fix(ui): update server installation timeout redirect link [BE-13124] (#2993)

Co-authored-by: Claude <noreply@anthropic.com>

.eslintrc.yml

@@ -114,6 +114,9 @@ overrides:
       '@typescript-eslint/explicit-module-boundary-types': off
       '@typescript-eslint/no-unused-vars': 'error'
       '@typescript-eslint/no-explicit-any': 'error'
+      '@typescript-eslint/switch-exhaustiveness-check': 'error'
+      'consistent-return': 'off'
+      'default-case': off
       'jsx-a11y/label-has-associated-control':
         - error
         - assert: either

.storybook/main.ts

@@ -1,6 +1,7 @@
+import path from 'path';
+
 import { StorybookConfig } from '@storybook/react-webpack5';
 
-import TsconfigPathsPlugin from 'tsconfig-paths-webpack-plugin';
 import { Configuration } from 'webpack';
 import postcss from 'postcss';
 
@@ -85,12 +86,7 @@ const config: StorybookConfig = {
       ...config,
       resolve: {
         ...config.resolve,
-        plugins: [
-          ...(config.resolve?.plugins || []),
-          new TsconfigPathsPlugin({
-            extensions: config.resolve?.extensions,
-          }),
-        ],
+        tsconfig: path.resolve(__dirname, '..', 'tsconfig.json'),
       },
       module: {
         ...config.module,
@@ -101,11 +97,17 @@ const config: StorybookConfig = {
   staticDirs: ['./public'],
   typescript: {
     reactDocgen: 'react-docgen-typescript',
+    reactDocgenTypescriptOptions: {
+      compilerOptions: {
+        outDir: path.resolve(__dirname, '..', 'dist/public'),
+      },
+    },
   },
   framework: {
     name: '@storybook/react-webpack5',
     options: {},
   },
+  docs: {},
 };
 
 export default config;

CLAUDE.md

@@ -11,7 +11,7 @@ see also:
 ## Package Manager
 
 - **PNPM** 10+ (for frontend)
-- **Go** 1.25.7 (for backend)
+- **Go** 1.25.8 (for backend)
 
 ## Build Commands
 
@@ -27,9 +27,13 @@ make dev                # Run both in dev mode
 make dev-client         # Start webpack-dev-server (port 8999)
 make dev-server         # Run containerized Go server
 
-pnpm run dev            # Webpack dev server
-pnpm run build          # Build frontend with webpack
-pnpm run test           # Run frontend tests
+# Frontend
+pnpm dev            # Webpack dev server
+pnpm build          # Build frontend with webpack
+pnpm typecheck      # Run typecheck for frontend (with tsc)
+pnpm lint           # lint frontend (with eslint)
+pnpm test           # test frontend (with vitest)
+pnpm format         # format frontend (with prettier)
 
 # Testing
 make test               # All tests (backend + frontend)

Makefile

@@ -4,7 +4,8 @@ WEBPACK_CONFIG=webpack/webpack.$(ENV).js
 TAG=local
 
 SWAG=go run github.com/swaggo/swag/cmd/swag@v1.16.2
-GOTESTSUM=go run gotest.tools/gotestsum@latest
+GOTESTSUM_VERSION?=v1.13.0
+GOTESTSUM=go run gotest.tools/gotestsum@$(GOTESTSUM_VERSION)
 
 # Don't change anything below this line unless you know what you're doing
 .DEFAULT_GOAL := help
@@ -57,8 +58,10 @@ test: test-server test-client ## Run all tests
 test-client: ## Run client tests
 	pnpm run test $(ARGS) --coverage
 
+TEST_PACKAGES?=./...
+
 test-server:	## Run server tests
-	$(GOTESTSUM) --format pkgname-and-test-fails --format-hide-empty-pkg --hide-summary skipped -- -cover -covermode=atomic -coverprofile=coverage.out ./...
+	$(GOTESTSUM) --format pkgname-and-test-fails --format-hide-empty-pkg --hide-summary skipped -- -cover -covermode=atomic -coverprofile=coverage.out $(TEST_PACKAGES)
 
 ##@ Dev
 .PHONY: dev dev-client dev-server

api/aws/ecr/authorization_token.go

@@ -8,8 +8,8 @@ import (
 	"time"
 )
 
-func (s *Service) GetEncodedAuthorizationToken() (token *string, expiry *time.Time, err error) {
-	getAuthorizationTokenOutput, err := s.client.GetAuthorizationToken(context.TODO(), nil)
+func (s *Service) GetEncodedAuthorizationToken(ctx context.Context) (token *string, expiry *time.Time, err error) {
+	getAuthorizationTokenOutput, err := s.client.GetAuthorizationToken(ctx, nil)
 	if err != nil {
 		return
 	}
@@ -27,8 +27,8 @@ func (s *Service) GetEncodedAuthorizationToken() (token *string, expiry *time.Ti
 	return
 }
 
-func (s *Service) GetAuthorizationToken() (token *string, expiry *time.Time, err error) {
-	tokenEncodedStr, expiry, err := s.GetEncodedAuthorizationToken()
+func (s *Service) GetAuthorizationToken(ctx context.Context) (token *string, expiry *time.Time, err error) {
+	tokenEncodedStr, expiry, err := s.GetEncodedAuthorizationToken(ctx)
 	if err != nil {
 		return
 	}

api/chisel/service.go

@@ -252,8 +252,9 @@ func (service *Service) startTunnelVerificationLoop() {
 	}
 }
 
-// checkTunnels finds the first tunnel that has not had any activity recently
-// and attempts to take a snapshot, then closes it and returns
+// checkTunnels finds tunnels that need snapshots and processes them one at a time.
+// For active tunnels missing an initial snapshot, it takes one without closing the tunnel.
+// For tunnels idle past activeTimeout, it snapshots and closes them.
 func (service *Service) checkTunnels() {
 	service.mu.RLock()
 
@@ -264,12 +265,32 @@ func (service *Service) checkTunnels() {
 			Float64("last_activity_seconds", elapsed.Seconds()).
 			Msg("environment tunnel monitoring")
 
+		tunnelPort := tunnel.Port
+
+		if !tunnel.HasSnapshot && elapsed < activeTimeout {
+			service.mu.RUnlock()
+
+			if endpointHasSnapshot(service.dataStore, endpointID) {
+				service.markSnapshotTaken(endpointID)
+
+				return
+			}
+
+			log.Debug().
+				Int("endpoint_id", int(endpointID)).
+				Msg("taking initial snapshot for active Edge environment")
+
+			if service.snapshotAndLog(endpointID, tunnelPort) {
+				service.markSnapshotTaken(endpointID)
+			}
+
+			return
+		}
+
 		if tunnel.Status == portainer.EdgeAgentManagementRequired && elapsed < activeTimeout {
 			continue
 		}
 
-		tunnelPort := tunnel.Port
-
 		service.mu.RUnlock()
 
 		log.Debug().
@@ -278,13 +299,7 @@ func (service *Service) checkTunnels() {
 			Float64("timeout_seconds", activeTimeout.Seconds()).
 			Msg("last activity timeout exceeded")
 
-		if err := service.snapshotEnvironment(endpointID, tunnelPort); err != nil {
-			log.Error().
-				Int("endpoint_id", int(endpointID)).
-				Err(err).
-				Msg("unable to snapshot Edge environment")
-		}
-
+		service.snapshotAndLog(endpointID, tunnelPort)
 		service.close(endpointID)
 
 		return
@@ -293,6 +308,28 @@ func (service *Service) checkTunnels() {
 	service.mu.RUnlock()
 }
 
+func (service *Service) snapshotAndLog(endpointID portainer.EndpointID, tunnelPort int) bool {
+	if err := service.snapshotEnvironment(endpointID, tunnelPort); err != nil {
+		log.Error().
+			Int("endpoint_id", int(endpointID)).
+			Err(err).
+			Msg("unable to snapshot Edge environment")
+
+		return false
+	}
+
+	return true
+}
+
+func (service *Service) markSnapshotTaken(endpointID portainer.EndpointID) {
+	service.mu.Lock()
+	defer service.mu.Unlock()
+
+	if tun, ok := service.activeTunnels[endpointID]; ok {
+		tun.HasSnapshot = true
+	}
+}
+
 func (service *Service) snapshotEnvironment(endpointID portainer.EndpointID, tunnelPort int) error {
 	endpoint, err := service.dataStore.Endpoint().Endpoint(endpointID)
 	if err != nil {

api/chisel/service_test.go

@@ -2,6 +2,7 @@ package chisel
 
 import (
 	"context"
+	"errors"
 	"net"
 	"net/http"
 	"testing"
@@ -18,13 +19,36 @@ func init() {
 	fips.InitFIPS(false)
 }
 
-func TestPingAgentPanic(t *testing.T) {
-	endpoint := &portainer.Endpoint{
-		ID:          1,
+type mockSnapshotService struct {
+	snapshotFn func(endpoint *portainer.Endpoint) error
+}
+
+func (m *mockSnapshotService) Start() {}
+
+func (m *mockSnapshotService) SetSnapshotInterval(_ string) error { return nil }
+
+func (m *mockSnapshotService) SnapshotEndpoint(endpoint *portainer.Endpoint) error {
+	if m.snapshotFn != nil {
+		return m.snapshotFn(endpoint)
+	}
+
+	return nil
+}
+
+func (m *mockSnapshotService) FillSnapshotData(_ *portainer.Endpoint, _ bool) error { return nil }
+
+func newEdgeEndpoint(id portainer.EndpointID) *portainer.Endpoint {
+	return &portainer.Endpoint{
+		ID:          id,
 		EdgeID:      "test-edge-id",
 		Type:        portainer.EdgeAgentOnDockerEnvironment,
 		UserTrusted: true,
 	}
+}
+
+func TestPingAgentPanic(t *testing.T) {
+	t.Parallel()
+	endpoint := newEdgeEndpoint(1)
 
 	_, store := datastore.MustNewTestStore(t, true, true)
 
@@ -57,3 +81,140 @@ func TestPingAgentPanic(t *testing.T) {
 	require.NoError(t, srv.Shutdown(context.Background()))
 	require.ErrorIs(t, <-errCh, http.ErrServerClosed)
 }
+
+func TestOpenDefaultsHasSnapshotToFalse(t *testing.T) {
+	t.Parallel()
+
+	endpoint := newEdgeEndpoint(1)
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	s := NewService(store, nil, nil)
+
+	err := s.Open(endpoint)
+	require.NoError(t, err)
+
+	require.False(t, s.activeTunnels[endpoint.ID].HasSnapshot)
+}
+
+func TestCheckTunnelsSetsHasSnapshotWhenSnapshotExists(t *testing.T) {
+	t.Parallel()
+
+	endpoint := newEdgeEndpoint(2)
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	err := store.Endpoint().Create(endpoint)
+	require.NoError(t, err)
+
+	snap := &portainer.Snapshot{
+		EndpointID: endpoint.ID,
+		Docker:     &portainer.DockerSnapshot{},
+	}
+	err = store.Snapshot().Create(snap)
+	require.NoError(t, err)
+
+	s := NewService(store, nil, nil)
+	s.activeTunnels[endpoint.ID] = &portainer.TunnelDetails{
+		Status:       portainer.EdgeAgentManagementRequired,
+		Port:         50003,
+		LastActivity: time.Now(),
+	}
+
+	s.checkTunnels()
+
+	require.NotNil(t, s.activeTunnels[endpoint.ID], "tunnel must remain open")
+	require.True(t, s.activeTunnels[endpoint.ID].HasSnapshot)
+}
+
+func TestCheckTunnelsSnapshotsActiveEnvironmentAndKeepsTunnelAlive(t *testing.T) {
+	t.Parallel()
+
+	endpoint := newEdgeEndpoint(3)
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	err := store.Endpoint().Create(endpoint)
+	require.NoError(t, err)
+
+	snapshotCalled := false
+	svc := &mockSnapshotService{
+		snapshotFn: func(_ *portainer.Endpoint) error {
+			snapshotCalled = true
+
+			return nil
+		},
+	}
+
+	s := NewService(store, nil, nil)
+	s.snapshotService = svc
+	s.activeTunnels[endpoint.ID] = &portainer.TunnelDetails{
+		Status:       portainer.EdgeAgentManagementRequired,
+		Port:         50000,
+		LastActivity: time.Now(),
+	}
+
+	s.checkTunnels()
+
+	require.True(t, snapshotCalled)
+	require.NotNil(t, s.activeTunnels[endpoint.ID], "tunnel must remain open after snapshot")
+	require.True(t, s.activeTunnels[endpoint.ID].HasSnapshot)
+}
+
+func TestCheckTunnelsKeepsHasSnapshotFalseOnSnapshotFailure(t *testing.T) {
+	t.Parallel()
+
+	endpoint := newEdgeEndpoint(4)
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	err := store.Endpoint().Create(endpoint)
+	require.NoError(t, err)
+
+	svc := &mockSnapshotService{
+		snapshotFn: func(_ *portainer.Endpoint) error {
+			return errors.New("snapshot failed")
+		},
+	}
+
+	s := NewService(store, nil, nil)
+	s.snapshotService = svc
+	s.activeTunnels[endpoint.ID] = &portainer.TunnelDetails{
+		Status:       portainer.EdgeAgentManagementRequired,
+		Port:         50001,
+		LastActivity: time.Now(),
+	}
+
+	s.checkTunnels()
+
+	require.NotNil(t, s.activeTunnels[endpoint.ID], "tunnel must remain open after failed snapshot")
+	require.False(t, s.activeTunnels[endpoint.ID].HasSnapshot, "HasSnapshot must stay false after failure")
+}
+
+func TestCheckTunnelsClosesIdleTunnelAndSnapshots(t *testing.T) {
+	t.Parallel()
+
+	endpoint := newEdgeEndpoint(5)
+	_, store := datastore.MustNewTestStore(t, false, true)
+
+	err := store.Endpoint().Create(endpoint)
+	require.NoError(t, err)
+
+	snapshotCalled := false
+	svc := &mockSnapshotService{
+		snapshotFn: func(_ *portainer.Endpoint) error {
+			snapshotCalled = true
+
+			return nil
+		},
+	}
+
+	s := NewService(store, nil, nil)
+	s.snapshotService = svc
+	s.activeTunnels[endpoint.ID] = &portainer.TunnelDetails{
+		Status:       portainer.EdgeAgentManagementRequired,
+		Port:         50002,
+		LastActivity: time.Now().Add(-(activeTimeout + time.Second)),
+	}
+
+	s.checkTunnels()
+
+	require.True(t, snapshotCalled)
+	require.Nil(t, s.activeTunnels[endpoint.ID], "tunnel must be closed after idle timeout")
+}

api/chisel/tunnel.go

@@ -9,6 +9,7 @@ import (
 	"time"
 
 	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/internal/edge"
 	"github.com/portainer/portainer/api/internal/edge/cache"
 	"github.com/portainer/portainer/api/internal/endpointutils"
@@ -237,3 +238,12 @@ func encryptCredentials(username, password, key string) (string, error) {
 
 	return base64.RawStdEncoding.EncodeToString(encryptedCredentials), nil
 }
+
+func endpointHasSnapshot(dataStore dataservices.DataStore, endpointID portainer.EndpointID) bool {
+	s, err := dataStore.Snapshot().Read(endpointID)
+	if err != nil {
+		return false
+	}
+
+	return s.Docker != nil || s.Kubernetes != nil
+}

api/cli/cli.go

@@ -56,6 +56,8 @@ func CLIFlags() *portainer.CLIFlags {
 		TrustedOrigins:            kingpin.Flag("trusted-origins", "List of trusted origins for CSRF protection. Separate multiple origins with a comma.").Envar(portainer.TrustedOriginsEnvVar).String(),
 		CSP:                       kingpin.Flag("csp", "Content Security Policy (CSP) header").Envar(portainer.CSPEnvVar).Default("true").Bool(),
 		CompactDB:                 kingpin.Flag("compact-db", "Enable database compaction on startup").Envar(portainer.CompactDBEnvVar).Default("false").Bool(),
+		NoSetupToken:              kingpin.Flag("no-setup-token", "Disable the setup token requirement for admin initialization and restore on an uninitialized instance").Envar(portainer.NoSetupTokenEnvVar).Bool(),
+		SetupToken:                kingpin.Flag("setup-token", "Set a custom setup token for admin initialization and restore on an uninitialized instance (overrides auto-generation)").Envar(portainer.SetupTokenEnvVar).String(),
 	}
 }
 
@@ -94,13 +96,20 @@ func (Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
 	flags.TLSKey = tlsKeyFlag.String()
 	flags.TLSCacert = kingpin.Flag("tlscacert", "Path to the CA").Default(defaultTLSCACertPath).String()
 
-	flags.KubectlShellImage = kingpin.Flag(
+	var hasKubectlShellImageFlag bool
+	kubectlShellImageFlag := kingpin.Flag(
 		"kubectl-shell-image",
 		"Kubectl shell image",
-	).Envar(portainer.KubectlShellImageEnvVar).Default(portainer.DefaultKubectlShellImage).String()
+	).Envar(portainer.KubectlShellImageEnvVar).
+		Default(portainer.DefaultKubectlShellImage).
+		IsSetByUser(&hasKubectlShellImageFlag)
+	flags.KubectlShellImage = kubectlShellImageFlag.String()
 
 	kingpin.Parse()
 
+	_, kubectlShellImageEnvVarSet := os.LookupEnv(portainer.KubectlShellImageEnvVar)
+	flags.KubectlShellImageSet = hasKubectlShellImageFlag || kubectlShellImageEnvVarSet
+
 	if !filepath.IsAbs(*flags.Assets) {
 		ex, err := os.Executable()
 		if err != nil {

api/cli/cli_test.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 	"testing"
 
+	portainer "github.com/portainer/portainer/api"
 	zerolog "github.com/rs/zerolog/log"
 	"github.com/stretchr/testify/require"
 )
@@ -26,6 +27,59 @@ func TestOptionParser(t *testing.T) {
 	require.True(t, *opts.EnableEdgeComputeFeatures)
 }
 
+func TestParseKubectlShellImageFlag(t *testing.T) {
+	tests := []struct {
+		name                         string
+		args                         []string
+		envVars                      map[string]string
+		expectedKubectlShellImageSet bool
+		expectedKubectlShellFlag     string
+	}{
+		{
+			name:                         "no flag, no env var",
+			expectedKubectlShellImageSet: false,
+			expectedKubectlShellFlag:     portainer.DefaultKubectlShellImage,
+		},
+		{
+			name:                         "explicit flag",
+			args:                         []string{"portainer", "--kubectl-shell-image=myimage:v2"},
+			expectedKubectlShellImageSet: true,
+			expectedKubectlShellFlag:     "myimage:v2",
+		},
+		{
+			name:                         "env var",
+			envVars:                      map[string]string{portainer.KubectlShellImageEnvVar: "myimage:v3"},
+			expectedKubectlShellImageSet: true,
+			expectedKubectlShellFlag:     "myimage:v3",
+		},
+		{
+			name:                         "both env var and flag set",
+			args:                         []string{"portainer", "--kubectl-shell-image=myimage:v2"},
+			envVars:                      map[string]string{portainer.KubectlShellImageEnvVar: "myimage:v3"},
+			expectedKubectlShellImageSet: true,
+			expectedKubectlShellFlag:     "myimage:v2",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if tc.args == nil {
+				tc.args = []string{"portainer"}
+			}
+			setOsArgs(t, tc.args)
+
+			for k, v := range tc.envVars {
+				t.Setenv(k, v)
+			}
+
+			flags, err := Service{}.ParseFlags("test-version")
+			require.NoError(t, err)
+			require.Equal(t, tc.expectedKubectlShellImageSet, flags.KubectlShellImageSet)
+			require.Equal(t, tc.expectedKubectlShellFlag, *flags.KubectlShellImage)
+		})
+	}
+}
+
 func TestParseTLSFlags(t *testing.T) {
 	testCases := []struct {
 		name                string

api/cmd/portainer/main.go

@@ -29,6 +29,7 @@ import (
 	"github.com/portainer/portainer/api/http"
 	"github.com/portainer/portainer/api/http/proxy"
 	kubeproxy "github.com/portainer/portainer/api/http/proxy/factory/kubernetes"
+	"github.com/portainer/portainer/api/http/security/setuptoken"
 	"github.com/portainer/portainer/api/internal/authorization"
 	"github.com/portainer/portainer/api/internal/edge/edgestacks"
 	"github.com/portainer/portainer/api/internal/endpointutils"
@@ -230,6 +231,32 @@ func initSnapshotService(
 	return snapshotService, nil
 }
 
+func resolveSetupToken(tx dataservices.DataStoreTx, providedToken string) (string, error) {
+	admins, err := tx.User().UsersByRole(portainer.AdministratorRole)
+	if err != nil {
+		return "", err
+	}
+	if len(admins) > 0 {
+		return "", nil
+	}
+
+	if providedToken != "" {
+		log.Info().Msg("using custom setup token; admin initialization and backup restore require this token in the X-Setup-Token header")
+		return providedToken, nil
+	}
+
+	token, err := setuptoken.Generate()
+	if err != nil {
+		return "", err
+	}
+
+	log.Info().
+		Str("setup_token", token).
+		Msg("no administrator account configured; admin initialization and backup restore require this setup token in the X-Setup-Token header. Start with --no-setup-token to disable.")
+
+	return token, nil
+}
+
 func initStatus(instanceID string) *portainer.Status {
 	return &portainer.Status{
 		Version:    portainer.APIVersion,
@@ -248,6 +275,10 @@ func updateSettingsFromFlags(dataStore dataservices.DataStore, flags *portainer.
 	settings.EnableEdgeComputeFeatures = cmp.Or(*flags.EnableEdgeComputeFeatures, settings.EnableEdgeComputeFeatures)
 	settings.TemplatesURL = cmp.Or(*flags.Templates, settings.TemplatesURL)
 
+	if flags.KubectlShellImageSet {
+		settings.KubectlShellImage = *flags.KubectlShellImage
+	}
+
 	if *flags.Labels != nil {
 		settings.BlackListedLabels = *flags.Labels
 	}
@@ -524,6 +555,17 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 		}
 	}
 
+	setupToken := ""
+	if adminPasswordHash == "" && !*flags.NoSetupToken {
+		if err := dataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+			var txErr error
+			setupToken, txErr = resolveSetupToken(tx, *flags.SetupToken)
+			return txErr
+		}); err != nil {
+			log.Fatal().Err(err).Msg("failed initializing setup token")
+		}
+	}
+
 	if err := reverseTunnelService.StartTunnelServer(*flags.TunnelAddr, *flags.TunnelPort, snapshotService); err != nil {
 		log.Fatal().Err(err).Msg("failed starting tunnel server")
 	}
@@ -613,6 +655,7 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 		PlatformService:             platformService,
 		PullLimitCheckDisabled:      *flags.PullLimitCheckDisabled,
 		TrustedOrigins:              trustedOrigins,
+		SetupToken:                  setupToken,
 	}
 }
 

api/cmd/portainer/main_test.go

@@ -5,14 +5,55 @@ import (
 	"path"
 	"testing"
 
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+func Test_resolveSetupToken(t *testing.T) {
+	t.Parallel()
+
+	t.Run("admin already exists — returns empty token", func(t *testing.T) {
+		admin := portainer.User{Role: portainer.AdministratorRole}
+		store := testhelpers.NewDatastore(testhelpers.WithUsers([]portainer.User{admin}))
+		token, err := resolveSetupToken(store, "")
+		require.NoError(t, err)
+		assert.Empty(t, token)
+	})
+
+	t.Run("no admin — generates a 64-char hex token", func(t *testing.T) {
+		store := testhelpers.NewDatastore(testhelpers.WithUsers([]portainer.User{}))
+		token, err := resolveSetupToken(store, "")
+		require.NoError(t, err)
+		assert.Len(t, token, 64)
+
+		token2, err := resolveSetupToken(store, "")
+		require.NoError(t, err)
+		assert.NotEqual(t, token, token2)
+	})
+
+	t.Run("no admin — uses provided token", func(t *testing.T) {
+		store := testhelpers.NewDatastore(testhelpers.WithUsers([]portainer.User{}))
+		token, err := resolveSetupToken(store, "mysecrettoken")
+		require.NoError(t, err)
+		assert.Equal(t, "mysecrettoken", token)
+	})
+
+	t.Run("admin already exists — ignores provided token", func(t *testing.T) {
+		admin := portainer.User{Role: portainer.AdministratorRole}
+		store := testhelpers.NewDatastore(testhelpers.WithUsers([]portainer.User{admin}))
+		token, err := resolveSetupToken(store, "mysecrettoken")
+		require.NoError(t, err)
+		assert.Empty(t, token)
+	})
+}
+
 const secretFileName = "secret.txt"
 
 func createPasswordFile(t *testing.T, secretPath, password string) string {
-	err := os.WriteFile(secretPath, []byte(password), 0600)
+	err := os.WriteFile(secretPath, []byte(password), 0o600)
 	require.NoError(t, err)
 	return secretPath
 }
@@ -38,6 +79,65 @@ func TestLoadEncryptionSecretKey(t *testing.T) {
 	require.Len(t, encryptionKey, 32)
 }
 
