chore: removes pointers to logevents

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/deploy.yml

@@ -9,13 +9,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: pnpm/action-setup@v4
+        name: Install pnpm
+      - uses: actions/setup-node@v5
         name: Install Node
         with:
           node-version: latest
       - run: corepack enable
       - run: pnpm --version
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: latest
           cache: "pnpm"
@@ -29,9 +31,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
-          go-version: 1.25.0
+          go-version: 1.25.2
           check-latest: true
       - name: Checkout code
         uses: actions/checkout@v5
@@ -49,13 +51,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: pnpm/action-setup@v4
+        name: Install pnpm
+      - uses: actions/setup-node@v5
         name: Install Node
         with:
           node-version: latest
       - run: corepack enable
       - run: pnpm --version
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: latest
           cache: "pnpm"
@@ -92,12 +96,12 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
       - name: Login to DockerHub
-        uses: docker/login-action@v3.5.0
+        uses: docker/login-action@v3.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Log in to the Container registry
-        uses: docker/login-action@v3.5.0
+        uses: docker/login-action@v3.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -140,8 +144,10 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 0
+      - uses: pnpm/action-setup@v4
+        name: Install pnpm
       - name: Install Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
       - name: Release to Github
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/dev.yml

@@ -15,12 +15,12 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
       - name: Login to DockerHub
-        uses: docker/login-action@v3.5.0
+        uses: docker/login-action@v3.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Log in to the Container registry
-        uses: docker/login-action@v3.5.0
+        uses: docker/login-action@v3.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/pages.yml

@@ -29,7 +29,7 @@ jobs:
           fetch-depth: 0 # Not needed if lastUpdated is not enabled
       - uses: pnpm/action-setup@v2
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: latest
           cache: pnpm # or pnpm / yarn

.github/workflows/test.yml

@@ -12,13 +12,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: pnpm/action-setup@v4
+        name: Install pnpm
+      - uses: actions/setup-node@v5
         name: Install Node
         with:
           node-version: latest
       - run: corepack enable
       - run: pnpm --version
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: latest
           cache: "pnpm"
@@ -32,13 +34,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: pnpm/action-setup@v4
+        name: Install pnpm
+      - uses: actions/setup-node@v5
         name: Install Node
         with:
           node-version: latest
       - run: corepack enable
       - run: pnpm --version
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: latest
           cache: "pnpm"
@@ -52,9 +56,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
-          go-version: "1.25.0"
+          go-version: "1.25.2"
           check-latest: true
       - name: Checkout code
         uses: actions/checkout@v5
@@ -75,9 +79,9 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
-          go-version: "1.25.0"
+          go-version: "1.25.2"
           check-latest: true
       - name: Generate dependencies
         run: make fake_assets shared_key.pem shared_cert.pem
@@ -91,13 +95,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-node@v4
+      - uses: pnpm/action-setup@v4
+        name: Install pnpm
+      - uses: actions/setup-node@v5
         name: Install Node
         with:
           node-version: latest
       - run: corepack enable
       - run: pnpm --version
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: latest
           cache: "pnpm"

assets/components/Announcements.vue

@@ -1,5 +1,9 @@
 <template>
-  <Dropdown class="dropdown-end" @closed="releaseSeen = mostRecent?.tag ?? config.version">
+  <Dropdown
+    class="dropdown-end"
+    @click="config.releaseCheckMode === 'manual' && fetchReleases()"
+    @closed="releaseSeen = mostRecent?.tag ?? config.version"
+  >
     <template #trigger>
       <mdi:announcement class="size-6 -rotate-12" />
       <template v-if="announcements.length > 0 && releaseSeen != mostRecent?.tag">
@@ -63,7 +67,7 @@
 <script setup lang="ts">
 import { useAnnouncements } from "@/stores/announcements";
 
-const { announcements, mostRecent } = useAnnouncements();
+const { announcements, mostRecent, fetchReleases } = useAnnouncements();
 const { t } = useI18n();
 
 const releaseSeen = useProfileStorage("releaseSeen", config.version);

assets/components/ContainerViewer/ContainerActionsToolbar.vue

@@ -15,7 +15,7 @@
           <KeyShortcut char="k" :modifiers="['shift', 'meta']" />
         </a>
       </li>
-      <li>
+      <li v-if="enableDownload">
         <a :href="downloadUrl" download> <octicon:download-24 /> {{ $t("toolbar.download") }} </a>
       </li>
       <li v-if="!historical">
@@ -167,7 +167,7 @@ import LogAnalytics from "../LogViewer/LogAnalytics.vue";
 import Terminal from "@/components/Terminal.vue";
 
