":false,"AllowVolumeBrowserForRegularUsers":false,"AllowBindMountsForRegularUsers":false,"AllowPrivilegedModeForRegularUsers":false,"AllowHostNamespaceForRegularUsers":false,"AllowStackManagementForRegularUsers":false,"AllowDeviceMappingForRegularUsers":false,"AllowContainerCapabilitiesForRegularUsers":false}`
+	jsonobject = `{"LogoURL":"","BlackListedLabels":[],"AuthenticationMethod":1,"InternalAuthSettings": {"RequiredPasswordLength": 12}"LDAPSettings":{"AnonymousMode":true,"ReaderDN":"","URL":"","TLSConfig":{"TLS":false,"TLSSkipVerify":false},"StartTLS":false,"SearchSettings":[{"BaseDN":"","Filter":"","UserNameAttribute":""}],"GroupSearchSettings":[{"GroupBaseDN":"","GroupFilter":"","GroupAttribute":""}],"AutoCreateUsers":true},"OAuthSettings":{"ClientID":"","AccessTokenURI":"","AuthorizationURI":"","ResourceURI":"","RedirectURI":"","UserIdentifier":"","Scopes":"","OAuthAutoCreateUsers":false,"DefaultTeamID":0,"SSO":true,"LogoutURI":"","KubeSecretKey":"j0zLVtY/lAWBk62ByyF0uP80SOXaitsABP0TTJX8MhI="},"OpenAMTConfiguration":{"Enabled":false,"MPSServer":"","MPSUser":"","MPSPassword":"","MPSToken":"","CertFileContent":"","CertFileName":"","CertFilePassword":"","DomainName":""},"FeatureFlagSettings":{},"SnapshotInterval":"5m","TemplatesURL":"https://raw.githubusercontent.com/portainer/templates/master/templates-2.0.json","EdgeAgentCheckinInterval":5,"EnableEdgeComputeFeatures":false,"UserSessionTimeout":"8h","KubeconfigExpiry":"0","HelmRepositoryURL":"https://charts.bitnami.com/bitnami","KubectlShellImage":"portainer/kubectl-shell","DisplayDonationHeader":false,"DisplayExternalContributors":false,"EnableHostManagementFeatures":false,"AllowVolumeBrowserForRegularUsers":false,"AllowBindMountsForRegularUsers":false,"AllowPrivilegedModeForRegularUsers":false,"AllowHostNamespaceForRegularUsers":false,"AllowStackManagementForRegularUsers":false,"AllowDeviceMappingForRegularUsers":false,"AllowContainerCapabilitiesForRegularUsers":false}`
 	passphrase = "my secret key"
 )
 
@@ -27,10 +27,9 @@ func secretToEncryptionKey(passphrase string) []byte {
 }
 
 func Test_MarshalObjectUnencrypted(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 
-	uuid := uuid.New()
+	uuid := uuid.Must(uuid.NewV4())
 
 	tests := []struct {
 		object   any
@@ -102,7 +101,6 @@ func Test_MarshalObjectUnencrypted(t *testing.T) {
 }
 
 func Test_UnMarshalObjectUnencrypted(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 
 	// Based on actual data entering and what we expect out of the function
@@ -144,7 +142,6 @@ func Test_UnMarshalObjectUnencrypted(t *testing.T) {
 }
 
 func Test_ObjectMarshallingEncrypted(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 
 	// Based on actual data entering and what we expect out of the function
@@ -187,7 +184,6 @@ func Test_ObjectMarshallingEncrypted(t *testing.T) {
 }
 
 func Test_NonceSources(t *testing.T) {
-	t.Parallel()
 	// ensure that the new go 1.24 NewGCMWithRandomNonce works correctly with
 	// the old way of creating and including the nonce
 

api/database/boltdb/tx_test.go

@@ -18,7 +18,6 @@ type testStruct struct {
 }
 
 func TestTxs(t *testing.T) {
-	t.Parallel()
 	conn := DbConnection{Path: t.TempDir()}
 
 	err := conn.Open()

api/database/database_test.go

@@ -10,7 +10,6 @@ import (
 )
 
 func TestNewDatabase(t *testing.T) {
-	t.Parallel()
 	dbPath := filesystem.JoinPaths(t.TempDir(), "test.db")
 	connection, err := NewDatabase("boltdb", dbPath, nil, false)
 	require.NoError(t, err)

api/dataservices/base_test.go

@@ -51,7 +51,6 @@ func (m mockConnection) ConvertToKey(v int) []byte {
 	return []byte(strconv.Itoa(v))
 }
 func TestReadAll(t *testing.T) {
-	t.Parallel()
 	service := BaseDataService[testObject, int]{
 		Bucket:     "testBucket",
 		Connection: mockConnection{store: make(map[int]testObject)},

api/dataservices/customtemplate/customtemplate_test.go

@@ -9,8 +9,7 @@ import (
 )
 
 func TestCustomTemplateCreate(t *testing.T) {
-	t.Parallel()
-	_, ds := datastore.MustNewTestStore(t, false, false)
+	_, ds := datastore.MustNewTestStore(t, true, false)
 	require.NotNil(t, ds)
 
 	require.NoError(t, ds.CustomTemplate().Create(&portainer.CustomTemplate{ID: 1}))

api/dataservices/customtemplate/tx_test.go

@@ -10,8 +10,7 @@ import (
 )
 
 func TestCustomTemplateCreateTx(t *testing.T) {
-	t.Parallel()
-	_, ds := datastore.MustNewTestStore(t, false, false)
+	_, ds := datastore.MustNewTestStore(t, true, false)
 	require.NotNil(t, ds)
 
 	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {

api/dataservices/edgestack/edgestack_test.go

@@ -11,7 +11,6 @@ import (
 )
 
 func TestUpdate(t *testing.T) {
-	t.Parallel()
 	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
 	err := conn.Open()
 	require.NoError(t, err)

api/dataservices/endpoint/endpoint.go

@@ -119,19 +119,6 @@ func (service *Service) Endpoints() ([]portainer.Endpoint, error) {
 	return endpoints, nil
 }
 
-// ReadAll retrieves all the elements that satisfy all the provided predicates.
-func (service *Service) ReadAll(predicates ...func(endpoint portainer.Endpoint) bool) ([]portainer.Endpoint, error) {
-	var endpoints []portainer.Endpoint
-	var err error
-
-	err = service.connection.ViewTx(func(tx portainer.Transaction) error {
-		endpoints, err = service.Tx(tx).ReadAll(predicates...)
-		return err
-	})
-
-	return endpoints, err
-}
-
 // EndpointIDByEdgeID returns the EndpointID from the given EdgeID using an in-memory index
 func (service *Service) EndpointIDByEdgeID(edgeID string) (portainer.EndpointID, bool) {
 	service.mu.RLock()

api/dataservices/endpoint/tx.go

@@ -89,11 +89,6 @@ func (service ServiceTx) Endpoints() ([]portainer.Endpoint, error) {
 	)
 }
 
-// ReadAll retrieves all the elements that satisfy all the provided predicates.
-func (service ServiceTx) ReadAll(predicates ...func(endpoint portainer.Endpoint) bool) ([]portainer.Endpoint, error) {
-	return dataservices.BaseDataServiceTx[portainer.Endpoint, portainer.EndpointID]{Bucket: BucketName, Connection: service.service.connection, Tx: service.tx}.ReadAll(predicates...)
-}
-
 func (service ServiceTx) EndpointIDByEdgeID(edgeID string) (portainer.EndpointID, bool) {
 	log.Error().Str("func", "EndpointIDByEdgeID").Msg("cannot be called inside a transaction")
 

api/dataservices/endpointrelation/endpointrelation.go

@@ -28,9 +28,6 @@ func (service *Service) BucketName() string {
 func (service *Service) RegisterUpdateStackFunction(
 	updateFuncTx func(portainer.Transaction, portainer.EdgeStackID, func(*portainer.EdgeStack)) error,
 ) {
-	service.mu.Lock()
-	defer service.mu.Unlock()
-
 	service.updateStackFnTx = updateFuncTx
 }
 

api/dataservices/endpointrelation/endpointrelation_test.go

@@ -13,7 +13,6 @@ import (
 )
 
 func TestUpdateRelation(t *testing.T) {
-	t.Parallel()
 	const endpointID = 1
 	const edgeStackID1 = 1
 	const edgeStackID2 = 2
@@ -107,7 +106,6 @@ func TestUpdateRelation(t *testing.T) {
 }
 
 func TestAddEndpointRelationsForEdgeStack(t *testing.T) {
-	t.Parallel()
 	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
 	err := conn.Open()
 	require.NoError(t, err)
@@ -127,7 +125,6 @@ func TestAddEndpointRelationsForEdgeStack(t *testing.T) {
 }
 
 func TestEndpointRelations(t *testing.T) {
-	t.Parallel()
 	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
 	err := conn.Open()
 	require.NoError(t, err)

api/dataservices/interface.go

@@ -102,9 +102,6 @@ type (
 
 	// EndpointService represents a service for managing environment(endpoint) data
 	EndpointService interface {
-		// partial dataservices.BaseCRUD[portainer.Endpoint, portainer.EndpointID]
-		ReadAll(predicates ...func(endpoint portainer.Endpoint) bool) ([]portainer.Endpoint, error)
-
 		Endpoint(ID portainer.EndpointID) (*portainer.Endpoint, error)
 		EndpointIDByEdgeID(edgeID string) (portainer.EndpointID, bool)
 		EndpointsByTeamID(teamID portainer.TeamID) ([]portainer.Endpoint, error)

api/dataservices/pendingactions/pendingactions_test.go

@@ -10,7 +10,6 @@ import (
 )
 
 func TestDeleteByEndpoint(t *testing.T) {
-	t.Parallel()
 	_, store := datastore.MustNewTestStore(t, false, false)
 
 	// Create Endpoint 1

api/dataservices/stack/tests/stack_test.go

@@ -8,13 +8,13 @@ import (
 	"github.com/portainer/portainer/api/datastore"
 	"github.com/portainer/portainer/api/filesystem"
 
-	"github.com/google/uuid"
+	"github.com/gofrs/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func newGuidString(t *testing.T) string {
-	uuid, err := uuid.NewRandom()
+	uuid, err := uuid.NewV4()
 	require.NoError(t, err)
 
 	return uuid.String()
@@ -27,11 +27,10 @@ type stackBuilder struct {
 }
 
 func TestService_StackByWebhookID(t *testing.T) {
-	t.Parallel()
 	if testing.Short() {
 		t.Skip("skipping test in short mode. Normally takes ~1s to run.")
 	}
-	_, store := datastore.MustNewTestStore(t, false, true)
+	_, store := datastore.MustNewTestStore(t, true, true)
 
 	b := stackBuilder{t: t, store: store}
 	b.createNewStack(newGuidString(t))
@@ -85,11 +84,10 @@ func (b *stackBuilder) createNewStack(webhookID string) portainer.Stack {
 }
 
 func Test_RefreshableStacks(t *testing.T) {
-	t.Parallel()
 	if testing.Short() {
 		t.Skip("skipping test in short mode. Normally takes ~1s to run.")
 	}
-	_, store := datastore.MustNewTestStore(t, false, true)
+	_, store := datastore.MustNewTestStore(t, true, true)
 
 	staticStack := portainer.Stack{ID: 1}
 	stackWithWebhook := portainer.Stack{ID: 2, AutoUpdate: &portainer.AutoUpdateSettings{Webhook: "webhook"}}

api/dataservices/team/tests/team_test.go

@@ -3,7 +3,6 @@ package tests
 import (
 	"testing"
 
-	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices/errors"
 	"github.com/portainer/portainer/api/datastore"
 
@@ -11,29 +10,9 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-type teamBuilder struct {
-	t     *testing.T
-	count int
-	store *datastore.Store
-}
-
-func (b *teamBuilder) createNew(name string) *portainer.Team {
-	b.count++
-	team := &portainer.Team{
-		ID:   portainer.TeamID(b.count),
-		Name: name,
-	}
-
-	err := b.store.Team().Create(team)
-	assert.NoError(b.t, err)
-
-	return team
-}
-
 func Test_teamByName(t *testing.T) {
-	t.Parallel()
 	t.Run("When store is empty should return ErrObjectNotFound", func(t *testing.T) {
-		_, store := datastore.MustNewTestStore(t, false, true)
+		_, store := datastore.MustNewTestStore(t, true, true)
 
 		_, err := store.Team().TeamByName("name")
 		require.ErrorIs(t, err, errors.ErrObjectNotFound)
@@ -41,7 +20,7 @@ func Test_teamByName(t *testing.T) {
 	})
 
 	t.Run("When there is no object with the same name should return ErrObjectNotFound", func(t *testing.T) {
-		_, store := datastore.MustNewTestStore(t, false, true)
+		_, store := datastore.MustNewTestStore(t, true, true)
 
 		teamBuilder := teamBuilder{
 			t:     t,
@@ -56,7 +35,7 @@ func Test_teamByName(t *testing.T) {
 	})
 
 	t.Run("When there is an object with the same name should return the object", func(t *testing.T) {
-		_, store := datastore.MustNewTestStore(t, false, true)
+		_, store := datastore.MustNewTestStore(t, true, true)
 
 		teamBuilder := teamBuilder{
 			t:     t,

api/dataservices/team/tests/utils.go

@@ -0,0 +1,28 @@
+package tests
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/stretchr/testify/assert"
+)
+
+type teamBuilder struct {
+	t     *testing.T
+	count int
+	store *datastore.Store
+}
+
+func (b *teamBuilder) createNew(name string) *portainer.Team {
+	b.count++
+	team := &portainer.Team{
+		ID:   portainer.TeamID(b.count),
+		Name: name,
+	}
+
+	err := b.store.Team().Create(team)
+	assert.NoError(b.t, err)
+
+	return team
+}

api/datastore/backup_test.go

@@ -13,7 +13,6 @@ import (
 )
 
 func TestStoreCreation(t *testing.T) {
-	t.Parallel()
 	_, store := MustNewTestStore(t, true, true)
 	require.NotNil(t, store)
 
@@ -32,7 +31,6 @@ func TestStoreCreation(t *testing.T) {
 }
 
 func TestBackup(t *testing.T) {
-	t.Parallel()
 	_, store := MustNewTestStore(t, true, true)
 	backupFileName := store.backupFilename()
 	t.Run("Backup should create "+backupFileName, func(t *testing.T) {
@@ -54,7 +52,6 @@ func TestBackup(t *testing.T) {
 }
 
 func TestRestore(t *testing.T) {
-	t.Parallel()
 	_, store := MustNewTestStore(t, true, false)
 
 	t.Run("Basic Restore", func(t *testing.T) {
@@ -96,7 +93,6 @@ func TestRestore(t *testing.T) {
 }
 
 func TestBackupDBFile(t *testing.T) {
-	t.Parallel()
 	_, store := MustNewTestStore(t, true, false)
 
 	t.Run("creates backup file without managing connection state", func(t *testing.T) {
@@ -126,7 +122,6 @@ func TestBackupDBFile(t *testing.T) {
 }
 
 func TestBackupDBFileUsesCorrectPath(t *testing.T) {
-	t.Parallel()
 	_, store := MustNewTestStore(t, true, false)
 
 	t.Run("backs up unencrypted db when encrypted flag is false", func(t *testing.T) {

api/datastore/datastore_test.go

@@ -29,7 +29,6 @@ const (
 // TestStoreFull an eventually comprehensive set of tests for the Store.
 // The idea is what we write to the store, we should read back.
 func TestStoreFull(t *testing.T) {
-	t.Parallel()
 	_, store := MustNewTestStore(t, true, true)
 
 	testCases := map[string]func(t *testing.T){

api/datastore/migrate_data_test.go

@@ -6,18 +6,18 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"path/filepath"
 	"testing"
 
+	"github.com/Masterminds/semver"
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/database/boltdb"
 	"github.com/portainer/portainer/api/database/models"
 	"github.com/portainer/portainer/api/datastore/migrator"
-	"github.com/portainer/portainer/api/filesystem"
+	"github.com/stretchr/testify/require"
 
-	"github.com/Masterminds/semver/v3"
 	"github.com/google/go-cmp/cmp"
 	"github.com/rs/zerolog/log"
-	"github.com/stretchr/testify/require"
 )
 
 func TestMigrateData(t *testing.T) {
@@ -174,7 +174,6 @@ func TestMigrateData(t *testing.T) {
 }
 
 func TestRollback(t *testing.T) {
-	t.Parallel()
 	t.Run("Rollback should restore upgrade after backup", func(t *testing.T) {
 		version := "2.11"
 
@@ -325,7 +324,7 @@ func migrateDBTestHelper(t *testing.T, srcPath, wantPath string, overrideInstanc
 