+func TestUpdateSettingsFromFlags_KubectlShellImage(t *testing.T) {
+	const existingImage = "existing-image:v1"
+	const newImage = "new-image:v2"
+
+	emptyString := ""
+	falseBool := false
+	var emptyLabels []portainer.Pair
+
+	tests := []struct {
+		name                      string
+		imageSet                  bool
+		flagImage                 string
+		expectedKubectlShellImage string
+	}{
+		{
+			name:                      "flag not set — DB image unchanged",
+			imageSet:                  false,
+			flagImage:                 portainer.DefaultKubectlShellImage,
+			expectedKubectlShellImage: existingImage,
+		},
+		{
+			name:                      "flag set — DB image updated",
+			imageSet:                  true,
+			flagImage:                 newImage,
+			expectedKubectlShellImage: newImage,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			store := testhelpers.NewDatastore(
+				testhelpers.WithSettingsService(&portainer.Settings{
+					KubectlShellImage: existingImage,
+				}),
+				testhelpers.WithSSLSettingsService(&portainer.SSLSettings{}),
+			)
+
+			flags := &portainer.CLIFlags{
+				SnapshotInterval:          &emptyString,
+				Logo:                      &emptyString,
+				EnableEdgeComputeFeatures: &falseBool,
+				Templates:                 &emptyString,
+				Labels:                    &emptyLabels,
+				HTTPDisabled:              &falseBool,
+				HTTPEnabled:               &falseBool,
+			}
+			flags.KubectlShellImage = &tc.flagImage
+			flags.KubectlShellImageSet = tc.imageSet
+
+			err := updateSettingsFromFlags(store, flags)
+			require.NoError(t, err)
+
+			settings, err := store.Settings().Settings()
+			require.NoError(t, err)
+			require.Equal(t, tc.expectedKubectlShellImage, settings.KubectlShellImage)
+		})
+	}
+}
+
 func TestDBSecretPath(t *testing.T) {
 	tests := []struct {
 		keyFilenameFlag string

api/crypto/nonce.go

@@ -4,6 +4,7 @@ import (
 	"crypto/rand"
 	"errors"
 	"io"
+	"slices"
 )
 
 type Nonce struct {
@@ -45,13 +46,9 @@ func (n *Nonce) Value() []byte {
 
 func (n *Nonce) Increment() error {
 	// Start incrementing from the least significant byte
-	for i := len(n.val) - 1; i >= 0; i-- {
-		// Increment the current byte
+	for i := range slices.Backward(n.val) {
 		n.val[i]++
-
-		// Check for overflow
 		if n.val[i] != 0 {
-			// No overflow, nonce is successfully incremented
 			return nil
 		}
 	}

api/datastore/init.go

@@ -59,6 +59,7 @@ func (store *Store) checkOrCreateDefaultSettings() error {
 			KubectlShellImage:        *store.flags.KubectlShellImage,
 
 			IsDockerDesktopExtension: isDDExtention,
+			EnforceEdgeID:            true,
 		}
 
 		return store.SettingsService.UpdateSettings(defaultSettings)

api/datastore/test_data/output_24_to_latest.json

@@ -613,7 +613,7 @@
       "RequiredPasswordLength": 12
     },
     "KubeconfigExpiry": "0",
-    "KubectlShellImage": "portainer/kubectl-shell:2.39.0",
+    "KubectlShellImage": "portainer/kubectl-shell:2.39.3",
     "LDAPSettings": {
       "AnonymousMode": true,
       "AutoCreateUsers": true,
@@ -942,7 +942,7 @@
     }
   ],
   "version": {
-    "VERSION": "{\"SchemaVersion\":\"2.39.0\",\"MigratorCount\":0,\"Edition\":1,\"InstanceID\":\"463d5c47-0ea5-4aca-85b1-405ceefee254\"}"
+    "VERSION": "{\"SchemaVersion\":\"2.39.3\",\"MigratorCount\":0,\"Edition\":1,\"InstanceID\":\"463d5c47-0ea5-4aca-85b1-405ceefee254\"}"
   },
   "webhooks": null
 }

api/exec/compose_stack.go

@@ -66,7 +66,7 @@ func (manager *ComposeStackManager) Up(ctx context.Context, stack *portainer.Sta
 			EnvFilePath: envFilePath,
 			Host:        url,
 			ProjectName: stack.Name,
-			Registries:  portainerRegistriesToAuthConfigs(manager.dataStore, options.Registries),
+			Registries:  portainerRegistriesToAuthConfigs(options.Registries),
 		},
 		ForceRecreate:        options.ForceRecreate,
 		AbortOnContainerExit: options.AbortOnContainerExit,
@@ -97,7 +97,7 @@ func (manager *ComposeStackManager) Run(ctx context.Context, stack *portainer.St
 			EnvFilePath: envFilePath,
 			Host:        url,
 			ProjectName: stack.Name,
-			Registries:  portainerRegistriesToAuthConfigs(manager.dataStore, options.Registries),
+			Registries:  portainerRegistriesToAuthConfigs(options.Registries),
 		},
 		Remove:   options.Remove,
 		Args:     options.Args,
@@ -146,7 +146,7 @@ func (manager *ComposeStackManager) Pull(ctx context.Context, stack *portainer.S
 		EnvFilePath: envFilePath,
 		Host:        url,
 		ProjectName: stack.Name,
-		Registries:  portainerRegistriesToAuthConfigs(manager.dataStore, options.Registries),
+		Registries:  portainerRegistriesToAuthConfigs(options.Registries),
 	})
 	return errors.Wrap(err, "failed to pull images of the stack")
 }
@@ -229,7 +229,12 @@ func copyConfigEnvVars(w io.Writer, envs []portainer.Pair) error {
 	return nil
 }
 
-func portainerRegistriesToAuthConfigs(tx dataservices.DataStoreTx, registries []portainer.Registry) []types.AuthConfig {
+// portainerRegistriesToAuthConfigs converts registries to Docker auth configs.
+// Callers must ensure ECR tokens are valid before calling this function (e.g. via
+// registryutils.RefreshAndPersistECRTokens with a real DataStoreTx). This function
+// intentionally performs no DB writes to avoid write-lock contention when called inside
+// an active BoltDB write transaction.
+func portainerRegistriesToAuthConfigs(registries []portainer.Registry) []types.AuthConfig {
 	var authConfigs []types.AuthConfig
 
 	for _, r := range registries {
@@ -242,7 +247,7 @@ func portainerRegistriesToAuthConfigs(tx dataservices.DataStoreTx, registries []
 		if r.Authentication {
 			var err error
 
-			ac.Username, ac.Password, err = getEffectiveRegUsernamePassword(tx, &r)
+			ac.Username, ac.Password, err = getEffectiveRegUsernamePassword(&r)
 			if err != nil {
 				continue
 			}
@@ -254,16 +259,7 @@ func portainerRegistriesToAuthConfigs(tx dataservices.DataStoreTx, registries []
 	return authConfigs
 }
 
-func getEffectiveRegUsernamePassword(tx dataservices.DataStoreTx, registry *portainer.Registry) (string, string, error) {
-	if err := registryutils.EnsureRegTokenValid(tx, registry); err != nil {
-		log.Warn().
-			Err(err).
-			Str("RegistryName", registry.Name).
-			Msg("Failed to validate registry token. Skip logging with this registry.")
-
-		return "", "", err
-	}
-
+func getEffectiveRegUsernamePassword(registry *portainer.Registry) (string, string, error) {
 	username, password, err := registryutils.GetRegEffectiveCredential(registry)
 	if err != nil {
 		log.Warn().

api/exec/compose_stack_test.go

@@ -6,6 +6,7 @@ import (
 	"path"
 	"path/filepath"
 	"testing"
+	"time"
 
 	portainer "github.com/portainer/portainer/api"
 
@@ -94,3 +95,74 @@ func Test_createEnvFile_mergesDefultAndInplaceEnvVars(t *testing.T) {
 
 	assert.Equal(t, []byte("VAR1=VAL1\nVAR2=VAL2\n\nVAR1=NEW_VAL1\nVAR3=VAL3\n"), content)
 }
+
+func Test_portainerRegistriesToAuthConfigs(t *testing.T) {
+	t.Parallel()
+
+	t.Run("returns empty slice for empty input", func(t *testing.T) {
+		t.Parallel()
+		result := portainerRegistriesToAuthConfigs([]portainer.Registry{})
+		require.Nil(t, result)
+	})
+
+	t.Run("uses registry URL, username and password for non-authenticated registry", func(t *testing.T) {
+		t.Parallel()
+		registries := []portainer.Registry{
+			{URL: "registry.example.com", Username: "user", Password: "pass", Authentication: false},
+		}
+		result := portainerRegistriesToAuthConfigs(registries)
+		require.Len(t, result, 1)
+		require.Equal(t, "registry.example.com", result[0].ServerAddress)
+		require.Equal(t, "user", result[0].Username)
+		require.Equal(t, "pass", result[0].Password)
+	})
+
+	t.Run("uses username and password for authenticated non-ECR registry", func(t *testing.T) {
+		t.Parallel()
+		registries := []portainer.Registry{
+			{URL: "registry.example.com", Username: "user", Password: "pass", Authentication: true, Type: portainer.CustomRegistry},
+		}
+		result := portainerRegistriesToAuthConfigs(registries)
+		require.Len(t, result, 1)
+		require.Equal(t, "user", result[0].Username)
+		require.Equal(t, "pass", result[0].Password)
+	})
+
+	t.Run("parses ECR access token for authenticated ECR registry with valid token", func(t *testing.T) {
+		t.Parallel()
+		registries := []portainer.Registry{
+			{
+				URL:               "123456789.dkr.ecr.us-east-1.amazonaws.com",
+				Username:          "AKIAIOSFODNN7EXAMPLE",
+				Password:          "secretkey",
+				Authentication:    true,
+				Type:              portainer.EcrRegistry,
+				Ecr:               portainer.EcrData{Region: "us-east-1"},
+				AccessToken:       "AWS:ecr-password",
+				AccessTokenExpiry: time.Now().Add(time.Hour).Unix(),
+			},
+		}
+		result := portainerRegistriesToAuthConfigs(registries)
+		require.Len(t, result, 1)
+		require.Equal(t, "AWS", result[0].Username)
+		require.Equal(t, "ecr-password", result[0].Password)
+	})
+
+	t.Run("includes valid registries and skips ones with credential errors", func(t *testing.T) {
+		t.Parallel()
+		registries := []portainer.Registry{
+			{URL: "valid.example.com", Username: "user", Password: "pass", Authentication: false},
+			{
+				URL:               "123456789.dkr.ecr.us-east-1.amazonaws.com",
+				Authentication:    true,
+				Type:              portainer.EcrRegistry,
+				Ecr:               portainer.EcrData{Region: "us-east-1"},
+				AccessToken:       "no-colon-token",
+				AccessTokenExpiry: time.Now().Add(time.Hour).Unix(),
+			},
+		}
+		result := portainerRegistriesToAuthConfigs(registries)
+		require.Len(t, result, 1)
+		require.Equal(t, "valid.example.com", result[0].ServerAddress)
+	})
+}

api/exec/swarm_stack.go

@@ -61,7 +61,7 @@ func (manager *SwarmStackManager) Login(registries []portainer.Registry, endpoin
 
 	for _, registry := range registries {
 		if registry.Authentication {
-			username, password, err := getEffectiveRegUsernamePassword(manager.dataStore, &registry)
+			username, password, err := getEffectiveRegUsernamePassword(&registry)
 			if err != nil {
 				continue
 			}

api/git/git.go

@@ -3,23 +3,42 @@ package git
 import (
 	"context"
 	"os"
-	"path/filepath"
 	"strings"
 
+	"github.com/portainer/portainer/api/filesystem"
 	gittypes "github.com/portainer/portainer/api/git/types"
-	"github.com/rs/zerolog/log"
 
+	"github.com/go-git/go-billy/v5"
+	"github.com/go-git/go-billy/v5/osfs"
 	"github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/config"
 	"github.com/go-git/go-git/v5/plumbing"
+	"github.com/go-git/go-git/v5/plumbing/cache"
 	"github.com/go-git/go-git/v5/plumbing/filemode"
 	"github.com/go-git/go-git/v5/plumbing/object"
 	"github.com/go-git/go-git/v5/plumbing/transport"
 	githttp "github.com/go-git/go-git/v5/plumbing/transport/http"
+	gogitfs "github.com/go-git/go-git/v5/storage/filesystem"
 	"github.com/go-git/go-git/v5/storage/memory"
 	"github.com/pkg/errors"
+	"github.com/rs/zerolog/log"
 )
 
+// noSymlinkFS wraps a billy.Filesystem and rejects symlink creation to prevent
+// symlink traversal attacks from untrusted git repositories
+type noSymlinkFS struct {
+	billy.Filesystem
+}
+
+func (fs noSymlinkFS) Symlink(_, _ string) error {
+	return gittypes.ErrSymlinkDetected
+}
+
+// NewNoSymlinkFS wraps fs and rejects any symlink creation
+func NewNoSymlinkFS(fs billy.Filesystem) billy.Filesystem {
+	return noSymlinkFS{fs}
+}
+
 type gitClient struct {
 	preserveGitDirectory bool
 }
@@ -30,8 +49,33 @@ func NewGitClient(preserveGitDir bool) *gitClient {
 	}
 }
 
+func (c *gitClient) Download(ctx context.Context, dst string, opt *git.CloneOptions) error {
+	wt := NewNoSymlinkFS(osfs.New(dst))
+	dot := osfs.New(filesystem.JoinPaths(dst, ".git"))
+	storer := gogitfs.NewStorage(dot, cache.NewObjectLRU(0))
+
+	_, err := git.CloneContext(ctx, storer, wt, opt)
+	if err != nil {
+		if err.Error() == "authentication required" {
+			return gittypes.ErrAuthenticationFailure
+		}
+
+		return errors.Wrap(err, "failed to clone git repository")
+	}
+
+	if c.preserveGitDirectory {
+		return nil
+	}
+
+	if err := os.RemoveAll(filesystem.JoinPaths(dst, ".git")); err != nil {
+		log.Error().Err(err).Msg("failed to remove .git directory")
+	}
+
+	return nil
+}
+
 func (c *gitClient) download(ctx context.Context, dst string, opt cloneOption) error {
-	gitOptions := git.CloneOptions{
+	gitOptions := &git.CloneOptions{
 		URL:             opt.repositoryUrl,
 		Depth:           opt.depth,
 		InsecureSkipTLS: opt.tlsSkipVerify,
@@ -43,23 +87,7 @@ func (c *gitClient) download(ctx context.Context, dst string, opt cloneOption) e
 		gitOptions.ReferenceName = plumbing.ReferenceName(opt.referenceName)
 	}
 
-	_, err := git.PlainCloneContext(ctx, dst, false, &gitOptions)
-
-	if err != nil {
-		if err.Error() == "authentication required" {
-			return gittypes.ErrAuthenticationFailure
-		}
-		return errors.Wrap(err, "failed to clone git repository")
-	}
-
-	if !c.preserveGitDirectory {
-		err := os.RemoveAll(filepath.Join(dst, ".git"))
-		if err != nil {
-			log.Error().Err(err).Msg("failed to remove .git directory")
-		}
-	}
-
-	return nil
+	return c.Download(ctx, dst, gitOptions)
 }
 
 func (c *gitClient) latestCommitID(ctx context.Context, opt fetchOption) (string, error) {
@@ -73,11 +101,12 @@ func (c *gitClient) latestCommitID(ctx context.Context, opt fetchOption) (string
 		InsecureSkipTLS: opt.tlsSkipVerify,
 	}
 
-	refs, err := remote.List(listOptions)
+	refs, err := remote.ListContext(ctx, listOptions)
 	if err != nil {
 		if err.Error() == "authentication required" {
 			return "", gittypes.ErrAuthenticationFailure
 		}
+
 		return "", errors.Wrap(err, "failed to list repository refs")
 	}
 
@@ -159,6 +188,7 @@ func (c *gitClient) listRefs(ctx context.Context, opt baseOption) ([]string, err
 		if ref.Name().String() == "HEAD" {
 			continue
 		}
+
 		ret = append(ret, ref.Name().String())
 	}
 
@@ -225,5 +255,6 @@ func checkGitError(err error) error {
 	} else if errMsg == "authentication required" {
 		return gittypes.ErrAuthenticationFailure
 	}
+
 	return err
 }

api/git/git_test.go

@@ -3,13 +3,17 @@ package git
 import (
 	"context"
 	"os"
-	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/portainer/portainer/api/archive"
+	"github.com/portainer/portainer/api/filesystem"
 	gittypes "github.com/portainer/portainer/api/git/types"
 
+	"github.com/go-git/go-billy/v5/osfs"
 	"github.com/go-git/go-git/v5"
+	"github.com/go-git/go-git/v5/plumbing"
+	"github.com/go-git/go-git/v5/plumbing/filemode"
 	"github.com/go-git/go-git/v5/plumbing/object"
 	"github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
@@ -18,7 +22,7 @@ import (
 
 func setup(t *testing.T) string {
 	dir := t.TempDir()
-	bareRepoDir := filepath.Join(dir, "test-clone.git")
+	bareRepoDir := filesystem.JoinPaths(dir, "test-clone.git")
 
 	file, err := os.OpenFile("./testdata/test-clone-git-repo.tar.gz", os.O_RDONLY, 0755)
 	if err != nil {
@@ -53,7 +57,7 @@ func Test_ClonePublicRepository_NoGitDirectory(t *testing.T) {
 	t.Logf("Cloning into %s", dir)
 	err := service.CloneRepository(dir, repositoryURL, referenceName, "", "", gittypes.GitCredentialAuthType_Basic, false)
 	require.NoError(t, err)
-	assert.NoDirExists(t, filepath.Join(dir, ".git"))
+	assert.NoDirExists(t, filesystem.JoinPaths(dir, ".git"))
 }
 
 func Test_cloneRepository(t *testing.T) {
@@ -146,6 +150,112 @@ func getCommitHistoryLength(t *testing.T, dir string) int {
 	return count
 }
 
+func Test_noSymlinkFS_Symlink(t *testing.T) {
+	fs := NewNoSymlinkFS(osfs.New(t.TempDir()))
+	err := fs.Symlink("../../../etc/passwd", "evil-link")
+	require.ErrorIs(t, err, gittypes.ErrSymlinkDetected)
+}
+
+func Test_noSymlinkFS_OtherOperations(t *testing.T) {
+	dir := t.TempDir()
+	fs := NewNoSymlinkFS(osfs.New(dir))
+
+	f, err := fs.Create("test.txt")
+	require.NoError(t, err)
+
+	_, err = f.Write([]byte("hello"))
+	require.NoError(t, err)
+
+	err = f.Close()
+	require.NoError(t, err)
+
+	info, err := fs.Stat("test.txt")
+	require.NoError(t, err)
+	require.Equal(t, "test.txt", info.Name())
+}
+
+func createBareRepoWithSymlink(t *testing.T) string {
+	t.Helper()
+
+	bareDir := filesystem.JoinPaths(t.TempDir(), "symlink-repo.git")
+
+	repo, err := git.PlainInit(bareDir, true)
+	require.NoError(t, err)
+
+	storer := repo.Storer
+
+	fileBlob := &plumbing.MemoryObject{}
+	fileBlob.SetType(plumbing.BlobObject)
+
+	_, err = fileBlob.Write([]byte("hello world\n"))
+	require.NoError(t, err)
+
+	fileHash, err := storer.SetEncodedObject(fileBlob)
+	require.NoError(t, err)
+
+	symlinkBlob := &plumbing.MemoryObject{}
+	symlinkBlob.SetType(plumbing.BlobObject)
+
+	_, err = symlinkBlob.Write([]byte("../../../etc/passwd"))
+	require.NoError(t, err)
+
+	symlinkHash, err := storer.SetEncodedObject(symlinkBlob)
+	require.NoError(t, err)
+
+	tree := &object.Tree{
+		Entries: []object.TreeEntry{
+			{Name: "evil-link", Mode: filemode.Symlink, Hash: symlinkHash},
+			{Name: "file.txt", Mode: filemode.Regular, Hash: fileHash},
+		},
+	}
+
+	treeObj := &plumbing.MemoryObject{}
+
+	err = tree.Encode(treeObj)
+	require.NoError(t, err)
+
+	treeHash, err := storer.SetEncodedObject(treeObj)
+	require.NoError(t, err)
+
+	sig := object.Signature{Name: "Test", Email: "test@test.com", When: time.Now()}
+	commit := &object.Commit{
+		Message:   "add symlink",
+		Author:    sig,
+		Committer: sig,
+		TreeHash:  treeHash,
+	}
+
+	commitObj := &plumbing.MemoryObject{}
+
+	err = commit.Encode(commitObj)
+	require.NoError(t, err)
+
+	commitHash, err := storer.SetEncodedObject(commitObj)
+	require.NoError(t, err)
+
+	err = storer.SetReference(plumbing.NewHashReference("refs/heads/main", commitHash))
+	require.NoError(t, err)
+
+	err = storer.SetReference(plumbing.NewSymbolicReference(plumbing.HEAD, "refs/heads/main"))
+	require.NoError(t, err)
+
+	return bareDir
+}
+
+func Test_Download_RejectsSymlink(t *testing.T) {
+	client := NewGitClient(false)
+	repoURL := createBareRepoWithSymlink(t)
+
+	err := client.Download(t.Context(), t.TempDir(), &git.CloneOptions{
+		URL:          repoURL,
+		Depth:        1,
+		SingleBranch: true,
+		Tags:         git.NoTags,
+	})
+	require.Error(t, err)
+	require.ErrorIs(t, err, gittypes.ErrSymlinkDetected)
+}
+
 func Test_listRefsPrivateRepository(t *testing.T) {
 	ensureIntegrationTest(t)
 

api/git/service.go

@@ -185,7 +185,19 @@ func (service *Service) LatestCommitID(
 		referenceName: referenceName,
 	}
 
-	return service.repoManager(options.baseOption).latestCommitID(context.TODO(), options)
+	ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
+	defer cancel()
+
+	id, err := service.repoManager(options.baseOption).latestCommitID(ctx, options)
+	if err != nil {
+		if ctx.Err() == context.DeadlineExceeded {
+			log.Error().Str("url", repositoryURL).Msg("git fetch timed out after 1 minute")
+		}
+
+		return "", err
+	}
+
+	return id, nil
 }
 
 // ListRefs will list target repository's references without cloning the repository

api/git/types/types.go

@@ -7,6 +7,7 @@ import (
 var (
 	ErrIncorrectRepositoryURL = errors.New("git repository could not be found, please ensure that the URL is correct")
 	ErrAuthenticationFailure  = errors.New("authentication failed, please ensure that the git credentials are correct")
+	ErrSymlinkDetected        = errors.New("repository contains a symlink, which is not allowed for security reasons")
 )
 
 type GitCredentialAuthType int

api/git/update/update.go

@@ -1,6 +1,7 @@
 package update
 
 import (
+	"os"
 	"strings"
 
 	"github.com/pkg/errors"
@@ -74,6 +75,11 @@ func UpdateGitObject(gitService portainer.GitService, objId string, gitConfig *g
 	}
 
 	if err := cloneGitRepository(gitService, cloneParams); err != nil {
+		if enableVersionFolder {
+			if removeErr := os.RemoveAll(toDir); removeErr != nil {
+				log.Warn().Err(removeErr).Str("dir", toDir).Msg("failed to remove partial clone directory")
+			}
+		}
 		return false, "", errors.WithMessagef(err, "failed to do a fresh clone of %v", objId)
 	}
 

api/http/handler/backup/handler.go

@@ -22,6 +22,7 @@ type Handler struct {
 	filestorePath   string
 	shutdownTrigger context.CancelFunc
 	adminMonitor    *adminmonitor.Monitor
+	SetupToken      string
 }
 
 // NewHandler creates an new instance of backup handler

api/http/handler/backup/restore.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/pkg/errors"
 	operations "github.com/portainer/portainer/api/backup"
+	"github.com/portainer/portainer/api/http/security/setuptoken"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 )
@@ -20,15 +21,21 @@ type restorePayload struct {
 // @id Restore
 // @summary Triggers a system restore using provided backup file
 // @description Triggers a system restore using provided backup file
-// @description **Access policy**: public
+// @description **Access policy**: public (requires the X-Setup-Token header on an uninitialized instance unless --no-setup-token is set)
 // @tags backup
 // @accept json
+// @param X-Setup-Token header string false "Setup token (required when instance is uninitialized and --no-setup-token is not set)"
 // @param restorePayload body restorePayload true "Restore request payload"
 // @success 200 "Success"
 // @failure 400 "Invalid request"
+// @failure 403 "Access denied - invalid or missing setup token"
 // @failure 500 "Server error"
 // @router /restore [post]
 func (h *Handler) restore(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	if err := setuptoken.Validate(r, h.SetupToken); err != nil {
+		return err
+	}
+
 	initialized, err := h.adminMonitor.WasInitialized()
 	if err != nil {
 		return httperror.InternalServerError("Failed to check system initialization", err)

api/http/handler/backup/restore_test.go

@@ -15,6 +15,7 @@ import (
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/adminmonitor"
 	"github.com/portainer/portainer/api/http/offlinegate"
+	"github.com/portainer/portainer/api/http/security/setuptoken"
 	"github.com/portainer/portainer/api/internal/testhelpers"
 