 const { showSearch } = useSearchFilter();
-const { enableActions, enableShell } = config;
+const { enableActions, enableShell, enableDownload } = config;
 const { streamConfig, hasComplexLogs, levels } = useLoggingContext();
 const showDrawer = useDrawer();
 

assets/components/Links.vue

@@ -33,7 +33,7 @@
             {{ config.user.email }}
           </div>
         </div>
-        <ul v-if="config.authProvider === 'simple'" class="menu mt-4 p-0">
+        <ul v-if="config.authProvider === 'simple' || config.logoutUrl" class="menu mt-4 p-0">
           <li>
             <button @click.prevent="logout()" class="text-primary p-2">
               <material-symbols:logout />
@@ -46,11 +46,17 @@
   </div>
 </template>
 <script lang="ts" setup>
-async function logout() {
-  await fetch(withBase("/api/token"), {
-    method: "DELETE",
-  });
+const { logoutUrl } = config;
 
-  location.reload();
+async function logout() {
+  if (logoutUrl) {
+    location.href = logoutUrl;
+  } else {
+    await fetch(withBase("/api/token"), {
+      method: "DELETE",
+    });
+
+    location.reload();
+  }
 }
 </script>

assets/components/LogViewer/LogDate.vue

@@ -1,5 +1,5 @@
 <template>
-  <Tag size="small" class="items-start!">
+  <Tag class="items-start!">
     <DateTime :date="date" class="text-blue whitespace-nowrap" />
   </Tag>
 </template>

assets/components/LogViewer/LogList.vue

@@ -82,7 +82,7 @@ ul {
   }
 
   &.large {
-    @apply text-lg;
+    @apply text-[1em];
   }
 
   &.compact {

assets/components/LogViewer/LogStd.vue

@@ -1,5 +1,5 @@
 <template>
-  <Tag size="small" :std="std" class="items-start!">
+  <Tag :std="std" class="items-start!">
     {{ std }}
   </Tag>
 </template>

assets/components/LogViewer/MultiContainerActionToolbar.vue

@@ -15,7 +15,7 @@
           <KeyShortcut char="k" :modifiers="['shift', 'meta']" />
         </a>
       </li>
-      <li>
+      <li v-if="enableDownload">
         <a :href="downloadUrl" download> <octicon:download-24 /> {{ $t("toolbar.download") }} </a>
       </li>
       <li>
@@ -88,7 +88,7 @@
 
 <script lang="ts" setup>
 const { showSearch } = useSearchFilter();
-
+const { enableDownload } = config;
 const clear = defineEmit();
 
 const { streamConfig, showHostname, showContainerName, containers } = useLoggingContext();

assets/components/LogViewer/StatMonitor.vue

@@ -1,5 +1,5 @@
 <template>
-  <div class="hover:text-secondary relative" @mouseenter="mouseOver = true" @mouseleave="mouseOver = false">
+  <div class="hover:text-primary relative" @mouseenter="mouseOver = true" @mouseleave="mouseOver = false">
     <div class="border-primary overflow-hidden rounded-xs border px-px pt-1 pb-px max-md:hidden">
       <StatSparkline :data="data" @selected-point="onSelectedPoint" />
     </div>