 	// Compare the result we got with the one we wanted.
 	if diff := cmp.Diff(wantJSON, gotJSON); diff != "" {
-		gotPath := filesystem.JoinPaths(os.TempDir(), "portainer-migrator-test-fail.json")
+		gotPath := filepath.Join(os.TempDir(), "portainer-migrator-test-fail.json")
 		err = os.WriteFile(
 			gotPath,
 			gotJSON,

api/datastore/migrate_dbversion29_test.go

@@ -26,7 +26,6 @@ func setup(store *Store) error {
 }
 
 func TestMigrateSettings(t *testing.T) {
-	t.Parallel()
 	_, store := MustNewTestStore(t, false, true)
 
 	err := setup(store)

api/datastore/migrate_dbversion33_test.go

@@ -12,7 +12,6 @@ import (
 )
 
 func TestMigrateStackEntryPoint(t *testing.T) {
-	t.Parallel()
 	_, store := MustNewTestStore(t, false, true)
 
 	stackService := store.Stack()

api/datastore/migrator/migrate_2_33_test.go

@@ -12,7 +12,6 @@ import (
 )
 
 func TestMigrateEdgeGroupEndpointsToRoars_2_33_0Idempotency(t *testing.T) {
-	t.Parallel()
 	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
 	err := conn.Open()
 	require.NoError(t, err)

api/datastore/migrator/migrate_2_40_test.go

@@ -1,206 +0,0 @@
-package migrator
-
-import (
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/database/boltdb"
-	"github.com/portainer/portainer/api/dataservices/endpoint"
-	"github.com/portainer/portainer/api/dataservices/pendingactions"
-	"github.com/portainer/portainer/api/dataservices/registry"
-	"github.com/portainer/portainer/api/logs"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestMigrateRegistryAccessSASecrets_2_40_0(t *testing.T) {
-	t.Parallel()
-	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
-	err := conn.Open()
-	require.NoError(t, err)
-	defer logs.CloseAndLogErr(conn)
-
-	registryService, err := registry.NewService(conn)
-	require.NoError(t, err)
-
-	endpointService, err := endpoint.NewService(conn)
-	require.NoError(t, err)
-
-	pendingActionsService, err := pendingactions.NewService(conn)
-	require.NoError(t, err)
-
-	t.Run("sets MigrateRegistrySASecrets flag for k8s endpoints with registry access", func(t *testing.T) {
-		k8sEndpoint := &portainer.Endpoint{
-			ID:   1,
-			Name: "k8s-cluster",
-			Type: portainer.AgentOnKubernetesEnvironment,
-		}
-		dockerEndpoint := &portainer.Endpoint{
-			ID:   2,
-			Name: "docker-standalone",
-			Type: portainer.DockerEnvironment,
-		}
-
-		err := conn.CreateObjectWithId(endpoint.BucketName, int(k8sEndpoint.ID), k8sEndpoint)
-		require.NoError(t, err)
-		err = conn.CreateObjectWithId(endpoint.BucketName, int(dockerEndpoint.ID), dockerEndpoint)
-		require.NoError(t, err)
-
-		reg := &portainer.Registry{
-			ID:   1,
-			Name: "test-registry",
-			RegistryAccesses: portainer.RegistryAccesses{
-				k8sEndpoint.ID: portainer.RegistryAccessPolicies{
-					Namespaces: []string{"default", "production"},
-				},
-				dockerEndpoint.ID: portainer.RegistryAccessPolicies{
-					Namespaces: []string{"ignored"},
-				},
-			},
-		}
-
-		err = conn.CreateObjectWithId(registry.BucketName, int(reg.ID), reg)
-		require.NoError(t, err)
-
-		m := NewMigrator(&MigratorParameters{
-			RegistryService:       registryService,
-			EndpointService:       endpointService,
-			PendingActionsService: pendingActionsService,
-		})
-
-		err = m.migrateRegistryAccessSASecrets_2_40_0()
-		require.NoError(t, err)
-
-		updatedK8sEndpoint, err := endpointService.Endpoint(k8sEndpoint.ID)
-		require.NoError(t, err)
-		assert.True(t, updatedK8sEndpoint.PostInitMigrations.MigrateRegistrySASecrets, "should have set MigrateRegistrySASecrets flag for k8s endpoint")
-
-		updatedDockerEndpoint, err := endpointService.Endpoint(dockerEndpoint.ID)
-		require.NoError(t, err)
-		assert.False(t, updatedDockerEndpoint.PostInitMigrations.MigrateRegistrySASecrets, "should not have set MigrateRegistrySASecrets flag for docker endpoint")
-	})
-
-	t.Run("skips endpoints with empty namespaces", func(t *testing.T) {
-		conn2 := &boltdb.DbConnection{Path: t.TempDir()}
-		err := conn2.Open()
-		require.NoError(t, err)
-		defer logs.CloseAndLogErr(conn2)
-
-		registryService2, _ := registry.NewService(conn2)
-		endpointService2, _ := endpoint.NewService(conn2)
-		pendingActionsService2, _ := pendingactions.NewService(conn2)
-
-		k8sEndpoint := &portainer.Endpoint{
-			ID:   10,
-			Name: "k8s-cluster",
-			Type: portainer.AgentOnKubernetesEnvironment,
-		}
-		err = conn2.CreateObjectWithId(endpoint.BucketName, int(k8sEndpoint.ID), k8sEndpoint)
-		require.NoError(t, err)
-
-		reg := &portainer.Registry{
-			ID:   10,
-			Name: "empty-registry",
-			RegistryAccesses: portainer.RegistryAccesses{
-				k8sEndpoint.ID: portainer.RegistryAccessPolicies{
-					Namespaces: []string{},
-				},
-			},
-		}
-		err = conn2.CreateObjectWithId(registry.BucketName, int(reg.ID), reg)
-		require.NoError(t, err)
-
-		m := NewMigrator(&MigratorParameters{
-			RegistryService:       registryService2,
-			EndpointService:       endpointService2,
-			PendingActionsService: pendingActionsService2,
-		})
-
-		err = m.migrateRegistryAccessSASecrets_2_40_0()
-		require.NoError(t, err)
-
-		allPAs, err := pendingActionsService2.ReadAll()
-		require.NoError(t, err)
-		assert.Empty(t, allPAs, "should not create pending actions for empty namespaces")
-	})
-
-	t.Run("skips non-existent endpoints", func(t *testing.T) {
-		conn3 := &boltdb.DbConnection{Path: t.TempDir()}
-		err := conn3.Open()
-		require.NoError(t, err)
-		defer logs.CloseAndLogErr(conn3)
-
-		registryService3, _ := registry.NewService(conn3)
-		endpointService3, _ := endpoint.NewService(conn3)
-		pendingActionsService3, _ := pendingactions.NewService(conn3)
-
-		reg := &portainer.Registry{
-			ID:   20,
-			Name: "orphan-registry",
-			RegistryAccesses: portainer.RegistryAccesses{
-				999: portainer.RegistryAccessPolicies{
-					Namespaces: []string{"default"},
-				},
-			},
-		}
-		err = conn3.CreateObjectWithId(registry.BucketName, int(reg.ID), reg)
-		require.NoError(t, err)
-
-		m := NewMigrator(&MigratorParameters{
-			RegistryService:       registryService3,
-			EndpointService:       endpointService3,
-			PendingActionsService: pendingActionsService3,
-		})
-
-		err = m.migrateRegistryAccessSASecrets_2_40_0()
-		require.NoError(t, err)
-
-		allPAs, err := pendingActionsService3.ReadAll()
-		require.NoError(t, err)
-		assert.Empty(t, allPAs, "should not create pending actions for non-existent endpoints")
-	})
-
-	t.Run("idempotent - running twice creates duplicate actions but doesn't error", func(t *testing.T) {
-		conn4 := &boltdb.DbConnection{Path: t.TempDir()}
-		err := conn4.Open()
-		require.NoError(t, err)
-		defer logs.CloseAndLogErr(conn4)
-
-		registryService4, _ := registry.NewService(conn4)
-		endpointService4, _ := endpoint.NewService(conn4)
-		pendingActionsService4, _ := pendingactions.NewService(conn4)
-
-		k8sEndpoint := &portainer.Endpoint{
-			ID:   30,
-			Name: "k8s-cluster",
-			Type: portainer.AgentOnKubernetesEnvironment,
-		}
-		err = conn4.CreateObjectWithId(endpoint.BucketName, int(k8sEndpoint.ID), k8sEndpoint)
-		require.NoError(t, err)
-
-		reg := &portainer.Registry{
-			ID:   30,
-			Name: "test-registry",
-			RegistryAccesses: portainer.RegistryAccesses{
-				k8sEndpoint.ID: portainer.RegistryAccessPolicies{
-					Namespaces: []string{"default"},
-				},
-			},
-		}
-		err = conn4.CreateObjectWithId(registry.BucketName, int(reg.ID), reg)
-		require.NoError(t, err)
-
-		m := NewMigrator(&MigratorParameters{
-			RegistryService:       registryService4,
-			EndpointService:       endpointService4,
-			PendingActionsService: pendingActionsService4,
-		})
-
-		err = m.migrateRegistryAccessSASecrets_2_40_0()
-		require.NoError(t, err)
-
-		err = m.migrateRegistryAccessSASecrets_2_40_0()
-		require.NoError(t, err)
-	})
-}

api/datastore/migrator/migrate_ce.go

@@ -7,7 +7,7 @@ import (
 	"github.com/pkg/errors"
 	portainer "github.com/portainer/portainer/api"
 
-	"github.com/Masterminds/semver/v3"
+	"github.com/Masterminds/semver"
 	"github.com/rs/zerolog/log"
 )
 

api/datastore/migrator/migrate_dbversion140.go

@@ -1,58 +0,0 @@
-package migrator
-
-import (
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/internal/endpointutils"
-	"github.com/rs/zerolog/log"
-)
-
-// migrateRegistryAccessSASecrets_2_40_0 marks Kubernetes endpoints that have
-// registry access configured so that imagePullSecrets can be added to their
-// default ServiceAccounts during the post-init migration phase (when cluster
-// access is available).
-func (m *Migrator) migrateRegistryAccessSASecrets_2_40_0() error {
-	log.Info().Msg("migrating registry access service account secrets")
-
-	registries, err := m.registryService.ReadAll()
-	if err != nil {
-		return err
-	}
-
-	endpoints, err := m.endpointService.Endpoints()
-	if err != nil {
-		return err
-	}
-
-	// Collect the IDs of endpoints that have at least one registry with
-	// non-empty namespace access - these need the SA imagePullSecrets migration.
-	needsMigration := make(map[portainer.EndpointID]bool)
-	for _, registry := range registries {
-		for endpointID, access := range registry.RegistryAccesses {
-			if len(access.Namespaces) > 0 {
-				needsMigration[endpointID] = true
-			}
-		}
-	}
-
-	for i := range endpoints {
-		endpoint := &endpoints[i]
-
-		if !endpointutils.IsKubernetesEndpoint(endpoint) {
-			continue
-		}
-
-		if !needsMigration[endpoint.ID] {
-			continue
-		}
-
-		endpoint.PostInitMigrations.MigrateRegistrySASecrets = true
-		if err := m.endpointService.UpdateEndpoint(endpoint.ID, endpoint); err != nil {
-			log.Warn().
-				Err(err).
-				Int("endpointID", int(endpoint.ID)).
-				Msg("failed to set registry SA secret migration flag for endpoint")
-		}
-	}
-
-	return nil
-}

api/datastore/migrator/migrator.go

@@ -29,7 +29,7 @@ import (
 	"github.com/portainer/portainer/api/dataservices/version"
 	"github.com/portainer/portainer/api/internal/authorization"
 
-	"github.com/Masterminds/semver/v3"
+	"github.com/Masterminds/semver"
 	"github.com/rs/zerolog/log"
 )
 
@@ -258,8 +258,6 @@ func (m *Migrator) initMigrations() {
 
 	m.addMigrations("2.33.1", m.migrateEdgeGroupEndpointsToRoars_2_33_0)
 
-	m.addMigrations("2.40.0", m.migrateRegistryAccessSASecrets_2_40_0)
-
 	// WARNING: do not change migrations that have already been released!
 
 	// Add new migrations above...

api/datastore/pendingactions_test.go

@@ -14,7 +14,6 @@ type cleanNAPWithOverridePolicies struct {
 }
 
 func Test_ConvertCleanNAPWithOverridePoliciesPayload(t *testing.T) {
-	t.Parallel()
 	t.Run("test ConvertCleanNAPWithOverridePoliciesPayload", func(t *testing.T) {
 
 		_, store := MustNewTestStore(t, true, false)

api/datastore/postinit/migrate_post_init.go

@@ -1,10 +1,8 @@
 package postinit
 
 import (
-	"cmp"
 	"context"
 	"fmt"
-	"slices"
 
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/client"
@@ -12,7 +10,6 @@ import (
 	"github.com/portainer/portainer/api/dataservices"
 	dockerClient "github.com/portainer/portainer/api/docker/client"
 	"github.com/portainer/portainer/api/internal/endpointutils"
-	"github.com/portainer/portainer/api/internal/registryutils"
 	"github.com/portainer/portainer/api/kubernetes/cli"
 	"github.com/portainer/portainer/api/logs"
 	"github.com/portainer/portainer/api/pendingactions/actions"
@@ -47,65 +44,40 @@ func NewPostInitMigrator(
 
 // PostInitMigrate will run all post-init migrations, which require docker/kube clients for all edge or non-edge environments
 func (postInitMigrator *PostInitMigrator) PostInitMigrate() error {
-	var environments []portainer.Endpoint
+	environments, err := postInitMigrator.dataStore.Endpoint().Endpoints()
+	if err != nil {
+		log.Error().Err(err).Msg("Error getting environments")
+		return err
+	}
 
-	if err := postInitMigrator.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		var err error
-		if environments, err = tx.Endpoint().ReadAll(func(endpoint portainer.Endpoint) bool {
-			return endpoints.HasDirectConnectivity(&endpoint)
-		}); err != nil {
-			return fmt.Errorf("failed to retrieve environments: %w", err)
-		}
-
-		var pendingActions []portainer.PendingAction
-		if pendingActions, err = tx.PendingActions().ReadAll(func(action portainer.PendingAction) bool {
-			return action.Action == actions.PostInitMigrateEnvironment
-		}); err != nil {
-			return fmt.Errorf("failed to retrieve pending actions: %w", err)
-		}
-
-		// Sort for the binary search in createPostInitMigrationPendingAction()
-		slices.SortFunc(pendingActions, func(a, b portainer.PendingAction) int {
-			return cmp.Compare(a.EndpointID, b.EndpointID)
-		})
-
-		for _, environment := range environments {
-			if !endpoints.IsEdgeEndpoint(&environment) {
+	for _, environment := range environments {
+		// edge environments will run after the server starts, in pending actions
+		if endpoints.IsEdgeEndpoint(&environment) {
+			// Skip edge environments that do not have direct connectivity
+			if !endpoints.HasDirectConnectivity(&environment) {
 				continue
 			}
 
-			// Edge environments will run after the server starts, in pending actions
 			log.Info().
 				Int("endpoint_id", int(environment.ID)).
 				Msg("adding pending action 'PostInitMigrateEnvironment' for environment")
 
-			if err := postInitMigrator.createPostInitMigrationPendingAction(tx, environment.ID, pendingActions); err != nil {
+			if err := postInitMigrator.createPostInitMigrationPendingAction(environment.ID); err != nil {
 				log.Error().
 					Err(err).
 					Int("endpoint_id", int(environment.ID)).
 					Msg("error creating pending action for environment")
 			}
+		} else {
+			// Non-edge environments will run before the server starts.
+			if err := postInitMigrator.MigrateEnvironment(&environment); err != nil {
+				log.Error().
+					Err(err).
+					Int("endpoint_id", int(environment.ID)).
+					Msg("error running post-init migrations for non-edge environment")
+			}
 		}
 
-		return err
-	}); err != nil {
-		log.Error().Err(err).Msg("error running post-init migrations")
-
-		return err
-	}
-
-	for _, environment := range environments {
-		if endpoints.IsEdgeEndpoint(&environment) {
-			continue
-		}
-
-		// Non-edge environments will run before the server starts.
-		if err := postInitMigrator.MigrateEnvironment(&environment); err != nil {
-			log.Error().
-				Err(err).
-				Int("endpoint_id", int(environment.ID)).
-				Msg("error running post-init migrations for non-edge environment")
-		}
 	}
 
 	return nil
@@ -113,79 +85,59 @@ func (postInitMigrator *PostInitMigrator) PostInitMigrate() error {
 
 // try to create a post init migration pending action. If it already exists, do nothing
 // this function exists for readability, not reusability
-// pending actions must be passed in ascending order by endpoint ID
-func (postInitMigrator *PostInitMigrator) createPostInitMigrationPendingAction(tx dataservices.DataStoreTx, environmentID portainer.EndpointID, pendingActions []portainer.PendingAction) error {
+func (postInitMigrator *PostInitMigrator) createPostInitMigrationPendingAction(environmentID portainer.EndpointID) error {
 	action := portainer.PendingAction{
 		EndpointID: environmentID,
 		Action:     actions.PostInitMigrateEnvironment,
 	}
 
-	if _, found := slices.BinarySearchFunc(pendingActions, environmentID, func(e portainer.PendingAction, id portainer.EndpointID) int {
-		return cmp.Compare(e.EndpointID, id)
-	}); found {
-		log.Debug().
-			Str("action", action.Action).
-			Int("endpoint_id", int(action.EndpointID)).
-			Msg("pending action already exists for environment, skipping...")
-
-		return nil
+	pendingActions, err := postInitMigrator.dataStore.PendingActions().ReadAll()
+	if err != nil {
+		return fmt.Errorf("failed to retrieve pending actions: %w", err)
 	}
 
-	return tx.PendingActions().Create(&action)
+	for _, dba := range pendingActions {
+		if dba.EndpointID == action.EndpointID && dba.Action == action.Action {
+			log.Debug().
+				Str("action", action.Action).
+				Int("endpoint_id", int(action.EndpointID)).
+				Msg("pending action already exists for environment, skipping...")
+			return nil
+		}
+	}
+
+	return postInitMigrator.dataStore.PendingActions().Create(&action)
 }
 
 // MigrateEnvironment runs migrations on a single environment
 func (migrator *PostInitMigrator) MigrateEnvironment(environment *portainer.Endpoint) error {
-	log.Info().
-		Int("endpoint_id", int(environment.ID)).
-		Msg("executing post init migration for environment")
+	log.Info().Msgf("Executing post init migration for environment %d", environment.ID)
 
 	switch {
 	case endpointutils.IsKubernetesEndpoint(environment):
 		// get the kubeclient for the environment, and skip all kube migrations if there's an error
 		kubeclient, err := migrator.kubeFactory.GetPrivilegedKubeClient(environment)
 		if err != nil {
-			log.Error().
-				Err(err).
-				Int("endpoint_id", int(environment.ID)).
-				Msg("error creating kubeclient for environment")
-
+			log.Error().Err(err).Msgf("Error creating kubeclient for environment: %d", environment.ID)
 			return err
 		}
 
-		// If one environment fails, it is logged and the next migration runs. The error is returned at the end and handled by pending actions
-		var latestErr error
-		kubernetesMigrations := []func() error{
-			func() error { return migrator.MigrateIngresses(*environment, kubeclient) },
-			func() error { return migrator.MigrateRegistrySASecrets(*environment, kubeclient) },
+		// if one environment fails, it is logged and the next migration runs. The error is returned at the end and handled by pending actions
+		if err := migrator.MigrateIngresses(*environment, kubeclient); err != nil {
+			return err
 		}
 