 	"github.com/stretchr/testify/assert"
@@ -125,6 +126,45 @@ func backup(t *testing.T, h *Handler, password string) []byte {
 	return archive
 }
 
+func Test_restore_setupTokenGate(t *testing.T) {
+	t.Parallel()
+	datastore := testhelpers.NewDatastore(
+		testhelpers.WithUsers([]portainer.User{}),
+		testhelpers.WithEdgeJobs([]portainer.EdgeJob{}),
+	)
+	adminMonitor := adminmonitor.New(time.Hour, datastore, context.Background())
+	h := NewHandler(
+		testhelpers.NewTestRequestBouncer(),
+		datastore,
+		offlinegate.NewOfflineGate(),
+		"./test_assets/handler_test",
+		func() {},
+		adminMonitor,
+	)
+	h.SetupToken = "secret-token"
+
+	t.Run("403 without token header", func(t *testing.T) {
+		err := h.restore(httptest.NewRecorder(), prepareMultipartRequest(t, "", []byte("x")))
+		require.Error(t, err)
+		assert.Equal(t, http.StatusForbidden, err.StatusCode)
+	})
+
+	t.Run("403 with wrong token", func(t *testing.T) {
+		r := prepareMultipartRequest(t, "", []byte("x"))
+		r.Header.Set(setuptoken.HeaderName, "wrong")
+		err := h.restore(httptest.NewRecorder(), r)
+		require.Error(t, err)
+		assert.Equal(t, http.StatusForbidden, err.StatusCode)
+	})
+
+	t.Run("passes gate with correct token", func(t *testing.T) {
+		archive := backup(t, h, "")
+		r := prepareMultipartRequest(t, "", archive)
+		r.Header.Set(setuptoken.HeaderName, "secret-token")
+		require.Nil(t, h.restore(httptest.NewRecorder(), r))
+	})
+}
+
 func prepareMultipartRequest(t *testing.T, password string, file []byte) *http.Request {
 	var body bytes.Buffer
 

api/http/handler/customtemplates/customtemplate_file.go

@@ -2,8 +2,14 @@ package customtemplates
 
 import (
 	"net/http"
+	"strconv"
 
 	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	httperrors "github.com/portainer/portainer/api/http/errors"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/slicesx"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
@@ -33,11 +39,46 @@ func (handler *Handler) customTemplateFile(w http.ResponseWriter, r *http.Reques
 		return httperror.BadRequest("Invalid custom template identifier route variable", err)
 	}
 
-	customTemplate, err := handler.DataStore.CustomTemplate().Read(portainer.CustomTemplateID(customTemplateID))
-	if handler.DataStore.IsErrObjectNotFound(err) {
-		return httperror.NotFound("Unable to find a custom template with the specified identifier inside the database", err)
-	} else if err != nil {
-		return httperror.InternalServerError("Unable to find a custom template with the specified identifier inside the database", err)
+	var customTemplate *portainer.CustomTemplate
+	if err := handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		customTemplate, err = tx.CustomTemplate().Read(portainer.CustomTemplateID(customTemplateID))
+		if tx.IsErrObjectNotFound(err) {
+			return httperror.NotFound("Unable to find a custom template with the specified identifier inside the database", err)
+		} else if err != nil {
+			return httperror.InternalServerError("Unable to find a custom template with the specified identifier inside the database", err)
+		}
+
+		resourceControl, err := tx.ResourceControl().ResourceControlByResourceIDAndType(strconv.Itoa(customTemplateID), portainer.CustomTemplateResourceControl)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve a resource control associated to the custom template", err)
+		}
+
+		securityContext, err := security.RetrieveRestrictedRequestContext(r)
+		if err != nil {
+			return httperror.InternalServerError("Unable to retrieve user info from request context", err)
+		}
+
+		canEdit := userCanEditTemplate(customTemplate, securityContext)
+		hasAccess := false
+
+		if resourceControl != nil {
+			customTemplate.ResourceControl = resourceControl
+
+			teamIDs := slicesx.Map(securityContext.UserMemberships, func(m portainer.TeamMembership) portainer.TeamID {
+				return m.TeamID
+			})
+
+			hasAccess = authorization.UserCanAccessResource(securityContext.UserID, teamIDs, resourceControl)
+		}
+
+		if canEdit || hasAccess {
+			return nil
+		}
+
+		return httperror.Forbidden("Access denied to resource", httperrors.ErrResourceAccessDenied)
+	}); err != nil {
+		return response.TxErrorResponse(err)
 	}
 
 	entryPath := customTemplate.EntryPoint

api/http/handler/customtemplates/customtemplate_file_test.go

@@ -0,0 +1,115 @@
+package customtemplates
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gorilla/mux"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCustomTemplateFile(t *testing.T) {
+	_, ds := datastore.MustNewTestStore(t, true, false)
+	require.NotNil(t, ds)
+
+	fs, err := filesystem.NewService(t.TempDir(), t.TempDir())
+	require.NoError(t, err)
+
+	templateContent := "some template content"
+	templateEntrypoint := "entrypoint"
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		require.NoError(t, tx.User().Create(&portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}))
+		require.NoError(t, tx.User().Create(&portainer.User{ID: 2, Username: "std2", Role: portainer.StandardUserRole}))
+		require.NoError(t, tx.User().Create(&portainer.User{ID: 3, Username: "std3", Role: portainer.StandardUserRole}))
+		require.NoError(t, tx.User().Create(&portainer.User{ID: 4, Username: "std4", Role: portainer.StandardUserRole}))
+		require.NoError(t, tx.Endpoint().Create(&portainer.Endpoint{ID: 1,
+			UserAccessPolicies: portainer.UserAccessPolicies{
+				2: portainer.AccessPolicy{RoleID: 0},
+				3: portainer.AccessPolicy{RoleID: 0},
+			}}))
+		require.NoError(t, tx.Team().Create(&portainer.Team{ID: 1}))
+		require.NoError(t, tx.TeamMembership().Create(&portainer.TeamMembership{ID: 1, UserID: 3, TeamID: 1, Role: portainer.TeamMember}))
+
+		// template 1
+		path, err := fs.StoreCustomTemplateFileFromBytes("1", templateEntrypoint, []byte(templateContent))
+		require.NoError(t, err)
+		require.NoError(t, tx.CustomTemplate().Create(&portainer.CustomTemplate{ID: 1, EntryPoint: templateEntrypoint, ProjectPath: path}))
+
+		// template 2
+		path, err = fs.StoreCustomTemplateFileFromBytes("2", templateEntrypoint, []byte(templateContent))
+		require.NoError(t, err)
+		require.NoError(t, tx.CustomTemplate().Create(&portainer.CustomTemplate{ID: 2, EntryPoint: templateEntrypoint, ProjectPath: path}))
+
+		require.NoError(t, tx.ResourceControl().Create(&portainer.ResourceControl{ID: 1, ResourceID: "2", Type: portainer.CustomTemplateResourceControl,
+			UserAccesses: []portainer.UserResourceAccess{{UserID: 2}},
+			TeamAccesses: []portainer.TeamResourceAccess{{TeamID: 1}},
+		}))
+		return nil
+	}))
+
+	handler := NewHandler(testhelpers.NewTestRequestBouncer(), ds, fs, nil)
+
+	test := func(templateID string, restrictedContext *security.RestrictedRequestContext) (*httptest.ResponseRecorder, *httperror.HandlerError) {
+		r := httptest.NewRequest(http.MethodGet, "/custom_templates/"+templateID+"/file", nil)
+		r = mux.SetURLVars(r, map[string]string{"id": templateID})
+		ctx := security.StoreRestrictedRequestContext(r, restrictedContext)
+		r = r.WithContext(ctx)
+		rr := httptest.NewRecorder()
+		return rr, handler.customTemplateFile(rr, r)
+	}
+
+	t.Run("unknown id should get not found error", func(t *testing.T) {
+		_, r := test("0", &security.RestrictedRequestContext{UserID: 1})
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusNotFound, r.StatusCode)
+	})
+
+	t.Run("admin should access adminonly template", func(t *testing.T) {
+		rr, r := test("1", &security.RestrictedRequestContext{UserID: 1, IsAdmin: true})
+		require.Nil(t, r)
+		require.Equal(t, http.StatusOK, rr.Result().StatusCode)
+		var res struct{ FileContent string }
+		require.NoError(t, json.NewDecoder(rr.Body).Decode(&res))
+		require.Equal(t, templateContent, res.FileContent)
+	})
+
+	t.Run("std should not access adminonly template", func(t *testing.T) {
+		_, r := test("1", &security.RestrictedRequestContext{UserID: 2})
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusForbidden, r.StatusCode)
+	})
+
+	t.Run("std should access template via direct user access", func(t *testing.T) {
+		rr, r := test("2", &security.RestrictedRequestContext{UserID: 2})
+		require.Nil(t, r)
+		require.Equal(t, http.StatusOK, rr.Result().StatusCode)
+		var res struct{ FileContent string }
+		require.NoError(t, json.NewDecoder(rr.Body).Decode(&res))
+		require.Equal(t, templateContent, res.FileContent)
+	})
+
+	t.Run("std should access template via team access", func(t *testing.T) {
+		rr, r := test("2", &security.RestrictedRequestContext{UserID: 3, UserMemberships: []portainer.TeamMembership{{ID: 1, UserID: 3, TeamID: 1}}})
+		require.Nil(t, r)
+		require.Equal(t, http.StatusOK, rr.Result().StatusCode)
+		var res struct{ FileContent string }
+		require.NoError(t, json.NewDecoder(rr.Body).Decode(&res))
+		require.Equal(t, templateContent, res.FileContent)
+	})
+
+	t.Run("std should not access template without access", func(t *testing.T) {
+		_, r := test("2", &security.RestrictedRequestContext{UserID: 4})
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusForbidden, r.StatusCode)
+	})
+}

api/http/handler/customtemplates/customtemplate_inspect.go

@@ -38,7 +38,7 @@ func (handler *Handler) customTemplateInspect(w http.ResponseWriter, r *http.Req
 	var customTemplate *portainer.CustomTemplate
 	err = handler.DataStore.ViewTx(func(tx dataservices.DataStoreTx) error {
 		customTemplate, err = tx.CustomTemplate().Read(portainer.CustomTemplateID(customTemplateID))
-		if handler.DataStore.IsErrObjectNotFound(err) {
+		if tx.IsErrObjectNotFound(err) {
 			return httperror.NotFound("Unable to find a custom template with the specified identifier inside the database", err)
 		} else if err != nil {
 			return httperror.InternalServerError("Unable to find a custom template with the specified identifier inside the database", err)

api/http/handler/customtemplates/customtemplate_inspect_test.go

@@ -9,6 +9,7 @@ import (
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/filesystem"
 	"github.com/portainer/portainer/api/http/security"
 	"github.com/portainer/portainer/api/internal/testhelpers"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
@@ -20,6 +21,9 @@ func TestInspectHandler(t *testing.T) {
 	_, ds := datastore.MustNewTestStore(t, true, false)
 	require.NotNil(t, ds)
 
+	fs, err := filesystem.NewService(t.TempDir(), t.TempDir())
+	require.NoError(t, err)
+
 	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
 		require.NoError(t, tx.User().Create(&portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}))
 		require.NoError(t, tx.User().Create(&portainer.User{ID: 2, Username: "std2", Role: portainer.StandardUserRole}))
@@ -42,7 +46,7 @@ func TestInspectHandler(t *testing.T) {
 		return nil
 	}))
 
-	handler := NewHandler(testhelpers.NewTestRequestBouncer(), ds, &TestFileService{}, nil)
+	handler := NewHandler(testhelpers.NewTestRequestBouncer(), ds, fs, nil)
 
 	test := func(templateID string, restrictedContext *security.RestrictedRequestContext) (*httptest.ResponseRecorder, *httperror.HandlerError) {
 		r := httptest.NewRequest(http.MethodGet, "/custom_templates/"+templateID, nil)

api/http/handler/docker/containers/recreate.go

@@ -1,6 +1,7 @@
 package containers
 
 import (
+	"context"
 	"net/http"
 
 	portainer "github.com/portainer/portainer/api"
@@ -46,7 +47,7 @@ func (handler *Handler) recreate(w http.ResponseWriter, r *http.Request) *httper
 
 	agentTargetHeader := r.Header.Get(portainer.PortainerAgentTargetHeader)
 
-	newContainer, err := handler.containerService.Recreate(r.Context(), endpoint, containerID, payload.PullImage, "", agentTargetHeader)
+	newContainer, err := handler.containerService.Recreate(context.TODO(), endpoint, containerID, payload.PullImage, "", agentTargetHeader)
 	if err != nil {
 		return httperror.InternalServerError("Error recreating container", err)
 	}

api/http/handler/docker/endpoint_authorization_test.go

@@ -0,0 +1,95 @@
+package docker
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/apikey"
+	"github.com/portainer/portainer/api/datastore"
+	dockerdomain "github.com/portainer/portainer/api/docker"
+	dockerclient "github.com/portainer/portainer/api/docker/client"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/jwt"
+	"github.com/portainer/portainer/pkg/fips"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// unreachableDockerURL points the test environment at a port that refuses connections, so an
+// authorized caller fails fast when the handler builds a docker client rather than blocking on a
+// real daemon. The authorization middleware runs before this, which is what these tests assert.
+const unreachableDockerURL = "tcp://127.0.0.1:1"
+
+func newDashboardAuthTestHandler(t *testing.T) (*Handler, *jwt.Service, *datastore.Store) {
+	t.Helper()
+	fips.InitFIPS(false)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	require.NoError(t, store.Endpoint().Create(&portainer.Endpoint{
+		ID: 1, Name: "docker-env", Type: portainer.DockerEnvironment, URL: unreachableDockerURL,
+	}))
+
+	jwtService, err := jwt.NewService("1h", store)
+	require.NoError(t, err)
+
+	bouncer := security.NewRequestBouncer(store, jwtService, apikey.NewAPIKeyService(nil, nil))
+
+	factory := dockerclient.NewClientFactory(nil, nil)
+	authorizationService := authorization.NewService(store)
+	containerService := dockerdomain.NewContainerService(factory, store)
+
+	handler := NewHandler(bouncer, authorizationService, store, factory, containerService)
+
+	return handler, jwtService, store
+}
+
+func dashboardRequest(t *testing.T, handler *Handler, jwtService *jwt.Service, user *portainer.User) *httptest.ResponseRecorder {
+	t.Helper()
+
+	req := httptest.NewRequest(http.MethodGet, "/docker/1/dashboard", nil)
+	tk, _, err := jwtService.GenerateToken(&portainer.TokenData{ID: user.ID, Username: user.Username, Role: user.Role})
+	require.NoError(t, err)
+	testhelpers.AddTestSecurityCookie(req, tk)
+
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+	return rr
+}
+
+// TestEndpointAuthorization_DeniedUser_Returns403 verifies that the docker /dashboard
+// route rejects users with no access policy for the target environment (R8S-1057).
+func TestEndpointAuthorization_DeniedUser_Returns403(t *testing.T) {
+	handler, jwtService, store := newDashboardAuthTestHandler(t)
+
+	noAccessUser := &portainer.User{
+		Username:                "no-access",
+		Role:                    portainer.StandardUserRole,
+		PortainerAuthorizations: authorization.DefaultPortainerAuthorizations(),
+	}
+	require.NoError(t, store.User().Create(noAccessUser))
+
+	// A standard user with no access policy must be rejected before the dashboard handler
+	// builds a docker client for the environment.
+	rr := dashboardRequest(t, handler, jwtService, noAccessUser)
+
+	assert.Equal(t, http.StatusForbidden, rr.Code)
+}
+
+// TestEndpointAuthorization_AuthorizedUser_NotForbidden verifies that the docker /dashboard
+// route lets an authorized caller through the authorization middleware (R8S-1057). The request
+// fails later when the handler cannot reach the docker daemon, but it must not be rejected with 403.
+func TestEndpointAuthorization_AuthorizedUser_NotForbidden(t *testing.T) {
+	handler, jwtService, store := newDashboardAuthTestHandler(t)
+
+	adminUser := &portainer.User{Username: "admin", Role: portainer.AdministratorRole}
+	require.NoError(t, store.User().Create(adminUser))
+
+	rr := dashboardRequest(t, handler, jwtService, adminUser)
+
+	assert.NotEqual(t, http.StatusForbidden, rr.Code)
+}

api/http/handler/docker/handler.go

@@ -44,7 +44,9 @@ func NewHandler(bouncer security.BouncerService, authorizationService *authoriza
 	endpointRouter.Use(bouncer.AuthenticatedAccess)
 	endpointRouter.Use(middlewares.WithEndpoint(dataStore.Endpoint(), "id"), dockerOnlyMiddleware)
 
-	endpointRouter.Handle("/dashboard", httperror.LoggerHandler(h.dashboard)).Methods(http.MethodGet)
+	// /dashboard is the only route on this router without its own endpoint authorization;
+	// the containers/images sub-routers already apply CheckEndpointAuthorization.
+	endpointRouter.Handle("/dashboard", middlewares.CheckEndpointAuthorization(bouncer)(httperror.LoggerHandler(h.dashboard))).Methods(http.MethodGet)
 
 	containersHandler := containers.NewHandler("/docker/{id}/containers", bouncer, dataStore, dockerClientFactory, containerService)
 	endpointRouter.PathPrefix("/containers").Handler(containersHandler)

api/http/handler/docker/utils/get_stacks.go

@@ -19,6 +19,7 @@ type StackViewModel struct {
 	Name       string
 	IsExternal bool
 	Type       portainer.StackType
+	Labels     map[string]string
 }
 
 // GetDockerStacks retrieves all the stacks associated to a specific environment filtered by the user's access.
@@ -56,6 +57,7 @@ func GetDockerStacks(tx dataservices.DataStoreTx, securityContext *security.Rest
 				Name:       name,
 				IsExternal: true,
 				Type:       portainer.DockerComposeStack,
+				Labels:     container.Labels,
 			}
 		}
 	}
@@ -68,6 +70,7 @@ func GetDockerStacks(tx dataservices.DataStoreTx, securityContext *security.Rest
 				Name:       name,
 				IsExternal: true,
 				Type:       portainer.DockerSwarmStack,
+				Labels:     service.Spec.Labels,
 			}
 		}
 	}
@@ -79,7 +82,10 @@ func GetDockerStacks(tx dataservices.DataStoreTx, securityContext *security.Rest
 
 	return uac.FilterByResourceControl(stacksList, user, securityContext.UserMemberships,
 		func(item StackViewModel) (*portainer.ResourceControl, error) {
-			return uac.StackResourceControlGetter(tx, environmentID)(*item.InternalStack)
+			if item.InternalStack != nil {
+				return uac.StackResourceControlGetter(tx, environmentID)(*item.InternalStack)
+			}
+			return uac.ExternalStackResourceControlGetter(tx, environmentID)(uac.ExternalStack{Labels: item.Labels})
 		},
 	)
 }

api/http/handler/docker/utils/get_stacks_test.go

@@ -8,7 +8,7 @@ import (
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/datastore"
-	dockerconsts "github.com/portainer/portainer/api/docker/consts"
+	"github.com/portainer/portainer/api/docker/consts"
 	"github.com/portainer/portainer/api/http/security"
 
 	"github.com/stretchr/testify/assert"
@@ -28,12 +28,13 @@ func TestHandler_getDockerStacks(t *testing.T) {
 	containers := []types.Container{
 		{
 			Labels: map[string]string{
-				dockerconsts.ComposeStackNameLabel: "stack1",
+				consts.ComposeStackNameLabel: "stack1",
 			},
 		},
 		{
 			Labels: map[string]string{
-				dockerconsts.ComposeStackNameLabel: "stack2",
+				consts.ComposeStackNameLabel:        "stack2",
+				"io.portainer.accesscontrol.public": "true",
 			},
 		},
 	}
@@ -43,7 +44,7 @@ func TestHandler_getDockerStacks(t *testing.T) {
 			Spec: swarm.ServiceSpec{
 				Annotations: swarm.Annotations{
 					Labels: map[string]string{
-						dockerconsts.SwarmStackNameLabel: "stack3",
+						consts.SwarmStackNameLabel: "stack3",
 					},
 				},
 			},
@@ -65,14 +66,16 @@ func TestHandler_getDockerStacks(t *testing.T) {
 		is.NoError(tx.Stack().Create(&stack1))
 		is.NoError(tx.Stack().Create(&portainer.Stack{
 			ID:         2,
-			Name:       "stack2",
+			Name:       "stack2", // stack 2 on env 2
 			EndpointID: 2,
 			Type:       portainer.DockerSwarmStack,
 		}))
 		is.NoError(tx.User().Create(&portainer.User{ID: 1, Role: portainer.AdministratorRole}))
+		is.NoError(tx.User().Create(&portainer.User{ID: 2, Role: portainer.StandardUserRole}))
 		return nil
 	}))
 
+	// testing admin user
 	is.NoError(store.ViewTx(func(tx dataservices.DataStoreTx) error {
 		stacksList, err := GetDockerStacks(tx, &security.RestrictedRequestContext{
 			IsAdmin: true,
@@ -93,11 +96,43 @@ func TestHandler_getDockerStacks(t *testing.T) {
 				Name:       "stack2",
 				IsExternal: true,
 				Type:       portainer.DockerComposeStack,
+				Labels: map[string]string{
+					consts.ComposeStackNameLabel:        "stack2",
+					"io.portainer.accesscontrol.public": "true",
+				},
 			},
 			{
 				Name:       "stack3",
 				IsExternal: true,
 				Type:       portainer.DockerSwarmStack,
+				Labels: map[string]string{
+					consts.SwarmStackNameLabel: "stack3",
+				},
+			},
+		}
+
+		assert.ElementsMatch(t, expectedStacks, stacksList)
+		return nil
+	}))
+
+	// testing standard user
+	is.NoError(store.ViewTx(func(tx dataservices.DataStoreTx) error {
+		stacksList, err := GetDockerStacks(tx, &security.RestrictedRequestContext{
+			IsAdmin: false,
+			UserID:  2,
+		}, environment.ID, containers, services)
+		require.NoError(t, err)
+		assert.Len(t, stacksList, 1)
+
+		expectedStacks := []StackViewModel{
+			{
+				Name:       "stack2",
+				IsExternal: true,
+				Type:       portainer.DockerComposeStack,
+				Labels: map[string]string{
+					consts.ComposeStackNameLabel:        "stack2",
+					"io.portainer.accesscontrol.public": "true",
+				},
 			},
 		}
 

api/http/handler/endpoints/endpoint_list.go

@@ -39,6 +39,7 @@ const (
 // @param tagsPartialMatch query bool false "If true, will return environment(endpoint) which has one of tagIds, if false (or missing) will return only environments(endpoints) that has all the tags"
 // @param endpointIds query []int false "will return only these environments(endpoints)"
 // @param excludeIds query []int false "will exclude these environments(endpoints)"
+// @param excludeGroupIds query []int false "will exclude environments(endpoints) belonging to these endpoint groups"
 // @param provisioned query bool false "If true, will return environment(endpoint) that were provisioned"
 // @param agentVersions query []string false "will return only environments with on of these agent versions"
 // @param edgeAsync query bool false "if exists true show only edge async agents, false show only standard edge agents. if missing, will show both types (relevant only for edge agents)"

api/http/handler/endpoints/filter.go

@@ -38,6 +38,7 @@ type EnvironmentsQuery struct {
 	edgeStackId              portainer.EdgeStackID
 	edgeStackStatus          *portainer.EdgeStackStatusType
 	excludeIds               []portainer.EndpointID
+	excludeGroupIds          []portainer.EndpointGroupID
 	edgeGroupIds             []portainer.EdgeGroupID
 	excludeEdgeGroupIds      []portainer.EdgeGroupID
 }
@@ -80,6 +81,11 @@ func parseQuery(r *http.Request) (EnvironmentsQuery, error) {
 		return EnvironmentsQuery{}, err
 	}
 
+	excludeGroupIDs, err := getNumberArrayQueryParameter[portainer.EndpointGroupID](r, "excludeGroupIds")
+	if err != nil {
+		return EnvironmentsQuery{}, err
+	}
+
 	edgeGroupIDs, err := getNumberArrayQueryParameter[portainer.EdgeGroupID](r, "edgeGroupIds")
 	if err != nil {
 		return EnvironmentsQuery{}, err
@@ -119,6 +125,7 @@ func parseQuery(r *http.Request) (EnvironmentsQuery, error) {
 		tagIds:                   tagIDs,
 		endpointIds:              endpointIDs,
 		excludeIds:               excludeIDs,
+		excludeGroupIds:          excludeGroupIDs,
 		tagsPartialMatch:         tagsPartialMatch,
 		groupIds:                 groupIDs,
 		status:                   status,
@@ -157,6 +164,12 @@ func (handler *Handler) filterEndpointsByQuery(
 		})
 	}
 
+	if len(query.excludeGroupIds) > 0 {
+		filteredEndpoints = filter(filteredEndpoints, func(endpoint portainer.Endpoint) bool {
+			return !slices.Contains(query.excludeGroupIds, endpoint.GroupID)
+		})
+	}
+
 	if len(query.groupIds) > 0 {
 		filteredEndpoints = filterEndpointsByGroupIDs(filteredEndpoints, query.groupIds)
 	}

api/http/handler/endpoints/filter_test.go

@@ -151,6 +151,46 @@ func Test_Filter_excludeIDs(t *testing.T) {
 	runTests(tests, t, handler, environments)
 }
 
