1.0.27

src/lib/server/scheduler/tasks/container-update.ts

@@ -38,6 +38,7 @@ import {
 import { getScannerSettings, scanImage, type ScanResult, type VulnerabilitySeverity } from '../../scanner';
 import { sendEventNotification } from '../../notifications';
 import { parseImageNameAndTag, shouldBlockUpdate, combineScanSummaries, isSystemContainer } from './update-utils';
+import { isUpdateDisabledByLabel } from '../../container-labels';
 
 // =============================================================================
 // TYPES
@@ -369,6 +370,18 @@ export async function runContainerUpdate(
 			return;
 		}
 
+		// Check dockhand.update label (label wins over DB settings)
+		if (isUpdateDisabledByLabel(inspectData.Config?.Labels)) {
+			log(`Skipping - dockhand.update=false label set on container`);
+			await updateScheduleExecution(execution.id, {
+				status: 'skipped',
+				completedAt: new Date().toISOString(),
+				duration: Date.now() - startTime,
+				details: { reason: 'Skipped by dockhand.update=false label' }
+			});
+			return;
+		}
+
 		// Skip digest-pinned images - they are explicitly locked to a specific version
 		if (isDigestBasedImage(imageNameFromConfig)) {
 			log(`Skipping ${containerName} - image pinned to specific digest`);

src/lib/server/scheduler/tasks/env-update-check.ts

@@ -31,6 +31,7 @@ import {
 import { sendEventNotification } from '../../notifications';
 import { getScannerSettings, scanImage, type VulnerabilitySeverity } from '../../scanner';
 import { parseImageNameAndTag, shouldBlockUpdate, combineScanSummaries, isSystemContainer } from './update-utils';
+import { isUpdateDisabledByLabel } from '../../container-labels';
 import { recreateContainer } from './container-update';
 
 interface UpdateInfo {
@@ -129,6 +130,12 @@ export async function runEnvUpdateCheckJob(
 					continue;
 				}
 
+				// Check dockhand.update label (label wins over DB settings)
+				if (isUpdateDisabledByLabel(inspectData.Config?.Labels)) {
+					await log(`  [${container.name}] Skipping - dockhand.update=false label`);
+					continue;
+				}
+
 				checkedCount++;
 				await log(`  Checking: ${container.name} (${imageName})`);