-		for _, migration := range kubernetesMigrations {
-			if err := migration(); err != nil {
-				latestErr = err
-			}
-		}
-
-		return latestErr
+		return nil
 	case endpointutils.IsDockerEndpoint(environment):
 		// get the docker client for the environment, and skip all docker migrations if there's an error
 		dockerClient, err := migrator.dockerFactory.CreateClient(environment, "", nil)
 		if err != nil {
-			log.Error().
-				Err(err).
-				Int("endpoint_id", int(environment.ID)).
-				Msg("error creating docker client for environment")
-
+			log.Error().Err(err).Msgf("Error creating docker client for environment: %d", environment.ID)
 			return err
 		}
 		defer logs.CloseAndLogErr(dockerClient)
 
 		if err := migrator.MigrateGPUs(*environment, dockerClient); err != nil {
-			log.Error().
-				Err(err).
-				Int("endpoint_id", int(environment.ID)).
-				Msg("error migrating GPUs for environment")
-
 			return err
 		}
 	}
@@ -193,73 +145,18 @@ func (migrator *PostInitMigrator) MigrateEnvironment(environment *portainer.Endp
 	return nil
 }
 
-func (migrator *PostInitMigrator) MigrateRegistrySASecrets(environment portainer.Endpoint, kubeclient *cli.KubeClient) error {
-	if !environment.PostInitMigrations.MigrateRegistrySASecrets {
-		return nil
-	}
-
-	log.Debug().
-		Int("endpoint_id", int(environment.ID)).
-		Msg("migrating registry SA secrets for environment")
-
-	return migrator.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		env, err := tx.Endpoint().Endpoint(environment.ID)
-		if err != nil {
-			return err
-		}
-
-		if !env.PostInitMigrations.MigrateRegistrySASecrets {
-			return nil
-		}
-
-		registries, err := tx.Registry().ReadAll()
-		if err != nil {
-			return err
-		}
-
-		for _, registry := range registries {
-			access, ok := registry.RegistryAccesses[env.ID]
-			if !ok || len(access.Namespaces) == 0 {
-				continue
-			}
-
-			secretName := registryutils.RegistrySecretName(registry.ID)
-			for _, namespace := range access.Namespaces {
-				if err := kubeclient.AddImagePullSecretToServiceAccount(namespace, "default", secretName); err != nil {
-					log.Warn().
-						Err(err).
-						Int("endpoint_id", int(env.ID)).
-						Str("namespace", namespace).
-						Str("secret", secretName).
-						Msg("failed to add imagePullSecret to service account during registry SA secret migration")
-				}
-			}
-		}
-
-		env.PostInitMigrations.MigrateRegistrySASecrets = false
-		return tx.Endpoint().UpdateEndpoint(env.ID, env)
-	})
-}
-
 func (migrator *PostInitMigrator) MigrateIngresses(environment portainer.Endpoint, kubeclient *cli.KubeClient) error {
 	// Early exit if we do not need to migrate!
 	if !environment.PostInitMigrations.MigrateIngresses {
 		return nil
 	}
+	log.Debug().Msgf("Migrating ingresses for environment %d", environment.ID)
 
-	log.Debug().
-		Int("endpoint_id", int(environment.ID)).
-		Msg("migrating ingresses for environment")
-
-	if err := migrator.kubeFactory.MigrateEndpointIngresses(&environment, migrator.dataStore, kubeclient); err != nil {
-		log.Error().
-			Err(err).
-			Int("endpoint_id", int(environment.ID)).
-			Msg("error migrating ingresses for environment")
-
+	err := migrator.kubeFactory.MigrateEndpointIngresses(&environment, migrator.dataStore, kubeclient)
+	if err != nil {
+		log.Error().Err(err).Msgf("Error migrating ingresses for environment %d", environment.ID)
 		return err
 	}
-
 	return nil
 }
 
@@ -269,42 +166,29 @@ func (migrator *PostInitMigrator) MigrateGPUs(e portainer.Endpoint, dockerClient
 	return migrator.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
 		environment, err := tx.Endpoint().Endpoint(e.ID)
 		if err != nil {
-			log.Error().
-				Err(err).
-				Int("endpoint_id", int(e.ID)).
-				Msg("error getting environment")
-
+			log.Error().Err(err).Msgf("Error getting environment %d", e.ID)
 			return err
 		}
-
 		// Early exit if we do not need to migrate!
 		if !environment.PostInitMigrations.MigrateGPUs {
 			return nil
 		}
+		log.Debug().Msgf("Migrating GPUs for environment %d", e.ID)
 
-		log.Debug().
-			Int("endpoint_id", int(e.ID)).
-			Msg("migrating GPUs for environment")
-
-		// Get all containers
+		// get all containers
 		containers, err := dockerClient.ContainerList(context.Background(), container.ListOptions{All: true})
 		if err != nil {
-			log.Error().
-				Err(err).
-				Int("endpoint_id", int(environment.ID)).
-				Msg("failed to list containers for environment")
-
+			log.Error().Err(err).Msgf("failed to list containers for environment %d", environment.ID)
 			return err
 		}
 
-		// Check for a gpu on each container. If even one GPU is found, set EnableGPUManagement to true for the whole environment
+		// check for a gpu on each container. If even one GPU is found, set EnableGPUManagement to true for the whole environment
 	containersLoop:
 		for _, container := range containers {
 			// https://www.sobyte.net/post/2022-10/go-docker/ has nice documentation on the docker client with GPUs
 			containerDetails, err := dockerClient.ContainerInspect(context.Background(), container.ID)
 			if err != nil {
 				log.Error().Err(err).Msg("failed to inspect container")
-
 				continue
 			}
 
@@ -318,14 +202,10 @@ func (migrator *PostInitMigrator) MigrateGPUs(e portainer.Endpoint, dockerClient
 			}
 		}
 
-		// Set the MigrateGPUs flag to false so we don't run this again
+		// set the MigrateGPUs flag to false so we don't run this again
 		environment.PostInitMigrations.MigrateGPUs = false
 		if err := tx.Endpoint().UpdateEndpoint(environment.ID, environment); err != nil {
-			log.Error().
-				Err(err).
-				Int("endpoint_id", int(environment.ID)).
-				Msg("error updating EnableGPUManagement flag for environment")
-
+			log.Error().Err(err).Msgf("Error updating EnableGPUManagement flag for environment %d", environment.ID)
 			return err
 		}
 

api/datastore/postinit/migrate_post_init_test.go

@@ -18,7 +18,6 @@ import (
 )
 
 func TestMigrateGPUs(t *testing.T) {
-	t.Parallel()
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if strings.HasSuffix(r.URL.Path, "/containers/json") {
 			containerSummary := []container.Summary{{ID: "container1"}}
@@ -80,7 +79,6 @@ func TestMigrateGPUs(t *testing.T) {
 }
 
 func TestPostInitMigrate_PendingActionsCreated(t *testing.T) {
-	t.Parallel()
 	tests := []struct {
 		name                   string
 		existingPendingActions []*portainer.PendingAction

api/datastore/test_data/output_24_to_latest.json

@@ -80,8 +80,7 @@
       "Name": "local",
       "PostInitMigrations": {
         "MigrateGPUs": true,
-        "MigrateIngresses": true,
-        "MigrateRegistrySASecrets": false
+        "MigrateIngresses": true
       },
       "PublicURL": "",
       "SecuritySettings": {
@@ -90,7 +89,6 @@
         "allowDeviceMappingForRegularUsers": true,
         "allowHostNamespaceForRegularUsers": true,
         "allowPrivilegedModeForRegularUsers": true,
-        "allowSecurityOptForRegularUsers": false,
         "allowStackManagementForRegularUsers": true,
         "allowSysctlSettingForRegularUsers": false,
         "allowVolumeBrowserForRegularUsers": false,
@@ -607,7 +605,6 @@
     "EnableEdgeComputeFeatures": false,
     "EnforceEdgeID": false,
     "FeatureFlagSettings": null,
-    "ForceSecureCookies": false,
     "GlobalDeploymentOptions": {
       "hideStacksFunctionality": false
     },
@@ -616,7 +613,7 @@
       "RequiredPasswordLength": 12
     },
     "KubeconfigExpiry": "0",
-    "KubectlShellImage": "portainer/kubectl-shell:2.42.0",
+    "KubectlShellImage": "portainer/kubectl-shell:2.39.2",
     "LDAPSettings": {
       "AnonymousMode": true,
       "AutoCreateUsers": true,
@@ -661,7 +658,18 @@
     "SnapshotInterval": "5m",
     "TemplatesURL": "",
     "TrustOnFirstConnect": false,
-    "UserSessionTimeout": "8h"
+    "UserSessionTimeout": "8h",
+    "openAMTConfiguration": {
+      "certFileContent": "",
+      "certFileName": "",
+      "certFilePassword": "",
+      "domainName": "",
+      "enabled": false,
+      "mpsPassword": "",
+      "mpsServer": "",
+      "mpsToken": "",
+      "mpsUser": ""
+    }
   },
   "snapshots": [
     {
@@ -798,7 +806,6 @@
       "AutoUpdate": null,
       "CreatedBy": "",
       "CreationDate": 0,
-      "DeploymentStartStatus": 0,
       "EndpointId": 1,
       "EntryPoint": "docker/alpine37-compose.yml",
       "Env": [],
@@ -821,7 +828,6 @@
       "AutoUpdate": null,
       "CreatedBy": "",
       "CreationDate": 0,
-      "DeploymentStartStatus": 0,
       "EndpointId": 1,
       "EntryPoint": "docker-compose.yml",
       "Env": [],
@@ -844,7 +850,6 @@
       "AutoUpdate": null,
       "CreatedBy": "",
       "CreationDate": 0,
-      "DeploymentStartStatus": 0,
       "EndpointId": 1,
       "EntryPoint": "docker-compose.yml",
       "Env": [],
@@ -937,7 +942,7 @@
     }
   ],
   "version": {
-    "VERSION": "{\"SchemaVersion\":\"2.42.0\",\"MigratorCount\":0,\"Edition\":1,\"InstanceID\":\"463d5c47-0ea5-4aca-85b1-405ceefee254\"}"
+    "VERSION": "{\"SchemaVersion\":\"2.39.2\",\"MigratorCount\":0,\"Edition\":1,\"InstanceID\":\"463d5c47-0ea5-4aca-85b1-405ceefee254\"}"
   },
   "webhooks": null
 }

api/docker/client/client_test.go

@@ -10,7 +10,6 @@ import (
 )
 
 func TestHttpClient(t *testing.T) {
-	t.Parallel()
 	fips.InitFIPS(false)
 
 	// Valid TLS configuration

api/docker/container.go

@@ -10,7 +10,7 @@ import (
 	"github.com/portainer/portainer/api/docker/images"
 	"github.com/portainer/portainer/api/logs"
 
-	"github.com/Masterminds/semver/v3"
+	"github.com/Masterminds/semver"
 	"github.com/docker/docker/api/types"
 	dockercontainer "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/network"
@@ -21,12 +21,14 @@ import (
 type ContainerService struct {
 	factory   *dockerclient.ClientFactory
 	dataStore dataservices.DataStore
+	sr        *serviceRestore
 }
 
 func NewContainerService(factory *dockerclient.ClientFactory, dataStore dataservices.DataStore) *ContainerService {
 	return &ContainerService{
 		factory:   factory,
 		dataStore: dataStore,
+		sr:        &serviceRestore{},
 	}
 }
 
@@ -139,14 +141,11 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 			initialNetwork.EndpointsConfig[name] = network
 		}
 	}
+	c.sr.enable()
+	defer c.sr.close()
+	defer c.sr.restore()
 
-	restore := true
-
-	defer func() {
-		if !restore {
-			return
-		}
-
+	c.sr.push(func() {
 		log.Debug().Str("container_id", containerId).Str("container", container.Name).Msg("restoring the container")
 		if err := cli.ContainerRename(ctx, containerId, container.Name); err != nil {
 			log.Warn().Err(err).Msg("failure to rename container")
@@ -161,7 +160,7 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 		if err := cli.ContainerStart(ctx, containerId, dockercontainer.StartOptions{}); err != nil {
 			log.Warn().Err(err).Msg("failure to start container")
 		}
-	}()
+	})
 
 	log.Debug().Str("container", strings.Split(container.Name, "/")[1]).Msg("starting to create a new container")
 
@@ -180,15 +179,8 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 	}
 
 	create, err := cli.ContainerCreate(ctx, container.Config, container.HostConfig, &initialNetwork, nil, container.Name)
-	if err != nil {
-		return nil, errors.Wrap(err, "create container error")
-	}
-
-	defer func() {
-		if !restore {
-			return
-		}
 
+	c.sr.push(func() {
 		log.Debug().Str("container_id", create.ID).Msg("removing the new container")
 
 		if err := cli.ContainerStop(ctx, create.ID, dockercontainer.StopOptions{}); err != nil {
@@ -198,7 +190,11 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 		if err := cli.ContainerRemove(ctx, create.ID, dockercontainer.RemoveOptions{}); err != nil {
 			log.Warn().Err(err).Msg("failure to remove container")
 		}
-	}()
+	})
+
+	if err != nil {
+		return nil, errors.Wrap(err, "create container error")
+	}
 
 	newContainerId := create.ID
 
@@ -228,7 +224,7 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 	log.Debug().Str("container_id", containerId).Msg("starting to remove the old container")
 	_ = cli.ContainerRemove(ctx, containerId, dockercontainer.RemoveOptions{})
 
-	restore = false
+	c.sr.disable()
 
 	newContainer, _, err := cli.ContainerInspectWithRaw(ctx, newContainerId, true)
 	if err != nil {
@@ -237,3 +233,51 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 
 	return &newContainer, nil
 }
+
+type serviceRestore struct {
+	restoreC chan struct{}
+	fs       []func()
+}
+
+func (sr *serviceRestore) enable() {
+	sr.restoreC = make(chan struct{}, 1)
+	sr.fs = make([]func(), 0)
+	sr.restoreC <- struct{}{}
+}
+
+func (sr *serviceRestore) disable() {
+	select {
+	case <-sr.restoreC:
+	default:
+	}
+}
+
+func (sr *serviceRestore) push(f func()) {
+	sr.fs = append(sr.fs, f)
+}
+
+func (sr *serviceRestore) restore() {
+	select {
+	case <-sr.restoreC:
+		l := len(sr.fs)
+		if l > 0 {
+			for i := l - 1; i >= 0; i-- {
+				sr.fs[i]()
+			}
+		}
+	default:
+	}
+}
+
+func (sr *serviceRestore) close() {
+	if sr == nil || sr.restoreC == nil {
+		return
+	}
+
+	select {
+	case <-sr.restoreC:
+	default:
+	}
+
+	close(sr.restoreC)
+}

api/docker/container_test.go

@@ -8,7 +8,6 @@ import (
 )
 
 func TestApplyVersionConstraint(t *testing.T) {
-	t.Parallel()
 	initialNet := network.NetworkingConfig{
 		EndpointsConfig: map[string]*network.EndpointSettings{
 			"key1": {

api/docker/images/digest_test.go

@@ -8,7 +8,6 @@ import (
 )
 
 func TestParseLocalImage(t *testing.T) {
-	t.Parallel()
 	// Test with a regular image
 
 	img, err := ParseLocalImage(image.InspectResponse{

api/docker/images/image_test.go

@@ -8,7 +8,6 @@ import (
 )
 
 func TestImageParser(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 
 	// portainer/portainer-ee
@@ -63,7 +62,6 @@ func TestImageParser(t *testing.T) {
 }
 
 func TestUpdateParsedImage(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 
 	// gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2

api/docker/images/registry_test.go

@@ -10,7 +10,6 @@ import (
 )
 
 func TestFindBestMatchNeedAuthRegistry(t *testing.T) {
-	t.Parallel()
 	is := assert.New(t)
 
 	t.Run("", func(t *testing.T) {

api/docker/images/status.go

@@ -89,11 +89,11 @@ func FigureOut(statuses []Status) Status {
 		return Preparing
 	}
 
-	if slices.Contains(statuses, Outdated) {
+	if contains(statuses, Outdated) {
 		return Outdated
-	} else if slices.Contains(statuses, Processing) {
+	} else if contains(statuses, Processing) {
 		return Processing
-	} else if slices.Contains(statuses, Error) {
+	} else if contains(statuses, Error) {
 		return Error
 	}
 
@@ -275,6 +275,14 @@ func EvictImageStatus(resourceID string) {
 	statusCache.Delete(resourceID)
 }
 
+func contains(statuses []Status, status Status) bool {
+	if len(statuses) == 0 {
+		return false
+	}
+
+	return slices.Contains(statuses, status)
+}
+
 func allMatch(statuses []Status, status Status) bool {
 	if len(statuses) == 0 {
 		return false

api/docker/stats/container_stats_test.go

@@ -25,7 +25,6 @@ func (m *MockDockerClient) ContainerInspect(ctx context.Context, containerID str
 }
 
 func TestCalculateContainerStats(t *testing.T) {
-	t.Parallel()
 	mockClient := new(MockDockerClient)
 
 	// Test containers - using enough containers to test concurrent processing
@@ -79,7 +78,7 @@ func TestCalculateContainerStats(t *testing.T) {
 
 	// Call the function and measure time
 	startTime := time.Now()
-	stats, err := CalculateContainerStats(t.Context(), mockClient, false, containers)
+	stats, err := CalculateContainerStats(context.Background(), mockClient, false, containers)
 	require.NoError(t, err, "failed to calculate container stats")
 	duration := time.Since(startTime)
 
@@ -106,7 +105,6 @@ func TestCalculateContainerStats(t *testing.T) {
 }
 
 func TestCalculateContainerStatsAllErrors(t *testing.T) {
-	t.Parallel()
 	mockClient := new(MockDockerClient)
 
 	// Test containers
@@ -120,7 +118,7 @@ func TestCalculateContainerStatsAllErrors(t *testing.T) {
 	mockClient.On("ContainerInspect", mock.Anything, "container2").Return(container.InspectResponse{}, errors.New("permission denied"))
 
 	// Call the function
-	stats, err := CalculateContainerStats(t.Context(), mockClient, false, containers)
+	stats, err := CalculateContainerStats(context.Background(), mockClient, false, containers)
 