+func Test_Filter_excludeGroupIDs(t *testing.T) {
+	groupA := portainer.EndpointGroupID(10)
+	groupB := portainer.EndpointGroupID(20)
+	groupC := portainer.EndpointGroupID(30)
+
+	endpoints := []portainer.Endpoint{
+		{ID: 1, GroupID: groupA, Type: portainer.DockerEnvironment},
+		{ID: 2, GroupID: groupA, Type: portainer.DockerEnvironment},
+		{ID: 3, GroupID: groupB, Type: portainer.DockerEnvironment},
+		{ID: 4, GroupID: groupB, Type: portainer.DockerEnvironment},
+		{ID: 5, GroupID: groupC, Type: portainer.DockerEnvironment},
+	}
+
+	handler := setupFilterTest(t, endpoints)
+
+	tests := []filterTest{
+		{
+			title:    "should exclude endpoints in groupA",
+			expected: []portainer.EndpointID{3, 4, 5},
+			query: EnvironmentsQuery{
+				excludeGroupIds: []portainer.EndpointGroupID{groupA},
+			},
+		},
+		{
+			title:    "should exclude endpoints in groupA and groupB",
+			expected: []portainer.EndpointID{5},
+			query: EnvironmentsQuery{
+				excludeGroupIds: []portainer.EndpointGroupID{groupA, groupB},
+			},
+		},
+		{
+			title:    "should return all endpoints when excludeGroupIds is empty",
+			expected: []portainer.EndpointID{1, 2, 3, 4, 5},
+			query:    EnvironmentsQuery{},
+		},
+	}
+
+	runTests(tests, t, handler, endpoints)
+}
+
 func BenchmarkFilterEndpointsBySearchCriteria_PartialMatch(b *testing.B) {
 	n := 10000
 

api/http/handler/endpoints/handler.go

@@ -61,7 +61,7 @@ func NewHandler(bouncer security.BouncerService) *Handler {
 		bouncer.RestrictedAccess(httperror.LoggerHandler(h.endpointList))).Methods(http.MethodGet)
 	h.Handle("/endpoints/agent_versions",
 		bouncer.RestrictedAccess(httperror.LoggerHandler(h.agentVersions))).Methods(http.MethodGet)
-	h.Handle("/endpoints/relations", bouncer.RestrictedAccess(httperror.LoggerHandler(h.updateRelations))).Methods(http.MethodPut)
+	h.Handle("/endpoints/relations", bouncer.AdminAccess(httperror.LoggerHandler(h.updateRelations))).Methods(http.MethodPut)
 
 	h.Handle("/endpoints/{id}",
 		bouncer.RestrictedAccess(httperror.LoggerHandler(h.endpointInspect))).Methods(http.MethodGet)

api/http/handler/handler.go

@@ -81,7 +81,7 @@ type Handler struct {
 }
 
 // @title PortainerCE API
-// @version 2.39.0
+// @version 2.39.3
 // @description.markdown api-description.md
 // @termsOfService
 

api/http/handler/kubernetes/endpoint_authorization_test.go

@@ -0,0 +1,124 @@
+package kubernetes
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+	"github.com/portainer/portainer/api/jwt"
+	"github.com/portainer/portainer/api/kubernetes"
+	kubeclient "github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// denyingBouncer satisfies security.BouncerService but rejects AuthorizedEndpointOperation.
+type denyingBouncer struct{}
+
+func (denyingBouncer) PublicAccess(h http.Handler) http.Handler         { return h }
+func (denyingBouncer) AdminAccess(h http.Handler) http.Handler          { return h }
+func (denyingBouncer) RestrictedAccess(h http.Handler) http.Handler     { return h }
+func (denyingBouncer) TeamLeaderAccess(h http.Handler) http.Handler     { return h }
+func (denyingBouncer) AuthenticatedAccess(h http.Handler) http.Handler  { return h }
+func (denyingBouncer) EdgeComputeOperation(h http.Handler) http.Handler { return h }
+func (denyingBouncer) AuthorizedEndpointOperation(_ *http.Request, _ *portainer.Endpoint) error {
+	return security.ErrAuthorizationRequired
+}
+func (denyingBouncer) AuthorizedEdgeEndpointOperation(_ *http.Request, _ *portainer.Endpoint) error {
+	return nil
+}
+func (denyingBouncer) CookieAuthLookup(*http.Request) (*portainer.TokenData, error) { return nil, nil }
+func (denyingBouncer) JWTAuthLookup(*http.Request) (*portainer.TokenData, error)    { return nil, nil }
+func (denyingBouncer) TrustedEdgeEnvironmentAccess(dataservices.DataStoreTx, *portainer.Endpoint) error {
+	return nil
+}
+func (denyingBouncer) RevokeJWT(string) {}
+func (denyingBouncer) DisableCSP()      {}
+
+func newEndpointAuthTestHandler(t *testing.T, bouncer security.BouncerService) (*Handler, *portainer.User, string) {
+	t.Helper()
+
+	srv := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{}`))
+	}))
+	t.Cleanup(srv.Close)
+
+	_, store := datastore.MustNewTestStore(t, true, true)
+
+	err := store.Endpoint().Create(&portainer.Endpoint{
+		ID:   1,
+		Type: portainer.KubernetesLocalEnvironment,
+	})
+	require.NoError(t, err)
+
+	u := &portainer.User{Username: "user", Role: portainer.StandardUserRole}
+	err = store.User().Create(u)
+	require.NoError(t, err)
+
+	jwtService, err := jwt.NewService("1h", store)
+	require.NoError(t, err)
+
+	tk, _, err := jwtService.GenerateToken(&portainer.TokenData{ID: u.ID, Username: u.Username, Role: u.Role})
+	require.NoError(t, err)
+
+	kubeClusterAccessService := kubernetes.NewKubeClusterAccessService("", "", "")
+
+	srvURL, err := url.Parse(srv.URL)
+	require.NoError(t, err)
+
+	cli := testhelpers.NewKubernetesClient()
+	factory, err := kubeclient.NewClientFactory(nil, nil, store, "", ":"+srvURL.Port(), "")
+	require.NoError(t, err)
+
+	authorizationService := authorization.NewService(store)
+	handler := NewHandler(bouncer, authorizationService, store, jwtService, kubeClusterAccessService, factory, cli)
+
+	return handler, u, tk
+}
+
+func newEndpointAuthRequest(t *testing.T, method, path string, u *portainer.User, tk string) *http.Request {
+	t.Helper()
+
+	req := httptest.NewRequest(method, path, nil)
+	ctx := security.StoreTokenData(req, &portainer.TokenData{ID: u.ID, Username: u.Username, Role: u.Role})
+	req = req.WithContext(ctx)
+	ctx = security.StoreRestrictedRequestContext(req, &security.RestrictedRequestContext{IsAdmin: false, UserID: u.ID})
+	req = req.WithContext(ctx)
+	testhelpers.AddTestSecurityCookie(req, tk)
+	return req
+}
+
+func TestEndpointAuthorization_DeniedUser_Returns403(t *testing.T) {
+	t.Parallel()
+
+	routes := []struct {
+		method string
+		path   string
+	}{
+		{http.MethodGet, "/kubernetes/1/namespaces"},
+		{http.MethodGet, "/kubernetes/1/configmaps"},
+		{http.MethodGet, "/kubernetes/1/services"},
+		{http.MethodGet, "/kubernetes/1/secrets"},
+		{http.MethodGet, "/kubernetes/1/ingresses"},
+	}
+
+	handler, u, tk := newEndpointAuthTestHandler(t, denyingBouncer{})
+
+	for _, route := range routes {
+		t.Run(route.method+" "+route.path, func(t *testing.T) {
+			req := newEndpointAuthRequest(t, route.method, route.path, u, tk)
+			rr := httptest.NewRecorder()
+			handler.ServeHTTP(rr, req)
+
+			assert.Equal(t, http.StatusForbidden, rr.Code)
+		})
+	}
+}

api/http/handler/kubernetes/handler.go

@@ -50,6 +50,7 @@ func NewHandler(bouncer security.BouncerService, authorizationService *authoriza
 	// endpoints
 	endpointRouter := kubeRouter.PathPrefix("/{id}").Subrouter()
 	endpointRouter.Use(middlewares.WithEndpoint(dataStore.Endpoint(), "id"))
+	endpointRouter.Use(middlewares.CheckEndpointAuthorization(bouncer))
 	endpointRouter.Use(h.kubeClientMiddleware)
 
 	endpointRouter.Handle("/applications", httperror.LoggerHandler(h.GetAllKubernetesApplications)).Methods(http.MethodGet)
@@ -113,7 +114,7 @@ func NewHandler(bouncer security.BouncerService, authorizationService *authoriza
 	namespaceRouter := endpointRouter.PathPrefix("/namespaces/{namespace}").Subrouter()
 	namespaceRouter.Handle("/configmaps/{configmap}", httperror.LoggerHandler(h.getKubernetesConfigMap)).Methods(http.MethodGet)
 	namespaceRouter.Handle("/events", httperror.LoggerHandler(h.getKubernetesEventsForNamespace)).Methods(http.MethodGet)
-	namespaceRouter.Handle("/system", bouncer.RestrictedAccess(httperror.LoggerHandler(h.namespacesToggleSystem))).Methods(http.MethodPut)
+	namespaceRouter.Handle("/system", bouncer.AdminAccess(httperror.LoggerHandler(h.namespacesToggleSystem))).Methods(http.MethodPut)
 	namespaceRouter.Handle("/ingresscontrollers", httperror.LoggerHandler(h.getKubernetesIngressControllersByNamespace)).Methods(http.MethodGet)
 	namespaceRouter.Handle("/ingresscontrollers", httperror.LoggerHandler(h.updateKubernetesIngressControllersByNamespace)).Methods(http.MethodPut)
 	namespaceRouter.Handle("/ingresses/{ingress}", httperror.LoggerHandler(h.getKubernetesIngress)).Methods(http.MethodGet)

api/http/handler/registries/handler.go

@@ -72,6 +72,7 @@ func (handler *Handler) initRouter(bouncer accessGuard) {
 	adminRouter.Handle("/registries/{id}", httperror.LoggerHandler(handler.registryUpdate)).Methods(http.MethodPut)
 	adminRouter.Handle("/registries/{id}/configure", httperror.LoggerHandler(handler.registryConfigure)).Methods(http.MethodPost)
 	adminRouter.Handle("/registries/{id}", httperror.LoggerHandler(handler.registryDelete)).Methods(http.MethodDelete)
+	adminRouter.PathPrefix("/registries/proxies/gitlab").Handler(httperror.LoggerHandler(handler.proxyRequestsToGitlabAPIWithoutRegistry))
 
 	// Use registry-specific access bouncer for inspect and repositories endpoints
 	registryAccessRouter := handler.NewRoute().Subrouter()
@@ -82,7 +83,6 @@ func (handler *Handler) initRouter(bouncer accessGuard) {
 	authenticatedRouter := handler.NewRoute().Subrouter()
 	authenticatedRouter.Use(bouncer.AuthenticatedAccess)
 	authenticatedRouter.Handle("/registries/ping", httperror.LoggerHandler(handler.pingRegistry)).Methods(http.MethodPost)
-	authenticatedRouter.PathPrefix("/registries/proxies/gitlab").Handler(httperror.LoggerHandler(handler.proxyRequestsToGitlabAPIWithoutRegistry))
 }
 
 type accessGuard interface {

api/http/handler/settings/handler.go

@@ -20,11 +20,12 @@ func hideFields(settings *portainer.Settings) {
 // Handler is the HTTP handler used to handle settings operations.
 type Handler struct {
 	*mux.Router
-	DataStore       dataservices.DataStore
-	FileService     portainer.FileService
-	JWTService      portainer.JWTService
-	LDAPService     portainer.LDAPService
-	SnapshotService portainer.SnapshotService
+	DataStore          dataservices.DataStore
+	FileService        portainer.FileService
+	JWTService         portainer.JWTService
+	LDAPService        portainer.LDAPService
+	SnapshotService    portainer.SnapshotService
+	SetupTokenRequired bool
 }
 
 // NewHandler creates a handler to manage settings operations.

api/http/handler/settings/settings_public.go

@@ -47,6 +47,8 @@ type publicSettingsResponse struct {
 	}
 
 	IsDockerDesktopExtension bool `json:"IsDockerDesktopExtension" example:"false"`
+	// Whether the setup wizard must send the X-Setup-Token header for admin init / restore
+	RequiresSetupToken bool `json:"RequiresSetupToken" example:"false"`
 }
 
 // @id SettingsPublic
@@ -65,6 +67,7 @@ func (handler *Handler) settingsPublic(w http.ResponseWriter, r *http.Request) *
 	}
 
 	publicSettings := generatePublicSettings(settings)
+	publicSettings.RequiresSetupToken = handler.SetupTokenRequired
 
 	return response.JSON(w, publicSettings)
 }

api/http/handler/users/admin_init.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/security/setuptoken"
 	httperror "github.com/portainer/portainer/pkg/libhttp/error"
 	"github.com/portainer/portainer/pkg/libhttp/request"
 	"github.com/portainer/portainer/pkg/libhttp/response"
@@ -31,17 +32,23 @@ func (payload *adminInitPayload) Validate(r *http.Request) error {
 // @id UserAdminInit
 // @summary Initialize administrator account
 // @description Initialize the 'admin' user account.
-// @description **Access policy**: public
+// @description **Access policy**: public (requires the X-Setup-Token header on an uninitialized instance unless --no-setup-token is set)
 // @tags users
 // @accept json
 // @produce json
+// @param X-Setup-Token header string false "Setup token (required when instance is uninitialized and --no-setup-token is not set)"
 // @param body body adminInitPayload true "User details"
 // @success 200 {object} portainer.User "Success"
 // @failure 400 "Invalid request"
+// @failure 403 "Access denied - invalid or missing setup token"
 // @failure 409 "Admin user already initialized"
 // @failure 500 "Server error"
 // @router /users/admin/init [post]
 func (handler *Handler) adminInit(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
+	if err := setuptoken.Validate(r, handler.SetupToken); err != nil {
+		return err
+	}
+
 	var payload adminInitPayload
 	err := request.DecodeAndValidateJSONPayload(r, &payload)
 	if err != nil {

api/http/handler/users/admin_init_test.go

@@ -0,0 +1,65 @@
+package users
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/portainer/portainer/api/apikey"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/http/security/setuptoken"
+	"github.com/portainer/portainer/api/internal/testhelpers"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newAdminInitHandler(t *testing.T) *Handler {
+	t.Helper()
+	_, store := datastore.MustNewTestStore(t, true, false)
+	rateLimiter := security.NewRateLimiter(10, 1*time.Second, 1*time.Hour)
+	apiKeyService := apikey.NewAPIKeyService(store.APIKeyRepository(), store.User())
+	h := NewHandler(testhelpers.NewTestRequestBouncer(), rateLimiter, apiKeyService, mockPasswordStrengthChecker{})
+	h.DataStore = store
+	h.CryptoService = testhelpers.NewCryptoService()
+	h.AdminCreationDone = make(chan struct{}, 1)
+	return h
+}
+
+func Test_adminInit_setupTokenGate(t *testing.T) {
+	t.Parallel()
+
+	t.Run("403 without token header", func(t *testing.T) {
+		handler := newAdminInitHandler(t)
+		handler.SetupToken = "secret-token"
+		body := strings.NewReader(`{"Username":"admin","Password":"abcdefgh12"}`)
+		r := httptest.NewRequest(http.MethodPost, "/users/admin/init", body)
+		err := handler.adminInit(httptest.NewRecorder(), r)
+		require.NotNil(t, err)
+		assert.Equal(t, http.StatusForbidden, err.StatusCode)
+	})
+
+	t.Run("403 with wrong token", func(t *testing.T) {
+		handler := newAdminInitHandler(t)
+		handler.SetupToken = "secret-token"
+		body := strings.NewReader(`{"Username":"admin","Password":"abcdefgh12"}`)
+		r := httptest.NewRequest(http.MethodPost, "/users/admin/init", body)
+		r.Header.Set(setuptoken.HeaderName, "wrong")
+		err := handler.adminInit(httptest.NewRecorder(), r)
+		require.NotNil(t, err)
+		assert.Equal(t, http.StatusForbidden, err.StatusCode)
+	})
+
+	t.Run("succeeds with correct token", func(t *testing.T) {
+		handler := newAdminInitHandler(t)
+		handler.SetupToken = "secret-token"
+		body := strings.NewReader(`{"Username":"admin","Password":"abcdefgh12"}`)
+		r := httptest.NewRequest(http.MethodPost, "/users/admin/init", body)
+		r.Header.Set(setuptoken.HeaderName, "secret-token")
+		err := handler.adminInit(httptest.NewRecorder(), r)
+		assert.Nil(t, err)
+	})
+}

api/http/handler/users/handler.go

@@ -35,6 +35,7 @@ type Handler struct {
 	passwordStrengthChecker security.PasswordStrengthChecker
 	AdminCreationDone       chan<- struct{}
 	FileService             portainer.FileService
+	SetupToken              string
 }
 
 // NewHandler creates a handler to manage user operations.

api/http/handler/websocket/attach.go

@@ -28,7 +28,6 @@ import (
 // @produce json
 // @param endpointId query int true "environment(endpoint) ID of the environment(endpoint) where the resource is located"
 // @param nodeName query string false "node name"
-// @param token query string true "JWT token used for authentication against this environment(endpoint)"
 // @success 200
 // @failure 400
 // @failure 403

api/http/handler/websocket/attach_test.go

@@ -0,0 +1,34 @@
+package websocket
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestWebsocketAttach_deniesUnauthorizedEndpoint asserts a non-admin with no access policy on
+// the environment is rejected with 403 — the environment-access (L2) gate (BE-13027).
+func TestWebsocketAttach_deniesUnauthorizedEndpoint(t *testing.T) {
+	handler, _ := newWebsocketTestHandler(t)
+
+	user := &portainer.User{Username: "restricted", Role: portainer.StandardUserRole}
+	err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(user)
+	})
+	require.NoError(t, err)
+
+	// attach requires a hexadecimal `id` query parameter to reach the authorization check.
+	req := httptest.NewRequest(http.MethodGet, "/websocket/attach?id=abcdef&endpointId=2", nil)
+	req = req.WithContext(security.StoreTokenData(req, &portainer.TokenData{ID: user.ID, Role: portainer.StandardUserRole}))
+
+	handlerErr := handler.websocketAttach(httptest.NewRecorder(), req)
+
+	require.NotNil(t, handlerErr, "expected an authorization error for a denied environment")
+	assert.Equal(t, http.StatusForbidden, handlerErr.StatusCode)
+}

api/http/handler/websocket/exec.go

@@ -32,7 +32,6 @@ type execStartOperationPayload struct {
 // @produce json
 // @param endpointId query int true "environment(endpoint) ID of the environment(endpoint) where the resource is located"
 // @param nodeName query string false "node name"
-// @param token query string true "JWT token used for authentication against this environment(endpoint)"
 // @success 200
 // @failure 400
 // @failure 409

api/http/handler/websocket/exec_test.go

@@ -0,0 +1,34 @@
+package websocket
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestWebsocketExec_deniesUnauthorizedEndpoint asserts a non-admin with no access policy on
+// the environment is rejected with 403 — the environment-access (L2) gate (BE-13027).
+func TestWebsocketExec_deniesUnauthorizedEndpoint(t *testing.T) {
+	handler, _ := newWebsocketTestHandler(t)
+
+	user := &portainer.User{Username: "restricted", Role: portainer.StandardUserRole}
+	err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(user)
+	})
+	require.NoError(t, err)
+
+	// exec requires a hexadecimal `id` query parameter to reach the authorization check.
+	req := httptest.NewRequest(http.MethodGet, "/websocket/exec?id=abcdef&endpointId=2", nil)
+	req = req.WithContext(security.StoreTokenData(req, &portainer.TokenData{ID: user.ID, Role: portainer.StandardUserRole}))
+
+	handlerErr := handler.websocketExec(httptest.NewRecorder(), req)
+
+	require.NotNil(t, handlerErr, "expected an authorization error for a denied environment")
+	assert.Equal(t, http.StatusForbidden, handlerErr.StatusCode)
+}

api/http/handler/websocket/pod.go

@@ -31,7 +31,6 @@ import (
 // @param podName query string true "name of the pod containing the container"
 // @param containerName query string true "name of the container"
 // @param command query string true "command to execute in the container"
-// @param token query string true "JWT token used for authentication against this environment(endpoint)"
 // @success 200
 // @failure 400
 // @failure 403

api/http/handler/websocket/pod_test.go

@@ -0,0 +1,62 @@
+package websocket
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// podExecQuery is the minimal set of query parameters required to reach the authorization
+// check in websocketPodExec.
+const podExecQuery = "/websocket/pod?endpointId=2&namespace=default&podName=p&containerName=c&command=sh"
+
+// TestWebsocketPodExec_deniesUnauthorizedEndpoint asserts a non-admin with no access policy on
+// the environment is rejected with 403 — the environment-access (L2) gate (BE-13027).
+func TestWebsocketPodExec_deniesUnauthorizedEndpoint(t *testing.T) {
+	handler, _ := newWebsocketTestHandler(t)
+
+	user := &portainer.User{Username: "restricted", Role: portainer.StandardUserRole}
+	err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(user)
+	})
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodGet, podExecQuery, nil)
+	req = req.WithContext(security.StoreTokenData(req, &portainer.TokenData{ID: user.ID, Role: portainer.StandardUserRole}))
+
+	handlerErr := handler.websocketPodExec(httptest.NewRecorder(), req)
+
+	require.NotNil(t, handlerErr, "expected an authorization error for a denied environment")
+	assert.Equal(t, http.StatusForbidden, handlerErr.StatusCode)
+}
+
+// TestWebsocketPodExec_allowsAuthorizedNonAdmin asserts a non-admin granted environment access
+// passes authorization (reaching the nil client via getToken and panicking). CE has no
+// operation-level (L3) layer, so environment access is the only gate (BE-13027).
+func TestWebsocketPodExec_allowsAuthorizedNonAdmin(t *testing.T) {
+	handler, endpoint := newWebsocketTestHandler(t)
+
+	user := &portainer.User{Username: "standard", Role: portainer.StandardUserRole}
+	err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		if err := tx.User().Create(user); err != nil {
+			return err
+		}
+		// Access is by membership; the access policy's role is irrelevant to the CE access decision.
+		endpoint.UserAccessPolicies = portainer.UserAccessPolicies{user.ID: {}}
+		return tx.Endpoint().UpdateEndpoint(endpoint.ID, endpoint)
+	})
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodGet, podExecQuery, nil)
+	req = req.WithContext(security.StoreTokenData(req, &portainer.TokenData{ID: user.ID, Role: portainer.StandardUserRole}))
+
+	assert.Panics(t, func() {
+		_ = handler.websocketPodExec(httptest.NewRecorder(), req)
+	})
+}

api/http/handler/websocket/shell_pod.go

@@ -18,10 +18,10 @@ import (
 // @accept json
 // @produce json
 // @param endpointId query int true "environment(endpoint) ID of the environment(endpoint) where the resource is located"
-// @param token query string true "JWT token used for authentication against this environment(endpoint)"
 // @success 200 "Success"
 // @failure 400 "Invalid request"
 // @failure 403 "Permission denied"
+// @failure 404 "Environment not found"
 // @failure 500 "Server error"
 // @router /websocket/kubernetes-shell [get]
 func (handler *Handler) websocketShellPodExec(w http.ResponseWriter, r *http.Request) *httperror.HandlerError {
@@ -37,9 +37,13 @@ func (handler *Handler) websocketShellPodExec(w http.ResponseWriter, r *http.Req
 		return httperror.InternalServerError("Unable to find the environment associated to the stack inside the database", err)
 	}
 
