1.0.27

src/routes/api/containers/[id]/inspect/+server.ts

@@ -1,7 +1,8 @@
 import { json } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
 import { inspectContainer } from '$lib/server/docker';
-import { getSecretKeyNames } from '$lib/server/db';
+import { getSecretKeysToMask } from '$lib/server/db';
+import { getStackComposeFile } from '$lib/server/stacks';
 import { authorize } from '$lib/server/authorize';
 import { validateDockerIdParam } from '$lib/server/docker-validation';
 
@@ -22,10 +23,12 @@ export const GET: RequestHandler = async ({ params, url, cookies }) => {
 	try {
 		const containerData = await inspectContainer(params.id, envIdNum);
 
-		// Mask secret env vars for containers belonging to a Compose stack
+		// Mask secret env vars for containers belonging to a Compose stack.
+		// Uses compose file parsing to detect interpolation (e.g., MYSQL_PASSWORD=${db_secret}).
 		const stackName = containerData.Config?.Labels?.['com.docker.compose.project'];
 		if (stackName && Array.isArray(containerData.Config?.Env)) {
-			const secretKeys = await getSecretKeyNames(stackName, envIdNum);
+			const composeResult = await getStackComposeFile(stackName, envIdNum).catch(() => null);
+			const secretKeys = await getSecretKeysToMask(stackName, envIdNum, composeResult?.content);
 			if (secretKeys.size > 0) {
 				containerData.Config.Env = containerData.Config.Env.map((entry: string) => {
 					const eqIdx = entry.indexOf('=');