assets/components/LogViewer/__snapshots__/EventSource.spec.ts.snap

@@ -23,7 +23,7 @@ exports[`<ContainerEventSource /> > render html correctly > should render dates
       <div class="flex gap-x-2 gap-y-1 group-[.compact]:gap-y-0 has-[>_*:nth-of-type(2)]:flex-col-reverse md:flex-row!">
         <!--v-if-->
         <!--v-if-->
-        <div class="tag bg-base-100 inline-flex items-center justify-center rounded-sm px-2 py-[0.2em] [[size='small']]:text-[0.8rem] items-start! shrink-0 select-none" size="small">
+        <div class="tag bg-base-100 inline-flex items-center justify-center rounded-sm px-2 py-[0.2em] [[size='small']]:text-[0.8rem] items-start! shrink-0 select-none">
           <div class="inline-flex gap-2 text-blue whitespace-nowrap"><time datetime="2019-06-12T10:55:42.459Z" class="max-md:hidden">06/12/2019</time><time datetime="2019-06-12T10:55:42.459Z">10:55:42 AM</time></div>
         </div>
       </div>
@@ -57,7 +57,7 @@ exports[`<ContainerEventSource /> > render html correctly > should render dates
       <div class="flex gap-x-2 gap-y-1 group-[.compact]:gap-y-0 has-[>_*:nth-of-type(2)]:flex-col-reverse md:flex-row!">
         <!--v-if-->
         <!--v-if-->
-        <div class="tag bg-base-100 inline-flex items-center justify-center rounded-sm px-2 py-[0.2em] [[size='small']]:text-[0.8rem] items-start! shrink-0 select-none" size="small">
+        <div class="tag bg-base-100 inline-flex items-center justify-center rounded-sm px-2 py-[0.2em] [[size='small']]:text-[0.8rem] items-start! shrink-0 select-none">
           <div class="inline-flex gap-2 text-blue whitespace-nowrap"><time datetime="2019-06-12T10:55:42.459Z" class="max-md:hidden">06/12/2019</time><time datetime="2019-06-12T10:55:42.459Z">10:55:42</time></div>
         </div>
       </div>
@@ -91,7 +91,7 @@ exports[`<ContainerEventSource /> > render html correctly > should render messag
       <div class="flex gap-x-2 gap-y-1 group-[.compact]:gap-y-0 has-[>_*:nth-of-type(2)]:flex-col-reverse md:flex-row!">
         <!--v-if-->
         <!--v-if-->
-        <div class="tag bg-base-100 inline-flex items-center justify-center rounded-sm px-2 py-[0.2em] [[size='small']]:text-[0.8rem] items-start! shrink-0 select-none" size="small">
+        <div class="tag bg-base-100 inline-flex items-center justify-center rounded-sm px-2 py-[0.2em] [[size='small']]:text-[0.8rem] items-start! shrink-0 select-none">
           <div class="inline-flex gap-2 text-blue whitespace-nowrap"><time datetime="2019-06-12T10:55:42.459Z" class="max-md:hidden">06/12/2019</time><time datetime="2019-06-12T10:55:42.459Z">10:55:42 AM</time></div>
         </div>
       </div>

assets/components/SideMenu.vue

@@ -1,5 +1,5 @@
 <template>
-  <div v-if="ready" data-testid="side-menu" class="flex min-h-0 flex-col">
+  <div v-if="ready" data-testid="side-menu" class="flex min-h-0 flex-col w-full">
     <Carousel v-model="selectedCard" class="flex-1">
       <CarouselItem :title="$t('label.host-menu')" id="host">
         <HostMenu />

assets/stores/announcements.ts

@@ -12,7 +12,25 @@ type Announcement = {
   breaking: number;
 };
 
-const { data: releases } = useFetch(withBase("/api/releases")).get().json<Announcement[]>();
+const releases = ref<Announcement[]>([]);
+let fetched = false;
+
+async function fetchReleases() {
+  if (fetched) return;
+  fetched = true;
+
+  try {
+    const { data } = await useFetch(withBase("/api/releases")).get().json<Announcement[]>();
+    releases.value = data.value || [];
+  } catch (error) {
+    console.error("Error while fetching releases:\n", error);
+    fetched = false;
+  }
+}
+
+if (config.releaseCheckMode === "automatic") {
+  fetchReleases();
+}
 
 const otherAnnouncements = [] as Announcement[];
 
@@ -33,5 +51,6 @@ export function useAnnouncements() {
     announcements,
     latestRelease,
     hasRelease,
+    fetchReleases,
   };
 }

assets/stores/config.ts

@@ -10,9 +10,12 @@ export interface Config {
   hostname: string;
   hosts: Host[];
   authProvider: "simple" | "none" | "forward-proxy";
+  logoutUrl?: string;
   enableActions: boolean;
   enableShell: boolean;
+  enableDownload: boolean;
   disableAvatars: boolean;
+  releaseCheckMode: "automatic" | "manual";
   user?: {
     username: string;
     email: string;

docker-compose.yml

@@ -95,7 +95,7 @@ services:
 
   playwright:
     container_name: playwright
-    image: mcr.microsoft.com/playwright:v1.55.0-jammy
+    image: mcr.microsoft.com/playwright:v1.56.0-jammy
     working_dir: /app
     volumes:
       - .:/app