+	if err := handler.requestBouncer.AuthorizedEndpointOperation(r, endpoint); err != nil {
+		return httperror.Forbidden("Permission denied to access environment", err)
+	}
+
 	tokenData, err := security.RetrieveTokenData(r)
 	if err != nil {
-		return httperror.Forbidden("Permission denied to access environment", err)
+		return httperror.InternalServerError("Unable to retrieve user authentication token", err)
 	}
 
 	cli, err := handler.KubernetesClientFactory.GetPrivilegedKubeClient(endpoint)

api/http/handler/websocket/shell_pod_test.go

@@ -0,0 +1,101 @@
+package websocket
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// newWebsocketTestHandler builds a websocket Handler backed by a test store with a single
+// Kubernetes environment (ID 2) and a real bouncer, returning both the handler and that
+// endpoint so callers can grant access via its UserAccessPolicies. KubernetesClientFactory is
+// left nil so any handler that proceeds past authorization trips a clear panic. Shared by the
+// exec/attach/pod/kubernetes-shell L2 tests (BE-13027).
+func newWebsocketTestHandler(t *testing.T) (*Handler, *portainer.Endpoint) {
+	t.Helper()
+
+	_, store := datastore.MustNewTestStore(t, true, false)
+
+	endpoint := &portainer.Endpoint{
+		ID:      2,
+		Name:    "target-env",
+		Type:    portainer.AgentOnKubernetesEnvironment,
+		GroupID: 1,
+	}
+	require.NoError(t, store.Endpoint().Create(endpoint))
+
+	bouncer := security.NewRequestBouncer(store, nil, nil)
+
+	handler := &Handler{
+		DataStore:      store,
+		requestBouncer: bouncer,
+		// KubernetesClientFactory intentionally left nil.
+	}
+
+	return handler, endpoint
+}
+
+// TestWebsocketShellPodExec_deniesUnauthorizedEndpoint asserts a non-admin with no access
+// policy on the environment is rejected with 403 — the environment-access (L2) gate (BE-13027).
+func TestWebsocketShellPodExec_deniesUnauthorizedEndpoint(t *testing.T) {
+	handler, _ := newWebsocketTestHandler(t)
+
+	user := &portainer.User{Username: "restricted", Role: portainer.StandardUserRole}
+	err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.User().Create(user)
+	})
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodGet, "/websocket/kubernetes-shell?endpointId=2", nil)
+	req = req.WithContext(security.StoreTokenData(req, &portainer.TokenData{ID: user.ID, Role: portainer.StandardUserRole}))
+
+	handlerErr := handler.websocketShellPodExec(httptest.NewRecorder(), req)
+
+	require.NotNil(t, handlerErr, "expected an authorization error for a denied environment")
+	assert.Equal(t, http.StatusForbidden, handlerErr.StatusCode)
+}
+
+// TestWebsocketShellPodExec_allowsAuthorizedEndpoint asserts an admin passes authorization and
+// reaches the nil KubernetesClientFactory (panic proves auth did not block the request) (BE-13027).
+func TestWebsocketShellPodExec_allowsAuthorizedEndpoint(t *testing.T) {
+	handler, _ := newWebsocketTestHandler(t)
+
+	req := httptest.NewRequest(http.MethodGet, "/websocket/kubernetes-shell?endpointId=2", nil)
+	req = req.WithContext(security.StoreTokenData(req, &portainer.TokenData{ID: 1, Role: portainer.AdministratorRole}))
+
+	assert.Panics(t, func() {
+		_ = handler.websocketShellPodExec(httptest.NewRecorder(), req)
+	})
+}
+
+// TestWebsocketShellPodExec_allowsAuthorizedNonAdmin asserts a non-admin granted environment
+// access passes authorization (reaching the nil client and panicking). CE has no operation-level
+// (L3) layer, so environment access is the only gate (BE-13027).
+func TestWebsocketShellPodExec_allowsAuthorizedNonAdmin(t *testing.T) {
+	handler, endpoint := newWebsocketTestHandler(t)
+
+	user := &portainer.User{Username: "standard", Role: portainer.StandardUserRole}
+	err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		if err := tx.User().Create(user); err != nil {
+			return err
+		}
+		// Access is by membership; the access policy's role is irrelevant to the CE access decision.
+		endpoint.UserAccessPolicies = portainer.UserAccessPolicies{user.ID: {}}
+		return tx.Endpoint().UpdateEndpoint(endpoint.ID, endpoint)
+	})
+	require.NoError(t, err)
+
+	req := httptest.NewRequest(http.MethodGet, "/websocket/kubernetes-shell?endpointId=2", nil)
+	req = req.WithContext(security.StoreTokenData(req, &portainer.TokenData{ID: user.ID, Role: portainer.StandardUserRole}))
+
+	assert.Panics(t, func() {
+		_ = handler.websocketShellPodExec(httptest.NewRecorder(), req)
+	})
+}

api/http/proxy/factory/docker/containers.go

@@ -170,18 +170,23 @@ func containerHasBlackListedLabel(containerLabels map[string]any, labelBlackList
 func (transport *Transport) decorateContainerCreationOperation(request *http.Request, resourceIdentifierAttribute string, resourceType portainer.ResourceControlType) (*http.Response, error) {
 	type PartialContainer struct {
 		HostConfig struct {
-			Privileged bool           `json:"Privileged"`
-			PidMode    string         `json:"PidMode"`
-			Devices    []any          `json:"Devices"`
-			Sysctls    map[string]any `json:"Sysctls"`
-			CapAdd     []string       `json:"CapAdd"`
-			CapDrop    []string       `json:"CapDrop"`
-			Binds      []string       `json:"Binds"`
+			Privileged  bool           `json:"Privileged"`
+			PidMode     string         `json:"PidMode"`
+			Devices     []any          `json:"Devices"`
+			Sysctls     map[string]any `json:"Sysctls"`
+			SecurityOpt []string       `json:"SecurityOpt"`
+			CapAdd      []string       `json:"CapAdd"`
+			CapDrop     []string       `json:"CapDrop"`
+			Binds       []string       `json:"Binds"`
+			Mounts      []struct {
+				Type string `json:"Type"`
+			} `json:"Mounts"`
 		} `json:"HostConfig"`
 	}
 
 	forbiddenResponse := &http.Response{
 		StatusCode: http.StatusForbidden,
+		Body:       http.NoBody,
 	}
 
 	tokenData, err := security.RetrieveTokenData(request)
@@ -230,7 +235,7 @@ func (transport *Transport) decorateContainerCreationOperation(request *http.Req
 			return nil, ErrContainerCapabilitiesForbidden
 		}
 
-		if !securitySettings.AllowBindMountsForRegularUsers && (len(partialContainer.HostConfig.Binds) > 0) {
+		if !securitySettings.AllowBindMountsForRegularUsers && len(partialContainer.HostConfig.Binds) > 0 {
 			for _, bind := range partialContainer.HostConfig.Binds {
 				if strings.HasPrefix(bind, "/") {
 					return forbiddenResponse, ErrBindMountsForbidden
@@ -238,6 +243,14 @@ func (transport *Transport) decorateContainerCreationOperation(request *http.Req
 			}
 		}
 
+		if !securitySettings.AllowBindMountsForRegularUsers && len(partialContainer.HostConfig.Mounts) > 0 {
+			for _, mount := range partialContainer.HostConfig.Mounts {
+				if mount.Type == "bind" {
+					return forbiddenResponse, ErrBindMountsForbidden
+				}
+			}
+		}
+
 		request.Body = io.NopCloser(bytes.NewBuffer(body))
 	}
 
@@ -252,3 +265,45 @@ func (transport *Transport) decorateContainerCreationOperation(request *http.Req
 
 	return response, err
 }
+
+func (transport *Transport) decorateContainerUpdateOperation(request *http.Request, containerID string) (*http.Response, error) {
+	type PartialContainerUpdate struct {
+		Devices []any `json:"Devices"`
+	}
+
+	forbiddenResponse := &http.Response{
+		StatusCode: http.StatusForbidden,
+	}
+
+	isAdminOrEndpointAdmin, err := transport.isAdminOrEndpointAdmin(request)
+	if err != nil {
+		return nil, err
+	}
+
+	if isAdminOrEndpointAdmin {
+		return transport.restrictedResourceOperation(request, containerID, containerID, portainer.ContainerResourceControl, false)
+	}
+
+	securitySettings, err := transport.fetchEndpointSecuritySettings()
+	if err != nil {
+		return nil, err
+	}
+
+	body, err := io.ReadAll(request.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	partialUpdate := &PartialContainerUpdate{}
+	if err := json.Unmarshal(body, partialUpdate); err != nil {
+		return nil, err
+	}
+
+	if !securitySettings.AllowDeviceMappingForRegularUsers && len(partialUpdate.Devices) > 0 {
+		return forbiddenResponse, ErrDeviceMappingForbidden
+	}
+
+	request.Body = io.NopCloser(bytes.NewBuffer(body))
+
+	return transport.restrictedResourceOperation(request, containerID, containerID, portainer.ContainerResourceControl, false)
+}

api/http/proxy/factory/docker/containers_test.go

@@ -0,0 +1,123 @@
+package docker
+
+import (
+	"bytes"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDecorateContainerCreationOperation_BindMounts(t *testing.T) {
+	t.Parallel()
+
+	admin := portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
+	regularUser := portainer.User{ID: 2, Username: "user", Role: portainer.StandardUserRole}
+
+	_, ds := datastore.MustNewTestStore(t, true, false)
+
+	err := ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		err := tx.User().Create(&admin)
+		require.NoError(t, err)
+
+		err = tx.User().Create(&regularUser)
+		require.NoError(t, err)
+
+		err = tx.Endpoint().Create(&portainer.Endpoint{
+			ID:   1,
+			Name: "test",
+			SecuritySettings: portainer.EndpointSecuritySettings{
+				AllowBindMountsForRegularUsers: false,
+			},
+		})
+		require.NoError(t, err)
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	srv, version := mockDockerAPIServer(t, RoutesDefinition{
+		{http.MethodPost, "/containers/create"}: map[string]any{"Id": "abc123", "Warnings": []any{}},
+	})
+	defer srv.Close()
+
+	transport := &Transport{
+		endpoint:      &portainer.Endpoint{ID: 1, URL: srv.URL},
+		dataStore:     ds,
+		HTTPTransport: &http.Transport{},
+	}
+
+	adminToken := portainer.TokenData{ID: admin.ID, Username: admin.Username, Role: admin.Role}
+	userToken := portainer.TokenData{ID: regularUser.ID, Username: regularUser.Username, Role: regularUser.Role}
+
+	makeRequest := func(token portainer.TokenData, body any) *http.Request {
+		bodyBytes, err := json.Marshal(body)
+		require.NoError(t, err)
+
+		req := httptest.NewRequest(http.MethodPost, srv.URL+"/v"+version+"/containers/create", bytes.NewReader(bodyBytes))
+		req = req.WithContext(security.StoreTokenData(req, &token))
+
+		return req
+	}
+
+	// Admin bypasses security checks
+	req := makeRequest(adminToken, map[string]any{
+		"HostConfig": map[string]any{
+			"Mounts": []map[string]any{{"Type": "bind", "Source": "/", "Target": "/host"}},
+		},
+	})
+	resp, err := transport.decorateContainerCreationOperation(req, containerObjectIdentifier, portainer.ContainerResourceControl)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+
+	// HostConfig.Binds with an absolute path is blocked for regular users
+	req = makeRequest(userToken, map[string]any{
+		"HostConfig": map[string]any{
+			"Binds": []string{"/:/host:ro"},
+		},
+	})
+	resp, err = transport.decorateContainerCreationOperation(req, containerObjectIdentifier, portainer.ContainerResourceControl)
+	require.ErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+
+	// HostConfig.Mounts with type bind is blocked for regular users
+	req = makeRequest(userToken, map[string]any{
+		"HostConfig": map[string]any{
+			"Mounts": []map[string]any{{"Type": "bind", "Source": "/", "Target": "/host"}},
+		},
+	})
+	resp, err = transport.decorateContainerCreationOperation(req, containerObjectIdentifier, portainer.ContainerResourceControl)
+	require.ErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+
+	// HostConfig.Mounts with a non-bind type is allowed for regular users
+	req = makeRequest(userToken, map[string]any{
+		"HostConfig": map[string]any{
+			"Mounts": []map[string]any{{"Type": "volume", "Source": "myvolume", "Target": "/data"}},
+		},
+	})
+	resp, err = transport.decorateContainerCreationOperation(req, containerObjectIdentifier, portainer.ContainerResourceControl)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}

api/http/proxy/factory/docker/services.go

@@ -3,13 +3,13 @@ package docker
 import (
 	"bytes"
 	"context"
-	"errors"
 	"io"
 	"net/http"
 
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/http/proxy/factory/utils"
 	"github.com/portainer/portainer/api/internal/authorization"
+	"github.com/portainer/portainer/api/logs"
 
 	"github.com/docker/docker/api/types/swarm"
 	"github.com/docker/docker/client"
@@ -18,6 +18,70 @@ import (
 
 const serviceObjectIdentifier = "ID"
 
+type partialServiceSpec struct {
+	TaskTemplate struct {
+		ContainerSpec struct {
+			CapabilityAdd  []string       `json:"CapabilityAdd"`
+			CapabilityDrop []string       `json:"CapabilityDrop"`
+			Sysctls        map[string]any `json:"Sysctls"`
+			Privileges     *struct {
+				Seccomp  *struct{ Mode string } `json:"Seccomp"`
+				AppArmor *struct{ Mode string } `json:"AppArmor"`
+			} `json:"Privileges"`
+			Mounts []struct {
+				Type          string `json:"Type"`
+				VolumeOptions *struct {
+					DriverConfig *struct {
+						Options map[string]string `json:"Options"`
+					} `json:"DriverConfig"`
+				} `json:"VolumeOptions"`
+			} `json:"Mounts"`
+		} `json:"ContainerSpec"`
+	} `json:"TaskTemplate"`
+}
+
+func CheckServiceBodyRestrictions(request *http.Request, securitySettings *portainer.EndpointSecuritySettings) error {
+	defer logs.CloseAndLogErr(request.Body)
+
+	body, err := io.ReadAll(request.Body)
+	if err != nil {
+		return err
+	}
+
+	spec := &partialServiceSpec{}
+	if err := json.Unmarshal(body, spec); err != nil {
+		return err
+	}
+
+	containerSpec := spec.TaskTemplate.ContainerSpec
+
+	if !securitySettings.AllowContainerCapabilitiesForRegularUsers && (len(containerSpec.CapabilityAdd) > 0 || len(containerSpec.CapabilityDrop) > 0) {
+		return ErrContainerCapabilitiesForbidden
+	}
+
+	if !securitySettings.AllowSysctlSettingForRegularUsers && len(containerSpec.Sysctls) > 0 {
+		return ErrSysCtlSettingsForbidden
+	}
+
+	if !securitySettings.AllowBindMountsForRegularUsers {
+		for _, mount := range containerSpec.Mounts {
+			if mount.Type == "bind" {
+				return ErrBindMountsForbidden
+			}
+
+			if mount.VolumeOptions != nil && mount.VolumeOptions.DriverConfig != nil {
+				if mount.VolumeOptions.DriverConfig.Options["type"] == "bind" {
+					return ErrBindMountsForbidden
+				}
+			}
+		}
+	}
+
+	request.Body = io.NopCloser(bytes.NewBuffer(body))
+
+	return nil
+}
+
 func getInheritedResourceControlFromServiceLabels(dockerClient *client.Client, endpointID portainer.EndpointID, serviceID string, resourceControls []portainer.ResourceControl) (*portainer.ResourceControl, error) {
 	service, _, err := dockerClient.ServiceInspectWithRaw(context.Background(), serviceID, swarm.ServiceInspectOptions{})
 	if err != nil {
@@ -90,20 +154,6 @@ func selectorServiceLabels(responseObject map[string]any) map[string]any {
 }
 
 func (transport *Transport) decorateServiceCreationOperation(request *http.Request) (*http.Response, error) {
-	type PartialService struct {
-		TaskTemplate struct {
-			ContainerSpec struct {
-				Mounts []struct {
-					Type string
-				}
-			}
-		}
-	}
-
-	forbiddenResponse := &http.Response{
-		StatusCode: http.StatusForbidden,
-	}
-
 	isAdminOrEndpointAdmin, err := transport.isAdminOrEndpointAdmin(request)
 	if err != nil {
 		return nil, err
@@ -118,25 +168,45 @@ func (transport *Transport) decorateServiceCreationOperation(request *http.Reque
 		return nil, err
 	}
 
-	body, err := io.ReadAll(request.Body)
+	if err := CheckServiceBodyRestrictions(request, securitySettings); err != nil {
+		return &http.Response{
+			StatusCode: http.StatusForbidden,
+			Body:       io.NopCloser(bytes.NewBufferString("Access denied: insufficient permissions to create service with specified configuration")),
+		}, err
+	}
+
+	return transport.replaceRegistryAuthenticationHeader(request)
+}
+
+func (transport *Transport) decorateServiceUpdateOperation(request *http.Request, serviceID string) (*http.Response, error) {
+	isAdminOrEndpointAdmin, err := transport.isAdminOrEndpointAdmin(request)
 	if err != nil {
 		return nil, err
 	}
 
-	partialService := &PartialService{}
-	if err := json.Unmarshal(body, partialService); err != nil {
+	if isAdminOrEndpointAdmin {
+		if err := transport.decorateRegistryAuthenticationHeader(request); err != nil {
+			return nil, err
+		}
+
+		return transport.executeDockerRequest(request)
+	}
+
+	securitySettings, err := transport.fetchEndpointSecuritySettings()
+	if err != nil {
 		return nil, err
 	}
 
-	if !securitySettings.AllowBindMountsForRegularUsers && (len(partialService.TaskTemplate.ContainerSpec.Mounts) > 0) {
-		for _, mount := range partialService.TaskTemplate.ContainerSpec.Mounts {
-			if mount.Type == "bind" {
-				return forbiddenResponse, errors.New("forbidden to use bind mounts")
-			}
-		}
+	if err := CheckServiceBodyRestrictions(request, securitySettings); err != nil {
+		return &http.Response{
+			StatusCode: http.StatusForbidden,
+			Body:       io.NopCloser(bytes.NewBufferString("Access denied: insufficient permissions to update service with specified configuration")),
+		}, err
 	}
 
-	request.Body = io.NopCloser(bytes.NewBuffer(body))
+	if err := transport.decorateRegistryAuthenticationHeader(request); err != nil {
+		return nil, err
+	}
 
-	return transport.replaceRegistryAuthenticationHeader(request)
+	return transport.restrictedResourceOperation(request, serviceID, serviceID, portainer.ServiceResourceControl, false)
 }

api/http/proxy/factory/docker/services_test.go

@@ -0,0 +1,522 @@
+package docker
+
+import (
+	"bytes"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+
+	"github.com/docker/docker/api/types/mount"
+	"github.com/docker/docker/api/types/swarm"
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+const serviceCreationAPIVersion = "1.51"
+
+type serviceCreationFixtures struct {
+	dockerSrv  *httptest.Server
+	ds         dataservices.DataStore
+	stdUser    portainer.User
+	adminUser  portainer.User
+	endpointID portainer.EndpointID
+}
+
+func newServiceCreationFixtures(t *testing.T) *serviceCreationFixtures {
+	t.Helper()
+
+	const serviceID = "some-service-id"
+
+	dockerSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodHead && r.URL.Path == "/_ping" {
+			w.Header().Add("Api-Version", serviceCreationAPIVersion)
+			_, _ = w.Write([]byte{})
+
+			return
+		}
+
+		if r.Method == http.MethodPost {
+			data, err := json.Marshal(map[string]string{"ID": serviceID})
+			if err != nil {
+				http.Error(w, err.Error(), http.StatusInternalServerError)
+
+				return
+			}
+
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusCreated)
+			_, _ = w.Write(data)
+
+			return
+		}
+
+		http.NotFound(w, r)
+	}))
+	t.Cleanup(dockerSrv.Close)
+
+	_, store := datastore.MustNewTestStore(t, true, false)
+
+	f := &serviceCreationFixtures{
+		dockerSrv:  dockerSrv,
+		ds:         store,
+		stdUser:    portainer.User{ID: 1, Username: "std", Role: portainer.StandardUserRole},
+		adminUser:  portainer.User{ID: 2, Username: "admin", Role: portainer.AdministratorRole},
+		endpointID: portainer.EndpointID(1),
+	}
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		err := tx.User().Create(&f.stdUser)
+		require.NoError(t, err)
+
+		err = tx.User().Create(&f.adminUser)
+		require.NoError(t, err)
+
+		err = tx.Endpoint().Create(&portainer.Endpoint{ID: f.endpointID, Name: "test-env"})
+		require.NoError(t, err)
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	return f
+}
+
+func (f *serviceCreationFixtures) setSecuritySettings(t *testing.T, settings portainer.EndpointSecuritySettings) {
+	t.Helper()
+
+	err := f.ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.Endpoint().UpdateEndpoint(f.endpointID, &portainer.Endpoint{
+			ID:               f.endpointID,
+			Name:             "test-env",
+			SecuritySettings: settings,
+		})
+	})
+	require.NoError(t, err)
+}
+
+func (f *serviceCreationFixtures) newTransport() *Transport {
+	return &Transport{
+		endpoint:      &portainer.Endpoint{ID: f.endpointID},
+		dataStore:     f.ds,
+		HTTPTransport: &http.Transport{},
+	}
+}
+
+func (f *serviceCreationFixtures) newRequest(t *testing.T, spec swarm.ServiceSpec, user portainer.User) *http.Request {
+	t.Helper()
+
+	data, err := json.Marshal(spec)
+	require.NoError(t, err)
+
+	req, err := http.NewRequestWithContext(
+		t.Context(),
+		http.MethodPost,
+		f.dockerSrv.URL+"/v"+serviceCreationAPIVersion+"/services/create",
+		bytes.NewReader(data),
+	)
+	require.NoError(t, err)
+
+	return req.WithContext(security.StoreTokenData(req, &portainer.TokenData{
+		ID:       user.ID,
+		Username: user.Username,
+		Role:     user.Role,
+	}))
+}
+
+var (
+	restrictiveSettings = portainer.EndpointSecuritySettings{
+		AllowContainerCapabilitiesForRegularUsers: false,
+		AllowSysctlSettingForRegularUsers:         false,
+		AllowBindMountsForRegularUsers:            false,
+	}
+
+	permissiveSettings = portainer.EndpointSecuritySettings{
+		AllowContainerCapabilitiesForRegularUsers: true,
+		AllowSysctlSettingForRegularUsers:         true,
+		AllowBindMountsForRegularUsers:            true,
+	}
+)
+
+func TestDecorateServiceCreationOperation_CapabilityAddForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				CapabilityAdd: []string{"NET_ADMIN"},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.ErrorIs(t, err, ErrContainerCapabilitiesForbidden)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_CapabilityDropForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				CapabilityDrop: []string{"MKNOD"},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.ErrorIs(t, err, ErrContainerCapabilitiesForbidden)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_CapabilitiesAllowed(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, permissiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				CapabilityAdd: []string{"NET_ADMIN"},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_NoCapabilitiesAllowed(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	var spec swarm.ServiceSpec
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.NotErrorIs(t, err, ErrContainerCapabilitiesForbidden)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_SysctlForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Sysctls: map[string]string{"net.ipv4.ip_forward": "1"},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.ErrorIs(t, err, ErrSysCtlSettingsForbidden)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_SysctlAllowed(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, permissiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Sysctls: map[string]string{"net.ipv4.ip_forward": "1"},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_BindMountForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Mounts: []mount.Mount{{Type: mount.TypeBind}},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.ErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_NonBindMountNotForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+
+	f.setSecuritySettings(t, portainer.EndpointSecuritySettings{
+		AllowContainerCapabilitiesForRegularUsers: true,
+		AllowSysctlSettingForRegularUsers:         true,
+		AllowBindMountsForRegularUsers:            false,
+	})
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Mounts: []mount.Mount{{Type: mount.TypeVolume}},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.NotErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_BindMountAllowed(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, permissiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Mounts: []mount.Mount{{Type: mount.TypeBind}},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_AdminBypassesAllSecurityChecks(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				CapabilityAdd:  []string{"NET_ADMIN"},
+				CapabilityDrop: []string{"MKNOD"},
+				Sysctls:        map[string]string{"net.ipv4.ip_forward": "1"},
+				Mounts:         []mount.Mount{{Type: mount.TypeBind}},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.adminUser))
+	require.NotErrorIs(t, err, ErrContainerCapabilitiesForbidden)
+	require.NotErrorIs(t, err, ErrSysCtlSettingsForbidden)
+	require.NotErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_StandardUserPermissiveSettingsSucceeds(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, permissiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				CapabilityAdd: []string{"NET_ADMIN"},
+				Sysctls:       map[string]string{"net.core.somaxconn": "128"},
+				Mounts:        []mount.Mount{{Type: mount.TypeBind}},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusCreated, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_VolumeWithBindDriverOptionForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Mounts: []mount.Mount{{
+					Type: mount.TypeVolume,
+					VolumeOptions: &mount.VolumeOptions{
+						DriverConfig: &mount.Driver{
+							Options: map[string]string{"type": "bind", "device": "/etc"},
+						},
+					},
+				}},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.ErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_VolumeWithBindDriverOptionAllowed(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, permissiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Mounts: []mount.Mount{{
+					Type: mount.TypeVolume,
+					VolumeOptions: &mount.VolumeOptions{
+						DriverConfig: &mount.Driver{
+							Options: map[string]string{"type": "bind", "device": "/etc"},
+						},
+					},
+				}},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceCreationOperation_VolumeWithNonBindDriverOptionNotForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Mounts: []mount.Mount{{
+					Type: mount.TypeVolume,
+					VolumeOptions: &mount.VolumeOptions{
+						DriverConfig: &mount.Driver{
+							Options: map[string]string{"type": "tmpfs"},
+						},
+					},
+				}},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceCreationOperation(f.newRequest(t, spec, f.stdUser))
+	require.NotErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateServiceUpdateOperation_VolumeWithBindDriverOptionForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newServiceCreationFixtures(t)
+	f.setSecuritySettings(t, restrictiveSettings)
+
+	spec := swarm.ServiceSpec{
+		TaskTemplate: swarm.TaskSpec{
+			ContainerSpec: &swarm.ContainerSpec{
+				Mounts: []mount.Mount{{
+					Type: mount.TypeVolume,
+					VolumeOptions: &mount.VolumeOptions{
+						DriverConfig: &mount.Driver{
+							Options: map[string]string{"type": "bind", "device": "/etc"},
+						},
+					},
+				}},
+			},
+		},
+	}
+
+	resp, err := f.newTransport().decorateServiceUpdateOperation(f.newRequest(t, spec, f.stdUser), "test-service-id")
+	require.ErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}

api/http/proxy/factory/docker/transport.go

@@ -22,6 +22,7 @@ import (
 	"github.com/portainer/portainer/api/http/security"
 	"github.com/portainer/portainer/api/internal/authorization"
 	"github.com/portainer/portainer/api/logs"
+	"github.com/portainer/portainer/api/slicesx"
 
