1.0.9

src/lib/server/scheduler/tasks/container-update.ts

@@ -31,7 +31,7 @@ import {
 } from '../../docker';
 import { getScannerSettings, scanImage, type ScanResult, type VulnerabilitySeverity } from '../../scanner';
 import { sendEventNotification } from '../../notifications';
-import { parseImageNameAndTag, shouldBlockUpdate, combineScanSummaries, isDockhandContainer } from './update-utils';
+import { parseImageNameAndTag, shouldBlockUpdate, combineScanSummaries, isSystemContainer } from './update-utils';
 
 /**
  * Execute a container auto-update.
@@ -98,14 +98,18 @@ export async function runContainerUpdate(
 			return;
 		}
 
-		// Prevent Dockhand from updating itself
-		if (isDockhandContainer(imageNameFromConfig)) {
-			log(`Skipping Dockhand container - cannot auto-update self`);
+		// Prevent system containers (Dockhand/Hawser) from being updated
+		const systemContainerType = isSystemContainer(imageNameFromConfig);
+		if (systemContainerType) {
+			const reason = systemContainerType === 'dockhand'
+				? 'Cannot auto-update Dockhand itself'
+				: 'Cannot auto-update Hawser agent';
+			log(`Skipping ${systemContainerType} container - ${reason}`);
 			await updateScheduleExecution(execution.id, {
 				status: 'skipped',
 				completedAt: new Date().toISOString(),
 				duration: Date.now() - startTime,
-				details: { reason: 'Cannot auto-update Dockhand itself' }
+				details: { reason }
 			});
 			return;
 		}

src/lib/server/scheduler/tasks/env-update-check.ts

@@ -33,7 +33,7 @@ import {
 } from '../../docker';
 import { sendEventNotification } from '../../notifications';
 import { getScannerSettings, scanImage, type VulnerabilitySeverity } from '../../scanner';
-import { parseImageNameAndTag, shouldBlockUpdate, combineScanSummaries, isDockhandContainer } from './update-utils';
+import { parseImageNameAndTag, shouldBlockUpdate, combineScanSummaries, isSystemContainer } from './update-utils';
 
 interface UpdateInfo {
 	containerId: string;
@@ -224,9 +224,13 @@ export async function runEnvUpdateCheckJob(
 			const blockedContainers: { name: string; reason: string; scannerResults?: { scanner: string; critical: number; high: number; medium: number; low: number }[] }[] = [];
 
 			for (const update of updatesAvailable) {
-				// Skip Dockhand container - cannot update itself
-				if (isDockhandContainer(update.imageName)) {
-					await log(`\n[${update.containerName}] Skipping - cannot auto-update Dockhand itself`);
+				// Skip system containers (Dockhand/Hawser) - cannot update themselves
+				const systemContainerType = isSystemContainer(update.imageName);
+				if (systemContainerType) {
+					const reason = systemContainerType === 'dockhand'
+						? 'cannot auto-update Dockhand itself'
+						: 'cannot auto-update Hawser agent';
+					await log(`\n[${update.containerName}] Skipping - ${reason}`);
 					continue;
 				}
 

src/lib/server/scheduler/tasks/update-utils.ts

@@ -99,6 +99,32 @@ export function isDockhandContainer(imageName: string): boolean {
 	return imageName.toLowerCase().includes('fnsys/dockhand');
 }
 
+/**
+ * Check if a container is a Hawser agent.
+ * Official image: ghcr.io/finsys/hawser
+ */
+export function isHawserContainer(imageName: string): boolean {
+	const lower = imageName.toLowerCase();
+	return lower.includes('finsys/hawser') || lower.includes('ghcr.io/finsys/hawser');
+}
+
+/**
+ * System container type - containers that cannot be updated from within Dockhand.
+ */
+export type SystemContainerType = 'dockhand' | 'hawser';
+
+/**
+ * Check if a container is a system container (Dockhand or Hawser).
+ * System containers cannot be updated from within Dockhand because:
+ * - Dockhand: Would need to stop itself to update
+ * - Hawser: Would disconnect from the environment it's managing
+ */
+export function isSystemContainer(imageName: string): SystemContainerType | null {
+	if (isDockhandContainer(imageName)) return 'dockhand';
+	if (isHawserContainer(imageName)) return 'hawser';
+	return null;
+}
+
 /**
  * Combine multiple scan summaries by taking the maximum of each severity level.
  */