docs/guide/authentication.md

@@ -28,6 +28,7 @@ users:
     # Generate with docker run -it --rm amir20/dozzle generate --name Admin --email me@email.net --password secret admin
     password: $2a$11$9ho4vY2LdJ/WBopFcsAS0uORC0x2vuFHQgT/yBqZyzclhHsoaIkzK
     filter:
+    roles:
 ```
 
 Dozzle uses `email` to generate avatars using [Gravatar](https://gravatar.com/). It is optional. The password is hashed using `bcrypt` which can be generated using `docker run amir20/dozzle generate`.
@@ -139,15 +140,44 @@ In this example, the `admin` user has no filter, so they can see all containers.
 > [!NOTE]
 > Filters can also be set [globally](/guide/filters) with the `--filter` flag. This flag is applied to all users. If a user has a filter set, it will override the global filter.
 
+### Setting specific roles for users
+
+Dozzle allows assigning roles to users. Roles define what actions a user can perform on containers. Roles are configured in the users.yml file.
+
+```yaml
+users:
+  admin:
+    email:
+    name: Admin
+    password: $2a$11$9ho4vY2LdJ/WBopFcsAS0uORC0x2vuFHQgT/yBqZyzclhHsoaIkzK
+    roles:
+
+  guest:
+    email:
+    name: Guest
+    password: $2a$11$9ho4vY2LdJ/WBopFcsAS0uORC0x2vuFHQgT/yBqZyzclhHsoaIkzK
+    roles: shell
+```
+
+In this example, the `admin` user has no roles specified, so they have full access to all container actions. The `guest` user has the shell role, meaning they can only open a shell in the containers. Roles make it easy to control and restrict what users can do in Dozzle.
+
+Dozzle supports the following roles:
+
+- **shell** - allows attach and exec in the container
+- **actions** - allows performing container actions (start, stop, restart)
+- **download** - allows downloading container logs
+- **none** - denies all actions
+- **all** - allows all actions (default)
+
 ## Generating users.yml
 
 Dozzle has a built-in `generate` command to generate `users.yml`. Here is an example:
 
 ```sh
-docker run -it --rm amir20/dozzle generate admin --password password --email test@email.net --name "John Doe" --user-filter name=foo > users.yml
+docker run -it --rm amir20/dozzle generate admin --password password --email test@email.net --name "John Doe" --user-filter name=foo --user-roles shell > users.yml
 ```
 
-In this example, `admin` is the username. Email and name are optional but recommended to display accurate avatars. `docker run -it --rm amir20/dozzle generate --help` displays all options. The `--user-filter` flag is a comma-separated list of filters.
+In this example, `admin` is the username. Email and name are optional but recommended to display accurate avatars. `docker run -it --rm amir20/dozzle generate --help` displays all options. The `--user-filter` flag is a comma-separated list of filters. The `--user-roles` flag is a comma-separated list of roles.
 
 ## Forward Proxy
 
@@ -179,11 +209,21 @@ In this mode, Dozzle expects the following headers:
 - `Remote-Email` to map to the user's email address. This email is also used to find the right [Gravatar](https://gravatar.com/) for the user.
 - `Remote-Name` to be a display name like `John Doe`
 - `Remote-Filter` to be a comma-separated list of filters allowed for user.
+- `Remote-Roles` to be a comma-separated list of roles allowed for user.
+
+Additionally, you can configure a logout URL with:
+
+```yaml
+DOZZLE_AUTH_LOGOUT_URL: http://oauth2.example.ru/oauth2/sign_out
+```
 
 ### Setting up Dozzle with Authelia
 
 [Authelia](https://www.authelia.com/) is an open-source authentication and authorization server and portal fulfilling the identity and access management. While setting up Authelia is out of scope for this section, the configuration can be shared as an example for setting up Dozzle with Authelia.
 
+<details>
+<summary>➡️ Click to expand Authelia example</summary>
+
 ::: code-group
 
 ```yaml [docker-compose.yml]
@@ -318,6 +358,8 @@ notifier:
 
 Valid SSL keys are required because Authelia only supports SSL.
 