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/api/types/swarm"
@@ -109,6 +110,28 @@ var prefixProxyFuncMap = map[string]func(*Transport, *http.Request, string) (*ht
 	"volumes":    (*Transport).proxyVolumeRequest,
 }
 
+type route struct {
+	method  string
+	pattern *regexp.Regexp
+}
+
+var adminOnlyRoutes = []route{
+	{http.MethodPost, regexp.MustCompile(`^/plugins/.+/enable$`)},
+	{http.MethodPost, regexp.MustCompile(`^/plugins/.+/disable$`)},
+	{http.MethodPost, regexp.MustCompile(`^/plugins/pull$`)},
+	{http.MethodPost, regexp.MustCompile(`^/plugins/.+/push$`)},
+	{http.MethodPost, regexp.MustCompile(`^/plugins/.+/upgrade$`)},
+	{http.MethodPost, regexp.MustCompile(`^/plugins/.+/set$`)},
+	{http.MethodPost, regexp.MustCompile(`^/plugins/create$`)},
+	{http.MethodDelete, regexp.MustCompile(`^/plugins/.+$`)},
+}
+
+func isAdminOnlyRoute(method string, path string) bool {
+	return slicesx.Some(adminOnlyRoutes, func(r route) bool {
+		return method == r.method && r.pattern.MatchString(path)
+	})
+}
+
 // ProxyDockerRequest intercepts a Docker API request and apply logic based
 // on the requested operation.
 func (transport *Transport) ProxyDockerRequest(request *http.Request) (*http.Response, error) {
@@ -137,6 +160,10 @@ func (transport *Transport) ProxyDockerRequest(request *http.Request) (*http.Res
 		return proxyFunc(transport, request, unversionedPath)
 	}
 
+	if isAdminOnlyRoute(request.Method, unversionedPath) {
+		return transport.administratorOperation(request)
+	}
+
 	return transport.executeDockerRequest(request)
 }
 
@@ -261,6 +288,11 @@ func (transport *Transport) proxyContainerRequest(request *http.Request, unversi
 			if action == "json" {
 				return transport.rewriteOperation(request, transport.containerInspectOperation)
 			}
+
+			if action == "update" {
+				return transport.decorateContainerUpdateOperation(request, containerID)
+			}
+
 			return transport.restrictedResourceOperation(request, containerID, containerID, portainer.ContainerResourceControl, false)
 		} else if match, _ := path.Match("/containers/*", requestPath); match {
 			// Handle /containers/{id} requests
@@ -292,6 +324,11 @@ func (transport *Transport) proxyServiceRequest(request *http.Request, unversion
 		if match, _ := path.Match("/services/*/*", requestPath); match {
 			// Handle /services/{id}/{action} requests
 			serviceID := path.Base(path.Dir(requestPath))
+			action := path.Base(requestPath)
+
+			if action == "update" {
+				return transport.decorateServiceUpdateOperation(request, serviceID)
+			}
 
 			if err := transport.decorateRegistryAuthenticationHeader(request); err != nil {
 				return nil, err

api/http/proxy/factory/docker/transport_test.go

@@ -108,6 +108,141 @@ func mockDockerAPIServer(t *testing.T, routes RoutesDefinition) (*httptest.Serve
 	return srv, version
 }
 
+func TestTransport_adminProxy(t *testing.T) {
+	t.Parallel()
+	admin := portainer.User{ID: 1, Username: "admin", Role: portainer.AdministratorRole}
+	std1 := portainer.User{ID: 2, Username: "std1", Role: portainer.StandardUserRole}
+	std2 := portainer.User{ID: 3, Username: "std2", Role: portainer.StandardUserRole}
+
+	_, ds := datastore.MustNewTestStore(t, true, false)
+
+	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		require.NoError(t, tx.User().Create(&admin))
+		require.NoError(t, tx.User().Create(&std1))
+		require.NoError(t, tx.User().Create(&std2))
+		require.NoError(t, tx.Endpoint().Create(&portainer.Endpoint{ID: 1, Name: "env",
+			UserAccessPolicies: portainer.UserAccessPolicies{std1.ID: portainer.AccessPolicy{RoleID: 1}},
+		}))
+
+		return nil
+	}))
+	srv, version := mockDockerAPIServer(t, RoutesDefinition{
+		// allowed routes
+		{http.MethodGet, "/plugins"}:            nil,
+		{http.MethodGet, "/plugins/xxx/json"}:   nil,
+		{http.MethodGet, "/plugins/privileges"}: nil,
+		// admin routes ; see `adminOnlyRoutes`
+		{http.MethodDelete, "/plugins/xxx"}:              nil,
+		{http.MethodPost, "/plugins/sshfs/enable"}:       nil, // simulate plugin "sshfs"
+		{http.MethodPost, "/plugins/vieux/sshfs/enable"}: nil, // simulate "vieux/sshfs"
+		{http.MethodPost, "/plugins/xxx/disable"}:        nil,
+		{http.MethodPost, "/plugins/pull"}:               nil,
+		{http.MethodPost, "/plugins/xxx/push"}:           nil,
+		{http.MethodPost, "/plugins/xxx/upgrade"}:        nil,
+		{http.MethodPost, "/plugins/xxx/set"}:            nil,
+		{http.MethodPost, "/plugins/create"}:             nil,
+	})
+	defer srv.Close()
+
+	transport := &Transport{
+		endpoint:      &portainer.Endpoint{URL: srv.URL},
+		dataStore:     ds,
+		HTTPTransport: &http.Transport{},
+	}
+
+	test := func(method string, url string, token portainer.TokenData) (*http.Response, error) {
+		req := httptest.NewRequest(method, srv.URL+"/v"+version+url, nil)
+		req = req.WithContext(security.StoreTokenData(req, &token))
+		require.NotNil(t, req)
+
+		return transport.ProxyDockerRequest(req)
+	}
+
+	adminToken := portainer.TokenData{ID: admin.ID, Username: admin.Username, Role: admin.Role}
+	std1Token := portainer.TokenData{ID: std1.ID, Username: std1.Username, Role: std1.Role}
+	std2Token := portainer.TokenData{ID: std2.ID, Username: std2.Username, Role: std2.Role}
+
+	{
+		r, err := test(http.MethodGet, "/plugins", adminToken)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodGet, "/plugins", std1Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodGet, "/plugins", std2Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/plugins/pull", adminToken)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/plugins/pull", std1Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusForbidden, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/plugins/pull", std2Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusForbidden, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/plugins/sshfs/enable", adminToken)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/plugins/sshfs/enable", std2Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusForbidden, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/plugins/vieux/sshfs/enable", adminToken)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusOK, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+
+	{
+		r, err := test(http.MethodPost, "/plugins/vieux/sshfs/enable", std2Token)
+		require.NoError(t, err)
+		require.NotNil(t, r)
+		require.Equal(t, http.StatusForbidden, r.StatusCode)
+		require.NoError(t, r.Body.Close())
+	}
+}
+
 func TestTransport_getRealResourceID(t *testing.T) {
 	srv, _ := mockDockerAPIServer(t, RoutesDefinition{
 		{http.MethodGet, "/networks"}:           []network.Summary{{ID: "16e37c629e88694663791dc738fd37affb908d7b85ce00a20680675d10554fd4", Name: "mynetwork"}},

api/http/proxy/factory/docker/volumes.go

@@ -1,9 +1,11 @@
 package docker
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"fmt"
+	"io"
 	"net/http"
 	"path"
 
@@ -15,6 +17,7 @@ import (
 	"github.com/portainer/portainer/api/logs"
 
 	"github.com/docker/docker/client"
+	"github.com/segmentio/encoding/json"
 )
 
 const volumeObjectIdentifier = "ResourceID"
@@ -122,12 +125,58 @@ func selectorVolumeLabels(responseObject map[string]any) map[string]any {
 	return utils.GetJSONObject(responseObject, "Labels")
 }
 
+func CheckVolumeBodyRestrictions(request *http.Request) error {
+	defer logs.CloseAndLogErr(request.Body)
+
+	body, err := io.ReadAll(request.Body)
+	if err != nil {
+		return err
+	}
+
+	var volumeCreateBody struct {
+		DriverOpts map[string]string `json:"DriverOpts"`
+	}
+
+	if err := json.Unmarshal(body, &volumeCreateBody); err != nil {
+		return err
+	}
+
+	if volumeCreateBody.DriverOpts["type"] == "bind" {
+		return ErrBindMountsForbidden
+	}
+
+	request.Body = io.NopCloser(bytes.NewBuffer(body))
+
+	return nil
+}
+
 func (transport *Transport) decorateVolumeResourceCreationOperation(request *http.Request, resourceType portainer.ResourceControlType) (*http.Response, error) {
 	tokenData, err := security.RetrieveTokenData(request)
 	if err != nil {
 		return nil, err
 	}
 
+	isAdminOrEndpointAdmin, err := transport.isAdminOrEndpointAdmin(request)
+	if err != nil {
+		return nil, err
+	}
+
+	if !isAdminOrEndpointAdmin {
+		securitySettings, err := transport.fetchEndpointSecuritySettings()
+		if err != nil {
+			return nil, err
+		}
+
+		if !securitySettings.AllowBindMountsForRegularUsers {
+			if err := CheckVolumeBodyRestrictions(request); err != nil {
+				return &http.Response{
+					StatusCode: http.StatusForbidden,
+					Body:       io.NopCloser(bytes.NewBufferString("Access denied: insufficient permissions to create volume with specified configuration")),
+				}, err
+			}
+		}
+	}
+
 	volumeID := request.Header.Get("X-Portainer-VolumeName")
 
 	if volumeID != "" {

api/http/proxy/factory/docker/volumes_test.go

@@ -0,0 +1,226 @@
+package docker
+
+import (
+	"bytes"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/http/security"
+
+	"github.com/docker/docker/api/types/volume"
+	"github.com/segmentio/encoding/json"
+	"github.com/stretchr/testify/require"
+)
+
+const volumeCreationAPIVersion = "1.51"
+
+type volumeCreationFixtures struct {
+	dockerSrv  *httptest.Server
+	ds         dataservices.DataStore
+	stdUser    portainer.User
+	adminUser  portainer.User
+	endpointID portainer.EndpointID
+}
+
+func newVolumeCreationFixtures(t *testing.T) *volumeCreationFixtures {
+	t.Helper()
+
+	dockerSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodHead && r.URL.Path == "/_ping" {
+			w.Header().Add("Api-Version", volumeCreationAPIVersion)
+			_, _ = w.Write([]byte{})
+
+			return
+		}
+
+		if r.Method == http.MethodPost {
+			data, err := json.Marshal(map[string]string{"Name": "test-volume"})
+			if err != nil {
+				http.Error(w, err.Error(), http.StatusInternalServerError)
+
+				return
+			}
+
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusCreated)
+			_, _ = w.Write(data)
+
+			return
+		}
+
+		http.NotFound(w, r)
+	}))
+	t.Cleanup(dockerSrv.Close)
+
+	_, store := datastore.MustNewTestStore(t, true, false)
+
+	f := &volumeCreationFixtures{
+		dockerSrv:  dockerSrv,
+		ds:         store,
+		stdUser:    portainer.User{ID: 1, Username: "std", Role: portainer.StandardUserRole},
+		adminUser:  portainer.User{ID: 2, Username: "admin", Role: portainer.AdministratorRole},
+		endpointID: portainer.EndpointID(1),
+	}
+
+	err := store.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		err := tx.User().Create(&f.stdUser)
+		require.NoError(t, err)
+
+		err = tx.User().Create(&f.adminUser)
+		require.NoError(t, err)
+
+		err = tx.Endpoint().Create(&portainer.Endpoint{ID: f.endpointID, Name: "test-env"})
+		require.NoError(t, err)
+
+		return nil
+	})
+	require.NoError(t, err)
+
+	return f
+}
+
+func (f *volumeCreationFixtures) setSecuritySettings(t *testing.T, settings portainer.EndpointSecuritySettings) {
+	t.Helper()
+
+	err := f.ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return tx.Endpoint().UpdateEndpoint(f.endpointID, &portainer.Endpoint{
+			ID:               f.endpointID,
+			Name:             "test-env",
+			SecuritySettings: settings,
+		})
+	})
+	require.NoError(t, err)
+}
+
+func (f *volumeCreationFixtures) newTransport() *Transport {
+	return &Transport{
+		endpoint:      &portainer.Endpoint{ID: f.endpointID},
+		dataStore:     f.ds,
+		HTTPTransport: &http.Transport{},
+	}
+}
+
+func (f *volumeCreationFixtures) newRequest(t *testing.T, body volume.CreateOptions, user portainer.User) *http.Request {
+	t.Helper()
+
+	data, err := json.Marshal(body)
+	require.NoError(t, err)
+
+	req, err := http.NewRequestWithContext(
+		t.Context(),
+		http.MethodPost,
+		f.dockerSrv.URL+"/v"+volumeCreationAPIVersion+"/volumes/create",
+		bytes.NewReader(data),
+	)
+	require.NoError(t, err)
+
+	return req.WithContext(security.StoreTokenData(req, &portainer.TokenData{
+		ID:       user.ID,
+		Username: user.Username,
+		Role:     user.Role,
+	}))
+}
+
+func TestDecorateVolumeResourceCreationOperation_BindDriverOptForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newVolumeCreationFixtures(t)
+	f.setSecuritySettings(t, portainer.EndpointSecuritySettings{
+		AllowBindMountsForRegularUsers: false,
+	})
+
+	body := volume.CreateOptions{
+		Name:   "evil-volume",
+		Driver: "local",
+		DriverOpts: map[string]string{
+			"type":   "bind",
+			"device": "/etc",
+			"o":      "bind",
+		},
+	}
+
+	resp, err := f.newTransport().decorateVolumeResourceCreationOperation(f.newRequest(t, body, f.stdUser), portainer.VolumeResourceControl)
+	require.ErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.Equal(t, http.StatusForbidden, resp.StatusCode)
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateVolumeResourceCreationOperation_BindDriverOptAllowedForAdmin(t *testing.T) {
+	t.Parallel()
+
+	f := newVolumeCreationFixtures(t)
+	f.setSecuritySettings(t, portainer.EndpointSecuritySettings{
+		AllowBindMountsForRegularUsers: false,
+	})
+
+	body := volume.CreateOptions{
+		Name:   "admin-volume",
+		Driver: "local",
+		DriverOpts: map[string]string{
+			"type":   "bind",
+			"device": "/etc",
+		},
+	}
+
+	resp, err := f.newTransport().decorateVolumeResourceCreationOperation(f.newRequest(t, body, f.adminUser), portainer.VolumeResourceControl)
+	require.NotErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateVolumeResourceCreationOperation_BindDriverOptAllowedWhenSettingPermissive(t *testing.T) {
+	t.Parallel()
+
+	f := newVolumeCreationFixtures(t)
+	f.setSecuritySettings(t, portainer.EndpointSecuritySettings{
+		AllowBindMountsForRegularUsers: true,
+	})
+
+	body := volume.CreateOptions{
+		Name:   "allowed-volume",
+		Driver: "local",
+		DriverOpts: map[string]string{
+			"type":   "bind",
+			"device": "/data",
+		},
+	}
+
+	resp, err := f.newTransport().decorateVolumeResourceCreationOperation(f.newRequest(t, body, f.stdUser), portainer.VolumeResourceControl)
+	require.NotErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}
+
+func TestDecorateVolumeResourceCreationOperation_NonBindDriverOptNotForbidden(t *testing.T) {
+	t.Parallel()
+
+	f := newVolumeCreationFixtures(t)
+	f.setSecuritySettings(t, portainer.EndpointSecuritySettings{
+		AllowBindMountsForRegularUsers: false,
+	})
+
+	body := volume.CreateOptions{
+		Name:   "normal-volume",
+		Driver: "local",
+		DriverOpts: map[string]string{
+			"type": "tmpfs",
+		},
+	}
+
+	resp, err := f.newTransport().decorateVolumeResourceCreationOperation(f.newRequest(t, body, f.stdUser), portainer.VolumeResourceControl)
+	require.NotErrorIs(t, err, ErrBindMountsForbidden)
+	require.NotNil(t, resp)
+	require.NotEqual(t, http.StatusForbidden, resp.StatusCode)
+	err = resp.Body.Close()
+	require.NoError(t, err)
+}

api/http/security/authorization.go

@@ -2,6 +2,7 @@ package security
 
 import (
 	"net/http"
+	"slices"
 
 	portainer "github.com/portainer/portainer/api"
 )
@@ -80,12 +81,14 @@ func AuthorizedResourceControlUpdate(resourceControl *portainer.ResourceControl,
 
 	if teamAccessesCount > 0 {
 		for _, access := range resourceControl.TeamAccesses {
-			for _, membership := range context.UserMemberships {
-				if membership.TeamID == access.TeamID {
-					return true
-				}
+			if !slices.ContainsFunc(context.UserMemberships, func(m portainer.TeamMembership) bool {
+				return m.TeamID == access.TeamID
+			}) {
+				return false
 			}
 		}
+
+		return true
 	}
 
 	return false

api/http/security/authorization_test.go

@@ -0,0 +1,173 @@
+package security
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAuthorizedResourceControlUpdate_AdminAlwaysAllowed(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{
+		AdministratorsOnly: true,
+	}
+	ctx := &RestrictedRequestContext{IsAdmin: true}
+
+	require.True(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
+
+func TestAuthorizedResourceControlUpdate_PublicAlwaysAllowed(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{
+		Public: true,
+	}
+	ctx := &RestrictedRequestContext{IsAdmin: false}
+
+	require.True(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
+
+func TestAuthorizedResourceControlUpdate_AdministratorsOnlyDenied(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{
+		AdministratorsOnly: true,
+		UserAccesses: []portainer.UserResourceAccess{
+			{UserID: 1, AccessLevel: portainer.ReadWriteAccessLevel},
+		},
+	}
+	ctx := &RestrictedRequestContext{IsAdmin: false, UserID: 1}
+
+	require.False(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
+
+func TestAuthorizedResourceControlUpdate_EmptyAccessesDenied(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{}
+	ctx := &RestrictedRequestContext{IsAdmin: false, UserID: 1}
+
+	require.False(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
+
+func TestAuthorizedResourceControlUpdate_UserAccessMatchingCurrentUser(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{
+		UserAccesses: []portainer.UserResourceAccess{
+			{UserID: 1, AccessLevel: portainer.ReadWriteAccessLevel},
+		},
+	}
+	ctx := &RestrictedRequestContext{IsAdmin: false, UserID: 1}
+
+	require.True(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
+
+func TestAuthorizedResourceControlUpdate_UserAccessNotMatchingCurrentUser(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{
+		UserAccesses: []portainer.UserResourceAccess{
+			{UserID: 2, AccessLevel: portainer.ReadWriteAccessLevel},
+		},
+	}
+	ctx := &RestrictedRequestContext{IsAdmin: false, UserID: 1}
+
+	require.False(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
+
+func TestAuthorizedResourceControlUpdate_TeamAccessUserMemberOfAllTeams(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{
+		TeamAccesses: []portainer.TeamResourceAccess{
+			{TeamID: 1, AccessLevel: portainer.ReadWriteAccessLevel},
+			{TeamID: 2, AccessLevel: portainer.ReadWriteAccessLevel},
+		},
+	}
+	ctx := &RestrictedRequestContext{
+		IsAdmin: false,
+		UserMemberships: []portainer.TeamMembership{
+			{TeamID: 1},
+			{TeamID: 2},
+		},
+	}
+
+	require.True(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
+
+func TestAuthorizedResourceControlUpdate_TeamAccessUserNotMemberOfAllTeams(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{
+		TeamAccesses: []portainer.TeamResourceAccess{
+			{TeamID: 1, AccessLevel: portainer.ReadWriteAccessLevel},
+			{TeamID: 3, AccessLevel: portainer.ReadWriteAccessLevel},
+		},
+	}
+	ctx := &RestrictedRequestContext{
+		IsAdmin: false,
+		UserMemberships: []portainer.TeamMembership{
+			{TeamID: 1},
+			{TeamID: 2},
+		},
+	}
+
+	require.False(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
+
+func TestAuthorizedResourceControlUpdate_TeamAccessUserNotMemberOfAnyTeam(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{
+		TeamAccesses: []portainer.TeamResourceAccess{
+			{TeamID: 5, AccessLevel: portainer.ReadWriteAccessLevel},
+		},
+	}
+	ctx := &RestrictedRequestContext{
+		IsAdmin: false,
+		UserMemberships: []portainer.TeamMembership{
+			{TeamID: 1},
+		},
+	}
+
+	require.False(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
+
+func TestAuthorizedResourceControlUpdate_MultipleUserAccessesDenied(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{
+		UserAccesses: []portainer.UserResourceAccess{
+			{UserID: 1, AccessLevel: portainer.ReadWriteAccessLevel},
+			{UserID: 2, AccessLevel: portainer.ReadWriteAccessLevel},
+		},
+	}
+	ctx := &RestrictedRequestContext{IsAdmin: false, UserID: 1}
+
+	require.False(t, AuthorizedResourceControlUpdate(rc, ctx))
+}
+
+func TestAuthorizedResourceControlUpdate_UserAndTeamAccessCombinationDenied(t *testing.T) {
+	t.Parallel()
+
+	rc := &portainer.ResourceControl{
+		UserAccesses: []portainer.UserResourceAccess{
+			{UserID: 1, AccessLevel: portainer.ReadWriteAccessLevel},
+		},
+		TeamAccesses: []portainer.TeamResourceAccess{
+			{TeamID: 1, AccessLevel: portainer.ReadWriteAccessLevel},
+		},
+	}
+	ctx := &RestrictedRequestContext{
+		IsAdmin: false,
+		UserID:  1,
+		UserMemberships: []portainer.TeamMembership{
+			{TeamID: 1},
+		},
+	}
+
+	require.False(t, AuthorizedResourceControlUpdate(rc, ctx))
+}

api/http/security/bouncer.go

@@ -447,26 +447,14 @@ func (bouncer *RequestBouncer) apiKeyLookup(r *http.Request) (*portainer.TokenDa
 	return tokenData, nil
 }
 
-// extractBearerToken extracts the Bearer token from the request header or query parameter and returns the token.
+// extractBearerToken extracts the Bearer token from the Authorization header and returns the token.
 func extractBearerToken(r *http.Request) (string, bool) {
-	// Token might be set via the "token" query parameter.
-	// For example, in websocket requests
-	// For these cases, hide the token from the query
-	query := r.URL.Query()
-	token := query.Get("token")
-	if token != "" {
-		query.Del("token")
-		r.URL.RawQuery = query.Encode()
-
-		return token, true
-	}
-
 	tokens, ok := r.Header[jwtTokenHeader]
 	if !ok || len(tokens) == 0 {
 		return "", false
 	}
 
-	token = tokens[0]
+	token := tokens[0]
 	token = strings.TrimPrefix(token, "Bearer ")
 
 	return token, true

api/http/security/setuptoken/setuptoken.go

@@ -0,0 +1,48 @@
+// Package setuptoken provides a one-time setup token used to protect the
+// public initialization endpoints (admin account creation and backup restore)
+// on an uninitialized Portainer instance.
+package setuptoken
+
+import (
+	"crypto/rand"
+	"crypto/subtle"
+	"encoding/hex"
+	"errors"
+	"net/http"
+
+	httperror "github.com/portainer/portainer/pkg/libhttp/error"
+)
+
+// HeaderName is the HTTP header that carries the setup token.
+const HeaderName = "X-Setup-Token"
+
+// tokenByteLength is the number of random bytes before hex-encoding (256 bits).
+const tokenByteLength = 32
+
+var errInvalidSetupToken = errors.New("invalid or missing setup token")
+
+// Generate returns a cryptographically random, hex-encoded setup token.
+func Generate() (string, error) {
+	b := make([]byte, tokenByteLength)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+
+	return hex.EncodeToString(b), nil
+}
+
+// Validate checks that the request carries the expected setup token in the
+// X-Setup-Token header. When expected is empty the gate is disabled and the
+// request is always allowed. Comparison is constant-time.
+func Validate(r *http.Request, expected string) *httperror.HandlerError {
+	if expected == "" {
+		return nil
+	}
+
+	provided := r.Header.Get(HeaderName)
+	if subtle.ConstantTimeCompare([]byte(provided), []byte(expected)) != 1 {
+		return httperror.Forbidden("Invalid or missing setup token. Provide the X-Setup-Token header with the token printed in the server logs at startup.", errInvalidSetupToken)
+	}
+
+	return nil
+}

api/http/security/setuptoken/setuptoken_test.go

@@ -0,0 +1,46 @@
+package setuptoken
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_Generate(t *testing.T) {
+	token, err := Generate()
+	require.NoError(t, err)
+	assert.Len(t, token, 64, "hex-encoded 32 bytes should be 64 characters")
+
+	token2, err := Generate()
+	require.NoError(t, err)
+	assert.NotEqual(t, token, token2, "two generated tokens should differ")
+}
+
+func Test_Validate_alwaysPassesWhenExpectedEmpty(t *testing.T) {
+	r := httptest.NewRequest(http.MethodPost, "/", nil)
+	assert.Nil(t, Validate(r, ""))
+}
+
+func Test_Validate_missingHeader(t *testing.T) {
+	r := httptest.NewRequest(http.MethodPost, "/", nil)
+	herr := Validate(r, "secret")
+	require.NotNil(t, herr)
+	assert.Equal(t, http.StatusForbidden, herr.StatusCode)
+}
+
+func Test_Validate_wrongToken(t *testing.T) {
+	r := httptest.NewRequest(http.MethodPost, "/", nil)
+	r.Header.Set(HeaderName, "wrong")
+	herr := Validate(r, "secret")
+	require.NotNil(t, herr)
+	assert.Equal(t, http.StatusForbidden, herr.StatusCode)
+}
+
+func Test_Validate_correctToken(t *testing.T) {
+	r := httptest.NewRequest(http.MethodPost, "/", nil)
+	r.Header.Set(HeaderName, "secret")
+	assert.Nil(t, Validate(r, "secret"))
+}

api/http/server.go

@@ -115,6 +115,7 @@ type Server struct {
 	PlatformService             platform.Service
 	PullLimitCheckDisabled      bool
 	TrustedOrigins              []string
+	SetupToken                  string
 }
 
