1.0.33

src/lib/server/scheduler/tasks/container-update.ts

@@ -38,7 +38,7 @@ import {
 import { getScannerSettings, scanImage, type ScanResult, type VulnerabilitySeverity } from '../../scanner';
 import { sendEventNotification } from '../../notifications';
 import { parseImageNameAndTag, shouldBlockUpdate, combineScanSummaries, isSystemContainer } from './update-utils';
-import { isUpdateDisabledByLabel } from '../../container-labels';
+import { isUpdateDisabledByLabel, isHiddenByLabel } from '../../container-labels';
 
 // =============================================================================
 // TYPES
@@ -382,6 +382,18 @@ export async function runContainerUpdate(
 			return;
 		}
 
+		// Hidden containers are excluded from update polling and auto-updates (#1083)
+		if (isHiddenByLabel(inspectData.Config?.Labels)) {
+			log(`Skipping - dockhand.hidden=true label set on container`);
+			await updateScheduleExecution(execution.id, {
+				status: 'skipped',
+				completedAt: new Date().toISOString(),
+				duration: Date.now() - startTime,
+				details: { reason: 'Skipped by dockhand.hidden=true label' }
+			});
+			return;
+		}
+
 		// Skip digest-pinned images - they are explicitly locked to a specific version
 		if (isDigestBasedImage(imageNameFromConfig)) {
 			log(`Skipping ${containerName} - image pinned to specific digest`);

src/lib/server/scheduler/tasks/env-update-check.ts

@@ -31,7 +31,7 @@ import {
 import { sendEventNotification } from '../../notifications';
 import { getScannerSettings, scanImage, type VulnerabilitySeverity } from '../../scanner';
 import { parseImageNameAndTag, shouldBlockUpdate, combineScanSummaries, isSystemContainer } from './update-utils';
-import { isUpdateDisabledByLabel } from '../../container-labels';
+import { isUpdateDisabledByLabel, isHiddenByLabel } from '../../container-labels';
 import { recreateContainer } from './container-update';
 
 interface UpdateInfo {
@@ -105,9 +105,12 @@ export async function runEnvUpdateCheckJob(
 		// Clear pending updates at the start - we'll re-add as we discover updates
 		await clearPendingContainerUpdates(environmentId);
 
-		// Get all containers in this environment
-		const containers = await listContainers(true, environmentId);
-		await log(`Found ${containers.length} containers`);
+		// Get all containers in this environment, excluding ones hidden via
+		// dockhand.hidden=true (consistent with manual check-updates, #1083).
+		const allContainers = await listContainers(true, environmentId);
+		const containers = allContainers.filter(c => !isHiddenByLabel(c.labels));
+		const hiddenCount = allContainers.length - containers.length;
+		await log(`Found ${containers.length} containers${hiddenCount ? ` (${hiddenCount} hidden by label)` : ''}`);
 
 		const updatesAvailable: UpdateInfo[] = [];
 		let checkedCount = 0;