 	// Assert that an error was returned
 	require.Error(t, err, "should return error when all containers fail to inspect")
@@ -142,7 +140,6 @@ func TestCalculateContainerStatsAllErrors(t *testing.T) {
 }
 
 func TestGetContainerStatus(t *testing.T) {
-	t.Parallel()
 	testCases := []struct {
 		name     string
 		state    *container.State
@@ -235,7 +232,6 @@ func TestGetContainerStatus(t *testing.T) {
 }
 
 func TestCalculateContainerStatsForSwarm(t *testing.T) {
-	t.Parallel()
 	containers := []container.Summary{
 		{State: "running"},
 		{State: "running", Status: "Up 5 minutes (healthy)"},

api/edge/edge.go

@@ -54,9 +54,6 @@ type (
 		// Used only for EE
 		AlwaysCloneGitRepoForRelativePath bool
 
-		// Whether the edge stack supports per device configs
-		SupportPerDeviceConfigs bool
-
 		// Mount point for relative path
 		FilesystemPath string
 		// Used only for EE

api/exec/common.go

@@ -1,79 +1,5 @@
 package exec
 
-import (
-	"fmt"
-	"regexp"
-	"strings"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/http/proxy"
-	"github.com/portainer/portainer/api/http/proxy/factory"
-	"github.com/portainer/portainer/api/internal/registryutils"
-
-	"github.com/docker/cli/cli/config/types"
-	"github.com/rs/zerolog/log"
-)
+import "regexp"
 
 var stackNameNormalizeRegex = regexp.MustCompile("[^-_a-z0-9]+")
-
-func normalizeStackName(name string) string {
-	return stackNameNormalizeRegex.ReplaceAllString(strings.ToLower(name), "")
-}
-
-// fetchEndpointProxy returns the Docker host URL for the given endpoint.
-// For remote endpoints it creates a local proxy that handles TLS termination and
-// Portainer agent header injection; for local unix/npipe sockets no proxy is needed.
-func fetchEndpointProxy(proxyManager *proxy.Manager, endpoint *portainer.Endpoint) (string, *factory.ProxyServer, error) {
-	if strings.HasPrefix(endpoint.URL, "unix://") || strings.HasPrefix(endpoint.URL, "npipe://") {
-		return "", nil, nil
-	}
-
-	proxy, err := proxyManager.CreateAgentProxyServer(endpoint)
-	if err != nil {
-		return "", nil, err
-	}
-
-	return fmt.Sprintf("tcp://127.0.0.1:%d", proxy.Port), proxy, nil
-}
-
-// portainerRegistriesToAuthConfigs converts registries to Docker auth configs.
-// Callers must ensure ECR tokens are valid before calling this function (e.g. via
-// registryutils.ValidateRegistriesECRTokens with a real DataStoreTx). This function
-// intentionally performs no DB writes to avoid write-lock contention when called inside
-// an active BoltDB write transaction.
-func portainerRegistriesToAuthConfigs(registries []portainer.Registry) []types.AuthConfig {
-	var authConfigs []types.AuthConfig
-
-	for _, r := range registries {
-		ac := types.AuthConfig{
-			Username:      r.Username,
-			Password:      r.Password,
-			ServerAddress: r.URL,
-		}
-
-		if r.Authentication {
-			var err error
-
-			ac.Username, ac.Password, err = getEffectiveRegUsernamePassword(&r)
-			if err != nil {
-				continue
-			}
-		}
-
-		authConfigs = append(authConfigs, ac)
-	}
-
-	return authConfigs
-}
-
-func getEffectiveRegUsernamePassword(registry *portainer.Registry) (string, string, error) {
-	username, password, err := registryutils.GetRegEffectiveCredential(registry)
-	if err != nil {
-		log.Warn().
-			Err(err).
-			Str("RegistryName", registry.Name).
-			Msg("Failed to get effective credential. Skip logging with this registry.")
-	}
-
-	return username, password, err
-}

api/exec/compose_stack.go

@@ -6,25 +6,35 @@ import (
 	"io"
 	"os"
 	"path"
+	"strings"
 
 	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/api/http/proxy/factory"
+	"github.com/portainer/portainer/api/internal/registryutils"
 	"github.com/portainer/portainer/api/logs"
 	"github.com/portainer/portainer/api/stacks/stackutils"
 	"github.com/portainer/portainer/pkg/libstack"
+
+	"github.com/docker/cli/cli/config/types"
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
 )
 
 // ComposeStackManager is a wrapper for docker-compose binary
 type ComposeStackManager struct {
 	deployer     libstack.Deployer
 	proxyManager *proxy.Manager
+	dataStore    dataservices.DataStore
 }
 
 // NewComposeStackManager returns a Compose stack manager
-func NewComposeStackManager(deployer libstack.Deployer, proxyManager *proxy.Manager) *ComposeStackManager {
+func NewComposeStackManager(deployer libstack.Deployer, proxyManager *proxy.Manager, dataStore dataservices.DataStore) *ComposeStackManager {
 	return &ComposeStackManager{
 		deployer:     deployer,
 		proxyManager: proxyManager,
+		dataStore:    dataStore,
 	}
 }
 
@@ -35,9 +45,9 @@ func (manager *ComposeStackManager) ComposeSyntaxMaxVersion() string {
 
 // Up builds, (re)creates and starts containers in the background. Wraps `docker-compose up -d` command
 func (manager *ComposeStackManager) Up(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, options portainer.ComposeUpOptions) error {
-	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	url, proxy, err := manager.fetchEndpointProxy(endpoint)
 	if err != nil {
-		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+		return errors.Wrap(err, "failed to fetch environment proxy")
 	}
 
 	if proxy != nil {
@@ -46,11 +56,11 @@ func (manager *ComposeStackManager) Up(ctx context.Context, stack *portainer.Sta
 
 	envFilePath, err := createEnvFile(stack)
 	if err != nil {
-		return fmt.Errorf("failed to create env file: %w", err)
+		return errors.Wrap(err, "failed to create env file")
 	}
 
 	filePaths := stackutils.GetStackFilePaths(stack, true)
-	if err = manager.deployer.Deploy(ctx, filePaths, libstack.DeployOptions{
+	err = manager.deployer.Deploy(ctx, filePaths, libstack.DeployOptions{
 		Options: libstack.Options{
 			WorkingDir:  stack.ProjectPath,
 			EnvFilePath: envFilePath,
@@ -60,18 +70,15 @@ func (manager *ComposeStackManager) Up(ctx context.Context, stack *portainer.Sta
 		},
 		ForceRecreate:        options.ForceRecreate,
 		AbortOnContainerExit: options.AbortOnContainerExit,
-		RemoveOrphans:        options.Prune,
-	}); err != nil {
-		return fmt.Errorf("failed to deploy a stack: %w", err)
-	}
-	return nil
+	})
+	return errors.Wrap(err, "failed to deploy a stack")
 }
 
 // Run runs a one-off command on a service. Wraps `docker-compose run` command
 func (manager *ComposeStackManager) Run(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, serviceName string, options portainer.ComposeRunOptions) error {
-	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	url, proxy, err := manager.fetchEndpointProxy(endpoint)
 	if err != nil {
-		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+		return errors.Wrap(err, "failed to fetch environment proxy")
 	}
 
 	if proxy != nil {
@@ -80,11 +87,11 @@ func (manager *ComposeStackManager) Run(ctx context.Context, stack *portainer.St
 
 	envFilePath, err := createEnvFile(stack)
 	if err != nil {
-		return fmt.Errorf("failed to create env file: %w", err)
+		return errors.Wrap(err, "failed to create env file")
 	}
 
 	filePaths := stackutils.GetStackFilePaths(stack, true)
-	if err = manager.deployer.Run(ctx, filePaths, serviceName, libstack.RunOptions{
+	err = manager.deployer.Run(ctx, filePaths, serviceName, libstack.RunOptions{
 		Options: libstack.Options{
 			WorkingDir:  stack.ProjectPath,
 			EnvFilePath: envFilePath,
@@ -95,63 +102,71 @@ func (manager *ComposeStackManager) Run(ctx context.Context, stack *portainer.St
 		Remove:   options.Remove,
 		Args:     options.Args,
 		Detached: options.Detached,
-	}); err != nil {
-		return fmt.Errorf("failed to deploy a stack: %w", err)
-	}
-	return nil
+	})
+	return errors.Wrap(err, "failed to deploy a stack")
 }
 
 // Down stops and removes containers, networks, images, and volumes
 func (manager *ComposeStackManager) Down(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint) error {
-	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	url, proxy, err := manager.fetchEndpointProxy(endpoint)
 	if err != nil {
-		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+		return err
 	} else if proxy != nil {
 		defer proxy.Close()
 	}
 
-	if err = manager.deployer.Remove(ctx, stack.Name, nil, libstack.RemoveOptions{
+	err = manager.deployer.Remove(ctx, stack.Name, nil, libstack.RemoveOptions{
 		Options: libstack.Options{
 			WorkingDir: "",
 			Host:       url,
 		},
-	}); err != nil {
-		return fmt.Errorf("failed to remove a stack: %w", err)
-	}
-	return nil
+	})
+
+	return errors.Wrap(err, "failed to remove a stack")
 }
 
 // Pull an image associated with a service defined in a docker-compose.yml or docker-stack.yml file,
 // but does not start containers based on those images.
 func (manager *ComposeStackManager) Pull(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, options portainer.ComposeOptions) error {
-	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	url, proxy, err := manager.fetchEndpointProxy(endpoint)
 	if err != nil {
-		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+		return err
 	} else if proxy != nil {
 		defer proxy.Close()
 	}
 
 	envFilePath, err := createEnvFile(stack)
 	if err != nil {
-		return fmt.Errorf("failed to create env file: %w", err)
+		return errors.Wrap(err, "failed to create env file")
 	}
 
 	filePaths := stackutils.GetStackFilePaths(stack, true)
-	if err = manager.deployer.Pull(ctx, filePaths, libstack.Options{
+	err = manager.deployer.Pull(ctx, filePaths, libstack.Options{
 		WorkingDir:  stack.ProjectPath,
 		EnvFilePath: envFilePath,
 		Host:        url,
 		ProjectName: stack.Name,
 		Registries:  portainerRegistriesToAuthConfigs(options.Registries),
-	}); err != nil {
-		return fmt.Errorf("failed to pull images of the stack: %w", err)
-	}
-	return nil
+	})
+	return errors.Wrap(err, "failed to pull images of the stack")
 }
 
 // NormalizeStackName returns a new stack name with unsupported characters replaced
 func (manager *ComposeStackManager) NormalizeStackName(name string) string {
-	return normalizeStackName(name)
+	return stackNameNormalizeRegex.ReplaceAllString(strings.ToLower(name), "")
+}
+
+func (manager *ComposeStackManager) fetchEndpointProxy(endpoint *portainer.Endpoint) (string, *factory.ProxyServer, error) {
+	if strings.HasPrefix(endpoint.URL, "unix://") || strings.HasPrefix(endpoint.URL, "npipe://") {
+		return "", nil, nil
+	}
+
+	proxy, err := manager.proxyManager.CreateAgentProxyServer(endpoint)
+	if err != nil {
+		return "", nil, err
+	}
+
+	return fmt.Sprintf("tcp://127.0.0.1:%d", proxy.Port), proxy, nil
 }
 
 // createEnvFile creates a file that would hold both "in-place" and default environment variables.
@@ -162,7 +177,7 @@ func createEnvFile(stack *portainer.Stack) (string, error) {
 	}
 
 	envFilePath := path.Join(stack.ProjectPath, "stack.env")
-	envfile, err := os.OpenFile(envFilePath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)
+	envfile, err := os.OpenFile(envFilePath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
 	if err != nil {
 		return "", err
 	}
@@ -213,3 +228,45 @@ func copyConfigEnvVars(w io.Writer, envs []portainer.Pair) error {
 
 	return nil
 }
+
+// portainerRegistriesToAuthConfigs converts registries to Docker auth configs.
+// Callers must ensure ECR tokens are valid before calling this function (e.g. via
+// registryutils.ValidateRegistriesECRTokens with a real DataStoreTx). This function
+// intentionally performs no DB writes to avoid write-lock contention when called inside
+// an active BoltDB write transaction.
+func portainerRegistriesToAuthConfigs(registries []portainer.Registry) []types.AuthConfig {
+	var authConfigs []types.AuthConfig
+
+	for _, r := range registries {
+		ac := types.AuthConfig{
+			Username:      r.Username,
+			Password:      r.Password,
+			ServerAddress: r.URL,
+		}
+
+		if r.Authentication {
+			var err error
+
+			ac.Username, ac.Password, err = getEffectiveRegUsernamePassword(&r)
+			if err != nil {
+				continue
+			}
+		}
+
+		authConfigs = append(authConfigs, ac)
+	}
+
+	return authConfigs
+}
+
+func getEffectiveRegUsernamePassword(registry *portainer.Registry) (string, string, error) {
+	username, password, err := registryutils.GetRegEffectiveCredential(registry)
+	if err != nil {
+		log.Warn().
+			Err(err).
+			Str("RegistryName", registry.Name).
+			Msg("Failed to get effective credential. Skip logging with this registry.")
+	}
+
+	return username, password, err
+}

api/exec/compose_stack_integration_test.go

@@ -1,13 +1,14 @@
 package exec
 
 import (
+	"context"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 	"testing"
 
 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/filesystem"
 	"github.com/portainer/portainer/pkg/libstack/compose"
 	"github.com/portainer/portainer/pkg/testhelpers"
 	"github.com/stretchr/testify/require"
@@ -25,7 +26,7 @@ const composedContainerName = "compose_wrapper_test"
 func setup(t *testing.T) (*portainer.Stack, *portainer.Endpoint) {
 	dir := t.TempDir()
 	composeFileName := "compose_wrapper_test.yml"
-	f, err := os.Create(filesystem.JoinPaths(dir, composeFileName))
+	f, err := os.Create(filepath.Join(dir, composeFileName))
 	require.NoError(t, err)
 
 	_, err = f.WriteString(composeFile)
@@ -41,16 +42,17 @@ func setup(t *testing.T) (*portainer.Stack, *portainer.Endpoint) {
 }
 
 func Test_UpAndDown(t *testing.T) {
-	t.Parallel()
 	testhelpers.IntegrationTest(t)
 
 	stack, endpoint := setup(t)
 
 	deployer := compose.NewComposeDeployer()
 
-	w := NewComposeStackManager(deployer, nil)
+	w := NewComposeStackManager(deployer, nil, nil)
 
-	if err := w.Up(t.Context(), stack, endpoint, portainer.ComposeUpOptions{}); err != nil {
+	ctx := context.TODO()
+
+	if err := w.Up(ctx, stack, endpoint, portainer.ComposeUpOptions{}); err != nil {
 		t.Fatalf("Error calling docker-compose up: %s", err)
 	}
 
@@ -58,7 +60,7 @@ func Test_UpAndDown(t *testing.T) {
 		t.Fatal("container should exist")
 	}
 
-	if err := w.Down(t.Context(), stack, endpoint); err != nil {
+	if err := w.Down(ctx, stack, endpoint); err != nil {
 		t.Fatalf("Error calling docker-compose down: %s", err)
 	}
 

api/exec/compose_stack_test.go

@@ -3,18 +3,18 @@ package exec
 import (
 	"io"
 	"os"
+	"path"
+	"path/filepath"
 	"testing"
 	"time"
 
 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/filesystem"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func Test_createEnvFile(t *testing.T) {
-	t.Parallel()
 	dir := t.TempDir()
 
 	tests := []struct {
@@ -57,9 +57,9 @@ func Test_createEnvFile(t *testing.T) {
 			result, _ := createEnvFile(tt.stack)
 
 			if tt.expected != "" {
-				assert.Equal(t, filesystem.JoinPaths(tt.stack.ProjectPath, "stack.env"), result)
+				assert.Equal(t, filepath.Join(tt.stack.ProjectPath, "stack.env"), result)
 
-				f, _ := os.Open(filesystem.JoinPaths(dir, "stack.env"))
+				f, _ := os.Open(path.Join(dir, "stack.env"))
 				content, _ := io.ReadAll(f)
 
 				assert.Equal(t, tt.expected, string(content))
@@ -71,9 +71,8 @@ func Test_createEnvFile(t *testing.T) {
 }
 
 func Test_createEnvFile_mergesDefultAndInplaceEnvVars(t *testing.T) {
-	t.Parallel()
 	dir := t.TempDir()
-	err := os.WriteFile(filesystem.JoinPaths(dir, ".env"), []byte("VAR1=VAL1\nVAR2=VAL2\n"), 0600)
+	err := os.WriteFile(path.Join(dir, ".env"), []byte("VAR1=VAL1\nVAR2=VAL2\n"), 0600)
 	require.NoError(t, err)
 
 	stack := &portainer.Stack{
@@ -84,11 +83,11 @@ func Test_createEnvFile_mergesDefultAndInplaceEnvVars(t *testing.T) {
 		},
 	}
 	result, err := createEnvFile(stack)
-	assert.Equal(t, filesystem.JoinPaths(stack.ProjectPath, "stack.env"), result)
+	assert.Equal(t, filepath.Join(stack.ProjectPath, "stack.env"), result)
 	require.NoError(t, err)
-	assert.FileExists(t, filesystem.JoinPaths(dir, "stack.env"))
+	assert.FileExists(t, path.Join(dir, "stack.env"))
 
-	f, err := os.Open(filesystem.JoinPaths(dir, "stack.env"))
+	f, err := os.Open(path.Join(dir, "stack.env"))
 	require.NoError(t, err)
 
 	content, err := io.ReadAll(f)

api/exec/exectest/kubernetes_mocks.go

@@ -1,8 +1,6 @@
 package exectest
 
 import (
-	"context"
-
 	portainer "github.com/portainer/portainer/api"
 )
 
@@ -15,14 +13,14 @@ func NewKubernetesDeployer() *kubernetesMockDeployer {
 	return &kubernetesMockDeployer{}
 }
 
-func (deployer *kubernetesMockDeployer) Deploy(_ context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
+func (deployer *kubernetesMockDeployer) Deploy(userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
 	return "", nil
 }
 
-func (deployer *kubernetesMockDeployer) Remove(_ context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
+func (deployer *kubernetesMockDeployer) Remove(userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
 	return "", nil
 }
 
-func (deployer *kubernetesMockDeployer) Restart(_ context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
+func (deployer *kubernetesMockDeployer) Restart(userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
 	return "", nil
 }

api/exec/kubernetes_deploy.go

@@ -76,16 +76,16 @@ func (deployer *KubernetesDeployer) getToken(userID portainer.UserID, endpoint *
 }
 
