v1.0.25

src/routes/api/containers/[id]/+server.ts

@@ -4,7 +4,7 @@ import {
 	removeContainer,
 	getContainerLogs
 } from '$lib/server/docker';
-import { deleteAutoUpdateSchedule, getAutoUpdateSetting, removePendingContainerUpdate } from '$lib/server/db';
+import { deleteAutoUpdateSchedule, getAutoUpdateSetting, getSecretKeyNames, removePendingContainerUpdate } from '$lib/server/db';
 import { authorize } from '$lib/server/authorize';
 import { auditContainer } from '$lib/server/audit';
 import { unregisterSchedule } from '$lib/server/scheduler';
@@ -33,6 +33,24 @@ export const GET: RequestHandler = async ({ params, url, cookies }) => {
 	try {
 
 		const details = await inspectContainer(params.id, envIdNum);
+
+		// Mask secret env vars for containers belonging to a Compose stack
+		const stackName = details.Config?.Labels?.['com.docker.compose.project'];
+		if (stackName && Array.isArray(details.Config?.Env)) {
+			const secretKeys = await getSecretKeyNames(stackName, envIdNum);
+			if (secretKeys.size > 0) {
+				details.Config.Env = details.Config.Env.map((entry: string) => {
+					const eqIdx = entry.indexOf('=');
+					if (eqIdx === -1) return entry;
+					const key = entry.substring(0, eqIdx);
+					if (secretKeys.has(key)) {
+						return `${key}=***`;
+					}
+					return entry;
+				});
+			}
+		}
+
 		return json(details);
 	} catch (error: any) {
 		if (error?.statusCode === 404) {

src/routes/api/containers/[id]/inspect/+server.ts

@@ -1,6 +1,7 @@
 import { json } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
 import { inspectContainer } from '$lib/server/docker';
+import { getSecretKeyNames } from '$lib/server/db';
 import { authorize } from '$lib/server/authorize';
 import { validateDockerIdParam } from '$lib/server/docker-validation';
 
@@ -20,6 +21,24 @@ export const GET: RequestHandler = async ({ params, url, cookies }) => {
 
 	try {
 		const containerData = await inspectContainer(params.id, envIdNum);
+
+		// Mask secret env vars for containers belonging to a Compose stack
+		const stackName = containerData.Config?.Labels?.['com.docker.compose.project'];
+		if (stackName && Array.isArray(containerData.Config?.Env)) {
+			const secretKeys = await getSecretKeyNames(stackName, envIdNum);
+			if (secretKeys.size > 0) {
+				containerData.Config.Env = containerData.Config.Env.map((entry: string) => {
+					const eqIdx = entry.indexOf('=');
+					if (eqIdx === -1) return entry;
+					const key = entry.substring(0, eqIdx);
+					if (secretKeys.has(key)) {
+						return `${key}=***`;
+					}
+					return entry;
+				});
+			}
+		}
+
 		return json(containerData);
 	} catch (error) {
 		console.error('Failed to inspect container:', error);

src/routes/api/containers/[id]/update/+server.ts

@@ -1,5 +1,5 @@
 import { json } from '@sveltejs/kit';
-import { pullImage, updateContainer, type CreateContainerOptions } from '$lib/server/docker';
+import { inspectContainer, pullImage, updateContainer, type CreateContainerOptions } from '$lib/server/docker';
 import { authorize } from '$lib/server/authorize';
 import { auditContainer } from '$lib/server/audit';
 import { removePendingContainerUpdate } from '$lib/server/db';
@@ -25,6 +25,29 @@ export const POST: RequestHandler = async (event) => {
 		const body = await request.json();
 		const { startAfterUpdate, repullImage, ...options } = body;
 
+		// Resolve masked secret values (***) back to real values from the current container.
+		// The GET endpoint masks secrets in Config.Env, so the edit modal sends *** for unchanged secrets.
+		if (Array.isArray(options.env) && options.env.some((e: string) => e.endsWith('=***'))) {
+			const currentData = await inspectContainer(params.id, envIdNum);
+			const currentEnvMap = new Map<string, string>();
+			for (const entry of currentData.Config?.Env || []) {
+				const eqIdx = entry.indexOf('=');
+				if (eqIdx !== -1) {
+					currentEnvMap.set(entry.substring(0, eqIdx), entry.substring(eqIdx + 1));
+				}
+			}
+			options.env = options.env.map((entry: string) => {
+				const eqIdx = entry.indexOf('=');
+				if (eqIdx === -1) return entry;
+				const key = entry.substring(0, eqIdx);
+				const value = entry.substring(eqIdx + 1);
+				if (value === '***' && currentEnvMap.has(key)) {
+					return `${key}=${currentEnvMap.get(key)}`;
+				}
+				return entry;
+			});
+		}
+
 		if (repullImage) {
 			console.log(`Pulling image...`);
 			try {