 // Start starts the HTTP server
@@ -151,6 +152,7 @@ func (server *Server) Start() error {
 		server.ShutdownTrigger,
 		adminMonitor,
 	)
+	backupHandler.SetupToken = server.SetupToken
 
 	var roleHandler = roles.NewHandler(requestBouncer)
 	roleHandler.DataStore = server.DataStore
@@ -234,6 +236,7 @@ func (server *Server) Start() error {
 	settingsHandler.JWTService = server.JWTService
 	settingsHandler.LDAPService = server.LDAPService
 	settingsHandler.SnapshotService = server.SnapshotService
+	settingsHandler.SetupTokenRequired = server.SetupToken != ""
 
 	var sslHandler = sslhandler.NewHandler(requestBouncer)
 	sslHandler.SSLService = server.SSLService
@@ -286,6 +289,7 @@ func (server *Server) Start() error {
 	userHandler.CryptoService = server.CryptoService
 	userHandler.AdminCreationDone = server.AdminCreationDone
 	userHandler.FileService = server.FileService
+	userHandler.SetupToken = server.SetupToken
 
 	var websocketHandler = websocket.NewHandler(server.KubernetesTokenCacheManager, requestBouncer)
 	websocketHandler.DataStore = server.DataStore

api/internal/registryutils/ecr_reg_token.go

@@ -1,6 +1,8 @@
 package registryutils
 
 import (
+	"context"
+	"fmt"
 	"time"
 
 	portainer "github.com/portainer/portainer/api"
@@ -14,9 +16,12 @@ func isRegTokenValid(registry *portainer.Registry) (valid bool) {
 	return registry.AccessToken != "" && registry.AccessTokenExpiry > time.Now().Unix()
 }
 
-func doGetRegToken(tx dataservices.DataStoreTx, registry *portainer.Registry) error {
+func fetchRegToken(registry *portainer.Registry) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
 	ecrClient := ecr.NewService(registry.Username, registry.Password, registry.Ecr.Region)
-	accessToken, expiryAt, err := ecrClient.GetAuthorizationToken()
+	accessToken, expiryAt, err := ecrClient.GetAuthorizationToken(ctx)
 	if err != nil {
 		return err
 	}
@@ -24,12 +29,35 @@ func doGetRegToken(tx dataservices.DataStoreTx, registry *portainer.Registry) er
 	registry.AccessToken = *accessToken
 	registry.AccessTokenExpiry = expiryAt.Unix()
 
+	return nil
+}
+
+func doGetRegToken(tx dataservices.DataStoreTx, registry *portainer.Registry) error {
+	if err := fetchRegToken(registry); err != nil {
+		return err
+	}
+
 	return tx.Registry().Update(registry.ID, registry)
 }
 
-func parseRegToken(registry *portainer.Registry) (username, password string, err error) {
-	return ecr.NewService(registry.Username, registry.Password, registry.Ecr.Region).
-		ParseAuthorizationToken(registry.AccessToken)
+// RefreshAndPersistECRTokens refreshes and persists ECR tokens for all registries that need it.
+// Must be called with a real DataStoreTx (not a top-level DataStore) to avoid write-lock contention.
+func RefreshAndPersistECRTokens(tx dataservices.DataStoreTx, registries []portainer.Registry) {
+	for i := range registries {
+		reg := &registries[i]
+		if reg.Type != portainer.EcrRegistry {
+			continue
+		}
+		if isRegTokenValid(reg) {
+			continue
+		}
+		if err := doGetRegToken(tx, reg); err != nil {
+			log.Warn().
+				Err(err).
+				Str("RegistryName", reg.Name).
+				Msg("Failed to get valid ECR registry token. Skip logging with this registry.")
+		}
+	}
 }
 
 func EnsureRegTokenValid(tx dataservices.DataStoreTx, registry *portainer.Registry) error {
@@ -57,7 +85,15 @@ func GetRegEffectiveCredential(registry *portainer.Registry) (username, password
 	password = registry.Password
 
 	if registry.Type == portainer.EcrRegistry {
-		username, password, err = parseRegToken(registry)
+		// Fallback token refresh in case the upstream caller did not pre-validate the token.
+		if !isRegTokenValid(registry) {
+			if err := fetchRegToken(registry); err != nil {
+				return "", "", fmt.Errorf("ECR registry %q credentials are invalid or expired. Error: %w", registry.Name, err)
+			}
+		}
+
+		username, password, err = ecr.NewService(registry.Username, registry.Password, registry.Ecr.Region).
+			ParseAuthorizationToken(registry.AccessToken)
 	}
 
 	return

api/internal/registryutils/ecr_reg_token_test.go

@@ -0,0 +1,99 @@
+package registryutils_test
+
+import (
+	"io"
+	"strings"
+	"testing"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/datastore"
+	"github.com/portainer/portainer/api/internal/registryutils"
+	zerolog "github.com/rs/zerolog/log"
+	"github.com/stretchr/testify/require"
+)
+
+func newECRRegistry(id portainer.RegistryID, accessToken string, expiry int64) portainer.Registry {
+	return portainer.Registry{
+		ID:                id,
+		Type:              portainer.EcrRegistry,
+		Name:              "test-ecr",
+		Username:          "AKIAIOSFODNN7EXAMPLE",
+		Password:          "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+		Ecr:               portainer.EcrData{Region: "us-east-1"},
+		AccessToken:       accessToken,
+		AccessTokenExpiry: expiry,
+	}
+}
+
+func TestRefreshAndPersistECRTokens(t *testing.T) {
+	t.Run("does not modify token for ECR registry with valid token", func(t *testing.T) {
+		_, ds := datastore.MustNewTestStore(t, true, false)
+		reg := newECRRegistry(1, "valid-token", time.Now().Add(time.Hour).Unix())
+		require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			registryutils.RefreshAndPersistECRTokens(tx, []portainer.Registry{reg})
+			return nil
+		}))
+		require.Equal(t, "valid-token", reg.AccessToken)
+	})
+
+	t.Run("does not block and leaves token empty when ECR token refresh fails", func(t *testing.T) {
+		var logOutput strings.Builder
+		setupLogOutput(t, &logOutput)
+
+		_, ds := datastore.MustNewTestStore(t, true, false)
+		reg := newECRRegistry(1, "", 0)
+		require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {
+			registryutils.RefreshAndPersistECRTokens(tx, []portainer.Registry{reg})
+			return nil
+		}))
+		require.Empty(t, reg.AccessToken)
+		require.Contains(t, logOutput.String(), "test-ecr")
+		require.Contains(t, logOutput.String(), "Failed to get valid ECR registry token")
+	})
+}
+
+func setupLogOutput(t *testing.T, w io.Writer) {
+	t.Helper()
+
+	oldLogger := zerolog.Logger
+	zerolog.Logger = zerolog.Output(w)
+	t.Cleanup(func() {
+		zerolog.Logger = oldLogger
+	})
+}
+
+func TestGetRegEffectiveCredential(t *testing.T) {
+	t.Parallel()
+
+	t.Run("returns username and password directly for non-ECR registry", func(t *testing.T) {
+		t.Parallel()
+		reg := &portainer.Registry{
+			Type:     portainer.DockerHubRegistry,
+			Username: "user",
+			Password: "pass",
+		}
+		username, password, err := registryutils.GetRegEffectiveCredential(reg)
+		require.NoError(t, err)
+		require.Equal(t, "user", username)
+		require.Equal(t, "pass", password)
+	})
+
+	t.Run("parses ECR access token when token is valid", func(t *testing.T) {
+		t.Parallel()
+		reg := newECRRegistry(1, "AWS:ecr-password", time.Now().Add(time.Hour).Unix())
+		username, password, err := registryutils.GetRegEffectiveCredential(&reg)
+		require.NoError(t, err)
+		require.Equal(t, "AWS", username)
+		require.Equal(t, "ecr-password", password)
+	})
+
+	t.Run("returns error for ECR registry with missing token and invalid credentials", func(t *testing.T) {
+		t.Parallel()
+		reg := newECRRegistry(1, "", 0)
+		_, _, err := registryutils.GetRegEffectiveCredential(&reg)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "test-ecr")
+	})
+}

api/internal/testhelpers/datastore.go

@@ -147,6 +147,27 @@ func WithSettingsService(settings *portainer.Settings) datastoreOption {
 	}
 }
 
+type stubSSLSettingsService struct {
+	settings *portainer.SSLSettings
+}
+
+func (s *stubSSLSettingsService) BucketName() string { return "ssl" }
+
+func (s *stubSSLSettingsService) Settings() (*portainer.SSLSettings, error) {
+	return s.settings, nil
+}
+
+func (s *stubSSLSettingsService) UpdateSettings(settings *portainer.SSLSettings) error {
+	s.settings = settings
+	return nil
+}
+
+func WithSSLSettingsService(settings *portainer.SSLSettings) datastoreOption {
+	return func(d *testDatastore) {
+		d.sslSettings = &stubSSLSettingsService{settings: settings}
+	}
+}
+
 type stubUserService struct {
 	dataservices.UserService
 

api/kubernetes/cli/cronjob.go

@@ -64,7 +64,7 @@ func (kcl *KubeClient) fetchCronJobs(namespace string) ([]models.K8sCronJob, err
 
 // parseCronJob converts a batchv1.CronJob object to a models.K8sCronJob object.
 func (kcl *KubeClient) parseCronJob(cronJob batchv1.CronJob, jobsList *batchv1.JobList) models.K8sCronJob {
-	jobs, err := kcl.getCronJobExecutions(cronJob.Name, jobsList)
+	jobs, err := kcl.getCronJobExecutions(cronJob.Name, cronJob.Namespace, jobsList)
 	if err != nil {
 		return models.K8sCronJob{}
 	}

api/kubernetes/cli/cronjob_test.go

@@ -5,7 +5,10 @@ import (
 	"testing"
 
 	models "github.com/portainer/portainer/api/http/models/kubernetes"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	batchv1 "k8s.io/api/batch/v1"
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	kfake "k8s.io/client-go/kubernetes/fake"
 )
@@ -64,3 +67,62 @@ func (kcl *KubeClient) TestFetchCronJobs(t *testing.T) {
 		t.Logf("Deleted Cron Jobs")
 	})
 }
+
+// TestGetCronJobExecutionsNamespaceFilter verifies that getCronJobExecutions only returns
+// executions belonging to the CronJob's own namespace, even when same-named CronJobs
+// exist across multiple namespaces.
+func TestGetCronJobExecutionsNamespaceFilter(t *testing.T) {
+	backoffLimit := int32(3)
+	completions := int32(1)
+
+	makeJob := func(name, namespace, cronJobName string) batchv1.Job {
+		return batchv1.Job{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      name,
+				Namespace: namespace,
+				OwnerReferences: []metav1.OwnerReference{
+					{Kind: "CronJob", Name: cronJobName},
+				},
+			},
+			Spec: batchv1.JobSpec{
+				BackoffLimit: &backoffLimit,
+				Completions:  &completions,
+				Template: corev1.PodTemplateSpec{
+					Spec: corev1.PodSpec{
+						Containers: []corev1.Container{{Name: "worker", Image: "busybox"}},
+					},
+				},
+			},
+		}
+	}
+
+	// Simulate the cross-namespace job list returned when fetchCronJobs is called with namespace=""
+	allJobs := &batchv1.JobList{
+		Items: []batchv1.Job{
+			makeJob("backup-prod-28001440", "ns-prod", "backup"),
+			makeJob("backup-test-28001441", "ns-test", "backup"),
+		},
+	}
+
+	kcl := &KubeClient{
+		cli:         kfake.NewSimpleClientset(),
+		instanceID:  "test",
+		isKubeAdmin: true,
+	}
+
+	t.Run("returns only executions from the matching namespace", func(t *testing.T) {
+		result, err := kcl.getCronJobExecutions("backup", "ns-prod", allJobs)
+		require.NoError(t, err)
+		require.Len(t, result, 1)
+		assert.Equal(t, "ns-prod", result[0].Namespace)
+		assert.Equal(t, "backup-prod-28001440", result[0].Name)
+	})
+
+	t.Run("returns only executions from the other matching namespace", func(t *testing.T) {
+		result, err := kcl.getCronJobExecutions("backup", "ns-test", allJobs)
+		require.NoError(t, err)
+		require.Len(t, result, 1)
+		assert.Equal(t, "ns-test", result[0].Namespace)
+		assert.Equal(t, "backup-test-28001441", result[0].Name)
+	})
+}

api/kubernetes/cli/exec.go

@@ -3,8 +3,10 @@ package cli
 import (
 	"context"
 	"errors"
+	"fmt"
 	"io"
 
+	"github.com/rs/zerolog/log"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/client-go/kubernetes/scheme"
 	"k8s.io/client-go/rest"
@@ -55,29 +57,43 @@ func (kcl *KubeClient) StartExecProcess(token string, useAdminToken bool, namesp
 		TTY:       true,
 	}, scheme.ParameterCodec)
 
+	streamOpts := remotecommand.StreamOptions{
+		Stdin:  stdin,
+		Stdout: stdout,
+		Tty:    true,
+	}
+
+	// Try WebSocket executor first, fall back to SPDY if it fails
 	exec, err := remotecommand.NewWebSocketExecutorForProtocols(
 		config,
 		"GET", // WebSocket uses GET for the upgrade request
 		req.URL().String(),
 		channelProtocolList...,
 	)
-	if err != nil {
-		exec, err = remotecommand.NewSPDYExecutor(config, "POST", req.URL())
-		if err != nil {
-			errChan <- err
+	if err == nil {
+		err = exec.StreamWithContext(context.TODO(), streamOpts)
+		if err == nil {
 			return
 		}
+
+		log.Warn().
+			Err(err).
+			Str("context", "StartExecProcess").
+			Msg("WebSocket exec failed, falling back to SPDY")
 	}
 
-	err = exec.StreamWithContext(context.TODO(), remotecommand.StreamOptions{
-		Stdin:  stdin,
-		Stdout: stdout,
-		Tty:    true,
-	})
+	// Fall back to SPDY executor
+	exec, err = remotecommand.NewSPDYExecutor(config, "POST", req.URL())
+	if err != nil {
+		errChan <- fmt.Errorf("unable to create SPDY executor: %w", err)
+		return
+	}
+
+	err = exec.StreamWithContext(context.TODO(), streamOpts)
 	if err != nil {
 		var exitError utilexec.ExitError
 		if !errors.As(err, &exitError) {
-			errChan <- errors.New("unable to start exec process")
+			errChan <- fmt.Errorf("unable to start exec process: %w", err)
 		}
 	}
 }

api/kubernetes/cli/job.go

@@ -168,11 +168,15 @@ func getJobPodName(kcl *KubeClient, job batchv1.Job) string {
 
 // getCronJobExecutions returns the jobs for a given cronjob
 // it returns the jobs for the cronjob
-func (kcl *KubeClient) getCronJobExecutions(cronJobName string, jobs *batchv1.JobList) ([]models.K8sJob, error) {
+func (kcl *KubeClient) getCronJobExecutions(cronJobName string, cronJobNamespace string, jobs *batchv1.JobList) ([]models.K8sJob, error) {
 	maxItems := 5
 
 	results := make([]models.K8sJob, 0)
 	for _, job := range jobs.Items {
+		if job.Namespace != cronJobNamespace {
+			continue
+		}
+
 		for _, owner := range job.OwnerReferences {
 			if owner.Kind == "CronJob" && owner.Name == cronJobName {
 				results = append(results, kcl.parseJob(job))

api/kubernetes/cli/resource_test.go

@@ -74,7 +74,6 @@ func Test_GenerateYAML(t *testing.T) {
 				name: portainer-ctx
 			current-context: portainer-ctx
 			kind: Config
-			preferences: {}
 			users:
 			- name: test-user
 				user:

api/ldap/ldap.go

@@ -73,7 +73,7 @@ func (Service) AuthenticateUser(username, password string, settings *portainer.L
 	if err != nil {
 		return err
 	}
-	defer connection.Close()
+	defer func() { _ = connection.Close() }()
 
 	if !settings.AnonymousMode {
 		err = connection.Bind(settings.ReaderDN, settings.Password)
@@ -108,7 +108,7 @@ func (Service) GetUserGroups(username string, settings *portainer.LDAPSettings)
 	if err != nil {
 		return nil, err
 	}
-	defer connection.Close()
+	defer func() { _ = connection.Close() }()
 
 	if !settings.AnonymousMode {
 		err = connection.Bind(settings.ReaderDN, settings.Password)
@@ -133,7 +133,7 @@ func (Service) SearchUsers(settings *portainer.LDAPSettings) ([]string, error) {
 	if err != nil {
 		return nil, err
 	}
-	defer connection.Close()
+	defer func() { _ = connection.Close() }()
 
 	if !settings.AnonymousMode {
 		err = connection.Bind(settings.ReaderDN, settings.Password)
@@ -182,7 +182,7 @@ func (Service) SearchGroups(settings *portainer.LDAPSettings) ([]portainer.LDAPU
 	if err != nil {
 		return nil, err
 	}
-	defer connection.Close()
+	defer func() { _ = connection.Close() }()
 
 	if !settings.AnonymousMode {
 		err = connection.Bind(settings.ReaderDN, settings.Password)
@@ -309,7 +309,7 @@ func (Service) TestConnectivity(settings *portainer.LDAPSettings) error {
 	if err != nil {
 		return err
 	}
-	defer connection.Close()
+	defer func() { _ = connection.Close() }()
 
 	if !settings.AnonymousMode {
 		err = connection.Bind(settings.ReaderDN, settings.Password)

api/ldap/ldap_test.go

@@ -33,7 +33,7 @@ func TestCreateConnectionForURL(t *testing.T) {
 	conn, err := createConnectionForURL(settings.URL, settings)
 	require.NoError(t, err)
 	require.NotNil(t, conn)
-	conn.Close()
+	require.NoError(t, conn.Close())
 
 	// TLS
 
@@ -45,7 +45,7 @@ func TestCreateConnectionForURL(t *testing.T) {
 	conn, err = createConnectionForURL(settings.URL, settings)
 	require.NoError(t, err)
 	require.NotNil(t, conn)
-	conn.Close()
+	require.NoError(t, conn.Close())
 
 	// Invalid TLS
 

api/portainer.go

@@ -141,8 +141,11 @@ type (
 		LogLevel                  *string
 		LogMode                   *string
 		KubectlShellImage         *string
+		KubectlShellImageSet      bool
 		PullLimitCheckDisabled    *bool
 		TrustedOrigins            *string
+		NoSetupToken              *bool
+		SetupToken                *string
 	}
 
 	// CustomTemplateVariableDefinition
@@ -576,7 +579,7 @@ type (
 	}
 
 	PolicyChartBundle struct {
-		PolicyChartSummary
+		PolicyChartSummary  `mapstructure:",squash"`
 		EncodedTgz          string             `json:"EncodedTgz"`
 		Namespace           string             `json:"Namespace"`
 		PreReleaseManifest  string             `json:"PreReleaseManifest,omitempty"`
@@ -1426,6 +1429,7 @@ type (
 		LastActivity time.Time
 		Port         int
 		Credentials  string
+		HasSnapshot  bool
 	}
 
 	// TunnelServerInfo represents information associated to the tunnel server
@@ -1874,7 +1878,7 @@ type (
 
 const (
 	// APIVersion is the version number of the Portainer API
-	APIVersion = "2.39.0"
+	APIVersion = "2.39.3"
 	// Support annotation for the API version ("STS" for Short-Term Support or "LTS" for Long-Term Support)
 	APIVersionSupport = "LTS"
 	// Edition is what this edition of Portainer is called
@@ -1941,6 +1945,10 @@ const (
 	CSPEnvVar = "CSP"
 	// CompactDBEnvVar is the environment variable used to enable/disable the startup compaction of the database
 	CompactDBEnvVar = "COMPACT_DB"
+	// NoSetupTokenEnvVar is the environment variable used to disable the setup token requirement on an uninitialized instance
+	NoSetupTokenEnvVar = "PORTAINER_NO_SETUP_TOKEN"
+	// SetupTokenEnvVar is the environment variable used to provide a custom setup token for admin initialization and restore on an uninitialized instance
+	SetupTokenEnvVar = "PORTAINER_SETUP_TOKEN"
 )
 
 // List of supported features

api/stacks/deployments/deployer.go

@@ -74,18 +74,10 @@ func (d *stackDeployer) DeployComposeStack(stack *portainer.Stack, endpoint *por
 		}
 	}
 
-	if err := d.composeStackManager.Up(context.TODO(), stack, endpoint, portainer.ComposeUpOptions{
+	return d.composeStackManager.Up(context.TODO(), stack, endpoint, portainer.ComposeUpOptions{
 		ComposeOptions: options,
 		ForceRecreate:  forceRecreate,
-	}); err != nil {
-		if err := d.composeStackManager.Down(context.TODO(), stack, endpoint); err != nil {
-			log.Warn().Err(err).Msg("failed to cleanup compose stack after failed deployment")
-		}
-
-		return err
-	}
-
-	return nil
+	})
 }
 
 func (d *stackDeployer) DeployKubernetesStack(stack *portainer.Stack, endpoint *portainer.Endpoint, user *portainer.User) error {

api/stacks/deployments/deployment_compose_config.go

@@ -6,6 +6,7 @@ import (
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/registryutils"
 	"github.com/portainer/portainer/api/stacks/stackutils"
 
 	"github.com/pkg/errors"
@@ -44,6 +45,8 @@ func CreateComposeStackDeploymentConfigTx(tx dataservices.DataStoreTx, securityC
 
 	filteredRegistries := security.FilterRegistries(registries, user, securityContext.UserMemberships, endpoint.ID)
 
+	registryutils.RefreshAndPersistECRTokens(tx, filteredRegistries)
+
 	config := &ComposeStackDeploymentConfig{
 		stack:          stack,
 		endpoint:       endpoint,

api/stacks/deployments/deployment_swarm_config.go

@@ -8,6 +8,7 @@ import (
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/http/security"
+	"github.com/portainer/portainer/api/internal/registryutils"
 	"github.com/portainer/portainer/api/stacks/stackutils"
 )
 
@@ -43,6 +44,8 @@ func CreateSwarmStackDeploymentConfigTx(tx dataservices.DataStoreTx, securityCon
 
 	filteredRegistries := security.FilterRegistries(registries, user, securityContext.UserMemberships, endpoint.ID)
 
+	registryutils.RefreshAndPersistECRTokens(tx, filteredRegistries)
+
 	config := &SwarmStackDeploymentConfig{
 		stack:         stack,
 		endpoint:      endpoint,

api/stacks/stackutils/env.go

@@ -0,0 +1,34 @@
+package stackutils
+
+import (
+	"maps"
+	"os"
+	"path"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
+
+	"github.com/compose-spec/compose-go/v2/dotenv"
+)
+
+// BuildEnvMap builds the environment variable map for stack validation/loading.
+// Priority (lowest to highest): OS env → .env file → stack.Env
+func BuildEnvMap(stack *portainer.Stack) map[string]string {
+	env := make(map[string]string, len(os.Environ()))
+	for _, e := range os.Environ() {
+		k, v, _ := strings.Cut(e, "=")
+		env[k] = v
+	}
+
+	dotEnvPath := filesystem.JoinPaths(stack.ProjectPath, path.Dir(stack.EntryPoint), ".env")
+	if dotVars, err := dotenv.Read(dotEnvPath); err == nil {
+		maps.Copy(env, dotVars)
+	}
+
+	for _, pair := range stack.Env {
+		env[pair.Name] = pair.Value
+	}
+
+	return env
+}

api/stacks/stackutils/validation.go

@@ -1,38 +1,38 @@
 package stackutils
 
 import (
-	portainer "github.com/portainer/portainer/api"
+	"context"
+	"path"
 