+</details>
+
 ### Setting up Dozzle with Cloudflare Zero Trust
 
 Cloudflare Zero Trust is a service for authenticated access to self-hosted software. This section defines how Dozzle can be set up to use Cloudflare Zero Trust for authentication.
@@ -341,3 +383,86 @@ services:
 ```
 
 After running the Dozzle container, configure the Application in Cloudflare Zero Trust dashboard by following the [guide](https://developers.cloudflare.com/cloudflare-one/applications/configure-apps/self-hosted-apps/).
+
+### Setting up Dozzle with Pocket ID
+
+You must first setup a container to pass OpenID Connect authentication through your reverse proxy.
+
+Below is an example using [oauth2-proxy](https://github.com/oauth2-proxy/oauth2-proxy).
+
+<details>
+<summary>➡️ Click to expand oauth2-proxy example</summary>
+
+1. Create a new OIDC client in Pocket ID for Dozzle:
+   - **Name:** `Dozzle`
+   - **Callback URLs:** `https://dozzle.example.com/oauth2/callback`
+   - **PKCE:** `Enabled`
+
+   Copy the **Client ID** and **Client Secret** values for use later.
+
+2. Add the following to your existing Dozzle compose:
+
+   ```yml
+   environment:
+     DOZZLE_AUTH_PROVIDER: forward-proxy
+     DOZZLE_AUTH_HEADER_USER: X-Forwarded-User
+     DOZZLE_AUTH_HEADER_EMAIL: X-Forwarded-Email
+     DOZZLE_AUTH_HEADER_NAME: X-Forwarded-Preferred-Username
+   ```
+
+   Comment out the Dozzle ports, as we will redirect these through the new authentication container.
+
+   This method should not require any changes to your reverse proxy configuration.
+
+   ```yml
+   # ports:
+   #   - 8080:8080
+   ```
+
+3. Add a new oauth2-proxy container service to your existing Dozzle compose:
+
+   ```yml
+   services:
+     # ...
+     oauth2-proxy:
+       image: quay.io/oauth2-proxy/oauth2-proxy:latest
+       restart: unless-stopped
+       container_name: dozzle-oidc
+       command: --config /oauth2-proxy.cfg
+       volumes:
+         - "./oauth2-proxy.cfg:/oauth2-proxy.cfg"
+       ports:
+         - 8080:4180
+   ```
+
+4. Create the oauth2-proxy config file.
+
+   In the directory beside your compose file, create `oauth2-proxy.cfg` :
+
+   ```toml
+    client_id = "xxx"                            # from Pocket ID
+    client_secret = "xxx"                        # from Pocket ID
+    cookie_secret = "xxx"                        # generate with openssl rand -base64 32 | tr -- '+/' '-_'
+    upstreams = "http://dozzle:8080"             # upstream to Dozzle containers internal port
+    code_challenge_method = "S256"               # PKCE challenges plain or S256
+    cookie_expire = "0"                          # seconds, 0 for session
+    cookie_name = "__Host-oauth2-proxy"          # or __Secure-oauth2-proxy (less secure)
+    cookie_secure = true                         # uses the secure HTTPS cookie
+    email_domains = ["*"]                        # allows any email domain to authenticate
+    http_address = "0.0.0.0:4180"                # port oauth2-proxy listens on
+    oidc_issuer_url = "https://id.example.com"   # your Pocket base URL
+    provider_display_name = "Pocket ID"          # display name for OIDC login
+    provider = "oidc"                            # use OpenID connect
+    reverse_proxy = true                         # reverse proxy the traffic
+    scope = "openid email profile groups"        # passthru these OIDC scopes
+   ```
+
+   Fill in the variables per the comments.
+
+5. Finally - restart your Docker compose stack.
+
+   Your reverse proxy should now authenticate you to Dozzle via oauth2-proxy.
+
+   Check logs for troubleshooting.
+
+</details>

docs/guide/container-groups.md

@@ -12,7 +12,7 @@ By default, containers are grouped by their stack name in host mode. If `com.doc
 
 ## Custom Groups
 
-Additionally, you can create custom groups by adding a label to your container. The label is `dev.dozzle.group` and the value is the name of the group. All containers with the same group name will be joined together in the UI. For example, if you have a group named `myapp`, all containers with the label `dozzle.group=myapp` will be joined together.
+Additionally, you can create custom groups by adding a label to your container. The label is `dev.dozzle.group` and the value is the name of the group. All containers with the same group name will be joined together in the UI. For example, if you have a group named `myapp`, all containers with the label `dev.dozzle.group=myapp` will be joined together.
 
 Here is an example using Docker Compose or Docker CLI:
 

docs/guide/remote-hosts.md

@@ -8,7 +8,7 @@ Dozzle supports connecting to remote Docker hosts. This is useful when running D
 
 However, with Dozzle agents, you can connect to remote hosts without exposing the Docker socket. See the [agent](/guide/agent) page for more information.
 