 // Deploy upserts Kubernetes resources defined in manifest(s)
-func (deployer *KubernetesDeployer) Deploy(ctx context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
-	return deployer.command(ctx, "apply", userID, endpoint, resources, namespace)
+func (deployer *KubernetesDeployer) Deploy(userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
+	return deployer.command("apply", userID, endpoint, resources, namespace)
 }
 
 // Remove deletes Kubernetes resources defined in manifest(s)
-func (deployer *KubernetesDeployer) Remove(ctx context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
-	return deployer.command(ctx, "delete", userID, endpoint, resources, namespace)
+func (deployer *KubernetesDeployer) Remove(userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
+	return deployer.command("delete", userID, endpoint, resources, namespace)
 }
 
-func (deployer *KubernetesDeployer) command(ctx context.Context, operation string, userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
+func (deployer *KubernetesDeployer) command(operation string, userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
 	token, err := deployer.getToken(userID, endpoint, endpoint.Type == portainer.KubernetesLocalEnvironment)
 	if err != nil {
 		return "", errors.Wrap(err, "failed generating a user token")
@@ -120,7 +120,7 @@ func (deployer *KubernetesDeployer) command(ctx context.Context, operation strin
 		return "", errors.Errorf("unsupported operation: %s", operation)
 	}
 
-	output, err := operationFunc(ctx, resources)
+	output, err := operationFunc(context.Background(), resources)
 	if err != nil {
 		return "", errors.Wrapf(err, "failed to execute kubectl %s command", operation)
 	}

api/exec/kubernetes_deploy_test.go

@@ -57,7 +57,6 @@ func testExecuteKubectlOperation(client *mockKubectlClient, operation string, ma
 }
 
 func TestExecuteKubectlOperation_Apply_Success(t *testing.T) {
-	t.Parallel()
 	called := false
 	mockClient := &mockKubectlClient{
 		applyFunc: func(ctx context.Context, files []string) error {
@@ -75,7 +74,6 @@ func TestExecuteKubectlOperation_Apply_Success(t *testing.T) {
 }
 
 func TestExecuteKubectlOperation_Apply_Error(t *testing.T) {
-	t.Parallel()
 	expectedErr := errors.New("kubectl apply failed")
 	called := false
 	mockClient := &mockKubectlClient{
@@ -95,7 +93,6 @@ func TestExecuteKubectlOperation_Apply_Error(t *testing.T) {
 }
 
 func TestExecuteKubectlOperation_Delete_Success(t *testing.T) {
-	t.Parallel()
 	called := false
 	mockClient := &mockKubectlClient{
 		deleteFunc: func(ctx context.Context, files []string) error {
@@ -113,7 +110,6 @@ func TestExecuteKubectlOperation_Delete_Success(t *testing.T) {
 }
 
 func TestExecuteKubectlOperation_Delete_Error(t *testing.T) {
-	t.Parallel()
 	expectedErr := errors.New("kubectl delete failed")
 	called := false
 	mockClient := &mockKubectlClient{
@@ -133,7 +129,6 @@ func TestExecuteKubectlOperation_Delete_Error(t *testing.T) {
 }
 
 func TestExecuteKubectlOperation_RolloutRestart_Success(t *testing.T) {
-	t.Parallel()
 	called := false
 	mockClient := &mockKubectlClient{
 		rolloutRestartFunc: func(ctx context.Context, resources []string) error {
@@ -151,7 +146,6 @@ func TestExecuteKubectlOperation_RolloutRestart_Success(t *testing.T) {
 }
 
 func TestExecuteKubectlOperation_RolloutRestart_Error(t *testing.T) {
-	t.Parallel()
 	expectedErr := errors.New("kubectl rollout restart failed")
 	called := false
 	mockClient := &mockKubectlClient{
@@ -171,7 +165,6 @@ func TestExecuteKubectlOperation_RolloutRestart_Error(t *testing.T) {
 }
 
 func TestExecuteKubectlOperation_UnsupportedOperation(t *testing.T) {
-	t.Parallel()
 	mockClient := &mockKubectlClient{}
 
 	err := testExecuteKubectlOperation(mockClient, "unsupported", []string{})

api/exec/swarm_stack.go

@@ -1,93 +1,247 @@
 package exec
 
 import (
-	"context"
-	"fmt"
+	"bytes"
+	"errors"
+	"os"
+	"os/exec"
+	"path"
+	"runtime"
+	"strings"
 
 	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/stacks/stackutils"
-	"github.com/portainer/portainer/pkg/libstack/swarm"
+
+	"github.com/rs/zerolog/log"
+	"github.com/segmentio/encoding/json"
 )
 
 // SwarmStackManager represents a service for managing stacks.
 type SwarmStackManager struct {
-	deployer     swarm.Deployer
-	proxyManager *proxy.Manager
+	binaryPath           string
+	configPath           string
+	signatureService     portainer.DigitalSignatureService
+	fileService          portainer.FileService
+	reverseTunnelService portainer.ReverseTunnelService
+	dataStore            dataservices.DataStore
 }
 
-// NewSwarmStackManager creates a new SwarmStackManager.
+// NewSwarmStackManager initializes a new SwarmStackManager service.
+// It also updates the configuration of the Docker CLI binary.
 func NewSwarmStackManager(
-	deployer swarm.Deployer,
-	proxyManager *proxy.Manager,
-) *SwarmStackManager {
-	return &SwarmStackManager{
-		deployer:     deployer,
-		proxyManager: proxyManager,
+	binaryPath, configPath string,
+	signatureService portainer.DigitalSignatureService,
+	fileService portainer.FileService,
+	reverseTunnelService portainer.ReverseTunnelService,
+	datastore dataservices.DataStore,
+) (*SwarmStackManager, error) {
+	manager := &SwarmStackManager{
+		binaryPath:           binaryPath,
+		configPath:           configPath,
+		signatureService:     signatureService,
+		fileService:          fileService,
+		reverseTunnelService: reverseTunnelService,
+		dataStore:            datastore,
 	}
+
+	if err := manager.updateDockerCLIConfiguration(manager.configPath); err != nil {
+		return nil, err
+	}
+
+	return manager, nil
 }
 
-// Deploy creates or updates a Docker Swarm stack.
-func (manager *SwarmStackManager) Deploy(
-	ctx context.Context,
-	stack *portainer.Stack,
-	prune bool,
-	pullImage bool,
-	endpoint *portainer.Endpoint,
-	registries []portainer.Registry,
-) error {
-	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+// Login executes the docker login command against a list of registries (including DockerHub).
+func (manager *SwarmStackManager) Login(registries []portainer.Registry, endpoint *portainer.Endpoint) error {
+	command, args, err := manager.prepareDockerCommandAndArgs(manager.binaryPath, manager.configPath, endpoint)
 	if err != nil {
-		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+		return err
 	}
 
-	if proxy != nil {
-		defer proxy.Close()
+	for _, registry := range registries {
+		if registry.Authentication {
+			username, password, err := getEffectiveRegUsernamePassword(&registry)
+			if err != nil {
+				continue
+			}
+
+			registryArgs := append(args, "login", "--username", username, "--password", password, registry.URL)
+			if err := runCommandAndCaptureStdErr(command, registryArgs, nil, ""); err != nil {
+				log.Warn().
+					Err(err).
+					Str("RegistryName", registry.Name).
+					Msg("Failed to login.")
+			}
+		}
 	}
 
+	return nil
+}
+
+// Logout executes the docker logout command.
+func (manager *SwarmStackManager) Logout(endpoint *portainer.Endpoint) error {
+	command, args, err := manager.prepareDockerCommandAndArgs(manager.binaryPath, manager.configPath, endpoint)
+	if err != nil {
+		return err
+	}
+
+	args = append(args, "logout")
+
+	return runCommandAndCaptureStdErr(command, args, nil, "")
+}
+
+// Deploy executes the docker stack deploy command.
+func (manager *SwarmStackManager) Deploy(stack *portainer.Stack, prune bool, pullImage bool, endpoint *portainer.Endpoint) error {
 	filePaths := stackutils.GetStackFilePaths(stack, true)
-
-	env := make([]string, 0, len(stack.Env))
-	for _, ev := range stack.Env {
-		env = append(env, ev.Name+"="+ev.Value)
-	}
-
-	return manager.deployer.Deploy(context.TODO(), filePaths, swarm.DeployOptions{
-		Options: swarm.Options{
-			ProjectName: stack.Name,
-			Host:        url,
-			Env:         env,
-			WorkingDir:  stack.ProjectPath,
-			Registries:  portainerRegistriesToAuthConfigs(registries),
-		},
-		RemoveOrphans: prune,
-		PullImage:     pullImage,
-	})
-}
-
-// Remove deletes all resources belonging to a Swarm stack.
-func (manager *SwarmStackManager) Remove(
-	ctx context.Context,
-	stack *portainer.Stack,
-	endpoint *portainer.Endpoint,
-) error {
-	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	command, args, err := manager.prepareDockerCommandAndArgs(manager.binaryPath, manager.configPath, endpoint)
 	if err != nil {
-		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+		return err
 	}
 
-	if proxy != nil {
-		defer proxy.Close()
+	if prune {
+		args = append(args, "stack", "deploy", "--prune", "--with-registry-auth")
+	} else {
+		args = append(args, "stack", "deploy", "--with-registry-auth")
 	}
 
-	return manager.deployer.Remove(context.TODO(), stack.Name, swarm.RemoveOptions{
-		Options: swarm.Options{
-			Host: url,
-		},
-	})
+	if !pullImage {
+		args = append(args, "--resolve-image=never")
+	}
+
+	args = configureFilePaths(args, filePaths)
+	args = append(args, stack.Name)
+
+	env := make([]string, 0)
+	for _, envvar := range stack.Env {
+		env = append(env, envvar.Name+"="+envvar.Value)
+	}
+
+	return runCommandAndCaptureStdErr(command, args, env, stack.ProjectPath)
+}
+
+// Remove executes the docker stack rm command.
+func (manager *SwarmStackManager) Remove(stack *portainer.Stack, endpoint *portainer.Endpoint) error {
+	command, args, err := manager.prepareDockerCommandAndArgs(manager.binaryPath, manager.configPath, endpoint)
+	if err != nil {
+		return err
+	}
+
+	args = append(args, "stack", "rm", "--detach=false", stack.Name)
+
+	return runCommandAndCaptureStdErr(command, args, nil, "")
+}
+
+func runCommandAndCaptureStdErr(command string, args []string, env []string, workingDir string) error {
+	var stderr bytes.Buffer
+
+	cmd := exec.Command(command, args...)
+	cmd.Stderr = &stderr
+
+	if workingDir != "" {
+		cmd.Dir = workingDir
+	}
+
+	if env != nil {
+		cmd.Env = os.Environ()
+		cmd.Env = append(cmd.Env, env...)
+	}
+
+	if err := cmd.Run(); err != nil {
+		return errors.New(stderr.String())
+	}
+
+	return nil
+}
+
+func (manager *SwarmStackManager) prepareDockerCommandAndArgs(binaryPath, configPath string, endpoint *portainer.Endpoint) (string, []string, error) {
+	// Assume Linux as a default
+	command := path.Join(binaryPath, "docker")
+
+	if runtime.GOOS == "windows" {
+		command = path.Join(binaryPath, "docker.exe")
+	}
+
+	args := make([]string, 0)
+	args = append(args, "--config", configPath)
+
+	endpointURL := endpoint.URL
+	if endpoint.Type == portainer.EdgeAgentOnDockerEnvironment {
+		tunnelAddr, err := manager.reverseTunnelService.TunnelAddr(endpoint)
+		if err != nil {
+			return "", nil, err
+		}
+
+		endpointURL = "tcp://" + tunnelAddr
+	}
+
+	args = append(args, "-H", endpointURL)
+
+	if endpoint.TLSConfig.TLS {
+		args = append(args, "--tls")
+
+		if !endpoint.TLSConfig.TLSSkipVerify {
+			args = append(args, "--tlsverify", "--tlscacert", endpoint.TLSConfig.TLSCACertPath)
+		} else {
+			args = append(args, "--tlscacert", "")
+		}
+
+		if endpoint.TLSConfig.TLSCertPath != "" && endpoint.TLSConfig.TLSKeyPath != "" {
+			args = append(args, "--tlscert", endpoint.TLSConfig.TLSCertPath, "--tlskey", endpoint.TLSConfig.TLSKeyPath)
+		}
+	}
+
+	return command, args, nil
+}
+
+func (manager *SwarmStackManager) updateDockerCLIConfiguration(configPath string) error {
+	configFilePath := path.Join(configPath, "config.json")
+
+	config, err := manager.retrieveConfigurationFromDisk(configFilePath)
+	if err != nil {
+		log.Warn().Err(err).Msg("unable to retrieve the Swarm configuration from disk, proceeding without it")
+	}
+
+	signature, err := manager.signatureService.CreateSignature(portainer.PortainerAgentSignatureMessage)
+	if err != nil {
+		return err
+	}
+
+	if config["HttpHeaders"] == nil {
+		config["HttpHeaders"] = make(map[string]any)
+	}
+
+	headersObject := config["HttpHeaders"].(map[string]any)
+	headersObject["X-PortainerAgent-ManagerOperation"] = "1"
+	headersObject["X-PortainerAgent-Signature"] = signature
+	headersObject["X-PortainerAgent-PublicKey"] = manager.signatureService.EncodedPublicKey()
+
+	return manager.fileService.WriteJSONToFile(configFilePath, config)
+}
+
+func (manager *SwarmStackManager) retrieveConfigurationFromDisk(path string) (map[string]any, error) {
+	var config map[string]any
+
+	raw, err := manager.fileService.GetFileContent(path, "")
+	if err != nil {
+		return make(map[string]any), nil
+	}
+
+	if err := json.Unmarshal(raw, &config); err != nil {
+		return nil, err
+	}
+
+	return config, nil
 }
 
-// NormalizeStackName returns a new stack name with unsupported characters replaced.
 func (manager *SwarmStackManager) NormalizeStackName(name string) string {
-	return normalizeStackName(name)
+	return stackNameNormalizeRegex.ReplaceAllString(strings.ToLower(name), "")
+}
+
+func configureFilePaths(args []string, filePaths []string) []string {
+	for _, path := range filePaths {
+		args = append(args, "--compose-file", path)
+	}
+
+	return args
 }

api/exec/swarm_stack_test.go

@@ -0,0 +1,43 @@
+package exec
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestConfigFilePaths(t *testing.T) {
+	args := []string{"stack", "deploy", "--with-registry-auth"}
+	filePaths := []string{"dir/file", "dir/file-two", "dir/file-three"}
+	expected := []string{"stack", "deploy", "--with-registry-auth", "--compose-file", "dir/file", "--compose-file", "dir/file-two", "--compose-file", "dir/file-three"}
+	output := configureFilePaths(args, filePaths)
+	assert.ElementsMatch(t, expected, output, "wrong output file paths")
+}
+
+func TestPrepareDockerCommandAndArgs(t *testing.T) {
+	binaryPath := "/test/dist"
+	configPath := "/test/config"
+	manager := &SwarmStackManager{
+		binaryPath: binaryPath,
+		configPath: configPath,
+	}
+
+	endpoint := &portainer.Endpoint{
+		URL: "tcp://test:9000",
+		TLSConfig: portainer.TLSConfiguration{
+			TLS:           true,
+			TLSSkipVerify: true,
+		},
+	}
+
+	command, args, err := manager.prepareDockerCommandAndArgs(binaryPath, configPath, endpoint)
+	require.NoError(t, err)
+
+	expectedCommand := "/test/dist/docker"
+	expectedArgs := []string{"--config", "/test/config", "-H", "tcp://test:9000", "--tls", "--tlscacert", ""}
+
+	require.Equal(t, expectedCommand, command)
+	require.Equal(t, expectedArgs, args)
+}

api/filesystem/copy_test.go

@@ -2,6 +2,8 @@ package filesystem
 
 import (
 	"os"
+	"path"
+	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -9,52 +11,47 @@ import (
 )
 
 func Test_copyFile_returnsError_whenSourceDoesNotExist(t *testing.T) {
-	t.Parallel()
 	tmpdir := t.TempDir()
 	err := copyFile("does-not-exist", tmpdir)
 	require.Error(t, err)
 }
 
 func Test_copyFile_shouldMakeAbackup(t *testing.T) {
-	t.Parallel()
 	tmpdir := t.TempDir()
 	content := []byte("content")
 
-	err := os.WriteFile(JoinPaths(tmpdir, "origin"), content, 0600)
+	err := os.WriteFile(path.Join(tmpdir, "origin"), content, 0600)
 	require.NoError(t, err)
 
-	err = copyFile(JoinPaths(tmpdir, "origin"), JoinPaths(tmpdir, "copy"))
+	err = copyFile(path.Join(tmpdir, "origin"), path.Join(tmpdir, "copy"))
 	require.NoError(t, err)
 
-	copyContent, err := os.ReadFile(JoinPaths(tmpdir, "copy"))
+	copyContent, err := os.ReadFile(path.Join(tmpdir, "copy"))
 	require.NoError(t, err)
 	assert.Equal(t, content, copyContent)
 }
 
 func Test_CopyDir_shouldCopyAllFilesAndDirectories(t *testing.T) {
-	t.Parallel()
 	destination := t.TempDir()
 	err := CopyDir("./testdata/copy_test", destination, true)
 	require.NoError(t, err)
 
-	assert.FileExists(t, JoinPaths(destination, "copy_test", "outer"))
-	assert.FileExists(t, JoinPaths(destination, "copy_test", "dir", ".dotfile"))
-	assert.FileExists(t, JoinPaths(destination, "copy_test", "dir", "inner"))
+	assert.FileExists(t, filepath.Join(destination, "copy_test", "outer"))
+	assert.FileExists(t, filepath.Join(destination, "copy_test", "dir", ".dotfile"))
+	assert.FileExists(t, filepath.Join(destination, "copy_test", "dir", "inner"))
 }
 
 func Test_CopyDir_shouldCopyOnlyDirContents(t *testing.T) {
-	t.Parallel()
 	destination := t.TempDir()
 	err := CopyDir("./testdata/copy_test", destination, false)
 	require.NoError(t, err)
 
