fix: accurate prune sizes, shared-image and revert tracking, and security hardening

[StrandedTurtle]

Summary

Prune was over-reporting (the "15 GB")

Docker's image Size is the whole image, including base layers still used by your current images. The preview and the "Freed X" message summed those, so they were wildly inflated. In a reproduction on real Docker, three leftovers showed 1.26 GB when they actually freed 60 MB.

• The preview now shows what each image really frees: its size minus layers shared with other images. Docker only computes SharedSize among images in the same response, so it's taken from the unfiltered list.
• "Freed X" is now measured (image-layer disk usage before minus after), not estimated.
• Untagged images still used by a container are no longer offered. Docker would refuse to delete them anyway.
• "Prune everything" now counts images rather than Docker's untag/layer entries.
• Revert points whose image was pruned are dropped. The dialog warns before pruning one, and Revert now refuses cleanly (410) if its image is gone.
• The Settings "needs pruning" badge now refreshes after a prune instead of waiting for the daily scan.

Bugs found by running the app against a real Docker daemon

• A container whose tag moved (e.g. a sibling on the same image updated first) or that was reverted reported "up to date" forever. A reverted standalone container also couldn't be updated, because DockPull tried docker pull sha256:….
• Revert copied Compose's com.docker.compose.image label, so a later compose update silently did nothing. That label is fixed now, and there's a force-recreate safety net after compose up.
• No revert point and blank history versions were recorded when the old image's digest was unknown. Rollback is now tracked by image ID, and versions are stored on history rows.
• Loopback registries (localhost:5000) are now queried over http, as Docker does.

Security

• CSRF: state-changing API calls require an X-DockPull: 1 header. SameSite=Lax doesn't protect against other apps on the same host on a different port.
• Container names are validated before reaching the Docker API, which puts them into request paths unescaped.
• The session cookie is bound to ADMIN_PASSWORD, so changing the password signs everyone out. Existing sessions need to log in once after upgrading.
• Registry credentials are only sent to https token servers.

Testing

• 149 server tests pass, including a prune test against a fake Docker API socket.
• Full lifecycle run live on Docker 29 (containerd store) with a local registry:
  • check, and compose + standalone update
  • revert, and re-update after revert
  • shared-image updates
  • prune preview, partial prune and prune-all, with freed space verified against docker system df
  • missing-image revert
  • skip/pin, settings, history, logout, CSRF and name validation
• The real UI was driven with Playwright through login, check, and the prune dialog, with no console errors.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KiL5R3bRpvGk6QP3E21eHF

---

Generated by Claude Code