-Dozzle agents remove the need to remotely expose the Docker socket but cannot be uses with a Docker Socket proxy inside the Dozzle agent stack. If you wish to use a Socket Proxy on it's own without an agent see the [connecting with a socket proxy](#connecting-with-a-socket-proxy) section.
+Dozzle agents remove the need to remotely expose the Docker socket but cannot be used with a Docker Socket proxy inside the Dozzle agent stack. If you wish to use a Socket Proxy on it's own without an agent see the [connecting with a socket proxy](#connecting-with-a-socket-proxy) section.
 
 > [!WARNING]
 > Remote hosts have been replaced with agents. Agents provide a more secure way to connect to remote hosts. Although remote hosts are still supported, it is recommended to use agents. See the [agent](/guide/agent) page for more information and examples. For comparison, see the [comparing agents with remote connections](/guide/agent#comparing-agents-with-remote-connection) section. I won't be able to investigate user's issues with remote hosts as it is very time consuming.

docs/guide/supported-env-vars.md

@@ -6,26 +6,30 @@ title: Environment Variables and Subcommands
 
 Configurations can be done with flags or environment variables. The table below outlines all supported options and their respective env vars.
 
-| Flag                  | Env Variable               | Default        |
-| --------------------- | -------------------------- | -------------- |
-| `--addr`              | `DOZZLE_ADDR`              | `:8080`        |
-| `--base`              | `DOZZLE_BASE`              | `/`            |
-| `--hostname`          | `DOZZLE_HOSTNAME`          | `""`           |
-| `--level`             | `DOZZLE_LEVEL`             | `info`         |
-| `--auth-provider`     | `DOZZLE_AUTH_PROVIDER`     | `none`         |
-| `--auth-header-user`  | `DOZZLE_AUTH_HEADER_USER`  | `Remote-User`  |
-| `--auth-header-email` | `DOZZLE_AUTH_HEADER_EMAIL` | `Remote-Email` |
-| `--auth-header-name`  | `DOZZLE_AUTH_HEADER_NAME`  | `Remote-Name`  |
-| `--enable-actions`    | `DOZZLE_ENABLE_ACTIONS`    | `false`        |
-| `--enable-shell`      | `DOZZLE_ENABLE_SHELL`      | `false`        |
-| `--disable-avatars`   | `DOZZLE_DISABLE_AVATARS`   | `false`        |
-| `--filter`            | `DOZZLE_FILTER`            | `""`           |
-| `--no-analytics`      | `DOZZLE_NO_ANALYTICS`      | `false`        |
-| `--mode`              | `DOZZLE_MODE`              | `server`       |
-| `--remote-host`       | `DOZZLE_REMOTE_HOST`       |                |
-| `--remote-agent`      | `DOZZLE_REMOTE_AGENT`      |                |
-| `--timeout`           | `DOZZLE_TIMEOUT`           | `10s`          |
-| `--namespace`         | `DOZZLE_NAMESPACE`         | `""`           |
+| Flag                   | Env Variable                | Default         |
+|------------------------|-----------------------------|-----------------|
+| `--addr`               | `DOZZLE_ADDR`               | `:8080`         |
+| `--base`               | `DOZZLE_BASE`               | `/`             |
+| `--hostname`           | `DOZZLE_HOSTNAME`           | `""`            |
+| `--level`              | `DOZZLE_LEVEL`              | `info`          |
+| `--auth-provider`      | `DOZZLE_AUTH_PROVIDER`      | `none`          |
+| `--auth-header-user`   | `DOZZLE_AUTH_HEADER_USER`   | `Remote-User`   |
+| `--auth-header-email`  | `DOZZLE_AUTH_HEADER_EMAIL`  | `Remote-Email`  |
+| `--auth-header-name`   | `DOZZLE_AUTH_HEADER_NAME`   | `Remote-Name`   |
+| `--auth-header-filter` | `DOZZLE_AUTH_HEADER_FILTER` | `Remote-Filter` |
+| `--auth-header-roles`  | `DOZZLE_AUTH_HEADER_ROLES`  | `Remote-Roles`  |
+| `--auth-logout-url`    | `DOZZLE_AUTH_LOGOUT_URL`    | `""`            |
+| `--enable-actions`     | `DOZZLE_ENABLE_ACTIONS`     | `false`         |
+| `--enable-shell`       | `DOZZLE_ENABLE_SHELL`       | `false`         |
+| `--disable-avatars`    | `DOZZLE_DISABLE_AVATARS`    | `false`         |
+| `--filter`             | `DOZZLE_FILTER`             | `""`            |
+| `--no-analytics`       | `DOZZLE_NO_ANALYTICS`       | `false`         |
+| `--mode`               | `DOZZLE_MODE`               | `server`        |
+| `--release-check-mode` | `DOZZLE_RELEASE_CHECK_MODE` | `automatic`     |
+| `--remote-host`        | `DOZZLE_REMOTE_HOST`        |                 |
+| `--remote-agent`       | `DOZZLE_REMOTE_AGENT`       |                 |
+| `--timeout`            | `DOZZLE_TIMEOUT`            | `10s`           |
+| `--namespace`          | `DOZZLE_NAMESPACE`          | `""`            |
 
 > [!TIP]
 > Some flags like `--remote-host` or `--remote-agent` can be used multiple times. For example, `--remote-agent 167.99.1.1:7007 --remote-agent 167.99.1.2:7007` or comma-separated `DOZZLE_REMOTE_AGENT=167.99.1.1:7007,167.99.1.2:7007`.
@@ -35,16 +39,18 @@ Configurations can be done with flags or environment variables. The table below
 Dozzle supports generating `users.yml` file. This file is used to authenticate users. Here is an example:
 