-	assert.FileExists(t, JoinPaths(destination, "outer"))
-	assert.FileExists(t, JoinPaths(destination, "dir", ".dotfile"))
-	assert.FileExists(t, JoinPaths(destination, "dir", "inner"))
+	assert.FileExists(t, filepath.Join(destination, "outer"))
+	assert.FileExists(t, filepath.Join(destination, "dir", ".dotfile"))
+	assert.FileExists(t, filepath.Join(destination, "dir", "inner"))
 }
 
 func Test_CopyPath_shouldSkipWhenNotExist(t *testing.T) {
-	t.Parallel()
 	tmpdir := t.TempDir()
 	err := CopyPath("does-not-exists", tmpdir)
 	require.NoError(t, err)
@@ -63,39 +60,36 @@ func Test_CopyPath_shouldSkipWhenNotExist(t *testing.T) {
 }
 
 func Test_CopyPath_shouldCopyFile(t *testing.T) {
-	t.Parallel()
 	tmpdir := t.TempDir()
 	content := []byte("content")
 
-	err := os.WriteFile(JoinPaths(tmpdir, "file"), content, 0600)
+	err := os.WriteFile(path.Join(tmpdir, "file"), content, 0600)
 	require.NoError(t, err)
 
-	err = os.MkdirAll(JoinPaths(tmpdir, "backup"), 0700)
+	err = os.MkdirAll(path.Join(tmpdir, "backup"), 0700)
 	require.NoError(t, err)
 
-	err = CopyPath(JoinPaths(tmpdir, "file"), JoinPaths(tmpdir, "backup"))
+	err = CopyPath(path.Join(tmpdir, "file"), path.Join(tmpdir, "backup"))
 	require.NoError(t, err)
 
-	copyContent, err := os.ReadFile(JoinPaths(tmpdir, "backup", "file"))
+	copyContent, err := os.ReadFile(path.Join(tmpdir, "backup", "file"))
 	require.NoError(t, err)
 	assert.Equal(t, content, copyContent)
 }
 
 func Test_CopyPath_shouldCopyDir(t *testing.T) {
-	t.Parallel()
 	destination := t.TempDir()
 	err := CopyPath("./testdata/copy_test", destination)
 	require.NoError(t, err)
 
-	assert.FileExists(t, JoinPaths(destination, "copy_test", "outer"))
-	assert.FileExists(t, JoinPaths(destination, "copy_test", "dir", ".dotfile"))
-	assert.FileExists(t, JoinPaths(destination, "copy_test", "dir", "inner"))
+	assert.FileExists(t, filepath.Join(destination, "copy_test", "outer"))
+	assert.FileExists(t, filepath.Join(destination, "copy_test", "dir", ".dotfile"))
+	assert.FileExists(t, filepath.Join(destination, "copy_test", "dir", "inner"))
 }
 
 func TestCopyPathPanic(t *testing.T) {
-	t.Parallel()
 	dir := t.TempDir()
-	p := JoinPaths(dir, "myfile")
+	p := filepath.Join(dir, "myfile")
 
 	err := os.WriteFile(p, []byte("contents"), 0644)
 	require.NoError(t, err)

api/filesystem/filesystem.go

@@ -14,7 +14,7 @@ import (
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/logs"
 
-	"github.com/google/uuid"
+	"github.com/gofrs/uuid"
 	"github.com/rs/zerolog/log"
 	"github.com/segmentio/encoding/json"
 )
@@ -46,6 +46,8 @@ const (
 	BinaryStorePath = "bin"
 	// EdgeJobStorePath represents the subfolder where schedule files are stored.
 	EdgeJobStorePath = "edge_jobs"
+	// DockerConfigPath represents the subfolder where docker configuration is stored.
+	DockerConfigPath = "docker_config"
 	// ExtensionRegistryManagementStorePath represents the subfolder where files related to the
 	// registry management extension are stored.
 	ExtensionRegistryManagementStorePath = "extensions"
@@ -89,7 +91,7 @@ func JoinPaths(trustedRoot string, untrustedPaths ...string) string {
 		trustedRoot = "."
 	}
 
-	p := filepath.Join(trustedRoot, filepath.Join(append([]string{"/"}, untrustedPaths...)...)) //nolint:forbidigo
+	p := filepath.Join(trustedRoot, filepath.Join(append([]string{"/"}, untrustedPaths...)...))
 
 	// avoid setting a volume name from the untrusted paths
 	vnp := filepath.VolumeName(p)
@@ -133,6 +135,11 @@ func NewService(dataStorePath, fileStorePath string) (*Service, error) {
 		return nil, err
 	}
 
+	err = service.createDirectoryInStore(DockerConfigPath)
+	if err != nil {
+		return nil, err
+	}
+
 	return service, nil
 }
 
@@ -141,6 +148,11 @@ func (service *Service) GetBinaryFolder() string {
 	return JoinPaths(service.fileStorePath, BinaryStorePath)
 }
 
+// GetDockerConfigPath returns the full path to the docker config store on the filesystem
+func (service *Service) GetDockerConfigPath() string {
+	return JoinPaths(service.fileStorePath, DockerConfigPath)
+}
+
 // RemoveDirectory removes a directory on the filesystem.
 func (service *Service) RemoveDirectory(directoryPath string) error {
 	return os.RemoveAll(directoryPath)
@@ -800,7 +812,7 @@ func (service *Service) getEdgeJobTaskLogPath(edgeJobID string, taskID string) s
 
 // GetTemporaryPath returns a temp folder
 func (service *Service) GetTemporaryPath() (string, error) {
-	uid, err := uuid.NewRandom()
+	uid, err := uuid.NewV4()
 	if err != nil {
 		return "", err
 	}

api/filesystem/filesystem_fileexists_test.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"math/rand"
 	"os"
+	"path"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -11,24 +12,20 @@ import (
 )
 
 func Test_fileSystemService_FileExists_whenFileExistsShouldReturnTrue(t *testing.T) {
-	t.Parallel()
 	service := createService(t)
 	testHelperFileExists_fileExists(t, service.FileExists)
 }
 
 func Test_fileSystemService_FileExists_whenFileNotExistsShouldReturnFalse(t *testing.T) {
-	t.Parallel()
 	service := createService(t)
 	testHelperFileExists_fileNotExists(t, service.FileExists)
 }
 
 func Test_FileExists_whenFileExistsShouldReturnTrue(t *testing.T) {
-	t.Parallel()
 	testHelperFileExists_fileExists(t, FileExists)
 }
 
 func Test_FileExists_whenFileNotExistsShouldReturnFalse(t *testing.T) {
-	t.Parallel()
 	testHelperFileExists_fileNotExists(t, FileExists)
 }
 
@@ -48,7 +45,7 @@ func testHelperFileExists_fileExists(t *testing.T, checker func(path string) (bo
 }
 
 func testHelperFileExists_fileNotExists(t *testing.T, checker func(path string) (bool, error)) {
-	filePath := JoinPaths(t.TempDir(), fmt.Sprintf("%s%d", t.Name(), rand.Int()))
+	filePath := path.Join(t.TempDir(), fmt.Sprintf("%s%d", t.Name(), rand.Int()))
 
 	err := os.RemoveAll(filePath)
 	require.NoError(t, err, "RemoveAll should not fail")

api/filesystem/filesystem_linux_test.go

@@ -3,7 +3,6 @@ package filesystem
 import "testing"
 
 func TestJoinPaths(t *testing.T) {
-	t.Parallel()
 	var ts = []struct {
 		trusted   string
 		untrusted string

api/filesystem/filesystem_move_test.go

@@ -2,6 +2,7 @@ package filesystem
 
 import (
 	"os"
+	"path"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -11,7 +12,6 @@ import (
 var content = []byte("content")
 
 func Test_movePath_shouldFailIfSourceDirDoesNotExist(t *testing.T) {
-	t.Parallel()
 	sourceDir := "missing"
 	destinationDir := t.TempDir()
 	file1 := addFile(t, destinationDir, "dir", "file")
@@ -24,7 +24,6 @@ func Test_movePath_shouldFailIfSourceDirDoesNotExist(t *testing.T) {
 }
 
 func Test_movePath_shouldFailIfDestinationDirExists(t *testing.T) {
-	t.Parallel()
 	sourceDir := t.TempDir()
 	file1 := addFile(t, sourceDir, "dir", "file")
 	file2 := addFile(t, sourceDir, "file")
@@ -41,7 +40,6 @@ func Test_movePath_shouldFailIfDestinationDirExists(t *testing.T) {
 }
 
 func Test_movePath_succesIfOverwriteSetWhenDestinationDirExists(t *testing.T) {
-	t.Parallel()
 	sourceDir := t.TempDir()
 	file1 := addFile(t, sourceDir, "dir", "file")
 	file2 := addFile(t, sourceDir, "file")
@@ -58,32 +56,31 @@ func Test_movePath_succesIfOverwriteSetWhenDestinationDirExists(t *testing.T) {
 }
 
 func Test_movePath_successWhenSourceExistsAndDestinationIsMissing(t *testing.T) {
-	t.Parallel()
 	tmp := t.TempDir()
-	sourceDir := JoinPaths(tmp, "source")
+	sourceDir := path.Join(tmp, "source")
 	err := os.Mkdir(sourceDir, 0766)
 	require.NoError(t, err)
 
 	file1 := addFile(t, sourceDir, "dir", "file")
 	file2 := addFile(t, sourceDir, "file")
-	destinationDir := JoinPaths(tmp, "destination")
+	destinationDir := path.Join(tmp, "destination")
 
 	err = MoveDirectory(sourceDir, destinationDir, false)
 	require.NoError(t, err)
 	assert.NoFileExists(t, file1, "source dir contents should be moved")
 	assert.NoFileExists(t, file2, "source dir contents should be moved")
-	assertFileContent(t, JoinPaths(destinationDir, "file"))
-	assertFileContent(t, JoinPaths(destinationDir, "dir", "file"))
+	assertFileContent(t, path.Join(destinationDir, "file"))
+	assertFileContent(t, path.Join(destinationDir, "dir", "file"))
 }
 
 func addFile(t *testing.T, fileParts ...string) (filepath string) {
 	if len(fileParts) > 2 {
-		dir := JoinPaths(fileParts[0], fileParts[1:len(fileParts)-1]...)
+		dir := path.Join(fileParts[:len(fileParts)-1]...)
 		err := os.MkdirAll(dir, 0766)
 		require.NoError(t, err)
 	}
 
-	p := JoinPaths(fileParts[0], fileParts[1:]...)
+	p := path.Join(fileParts...)
 	err := os.WriteFile(p, content, 0766)
 	require.NoError(t, err)
 

api/filesystem/filesystem_test.go

@@ -2,13 +2,14 @@ package filesystem
 
 import (
 	"os"
+	"path"
 	"testing"
 
 	"github.com/stretchr/testify/require"
 )
 
 func createService(t *testing.T) *Service {
-	dataStorePath := JoinPaths(t.TempDir(), t.Name())
+	dataStorePath := path.Join(t.TempDir(), t.Name())
 
 	service, err := NewService(dataStorePath, "")
 	require.NoError(t, err, "NewService should not fail")

api/filesystem/filesystem_windows_test.go

@@ -3,7 +3,6 @@ package filesystem
 import "testing"
 
 func TestJoinPaths(t *testing.T) {
-	t.Parallel()
 	var ts = []struct {
 		trusted   string
 		untrusted string

api/filesystem/serialize_per_dev_configs_test.go

@@ -10,7 +10,6 @@ import (
 )
 
 func TestMultiFilterDirForPerDevConfigs(t *testing.T) {
-	t.Parallel()
 	f := func(dirEntries []DirEntry, configPath string, multiFilterArgs MultiFilterArgs, wantDirEntries []DirEntry) {
 		t.Helper()
 
@@ -81,7 +80,6 @@ func TestMultiFilterDirForPerDevConfigs(t *testing.T) {
 }
 
 func TestMultiFilterDirForPerDevConfigsWithDefaults(t *testing.T) {
-	t.Parallel()
 	f := func(dirEntries []DirEntry, configPath string, multiFilterArgs MultiFilterArgs, defaultFilenames []string, wantDirEntries []DirEntry) {
 		t.Helper()
 
@@ -182,7 +180,6 @@ func TestMultiFilterDirForPerDevConfigsWithDefaults(t *testing.T) {
 }
 
 func TestMultiFilterDirForPerDevConfigsEnvFiles(t *testing.T) {
-	t.Parallel()
 	f := func(dirEntries []DirEntry, configPath string, multiFilterArgs MultiFilterArgs, wantEnvFiles []string) {
 		t.Helper()
 
@@ -207,7 +204,6 @@ func TestMultiFilterDirForPerDevConfigsEnvFiles(t *testing.T) {
 }
 
 func TestIsInConfigDir(t *testing.T) {
-	t.Parallel()
 	f := func(dirEntry DirEntry, configPath string, expect bool) {
 		t.Helper()
 
@@ -227,16 +223,3 @@ func TestIsInConfigDir(t *testing.T) {
 	f(DirEntry{Name: "edgestacktest/edge-configs/standalone-edge-agent-async"}, "edgestacktest/edge-configs", true)
 	f(DirEntry{Name: "edgestacktest/edge-configs/abc.txt"}, "edgestacktest/edge-configs", true)
 }
-
-func TestShouldIncludeDir(t *testing.T) {
-	t.Parallel()
-	f := func(dirEntry DirEntry, deviceName, configPath string, expect bool) {
-		t.Helper()
-
-		actual := shouldIncludeDir(dirEntry, deviceName, configPath)
-		assert.Equal(t, expect, actual)
-	}
-
-	f(DirEntry{Name: "app/blue-app", IsFile: false}, "blue-app", "app", true)
-	f(DirEntry{Name: "app/blue-app/values.yaml", IsFile: true}, "blue-app", "app", true)
-}

api/filesystem/write_test.go

@@ -2,6 +2,7 @@ package filesystem
 
 import (
 	"os"
+	"path"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -9,9 +10,8 @@ import (
 )
 
 func Test_WriteFile_CanStoreContentInANewFile(t *testing.T) {
-	t.Parallel()
 	tmpDir := t.TempDir()
-	tmpFilePath := JoinPaths(tmpDir, "dummy")
+	tmpFilePath := path.Join(tmpDir, "dummy")
 
 	content := []byte("content")
 	err := WriteToFile(tmpFilePath, content)
@@ -22,9 +22,8 @@ func Test_WriteFile_CanStoreContentInANewFile(t *testing.T) {
 }
 
 func Test_WriteFile_CanOverwriteExistingFile(t *testing.T) {
-	t.Parallel()
 	tmpDir := t.TempDir()
-	tmpFilePath := JoinPaths(tmpDir, "dummy")
+	tmpFilePath := path.Join(tmpDir, "dummy")
 
 	err := WriteToFile(tmpFilePath, []byte("content"))
 	require.NoError(t, err)
@@ -38,9 +37,8 @@ func Test_WriteFile_CanOverwriteExistingFile(t *testing.T) {
 }
 
 func Test_WriteFile_CanWriteANestedPath(t *testing.T) {
-	t.Parallel()
 	tmpDir := t.TempDir()
-	tmpFilePath := JoinPaths(tmpDir, "dir", "sub-dir", "dummy")
+	tmpFilePath := path.Join(tmpDir, "dir", "sub-dir", "dummy")
 
 	content := []byte("content")
 	err := WriteToFile(tmpFilePath, content)

api/git/azure.go

@@ -16,9 +16,7 @@ import (
 	"github.com/portainer/portainer/api/logs"
 	"github.com/rs/zerolog/log"
 
-	"github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/plumbing/filemode"
-	githttp "github.com/go-git/go-git/v5/plumbing/transport/http"
 	"github.com/pkg/errors"
 	"github.com/segmentio/encoding/json"
 )
@@ -28,7 +26,7 @@ const (
 	visualStudioHostSuffix = ".visualstudio.com"
 )
 
-func IsAzureUrl(s string) bool {
+func isAzureUrl(s string) bool {
 	return strings.Contains(s, azureDevOpsHost) ||
 		strings.Contains(s, visualStudioHostSuffix)
 }
@@ -75,11 +73,7 @@ func newHttpClientForAzure(insecureSkipVerify bool) *http.Client {
 	return httpsCli
 }
 
-func (a *azureClient) Download(ctx context.Context, destination string, opt *git.CloneOptions) error {
-	if opt == nil {
-		return errors.New("options cannot be nil")
-	}
-
+func (a *azureClient) download(ctx context.Context, destination string, opt cloneOption) error {
 	zipFilepath, err := a.downloadZipFromAzureDevOps(ctx, opt)
 	if err != nil {
 		return errors.Wrap(err, "failed to download a zip file from Azure DevOps")
@@ -97,13 +91,13 @@ func (a *azureClient) Download(ctx context.Context, destination string, opt *git
 	return nil
 }
 
-func (a *azureClient) downloadZipFromAzureDevOps(ctx context.Context, opt *git.CloneOptions) (string, error) {
-	config, err := parseUrl(opt.URL)
+func (a *azureClient) downloadZipFromAzureDevOps(ctx context.Context, opt cloneOption) (string, error) {
+	config, err := parseUrl(opt.repositoryUrl)
 	if err != nil {
 		return "", errors.WithMessage(err, "failed to parse url")
 	}
 
-	downloadUrl, err := a.buildDownloadUrl(config, string(opt.ReferenceName))
+	downloadUrl, err := a.buildDownloadUrl(config, opt.referenceName)
 	if err != nil {
 		return "", errors.WithMessage(err, "failed to build download url")
 	}
@@ -115,18 +109,9 @@ func (a *azureClient) downloadZipFromAzureDevOps(ctx context.Context, opt *git.C
 
 	defer logs.CloseAndLogErr(zipFile)
 
-	var basicAuth *githttp.BasicAuth
-	if opt.Auth != nil {
-		var ok bool
-		basicAuth, ok = opt.Auth.(*githttp.BasicAuth)
-		if !ok {
-			return "", errors.New("only basic auth is supported for azure")
-		}
-	}
-
 	req, err := http.NewRequestWithContext(ctx, "GET", downloadUrl, nil)
-	if basicAuth != nil {
-		req.SetBasicAuth(basicAuth.Username, basicAuth.Password)
+	if opt.username != "" || opt.password != "" {
+		req.SetBasicAuth(opt.username, opt.password)
 	} else if config.username != "" || config.password != "" {
 		req.SetBasicAuth(config.username, config.password)
 	}
@@ -135,7 +120,7 @@ func (a *azureClient) downloadZipFromAzureDevOps(ctx context.Context, opt *git.C
 		return "", errors.WithMessage(err, "failed to create a new HTTP request")
 	}
 