-	"github.com/docker/cli/cli/compose/loader"
-	"github.com/docker/cli/cli/compose/types"
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
+
+	composeloader "github.com/compose-spec/compose-go/v2/loader"
+	composetypes "github.com/compose-spec/compose-go/v2/types"
 	"github.com/pkg/errors"
 )
 
-func IsValidStackFile(stackFileContent []byte, securitySettings *portainer.EndpointSecuritySettings) error {
-	composeConfigYAML, err := loader.ParseYAML(stackFileContent)
+type StackFileValidationConfig struct {
+	Content          []byte
+	SecuritySettings *portainer.EndpointSecuritySettings
+	Env              map[string]string
+	WorkingDir       string
+}
+
+func IsValidStackFile(config StackFileValidationConfig) error {
+	composeConfigDetails := composetypes.ConfigDetails{
+		ConfigFiles: []composetypes.ConfigFile{{Content: config.Content}},
+		Environment: config.Env,
+		WorkingDir:  config.WorkingDir,
+	}
+
+	composeConfig, err := composeloader.LoadWithContext(context.Background(), composeConfigDetails, composeloader.WithSkipValidation)
 	if err != nil {
 		return err
 	}
 
-	composeConfigFile := types.ConfigFile{
-		Config: composeConfigYAML,
-	}
-
-	composeConfigDetails := types.ConfigDetails{
-		ConfigFiles: []types.ConfigFile{composeConfigFile},
-		Environment: map[string]string{},
-	}
-
-	composeConfig, err := loader.Load(composeConfigDetails, func(options *loader.Options) {
-		options.SkipValidation = true
-	})
-	if err != nil {
-		return err
-	}
-
-	for key := range composeConfig.Services {
-		service := composeConfig.Services[key]
-		if !securitySettings.AllowBindMountsForRegularUsers {
+	for _, service := range composeConfig.Services {
+		if !config.SecuritySettings.AllowBindMountsForRegularUsers {
 			for _, volume := range service.Volumes {
 				if volume.Type == "bind" {
 					return errors.New("bind-mount disabled for non administrator users")
@@ -40,23 +40,23 @@ func IsValidStackFile(stackFileContent []byte, securitySettings *portainer.Endpo
 			}
 		}
 
-		if !securitySettings.AllowPrivilegedModeForRegularUsers && service.Privileged {
+		if !config.SecuritySettings.AllowPrivilegedModeForRegularUsers && service.Privileged {
 			return errors.New("privileged mode disabled for non administrator users")
 		}
 
-		if !securitySettings.AllowHostNamespaceForRegularUsers && service.Pid == "host" {
+		if !config.SecuritySettings.AllowHostNamespaceForRegularUsers && service.Pid == "host" {
 			return errors.New("pid host disabled for non administrator users")
 		}
 
-		if !securitySettings.AllowDeviceMappingForRegularUsers && len(service.Devices) > 0 {
+		if !config.SecuritySettings.AllowDeviceMappingForRegularUsers && len(service.Devices) > 0 {
 			return errors.New("device mapping disabled for non administrator users")
 		}
 
-		if !securitySettings.AllowSysctlSettingForRegularUsers && len(service.Sysctls) > 0 {
+		if !config.SecuritySettings.AllowSysctlSettingForRegularUsers && len(service.Sysctls) > 0 {
 			return errors.New("sysctl setting disabled for non administrator users")
 		}
 
-		if !securitySettings.AllowContainerCapabilitiesForRegularUsers && (len(service.CapAdd) > 0 || len(service.CapDrop) > 0) {
+		if !config.SecuritySettings.AllowContainerCapabilitiesForRegularUsers && (len(service.CapAdd) > 0 || len(service.CapDrop) > 0) {
 			return errors.New("container capabilities disabled for non administrator users")
 		}
 	}
@@ -65,13 +65,21 @@ func IsValidStackFile(stackFileContent []byte, securitySettings *portainer.Endpo
 }
 
 func ValidateStackFiles(stack *portainer.Stack, securitySettings *portainer.EndpointSecuritySettings, fileService portainer.FileService) error {
+	env := BuildEnvMap(stack)
+	workingDir := filesystem.JoinPaths(stack.ProjectPath, path.Dir(stack.EntryPoint))
+
 	for _, file := range GetStackFilePaths(stack, false) {
 		stackContent, err := fileService.GetFileContent(stack.ProjectPath, file)
 		if err != nil {
 			return errors.Wrap(err, "failed to get stack file content")
 		}
 
-		if err := IsValidStackFile(stackContent, securitySettings); err != nil {
+		if err := IsValidStackFile(StackFileValidationConfig{
+			Content:          stackContent,
+			SecuritySettings: securitySettings,
+			Env:              env,
+			WorkingDir:       workingDir,
+		}); err != nil {
 			return errors.Wrap(err, "stack config file is invalid")
 		}
 	}

api/stacks/stackutils/validation_test.go

@@ -1,10 +1,11 @@
 package stackutils
 
 import (
+	"os"
+	"path/filepath"
 	"testing"
 
 	portainer "github.com/portainer/portainer/api"
-
 	"github.com/stretchr/testify/require"
 )
 
@@ -30,32 +31,236 @@ networks:
 `)
 
 	securitySettings := &portainer.EndpointSecuritySettings{}
-	err := IsValidStackFile(yamlContent, securitySettings)
+	err := IsValidStackFile(StackFileValidationConfig{
+		Content:          yamlContent,
+		SecuritySettings: securitySettings,
+	})
 	require.NoError(t, err)
 }
 
-func TestIsValidStackFile_PortEnv(t *testing.T) {
-	yamlContent := []byte(`
+// TestIsValidStackFile_MissingEnvVarBehavior documents how port variable position affects
+// validation when the env var is not provided. Docker accepts an empty host port (left side)
+// but requires a valid container port (right side).
+func TestIsValidStackFile_MissingEnvVarBehavior(t *testing.T) {
+	securitySettings := &portainer.EndpointSecuritySettings{}
+
+	t.Run("var on left side only passes (docker allows :9090)", func(t *testing.T) {
+		err := IsValidStackFile(StackFileValidationConfig{
+			Content: []byte(`
+version: "3"
+services:
+  api:
+    image: nginx
+    ports:
+      - "${API_PORT}:9090"
+`),
+			SecuritySettings: securitySettings,
+		})
+		require.NoError(t, err)
+	})
+
+	t.Run("var on right side fails", func(t *testing.T) {
+		err := IsValidStackFile(StackFileValidationConfig{
+			Content: []byte(`
+version: "3"
+services:
+  api:
+    image: nginx
+    ports:
+      - "9090:${API_PORT}"
+`),
+			SecuritySettings: securitySettings,
+		})
+		require.Error(t, err)
+	})
+
+	t.Run("var on both sides fails", func(t *testing.T) {
+		err := IsValidStackFile(StackFileValidationConfig{
+			Content: []byte(`
+version: "3"
+services:
+  api:
+    image: nginx
+    ports:
+      - "${API_PORT}:${API_PORT}"
+`),
+			SecuritySettings: securitySettings,
+		})
+		require.Error(t, err)
+	})
+}
+
+func TestIsValidStackFile_EnvVarInBothPortFields(t *testing.T) {
+	securitySettings := &portainer.EndpointSecuritySettings{}
+	err := IsValidStackFile(StackFileValidationConfig{
+		Content: []byte(`
 version: "3"
 
 services:
-  webservice:
+  api:
     image: nginx
-    container_name: hello-world
-    networks:
-      - "mynet1"
     ports:
-      - "${PORT}:80"
-
-networks:
-  mynet1:
-    driver: bridge
-    ipam:
-      config:
-        - subnet: 172.16.0.0/24
-`)
-
-	securitySettings := &portainer.EndpointSecuritySettings{}
-	err := IsValidStackFile(yamlContent, securitySettings)
+      - "${API_PORT}:${API_PORT}"
+`),
+		SecuritySettings: securitySettings,
+		Env:              map[string]string{"API_PORT": "3000"},
+	})
 	require.NoError(t, err)
 }
+
+type mockFileService struct {
+	portainer.FileService
+	fileContent        []byte
+	projectVersionPath string
+}
+
+func (m mockFileService) GetFileContent(trustedRootPath, filePath string) ([]byte, error) {
+	return m.fileContent, nil
+}
+
+func (m mockFileService) FormProjectPathByVersion(projectPath string, version int, commitHash string) string {
+	return m.projectVersionPath
+}
+
+func TestValidateStackFiles_EnvVars(t *testing.T) {
+	fileContent := []byte(`
+version: "3"
+
+services:
+  api:
+    image: nginx
+    ports:
+      - "${API_PORT}:${API_PORT}"
+`)
+
+	stack := &portainer.Stack{
+
+		ProjectPath: "/tmp/stack/1",
+		EntryPoint:  "docker-compose.yml",
+		Env:         []portainer.Pair{{Name: "API_PORT", Value: "3000"}},
+	}
+
+	fileService := mockFileService{
+		fileContent:        fileContent,
+		projectVersionPath: "/tmp/stack/1",
+	}
+
+	securitySettings := &portainer.EndpointSecuritySettings{}
+	err := ValidateStackFiles(stack, securitySettings, fileService)
+	require.NoError(t, err)
+}
+
+func TestValidateStackFiles_OSEnvVar(t *testing.T) {
+	t.Setenv("HOST_PORT", "3000")
+
+	fileContent := []byte(`
+version: "3"
+services:
+  api:
+    image: nginx
+    ports:
+      - "80:${HOST_PORT}"
+`)
+
+	stack := &portainer.Stack{
+		ProjectPath: "/tmp/stack/1",
+		EntryPoint:  "docker-compose.yml",
+	}
+
+	fileService := mockFileService{
+		fileContent:        fileContent,
+		projectVersionPath: "/tmp/stack/1",
+	}
+
+	securitySettings := &portainer.EndpointSecuritySettings{}
+	err := ValidateStackFiles(stack, securitySettings, fileService)
+	require.NoError(t, err)
+}
+
+func TestValidateStackFiles_DotEnvFile(t *testing.T) {
+	tmpDir := t.TempDir()
+
+	err := os.WriteFile(filepath.Join(tmpDir, ".env"), []byte("HOST_PORT=3000\n"), 0600)
+	require.NoError(t, err)
+
+	fileContent := []byte(`
+version: "3"
+services:
+  api:
+    image: nginx
+    ports:
+      - "80:${HOST_PORT}"
+`)
+
+	stack := &portainer.Stack{
+		ProjectPath: tmpDir,
+		EntryPoint:  "docker-compose.yml",
+	}
+
+	fileService := mockFileService{
+		fileContent:        fileContent,
+		projectVersionPath: tmpDir,
+	}
+
+	securitySettings := &portainer.EndpointSecuritySettings{}
+	err = ValidateStackFiles(stack, securitySettings, fileService)
+	require.NoError(t, err)
+}
+
+func TestValidateStackFiles_EnvFileAttribute(t *testing.T) {
+	tmpDir := t.TempDir()
+
+	err := os.WriteFile(filepath.Join(tmpDir, "web.env"), []byte("HOST_PORT=3000\n"), 0600)
+	require.NoError(t, err)
+
+	fileContent := []byte(`
+version: "3"
+services:
+  api:
+    image: nginx
+    env_file:
+      - ./web.env
+`)
+
+	stack := &portainer.Stack{
+		ProjectPath: tmpDir,
+		EntryPoint:  "docker-compose.yml",
+	}
+
+	fileService := mockFileService{
+		fileContent:        fileContent,
+		projectVersionPath: tmpDir,
+	}
+
+	securitySettings := &portainer.EndpointSecuritySettings{}
+	err = ValidateStackFiles(stack, securitySettings, fileService)
+	require.NoError(t, err)
+}
+
+func TestValidateStackFiles_BindMountBlockedForNonAdmin(t *testing.T) {
+	fileContent := []byte(`
+version: "3"
+
+services:
+  api:
+    image: nginx
+    volumes:
+      - /host/path:/container/path
+`)
+
+	stack := &portainer.Stack{
+		ProjectPath: "/tmp/stack/1",
+		EntryPoint:  "docker-compose.yml",
+	}
+
+	fileService := mockFileService{
+		fileContent:        fileContent,
+		projectVersionPath: "/tmp/stack/1",
+	}
+
+	securitySettings := &portainer.EndpointSecuritySettings{
+		AllowBindMountsForRegularUsers: false,
+	}
+	err := ValidateStackFiles(stack, securitySettings, fileService)
+	require.ErrorContains(t, err, "bind-mount disabled for non administrator users")
+}

api/uac/stacks.go

@@ -25,3 +25,24 @@ func StackResourceControlGetter[
 func StackResourceControlID(endpointID portainer.EndpointID, name string) string {
 	return stackutils.ResourceControlID(endpointID, name)
 }
+
+type ExternalStack struct {
+	Labels map[string]string
+}
+
+// External stacks are indirectly detected either via containers or services labels
+// Any UAC applied to them can only be fetched from containers'/services' labels
+func ExternalStackResourceControlGetter[
+	TX txLike[RCS, TS, US],
+	RCS rcServiceLike,
+	TS teamServiceLike,
+	US userServiceLike,
+](
+	tx TX,
+	endpointID portainer.EndpointID) func(item ExternalStack) (*portainer.ResourceControl, error) {
+	return genericResourcControlGetter(tx, endpointID, ResourceContext[ExternalStack]{
+		RCType:       portainer.StackResourceControl,
+		IDGetter:     func(s ExternalStack) string { return "0" },
+		LabelsGetter: func(es ExternalStack) map[string]string { return es.Labels },
+	})
+}

app/docker/views/services/create/createServiceController.js

@@ -358,7 +358,7 @@ angular.module('portainer.docker').controller('CreateServiceController', [
       input.ExtraNetworks.forEach(function (network) {
         networks.push({ Target: network.Name });
       });
-      config.Networks = _.uniqWith(networks, _.isEqual);
+      config.TaskTemplate.Networks = _.uniqWith(networks, _.isEqual);
     }
 
     function prepareHostsEntries(config, input) {

app/portainer/models/settings.js

@@ -34,6 +34,7 @@ export function PublicSettingsViewModel(settings) {
   this.Edge = new EdgeSettingsViewModel(settings.Edge);
   this.DefaultRegistry = settings.DefaultRegistry;
   this.IsAMTEnabled = settings.IsAMTEnabled;
+  this.RequiresSetupToken = settings.RequiresSetupToken;
 }
 
 export function InternalAuthSettingsViewModel(data) {

app/portainer/react/components/auth.ts

@@ -0,0 +1,8 @@
+import angular from 'angular';
+
+import { r2a } from '@/react-tools/react2angular';
+import { SetupTokenTextTip } from '@/react/portainer/init/InitAdminView/SetupTokenTextTip';
+
+export const authModule = angular
+  .module('portainer.app.react.components.auth', [])
+  .component('setupTokenTextTip', r2a(SetupTokenTextTip, [])).name;

app/portainer/react/components/index.ts

@@ -52,9 +52,11 @@ import { usersModule } from './users';
 import { activityLogsModule } from './activity-logs';
 import { rbacModule } from './rbac';
 import { stacksModule } from './stacks';
+import { authModule } from './auth';
 
 export const ngModule = angular
   .module('portainer.app.react.components', [
+    authModule,
     accessControlModule,
     customTemplatesModule,
     environmentsModule,

app/portainer/rest/user.js

@@ -16,7 +16,17 @@ angular.module('portainer.app').factory('Users', [
         remove: { method: 'DELETE', params: { id: '@id' } },
         queryMemberships: { method: 'GET', isArray: true, params: { id: '@id', entity: 'memberships' } },
         checkAdminUser: { method: 'GET', params: { id: 'admin', entity: 'check' }, isArray: true, ignoreLoadingBar: true },
-        initAdminUser: { method: 'POST', params: { id: 'admin', entity: 'init' }, ignoreLoadingBar: true },
+        initAdminUser: {
+          method: 'POST',
+          params: { id: 'admin', entity: 'init' },
+          ignoreLoadingBar: true,
+          headers: { 'X-Setup-Token': (config) => config.data.setupToken },
+          transformRequest: (data) => {
+            // eslint-disable-next-line no-unused-vars
+            const { setupToken, ...payload } = data;
+            return angular.toJson(payload);
+          },
+        },
         getAccessTokens: { method: 'GET', params: { id: '@id', entity: 'tokens' }, isArray: true },
         deleteAccessToken: { url: `${API_ENDPOINT_USERS}/:id/tokens/:tokenId`, method: 'DELETE', params: { id: '@id', entityId: '@tokenId' } },
       }

app/portainer/services/api/backupService.js

@@ -11,8 +11,8 @@ angular.module('portainer.app').factory('BackupService', [
       return Backup.download({}, payload).$promise;
     };
 
-    service.uploadBackup = function (file, password) {
-      return FileUploadService.uploadBackup(file, password);
+    service.uploadBackup = function (file, password, setupToken) {
+      return FileUploadService.uploadBackup(file, password, setupToken);
     };
 
     service.getS3Settings = function () {

app/portainer/services/api/userService.js

@@ -84,8 +84,8 @@ export function UserService($q, Users, TeamService) {
     return deferred.promise;
   };
 
-  service.initAdministrator = function (username, password) {
-    return Users.initAdminUser({ Username: username, Password: password }).$promise;
+  service.initAdministrator = function (username, password, setupToken) {
+    return Users.initAdminUser({ Username: username, Password: password, setupToken }).$promise;
   };
 
   service.administratorExists = function () {

app/portainer/services/fileUpload.js

@@ -38,13 +38,11 @@ function FileUploadFactory($q, Upload) {
     });
   };
 
-  service.uploadBackup = function (file, password) {
+  service.uploadBackup = function (file, password, setupToken) {
     return Upload.upload({
       url: 'api/restore',
-      data: {
-        file,
-        password,
-      },
+      data: { file, password },
+      headers: setupToken ? { 'X-Setup-Token': setupToken } : {},
     });
   };
 

app/portainer/views/init/admin/initAdmin.html

@@ -65,6 +65,18 @@
               </div>
             </div>
             <!-- !confirm-password-input -->
+            <!-- setup-token-input -->
+            <div class="form-group" ng-if="requiresSetupToken">
+              <label for="setup_token" class="col-sm-4 control-label text-left">
+                Setup token
+                <portainer-tooltip message="'Find this token in the Portainer server logs'"></portainer-tooltip>
+              </label>
+              <div class="col-sm-8">
+                <input type="text" class="form-control" ng-model="formValues.SetupToken" id="setup_token" data-cy="init-adminSetupToken" />
+                <setup-token-text-tip></setup-token-text-tip>
+              </div>
+            </div>
+            <!-- !setup-token-input -->
             <!-- note -->
             <div class="form-group">
               <div class="col-sm-12 text-warning">
@@ -82,7 +94,7 @@
                 <button
                   type="submit"
                   class="btn btn-primary btn-sm"
-                  ng-disabled="state.actionInProgress || form.$invalid || !formValues.Password || !formValues.ConfirmPassword ||  form.password.$viewValue !== formValues.ConfirmPassword"
+                  ng-disabled="state.actionInProgress || form.$invalid || !formValues.Password || !formValues.ConfirmPassword || form.password.$viewValue !== formValues.ConfirmPassword || (requiresSetupToken && !formValues.SetupToken)"
                   ng-click="createAdminUser()"
                   button-spinner="state.actionInProgress"
                 >
@@ -277,13 +289,25 @@
               </div>
             </div>
             <!-- !note -->
+            <!-- setup-token-input -->
+            <div class="form-group" ng-if="requiresSetupToken">
+              <label for="restore_setup_token" class="col-sm-3 control-label text-left">
+                Setup token
+                <portainer-tooltip message="'Find this token in the Portainer server logs (docker logs &lt;container&gt;).'"></portainer-tooltip>
+              </label>
+              <div class="col-sm-4">
+                <input type="text" class="form-control" ng-model="formValues.SetupToken" id="restore_setup_token" data-cy="init-restoreSetupToken" />
+                <setup-token-text-tip></setup-token-text-tip>
+              </div>
+            </div>
+            <!-- !setup-token-input -->
             <!-- actions -->
             <div class="form-group">
               <div class="col-sm-12">
                 <button
                   type="submit"
                   class="btn btn-primary btn-sm"
-                  ng-disabled="!formValues.BackupFile || state.backupInProgress"
+                  ng-disabled="!formValues.BackupFile || state.backupInProgress || (requiresSetupToken && !formValues.SetupToken)"
                   ng-click="uploadBackup()"
                   button-spinner="state.backupInProgress"
                   data-cy="init-restorePortainerButton"

app/portainer/views/init/admin/initAdminController.js

@@ -1,6 +1,8 @@
 import { getEnvironments } from '@/react/portainer/environments/environment.service';
 import { restoreOptions } from '@/react/portainer/init/InitAdminView/restore-options';
 
+const REDIRECT_REASON_TIMEOUT = 'AdminInitTimeout';
+
 angular.module('portainer.app').controller('InitAdminController', [
   '$scope',
   '$state',
@@ -23,6 +25,7 @@ angular.module('portainer.app').controller('InitAdminController', [
       Username: 'admin',
       Password: '',
       ConfirmPassword: '',
+      SetupToken: '',
       restoreFormType: $scope.RESTORE_FORM_TYPES.FILE,
     };
 
@@ -51,7 +54,7 @@ angular.module('portainer.app').controller('InitAdminController', [
       var password = $scope.formValues.Password;
 
       $scope.state.actionInProgress = true;
-      UserService.initAdministrator(username, password)
+      UserService.initAdministrator(username, password, $scope.formValues.SetupToken)
         .then(function success() {
           return Authentication.login(username, password);
         })
@@ -69,8 +72,9 @@ angular.module('portainer.app').controller('InitAdminController', [
           }
         })
         .catch(function error(err) {
-          handleError(err);
-          Notifications.error('Failure', err, 'Unable to create administrator user');
+          if (!handleError(err)) {
+            Notifications.error('Failure', err, 'Unable to create administrator user');
+          }
         })
         .finally(function final() {
           $scope.state.actionInProgress = false;
@@ -79,18 +83,24 @@ angular.module('portainer.app').controller('InitAdminController', [
 
     function handleError(err) {
       if (err.status === 303) {
-        const headers = err.headers();
-        const REDIRECT_REASON_TIMEOUT = 'AdminInitTimeout';
-        if (headers && headers['redirect-reason'] === REDIRECT_REASON_TIMEOUT) {
+        const headers = err.response?.headers ?? {};
+        if (headers['redirect-reason'] === REDIRECT_REASON_TIMEOUT) {
           window.location.href = '/timeout.html';
         }
+        return true;
       }
+      if (err.status === 403) {
+        Notifications.error('Failure', err, 'Setup token is missing or invalid. Find the current token in the Portainer server logs.');
+        return true;
+      }
+      return false;
     }
 
     function createAdministratorFlow() {
       SettingsService.publicSettings()
         .then(function success(data) {
           $scope.requiredPasswordLength = data.RequiredPasswordLength;
+          $scope.requiresSetupToken = data.RequiresSetupToken;
         })
         .catch(function error(err) {
           Notifications.error('Failure', err, 'Unable to retrieve application settings');
@@ -113,7 +123,7 @@ angular.module('portainer.app').controller('InitAdminController', [
       const file = $scope.formValues.BackupFile;
       const password = $scope.formValues.Password;
 
-      restoreAndRefresh(() => BackupService.uploadBackup(file, password));
+      restoreAndRefresh(() => BackupService.uploadBackup(file, password, $scope.formValues.SetupToken));
     }
 
     async function restoreAndRefresh(restoreAsyncFn) {
@@ -122,8 +132,9 @@ angular.module('portainer.app').controller('InitAdminController', [
       try {
         await restoreAsyncFn();
       } catch (err) {
-        handleError(err);
-        Notifications.error('Failure', err, 'Unable to restore the backup');
+        if (!handleError(err)) {
+          Notifications.error('Failure', err, 'Unable to restore the backup');
+        }
         $scope.state.backupInProgress = false;
 
         return;
@@ -134,8 +145,9 @@ angular.module('portainer.app').controller('InitAdminController', [
         Notifications.success('Success', 'The backup has successfully been restored');
         $state.go('portainer.auth');
       } catch (err) {
-        handleError(err);
-        Notifications.error('Failure', err, 'Unable to check for status');
+        if (!handleError(err)) {
+          Notifications.error('Failure', err, 'Unable to check for status');
+        }
         await wait(2);
         location.reload();
       }

app/react/common/stacks/queries/useCreateStack/createStandaloneStackFromFileContent.ts

@@ -13,7 +13,7 @@ export interface StandaloneFileContentPayload {
 
   stackFileContent: string;
   /** List of environment variables */
-  env?: Array<Pair>;
+  env?: Array<Pair> | null;
 
   /** Whether the stack is from an app template */
   fromAppTemplate?: boolean;

app/react/common/stacks/queries/useCreateStack/createSwarmStackFromFileContent.ts

@@ -13,7 +13,7 @@ export interface SwarmFileContentPayload {
 
   stackFileContent: string;
   /** List of environment variables */
-  env?: Array<Pair>;
+  env?: Array<Pair> | null;
 
   /** Whether the stack is from an app template */
   fromAppTemplate?: boolean;