 ```sh
-docker run -it --rm amir20/dozzle generate admin --password password --email test@email.net --name "John Doe" > users.yml
+docker run -it --rm amir20/dozzle generate admin --password password --email test@email.net --name "John Doe" --user-filter name=foo --user-roles shell > users.yml
 ```
 
 In this example, `admin` is the username. Email and name are optional but recommended to display accurate avatars. `docker run amir20/dozzle generate --help` displays all options.
 
-| Flag         | Description      | Default |
-| ------------ | ---------------- | ------- |
-| `--password` | User's password  |         |
-| `--email`    | User's email     |         |
-| `--name`     | User's full name |         |
+| Flag            | Description      | Default |
+|-----------------|------------------| ------- |
+| `--password`    | User's password  |         |
+| `--email`       | User's email     |         |
+| `--name`        | User's full name |         |
+| `--user-filter` | User's filters   |         |
+| `--user-roles`  | User's roles     |         |
 
 See [authentication](/guide/authentication) for more information.
 

docs/package.json

@@ -6,6 +6,6 @@
     "dozzle": "workspace:*"
   },
   "dependencies": {
-    "@fontsource-variable/playfair-display": "^5.2.6"
+    "@fontsource-variable/playfair-display": "^5.2.8"
   }
 }

docs/pnpm-lock.yaml

@@ -12,8 +12,8 @@ importers:
   .:
     dependencies:
       '@fontsource-variable/playfair-display':
-        specifier: ^5.2.6
-        version: 5.2.6
+        specifier: ^5.2.8
+        version: 5.2.8
     devDependencies:
       dozzle:
         specifier: workspace:*
@@ -21,9 +21,9 @@ importers:
 
 packages:
 
-  '@fontsource-variable/playfair-display@5.2.6':
-    resolution: {integrity: sha512-Uedpo4WwsWtobi1KMYGm9tlKcZJcD18EiBtPWhbbccT2u58qM7vwkOZGdrmdWVDhcEhjwNrqRUyZijwIFtsCcQ==}
+  '@fontsource-variable/playfair-display@5.2.8':
+    resolution: {integrity: sha512-ZzVIXPOrL85yyOvZYoBzUszIJM+xKkHqni4IYn2CVLaGQQdJR8sBeC8yFNgjxSJ7ludTwta8qpULeOFuk5X75A==}
 
 snapshots:
 
-  '@fontsource-variable/playfair-display@5.2.6': {}
+  '@fontsource-variable/playfair-display@5.2.8': {}

go.mod

@@ -4,7 +4,7 @@ require (
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/alexflint/go-arg v1.6.0
 	github.com/beme/abide v0.0.0-20190723115211-635a09831760
-	github.com/docker/docker v28.3.3+incompatible
+	github.com/docker/docker v28.5.1+incompatible
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dustin/go-humanize v1.0.1
@@ -14,11 +14,11 @@ require (
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0 // indirect
 	github.com/sergi/go-diff v1.3.1 // indirect
-	github.com/spf13/afero v1.14.0
+	github.com/spf13/afero v1.15.0
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/stretchr/testify v1.11.1
-	golang.org/x/net v0.42.0 // indirect
-	golang.org/x/sys v0.35.0 // indirect
+	golang.org/x/net v0.45.0 // indirect
+	golang.org/x/sys v0.37.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -27,21 +27,21 @@ require (
 	github.com/andybalholm/brotli v1.2.0
 	github.com/go-chi/chi/v5 v5.2.3
 	github.com/go-chi/jwtauth/v5 v5.3.3
-	github.com/go-faker/faker/v4 v4.6.1
+	github.com/go-faker/faker/v4 v4.7.0
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
-	github.com/puzpuzpuz/xsync/v4 v4.1.0
+	github.com/puzpuzpuz/xsync/v4 v4.2.0
 	github.com/rs/zerolog v1.34.0
-	github.com/samber/lo v1.51.0
+	github.com/samber/lo v1.52.0
 	github.com/wk8/go-ordered-map/v2 v2.1.8
 	github.com/yuin/goldmark v1.7.13
-	golang.org/x/crypto v0.41.0
-	golang.org/x/sync v0.16.0
-	google.golang.org/grpc v1.75.0