-	client := newHttpClientForAzure(opt.InsecureSkipTLS)
+	client := newHttpClientForAzure(opt.tlsSkipVerify)
 	defer client.CloseIdleConnections()
 
 	res, err := client.Do(req)
@@ -160,12 +145,8 @@ func (a *azureClient) downloadZipFromAzureDevOps(ctx context.Context, opt *git.C
 	return zipFile.Name(), nil
 }
 
-func (a *azureClient) LatestCommitID(ctx context.Context, repositoryUrl, referenceName string, opt *git.ListOptions) (string, error) {
-	if opt == nil {
-		return "", errors.New("options cannot be nil")
-	}
-
-	rootItem, err := a.getRootItem(ctx, repositoryUrl, referenceName, opt)
+func (a *azureClient) latestCommitID(ctx context.Context, opt fetchOption) (string, error) {
+	rootItem, err := a.getRootItem(ctx, opt)
 	if err != nil {
 		return "", err
 	}
@@ -173,29 +154,20 @@ func (a *azureClient) LatestCommitID(ctx context.Context, repositoryUrl, referen
 	return rootItem.CommitId, nil
 }
 
-func (a *azureClient) getRootItem(ctx context.Context, repositoryUrl, referenceName string, opt *git.ListOptions) (*azureItem, error) {
-	config, err := parseUrl(repositoryUrl)
+func (a *azureClient) getRootItem(ctx context.Context, opt fetchOption) (*azureItem, error) {
+	config, err := parseUrl(opt.repositoryUrl)
 	if err != nil {
 		return nil, errors.WithMessage(err, "failed to parse url")
 	}
 
-	rootItemUrl, err := a.buildRootItemUrl(config, referenceName)
+	rootItemUrl, err := a.buildRootItemUrl(config, opt.referenceName)
 	if err != nil {
 		return nil, errors.WithMessage(err, "failed to build azure root item url")
 	}
 
-	var basicAuth *githttp.BasicAuth
-	if opt.Auth != nil {
-		var ok bool
-		basicAuth, ok = opt.Auth.(*githttp.BasicAuth)
-		if !ok {
-			return nil, errors.New("only basic auth is supported for azure")
-		}
-	}
-
 	req, err := http.NewRequestWithContext(ctx, "GET", rootItemUrl, nil)
-	if basicAuth != nil {
-		req.SetBasicAuth(basicAuth.Username, basicAuth.Password)
+	if opt.username != "" || opt.password != "" {
+		req.SetBasicAuth(opt.username, opt.password)
 	} else if config.username != "" || config.password != "" {
 		req.SetBasicAuth(config.username, config.password)
 	}
@@ -204,7 +176,7 @@ func (a *azureClient) getRootItem(ctx context.Context, repositoryUrl, referenceN
 		return nil, errors.WithMessage(err, "failed to create a new HTTP request")
 	}
 
-	client := newHttpClientForAzure(opt.InsecureSkipTLS)
+	client := newHttpClientForAzure(opt.tlsSkipVerify)
 	defer client.CloseIdleConnections()
 
 	resp, err := client.Do(req)
@@ -267,10 +239,8 @@ func parseSshUrl(rawUrl string) (*azureOptions, error) {
 	}, nil
 }
 
-const (
-	expectedAzureDevOpsHttpUrl  = "https://Organisation@dev.azure.com/Organisation/Project/_git/Repository"
-	expectedVisualStudioHttpUrl = "https://organisation.visualstudio.com/project/_git/repository"
-)
+const expectedAzureDevOpsHttpUrl = "https://Organisation@dev.azure.com/Organisation/Project/_git/Repository"
+const expectedVisualStudioHttpUrl = "https://organisation.visualstudio.com/project/_git/repository"
 
 func parseHttpUrl(rawUrl string) (*azureOptions, error) {
 	u, err := url.Parse(rawUrl)
@@ -313,6 +283,7 @@ func (a *azureClient) buildDownloadUrl(config *azureOptions, referenceName strin
 		url.PathEscape(config.project),
 		url.PathEscape(config.repository))
 	u, err := url.Parse(rawUrl)
+
 	if err != nil {
 		return "", errors.Wrapf(err, "failed to parse download url path %s", rawUrl)
 	}
@@ -339,6 +310,7 @@ func (a *azureClient) buildRootItemUrl(config *azureOptions, referenceName strin
 		url.PathEscape(config.project),
 		url.PathEscape(config.repository))
 	u, err := url.Parse(rawUrl)
+
 	if err != nil {
 		return "", errors.Wrapf(err, "failed to parse root item url path %s", rawUrl)
 	}
@@ -363,6 +335,7 @@ func (a *azureClient) buildRefsUrl(config *azureOptions) (string, error) {
 		url.PathEscape(config.project),
 		url.PathEscape(config.repository))
 	u, err := url.Parse(rawUrl)
+
 	if err != nil {
 		return "", errors.Wrapf(err, "failed to parse list refs url path %s", rawUrl)
 	}
@@ -384,6 +357,7 @@ func (a *azureClient) buildTreeUrl(config *azureOptions, rootObjectHash string)
 		url.PathEscape(rootObjectHash),
 	)
 	u, err := url.Parse(rawUrl)
+
 	if err != nil {
 		return "", errors.Wrapf(err, "failed to parse list tree url path %s", rawUrl)
 	}
@@ -426,12 +400,8 @@ func getVersionType(name string) string {
 	return "commit"
 }
 
-func (a *azureClient) ListRefs(ctx context.Context, repositoryUrl string, opt *git.ListOptions) ([]string, error) {
-	if opt == nil {
-		return nil, errors.New("options cannot be nil")
-	}
-
-	config, err := parseUrl(repositoryUrl)
+func (a *azureClient) listRefs(ctx context.Context, opt baseOption) ([]string, error) {
+	config, err := parseUrl(opt.repositoryUrl)
 	if err != nil {
 		return nil, errors.WithMessage(err, "failed to parse url")
 	}
@@ -441,18 +411,9 @@ func (a *azureClient) ListRefs(ctx context.Context, repositoryUrl string, opt *g
 		return nil, errors.WithMessage(err, "failed to build list refs url")
 	}
 
-	var basicAuth *githttp.BasicAuth
-	if opt.Auth != nil {
-		var ok bool
-		basicAuth, ok = opt.Auth.(*githttp.BasicAuth)
-		if !ok {
-			return nil, errors.New("only basic auth is supported for azure")
-		}
-	}
-
 	req, err := http.NewRequestWithContext(ctx, "GET", listRefsUrl, nil)
-	if basicAuth != nil {
-		req.SetBasicAuth(basicAuth.Username, basicAuth.Password)
+	if opt.username != "" || opt.password != "" {
+		req.SetBasicAuth(opt.username, opt.password)
 	} else if config.username != "" || config.password != "" {
 		req.SetBasicAuth(config.username, config.password)
 	}
@@ -461,7 +422,7 @@ func (a *azureClient) ListRefs(ctx context.Context, repositoryUrl string, opt *g
 		return nil, errors.WithMessage(err, "failed to create a new HTTP request")
 	}
 
-	client := newHttpClientForAzure(opt.InsecureSkipTLS)
+	client := newHttpClientForAzure(opt.tlsSkipVerify)
 	defer client.CloseIdleConnections()
 
 	resp, err := client.Do(req)
@@ -498,21 +459,13 @@ func (a *azureClient) ListRefs(ctx context.Context, repositoryUrl string, opt *g
 }
 
 // listFiles list all filenames under the specific repository
-func (a *azureClient) ListFiles(ctx context.Context, dirOnly bool, opt *git.CloneOptions) ([]string, error) {
-	if opt == nil {
-		return nil, errors.New("options cannot be nil")
-	}
-
-	listOptions := &git.ListOptions{
-		Auth:            opt.Auth,
-		InsecureSkipTLS: opt.InsecureSkipTLS,
-	}
-	rootItem, err := a.getRootItem(ctx, opt.URL, string(opt.ReferenceName), listOptions)
+func (a *azureClient) listFiles(ctx context.Context, opt fetchOption) ([]string, error) {
+	rootItem, err := a.getRootItem(ctx, opt)
 	if err != nil {
 		return nil, err
 	}
 
-	config, err := parseUrl(opt.URL)
+	config, err := parseUrl(opt.repositoryUrl)
 	if err != nil {
 		return nil, errors.WithMessage(err, "failed to parse url")
 	}
@@ -522,18 +475,9 @@ func (a *azureClient) ListFiles(ctx context.Context, dirOnly bool, opt *git.Clon
 		return nil, errors.WithMessage(err, "failed to build list tree url")
 	}
 
-	var basicAuth *githttp.BasicAuth
-	if opt.Auth != nil {
-		var ok bool
-		basicAuth, ok = opt.Auth.(*githttp.BasicAuth)
-		if !ok {
-			return nil, errors.New("only basic auth is supported for azure")
-		}
-	}
-
 	req, err := http.NewRequestWithContext(ctx, "GET", listTreeUrl, nil)
-	if basicAuth != nil {
-		req.SetBasicAuth(basicAuth.Username, basicAuth.Password)
+	if opt.username != "" || opt.password != "" {
+		req.SetBasicAuth(opt.username, opt.password)
 	} else if config.username != "" || config.password != "" {
 		req.SetBasicAuth(config.username, config.password)
 	}
@@ -542,7 +486,7 @@ func (a *azureClient) ListFiles(ctx context.Context, dirOnly bool, opt *git.Clon
 		return nil, errors.WithMessage(err, "failed to create a new HTTP request")
 	}
 
-	client := newHttpClientForAzure(opt.InsecureSkipTLS)
+	client := newHttpClientForAzure(opt.tlsSkipVerify)
 	defer client.CloseIdleConnections()
 
 	resp, err := client.Do(req)
@@ -574,7 +518,7 @@ func (a *azureClient) ListFiles(ctx context.Context, dirOnly bool, opt *git.Clon
 	for _, treeEntry := range tree.TreeEntries {
 		mode, _ := filemode.New(treeEntry.Mode)
 		isDir := filemode.Dir == mode
-		if dirOnly == isDir {
+		if opt.dirOnly == isDir {
 			allPaths = append(allPaths, treeEntry.RelativePath)
 		}
 	}

api/git/azure_integration_test.go

@@ -1,12 +1,13 @@
 package git
 
 import (
+	"context"
 	"fmt"
 	"os"
+	"path/filepath"
 	"testing"
 	"time"
 
-	"github.com/portainer/portainer/api/filesystem"
 	gittypes "github.com/portainer/portainer/api/git/types"
 
 	_ "github.com/joho/godotenv/autoload"
@@ -17,11 +18,10 @@ import (
 const privateAzureRepoURL = "https://portainer.visualstudio.com/gitops-test/_git/gitops-test"
 
 func TestService_ClonePublicRepository_Azure(t *testing.T) {
-	t.Parallel()
 	ensureIntegrationTest(t)
 
 	pat := getRequiredValue(t, "AZURE_DEVOPS_PAT")
-	service := NewService(t.Context())
+	service := NewService(context.TODO())
 
 	type args struct {
 		repositoryURLFormat string
@@ -60,55 +60,53 @@ func TestService_ClonePublicRepository_Azure(t *testing.T) {
 			dst := t.TempDir()
 			repositoryUrl := fmt.Sprintf(tt.args.repositoryURLFormat, tt.args.password)
 			err := service.CloneRepository(
-				t.Context(),
 				dst,
 				repositoryUrl,
 				tt.args.referenceName,
 				"",
 				"",
+				gittypes.GitCredentialAuthType_Basic,
 				false,
 			)
 			require.NoError(t, err)
-			assert.FileExists(t, filesystem.JoinPaths(dst, "README.md"))
+			assert.FileExists(t, filepath.Join(dst, "README.md"))
 		})
 	}
 }
 
 func TestService_ClonePrivateRepository_Azure(t *testing.T) {
-	t.Parallel()
 	ensureIntegrationTest(t)
 
 	pat := getRequiredValue(t, "AZURE_DEVOPS_PAT")
-	service := NewService(t.Context())
+	service := NewService(context.TODO())
 
 	dst := t.TempDir()
 
 	err := service.CloneRepository(
-		t.Context(),
 		dst,
 		privateAzureRepoURL,
 		"refs/heads/main",
 		"",
 		pat,
+		gittypes.GitCredentialAuthType_Basic,
 		false,
 	)
 	require.NoError(t, err)
-	assert.FileExists(t, filesystem.JoinPaths(dst, "README.md"))
+	assert.FileExists(t, filepath.Join(dst, "README.md"))
 }
 
 func TestService_LatestCommitID_Azure(t *testing.T) {
-	t.Parallel()
 	ensureIntegrationTest(t)
 
 	pat := getRequiredValue(t, "AZURE_DEVOPS_PAT")
-	service := NewService(t.Context())
+	service := NewService(context.TODO())
 
 	id, err := service.LatestCommitID(
-		t.Context(),
 		privateAzureRepoURL,
 		"refs/heads/main",
 		"",
 		pat,
+		gittypes.GitCredentialAuthType_Basic,
 		false,
 	)
 	require.NoError(t, err)
@@ -116,18 +114,17 @@ func TestService_LatestCommitID_Azure(t *testing.T) {
 }
 
 func TestService_ListRefs_Azure(t *testing.T) {
-	t.Parallel()
 	ensureIntegrationTest(t)
 
 	accessToken := getRequiredValue(t, "AZURE_DEVOPS_PAT")
 	username := getRequiredValue(t, "AZURE_DEVOPS_USERNAME")
-	service := NewService(t.Context())
+	service := NewService(context.TODO())
 
 	refs, err := service.ListRefs(
-		t.Context(),
 		privateAzureRepoURL,
 		username,
 		accessToken,
+		gittypes.GitCredentialAuthType_Basic,
 		false,
 		false,
 	)
@@ -136,59 +133,52 @@ func TestService_ListRefs_Azure(t *testing.T) {
 }
 
 func TestService_ListRefs_Azure_Concurrently(t *testing.T) {
-	t.Parallel()
 	ensureIntegrationTest(t)
 
 	accessToken := getRequiredValue(t, "AZURE_DEVOPS_PAT")
 	username := getRequiredValue(t, "AZURE_DEVOPS_USERNAME")
-	service := newService(t.Context(), repositoryCacheSize, 200*time.Millisecond)
+	service := newService(context.TODO(), repositoryCacheSize, 200*time.Millisecond)
 
 	go func() {
-		_, _ = service.ListRefs(t.Context(), privateAzureRepoURL, username, accessToken, false, false)
+		_, _ = service.ListRefs(privateAzureRepoURL, username, accessToken, gittypes.GitCredentialAuthType_Basic, false, false)
 	}()
 
-	_, err := service.ListRefs(t.Context(), privateAzureRepoURL, username, accessToken, false, false)
+	_, err := service.ListRefs(privateAzureRepoURL, username, accessToken, gittypes.GitCredentialAuthType_Basic, false, false)
 	require.NoError(t, err)
 
 	time.Sleep(2 * time.Second)
 }
 
 func TestService_ListFiles_Azure(t *testing.T) {
-	t.Parallel()
 	ensureIntegrationTest(t)
 
-	type args struct {
-		repositoryUrl string
-		referenceName string
-		username      string
-		password      string
-		extensions    []string
-	}
-
 	type expectResult struct {
 		shouldFail   bool
 		err          error
 		matchedCount int
 	}
 
-	service := newService(t.Context(), 0, 0)
+	service := newService(context.TODO(), 0, 0)
 	accessToken := getRequiredValue(t, "AZURE_DEVOPS_PAT")
 	username := getRequiredValue(t, "AZURE_DEVOPS_USERNAME")
 
 	tests := []struct {
-		name   string
-		args   args
-		expect expectResult
+		name       string
+		args       fetchOption
+		extensions []string
+		expect     expectResult
 	}{
 		{
 			name: "list tree with real repository and head ref but incorrect credential",
-			args: args{
-				repositoryUrl: privateAzureRepoURL,
+			args: fetchOption{
+				baseOption: baseOption{
+					repositoryUrl: privateAzureRepoURL,
+					username:      "test-username",
+					password:      "test-token",
+				},
 				referenceName: "refs/heads/main",
-				username:      "test-username",
-				password:      "test-token",
-				extensions:    []string{},
 			},
+			extensions: []string{},
 			expect: expectResult{
 				shouldFail: true,
 				err:        gittypes.ErrAuthenticationFailure,
@@ -196,13 +186,15 @@ func TestService_ListFiles_Azure(t *testing.T) {
 		},
 		{
 			name: "list tree with real repository and head ref but no credential",
-			args: args{
-				repositoryUrl: privateAzureRepoURL,
+			args: fetchOption{
+				baseOption: baseOption{
+					repositoryUrl: privateAzureRepoURL,
+					username:      "",
+					password:      "",
+				},
 				referenceName: "refs/heads/main",
-				username:      "",
-				password:      "",
-				extensions:    []string{},
 			},
+			extensions: []string{},
 			expect: expectResult{
 				shouldFail: true,
 				err:        gittypes.ErrAuthenticationFailure,
@@ -210,13 +202,15 @@ func TestService_ListFiles_Azure(t *testing.T) {
 		},
 		{
 			name: "list tree with real repository and head ref",
-			args: args{
-				repositoryUrl: privateAzureRepoURL,
+			args: fetchOption{
+				baseOption: baseOption{
+					repositoryUrl: privateAzureRepoURL,
+					username:      username,
+					password:      accessToken,
+				},
 				referenceName: "refs/heads/main",
-				username:      username,
-				password:      accessToken,
-				extensions:    []string{},
 			},
+			extensions: []string{},
 			expect: expectResult{
 				err:          nil,
 				matchedCount: 19,
@@ -224,13 +218,15 @@ func TestService_ListFiles_Azure(t *testing.T) {
 		},
 		{
 			name: "list tree with real repository and head ref and existing file extension",
-			args: args{
-				repositoryUrl: privateAzureRepoURL,
+			args: fetchOption{
+				baseOption: baseOption{
+					repositoryUrl: privateAzureRepoURL,
+					username:      username,
+					password:      accessToken,
+				},
 				referenceName: "refs/heads/main",
-				username:      username,
-				password:      accessToken,
-				extensions:    []string{"yml"},
 			},
+			extensions: []string{"yml"},
 			expect: expectResult{
 				err:          nil,
 				matchedCount: 2,
@@ -238,13 +234,15 @@ func TestService_ListFiles_Azure(t *testing.T) {
 		},
 		{
 			name: "list tree with real repository and head ref and non-existing file extension",
-			args: args{
-				repositoryUrl: privateAzureRepoURL,
+			args: fetchOption{
+				baseOption: baseOption{
+					repositoryUrl: privateAzureRepoURL,
+					username:      username,
+					password:      accessToken,
+				},
 				referenceName: "refs/heads/main",
-				username:      username,
-				password:      accessToken,
-				extensions:    []string{"hcl"},
 			},
+			extensions: []string{"hcl"},
 			expect: expectResult{
 				err:          nil,
 				matchedCount: 2,
@@ -252,26 +250,30 @@ func TestService_ListFiles_Azure(t *testing.T) {
 		},
 		{
 			name: "list tree with real repository but non-existing ref",
-			args: args{
-				repositoryUrl: privateAzureRepoURL,
+			args: fetchOption{
+				baseOption: baseOption{
+					repositoryUrl: privateAzureRepoURL,
+					username:      username,
+					password:      accessToken,
+				},
 				referenceName: "refs/fake/feature",
-				username:      username,
-				password:      accessToken,
-				extensions:    []string{},
 			},
+			extensions: []string{},
 			expect: expectResult{
 				shouldFail: true,
 			},
 		},
 		{
 			name: "list tree with fake repository ",
-			args: args{
-				repositoryUrl: privateAzureRepoURL + "fake",
+			args: fetchOption{
+				baseOption: baseOption{
+					repositoryUrl: privateAzureRepoURL + "fake",
+					username:      username,
+					password:      accessToken,
+				},
 				referenceName: "refs/fake/feature",
-				username:      username,
-				password:      accessToken,
-				extensions:    []string{},
 			},
+			extensions: []string{},
 			expect: expectResult{
 				shouldFail: true,
 				err:        gittypes.ErrIncorrectRepositoryURL,
@@ -282,14 +284,14 @@ func TestService_ListFiles_Azure(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			paths, err := service.ListFiles(
-				t.Context(),
 				tt.args.repositoryUrl,
 				tt.args.referenceName,
 				tt.args.username,
 				tt.args.password,
+				gittypes.GitCredentialAuthType_Basic,
 				false,
 				false,
-				tt.args.extensions,
+				tt.extensions,
 				false,
 			)
 
@@ -309,20 +311,19 @@ func TestService_ListFiles_Azure(t *testing.T) {
 }
 
 func TestService_ListFiles_Azure_Concurrently(t *testing.T) {
-	t.Parallel()
 	ensureIntegrationTest(t)
 
 	accessToken := getRequiredValue(t, "AZURE_DEVOPS_PAT")
 	username := getRequiredValue(t, "AZURE_DEVOPS_USERNAME")
-	service := newService(t.Context(), repositoryCacheSize, 200*time.Millisecond)
+	service := newService(context.TODO(), repositoryCacheSize, 200*time.Millisecond)
 
 	go func() {
 		_, _ = service.ListFiles(
-			t.Context(),
 			privateAzureRepoURL,
 			"refs/heads/main",
 			username,
 			accessToken,
+			gittypes.GitCredentialAuthType_Basic,
 			false,
 			false,
 			[]string{},
@@ -331,11 +332,11 @@ func TestService_ListFiles_Azure_Concurrently(t *testing.T) {
 	}()
 
 	_, err := service.ListFiles(
-		t.Context(),
 		privateAzureRepoURL,
 		"refs/heads/main",
 		username,
 		accessToken,
+		gittypes.GitCredentialAuthType_Basic,
 		false,
 		false,
 		[]string{},

api/git/azure_test.go

@@ -7,9 +7,6 @@ import (
 	"net/url"
 	"testing"
 
-	"github.com/go-git/go-git/v5"
-	"github.com/go-git/go-git/v5/plumbing"
-	githttp "github.com/go-git/go-git/v5/plumbing/transport/http"
 	gittypes "github.com/portainer/portainer/api/git/types"
 	"github.com/portainer/portainer/pkg/fips"
 
@@ -18,7 +15,6 @@ import (
 )
 
 func Test_buildDownloadUrl(t *testing.T) {
-	t.Parallel()
 	a := NewAzureClient()
 	u, err := a.buildDownloadUrl(&azureOptions{
 		organisation: "organisation",
@@ -40,7 +36,6 @@ func Test_buildDownloadUrl(t *testing.T) {
 }
 
 func Test_buildRootItemUrl(t *testing.T) {
-	t.Parallel()
 	a := NewAzureClient()
 	u, err := a.buildRootItemUrl(&azureOptions{
 		organisation: "organisation",
@@ -58,7 +53,6 @@ func Test_buildRootItemUrl(t *testing.T) {
 }
 
 func Test_buildRefsUrl(t *testing.T) {
-	t.Parallel()
 	a := NewAzureClient()
 	u, err := a.buildRefsUrl(&azureOptions{
 		organisation: "organisation",
@@ -76,7 +70,6 @@ func Test_buildRefsUrl(t *testing.T) {
 }
 
 func Test_buildTreeUrl(t *testing.T) {
-	t.Parallel()
 	a := NewAzureClient()
 	u, err := a.buildTreeUrl(&azureOptions{
 		organisation: "organisation",
@@ -94,7 +87,6 @@ func Test_buildTreeUrl(t *testing.T) {
 }
 
 func Test_parseAzureUrl(t *testing.T) {
-	t.Parallel()
 	type args struct {
 		url string
 	}
@@ -210,7 +202,6 @@ func Test_parseAzureUrl(t *testing.T) {
 }
 
 func Test_isAzureUrl(t *testing.T) {
-	t.Parallel()
 	type args struct {
 		s string
 	}
@@ -243,19 +234,16 @@ func Test_isAzureUrl(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, IsAzureUrl(tt.args.s))
+			assert.Equal(t, tt.want, isAzureUrl(tt.args.s))
 		})
 	}
 }
 
 func Test_azureDownloader_downloadZipFromAzureDevOps(t *testing.T) {
-	t.Parallel()
 	fips.InitFIPS(false)
 
 	type args struct {
-		repositoryUrl string
-		username      string
-		password      string
+		options baseOption
 	}
 	type basicAuth struct {
 		username, password string
@@ -268,7 +256,9 @@ func Test_azureDownloader_downloadZipFromAzureDevOps(t *testing.T) {
 		{
 			name: "username, password embedded",
 			args: args{
-				repositoryUrl: "https://username:password@dev.azure.com/Organisation/Project/_git/Repository",
+				options: baseOption{
+					repositoryUrl: "https://username:password@dev.azure.com/Organisation/Project/_git/Repository",
+				},
 			},
 			want: &basicAuth{
 				username: "username",
@@ -278,9 +268,11 @@ func Test_azureDownloader_downloadZipFromAzureDevOps(t *testing.T) {
 		{
 			name: "username, password embedded, clone options take precedence",
 			args: args{
-				repositoryUrl: "https://username:password@dev.azure.com/Organisation/Project/_git/Repository",
-				username:      "u",
-				password:      "p",
+				options: baseOption{
+					repositoryUrl: "https://username:password@dev.azure.com/Organisation/Project/_git/Repository",
+					username:      "u",
+					password:      "p",
+				},
 			},
 			want: &basicAuth{
 				username: "u",
@@ -290,7 +282,9 @@ func Test_azureDownloader_downloadZipFromAzureDevOps(t *testing.T) {
 		{
 			name: "no credentials",
 			args: args{
-				repositoryUrl: "https://dev.azure.com/Organisation/Project/_git/Repository",
+				options: baseOption{
+					repositoryUrl: "https://dev.azure.com/Organisation/Project/_git/Repository",
+				},
 			},
 		},
 	}
@@ -309,16 +303,12 @@ func Test_azureDownloader_downloadZipFromAzureDevOps(t *testing.T) {
 				baseUrl: server.URL,
 			}
 
-			option := &git.CloneOptions{
-				URL: tt.args.repositoryUrl,
+			option := cloneOption{
+				fetchOption: fetchOption{
+					baseOption: tt.args.options,
+				},
 			}
-			if tt.args.username != "" || tt.args.password != "" {
-				option.Auth = &githttp.BasicAuth{
-					Username: tt.args.username,
-					Password: tt.args.password,
-				}
-			}
-			_, err := a.downloadZipFromAzureDevOps(t.Context(), option)
+			_, err := a.downloadZipFromAzureDevOps(context.Background(), option)
 			require.Error(t, err)
 			assert.Equal(t, tt.want, zipRequestAuth)
 		})
@@ -326,7 +316,6 @@ func Test_azureDownloader_downloadZipFromAzureDevOps(t *testing.T) {
 }
 
 func Test_azureDownloader_latestCommitID(t *testing.T) {
-	t.Parallel()
 	fips.InitFIPS(false)
 
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -351,21 +340,18 @@ func Test_azureDownloader_latestCommitID(t *testing.T) {
 
 	a := &azureClient{baseUrl: server.URL}
 
-	type args struct {
-		repositoryUrl string
-		referenceName string
-	}
-
 	tests := []struct {
 		name    string
-		args    args
+		args    fetchOption
 		want    string
 		wantErr bool
 	}{
 		{
 			name: "should be able to parse response",
-			args: args{
-				repositoryUrl: "https://dev.azure.com/Organisation/Project/_git/Repository",
+			args: fetchOption{
+				baseOption: baseOption{
+					repositoryUrl: "https://dev.azure.com/Organisation/Project/_git/Repository",
+				},
 				referenceName: "",
 			},
 			want:    "27104ad7549d9e66685e115a497533f18024be9c",
@@ -375,7 +361,7 @@ func Test_azureDownloader_latestCommitID(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			id, err := a.LatestCommitID(t.Context(), tt.args.repositoryUrl, tt.args.referenceName, &git.ListOptions{})
+			id, err := a.latestCommitID(context.Background(), tt.args)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("azureDownloader.latestCommitID() error = %v, wantErr %v", err, tt.wantErr)
 				return
@@ -389,25 +375,23 @@ type testRepoManager struct {
 	called bool
 }
 
-func (t *testRepoManager) Download(_ context.Context, _ string, _ *git.CloneOptions) error {
+func (t *testRepoManager) download(_ context.Context, _ string, _ cloneOption) error {
 	t.called = true
 	return nil
 }
 
-func (t *testRepoManager) LatestCommitID(_ context.Context, _, _ string, _ *git.ListOptions) (string, error) {
+func (t *testRepoManager) latestCommitID(_ context.Context, _ fetchOption) (string, error) {
 	return "", nil
 }
 
-func (t *testRepoManager) ListRefs(_ context.Context, _ string, _ *git.ListOptions) ([]string, error) {
+func (t *testRepoManager) listRefs(_ context.Context, _ baseOption) ([]string, error) {
 	return nil, nil
 }
 
-func (t *testRepoManager) ListFiles(_ context.Context, _ bool, _ *git.CloneOptions) ([]string, error) {
+func (t *testRepoManager) listFiles(_ context.Context, _ fetchOption) ([]string, error) {
 	return nil, nil
 }
-
 func Test_cloneRepository_azure(t *testing.T) {
-	t.Parallel()
 	tests := []struct {
 		name   string
 		url    string
@@ -436,7 +420,15 @@ func Test_cloneRepository_azure(t *testing.T) {
 			git := &testRepoManager{}
 
 			s := &Service{azure: azure, git: git}
-			err := s.CloneRepository(t.Context(), "", tt.url, "", "", "", false)
+			err := s.cloneRepository("", cloneOption{
+				fetchOption: fetchOption{
+					baseOption: baseOption{
+
+						repositoryUrl: tt.url,
+					},
+				},
+				depth: 1,
+			})
 			require.NoError(t, err)
 
 			// if azure API is called, git isn't and vice versa
@@ -447,17 +439,10 @@ func Test_cloneRepository_azure(t *testing.T) {
 }
 
 func Test_listRefs_azure(t *testing.T) {
-	t.Parallel()
 	ensureIntegrationTest(t)
 
 	client := NewAzureClient()
 
-	type args struct {
-		repositoryUrl string
-		username      string
-		password      string
-	}
-
 	type expectResult struct {
 		err       error
 		refsCount int
@@ -468,12 +453,12 @@ func Test_listRefs_azure(t *testing.T) {
 
 	tests := []struct {
 		name   string
-		args   args
+		args   baseOption
 		expect expectResult
 	}{
 		{
 			name: "list refs of a real repository",
-			args: args{
+			args: baseOption{
 				repositoryUrl: privateAzureRepoURL,
 				username:      username,
 				password:      accessToken,
@@ -485,7 +470,7 @@ func Test_listRefs_azure(t *testing.T) {
 		},
 		{
 			name: "list refs of a real repository with incorrect credential",
-			args: args{
+			args: baseOption{
 				repositoryUrl: privateAzureRepoURL,
 				username:      "test-username",
 				password:      "test-token",
@@ -496,7 +481,7 @@ func Test_listRefs_azure(t *testing.T) {
 		},
 		{
 			name: "list refs of a real repository without providing credential",
-			args: args{
+			args: baseOption{
 				repositoryUrl: privateAzureRepoURL,
 				username:      "",
 				password:      "",
@@ -507,7 +492,7 @@ func Test_listRefs_azure(t *testing.T) {
 		},
 		{
 			name: "list refs of a fake repository",
-			args: args{
+			args: baseOption{
 				repositoryUrl: privateAzureRepoURL + "fake",
 				username:      username,
 				password:      accessToken,
@@ -520,14 +505,7 @@ func Test_listRefs_azure(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			option := &git.ListOptions{}
-			if tt.args.username != "" || tt.args.password != "" {
-				option.Auth = &githttp.BasicAuth{
-					Username: tt.args.username,
-					Password: tt.args.password,
-				}
-			}
-			refs, err := client.ListRefs(t.Context(), tt.args.repositoryUrl, option)
+			refs, err := client.listRefs(context.TODO(), tt.args)
 			if tt.expect.err == nil {
 				require.NoError(t, err)
 				if tt.expect.refsCount > 0 {
@@ -539,21 +517,14 @@ func Test_listRefs_azure(t *testing.T) {
 			}
 		})
 	}
+
 }
 
 func Test_listFiles_azure(t *testing.T) {
-	t.Parallel()
 	ensureIntegrationTest(t)
 
 	client := NewAzureClient()
 
-	type args struct {
-		repositoryUrl string
-		referenceName string
-		username      string
-		password      string
-	}
-
 	type expectResult struct {
 		shouldFail   bool
 		err          error
@@ -564,16 +535,18 @@ func Test_listFiles_azure(t *testing.T) {
 	username := getRequiredValue(t, "AZURE_DEVOPS_USERNAME")
 	tests := []struct {
 		name   string
-		args   args
+		args   fetchOption
 		expect expectResult
 	}{
 		{
 			name: "list tree with real repository and head ref but incorrect credential",
-			args: args{
-				repositoryUrl: privateAzureRepoURL,
+			args: fetchOption{
+				baseOption: baseOption{
+					repositoryUrl: privateAzureRepoURL,
+					username:      "test-username",
+					password:      "test-token",
+				},
 				referenceName: "refs/heads/main",
-				username:      "test-username",
-				password:      "test-token",
 			},
 			expect: expectResult{
 				shouldFail: true,
@@ -582,11 +555,13 @@ func Test_listFiles_azure(t *testing.T) {
 		},
 		{
 			name: "list tree with real repository and head ref but no credential",
-			args: args{
-				repositoryUrl: privateAzureRepoURL,
+			args: fetchOption{
+				baseOption: baseOption{
+					repositoryUrl: privateAzureRepoURL,
+					username:      "",
+					password:      "",
+				},
 				referenceName: "refs/heads/main",
-				username:      "",
-				password:      "",
 			},
 			expect: expectResult{
 				shouldFail: true,
@@ -595,11 +570,13 @@ func Test_listFiles_azure(t *testing.T) {
 		},
 		{
 			name: "list tree with real repository and head ref",
-			args: args{
-				repositoryUrl: privateAzureRepoURL,
+			args: fetchOption{
+				baseOption: baseOption{
+					repositoryUrl: privateAzureRepoURL,
+					username:      username,
+					password:      accessToken,
+				},
 				referenceName: "refs/heads/main",
-				username:      username,
-				password:      accessToken,
 			},
 			expect: expectResult{
 				err:          nil,
@@ -608,11 +585,13 @@ func Test_listFiles_azure(t *testing.T) {
 		},
 		{
 			name: "list tree with real repository but non-existing ref",
-			args: args{
-				repositoryUrl: privateAzureRepoURL,
+			args: fetchOption{
+				baseOption: baseOption{
+					repositoryUrl: privateAzureRepoURL,
+					username:      username,
+					password:      accessToken,
+				},
 				referenceName: "refs/fake/feature",
-				username:      username,
-				password:      accessToken,
 			},
 			expect: expectResult{
 				shouldFail: true,
@@ -620,11 +599,13 @@ func Test_listFiles_azure(t *testing.T) {
 		},
 		{
 			name: "list tree with fake repository ",
-			args: args{
-				repositoryUrl: privateAzureRepoURL + "fake",
+			args: fetchOption{
+				baseOption: baseOption{
+					repositoryUrl: privateAzureRepoURL + "fake",
+					username:      username,
+					password:      accessToken,
+				},
 				referenceName: "refs/fake/feature",
-				username:      username,
-				password:      accessToken,
 			},
 			expect: expectResult{
 				shouldFail: true,
@@ -635,17 +616,7 @@ func Test_listFiles_azure(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			option := &git.CloneOptions{
-				URL:           tt.args.repositoryUrl,
-				ReferenceName: plumbing.ReferenceName(tt.args.referenceName),
-			}
-			if tt.args.username != "" || tt.args.password != "" {
-				option.Auth = &githttp.BasicAuth{
-					Username: tt.args.username,
-					Password: tt.args.password,
-				}
-			}
-			paths, err := client.ListFiles(t.Context(), false, option)
+			paths, err := client.listFiles(context.TODO(), tt.args)
 			if tt.expect.shouldFail {
 				require.Error(t, err)
 				if tt.expect.err != nil {