-	google.golang.org/protobuf v1.36.8
-	k8s.io/api v0.34.0
-	k8s.io/apimachinery v0.34.0
-	k8s.io/client-go v0.34.0
-	k8s.io/metrics v0.34.0
+	golang.org/x/crypto v0.43.0
+	golang.org/x/sync v0.17.0
+	google.golang.org/grpc v1.76.0
+	google.golang.org/protobuf v1.36.10
+	k8s.io/api v0.34.1
+	k8s.io/apimachinery v0.34.1
+	k8s.io/client-go v0.34.1
+	k8s.io/metrics v0.34.1
 )
 
 require (
@@ -102,10 +102,10 @@ require (
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/term v0.34.0 // indirect
-	golang.org/x/text v0.28.0 // indirect
+	golang.org/x/term v0.36.0 // indirect
+	golang.org/x/text v0.30.0 // indirect
 	golang.org/x/time v0.10.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250804133106-a7a43d27e69b // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gotest.tools/v3 v3.0.3 // indirect
@@ -119,4 +119,4 @@ require (
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
 
-go 1.25.0
+go 1.25.2

go.sum

@@ -56,6 +56,12 @@ github.com/docker/docker v28.3.2+incompatible h1:wn66NJ6pWB1vBZIilP8G3qQPqHy5Xym
 github.com/docker/docker v28.3.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI=
 github.com/docker/docker v28.3.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v28.4.0+incompatible h1:KVC7bz5zJY/4AZe/78BIvCnPsLaC9T/zh72xnlrTTOk=
+github.com/docker/docker v28.4.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v28.5.0+incompatible h1:ZdSQoRUE9XxhFI/B8YLvhnEFMmYN9Pp8Egd2qcaFk1E=
+github.com/docker/docker v28.5.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v28.5.1+incompatible h1:Bm8DchhSD2J6PsFzxC35TZo4TLGR2PdW/E69rU45NhM=
+github.com/docker/docker v28.5.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
 github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
@@ -84,6 +90,10 @@ github.com/go-faker/faker/v4 v4.6.0 h1:6aOPzNptRiDwD14HuAnEtlTa+D1IfFuEHO8+vEFwj
 github.com/go-faker/faker/v4 v4.6.0/go.mod h1:ZmrHuVtTTm2Em9e0Du6CJ9CADaLEzGXW62z1YqFH0m0=
 github.com/go-faker/faker/v4 v4.6.1 h1:xUyVpAjEtB04l6XFY0V/29oR332rOSPWV4lU8RwDt4k=
 github.com/go-faker/faker/v4 v4.6.1/go.mod h1:arSdxNCSt7mOhdk8tEolvHeIJ7eX4OX80wXjKKvkKBY=
+github.com/go-faker/faker/v4 v4.6.2 h1:IR1uQUYotFZnuTL7Iuy0FDGtHM5Rt1Q+2nipH9gnqKs=
+github.com/go-faker/faker/v4 v4.6.2/go.mod h1:u1dIRP5neLB6kTzgyVjdBOV5R1uP7BdxkcWk7tiKQXk=
+github.com/go-faker/faker/v4 v4.7.0 h1:VboC02cXHl/NuQh5lM2W8b87yp4iFXIu59x4w0RZi4E=
+github.com/go-faker/faker/v4 v4.7.0/go.mod h1:u1dIRP5neLB6kTzgyVjdBOV5R1uP7BdxkcWk7tiKQXk=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -205,6 +215,8 @@ github.com/puzpuzpuz/xsync/v4 v4.0.0 h1:F1za+MBXzDQtQq+OVgFsojSX4w66rsNDmQNebPFA
 github.com/puzpuzpuz/xsync/v4 v4.0.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
 github.com/puzpuzpuz/xsync/v4 v4.1.0 h1:x9eHRl4QhZFIPJ17yl4KKW9xLyVWbb3/Yq4SXpjF71U=
 github.com/puzpuzpuz/xsync/v4 v4.1.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
+github.com/puzpuzpuz/xsync/v4 v4.2.0 h1:dlxm77dZj2c3rxq0/XNvvUKISAmovoXF4a4qM6Wvkr0=
+github.com/puzpuzpuz/xsync/v4 v4.2.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
 github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
 github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
@@ -216,6 +228,8 @@ github.com/samber/lo v1.50.0 h1:XrG0xOeHs+4FQ8gJR97zDz5uOFMW7OwFWiFVzqopKgY=
 github.com/samber/lo v1.50.0/go.mod h1:RjZyNk6WSnUFRKK6EyOhsRJMqft3G+pg7dCWHQCWvsc=
 github.com/samber/lo v1.51.0 h1:kysRYLbHy/MB7kQZf5DSN50JHmMsNEdeY24VzJFu7wI=
 github.com/samber/lo v1.51.0/go.mod h1:4+MXEGsJzbKGaUEQFKBq2xtfuznW9oz/WrgyzMzRoM0=
+github.com/samber/lo v1.52.0 h1:Rvi+3BFHES3A8meP33VPAxiBZX/Aws5RxrschYGjomw=
+github.com/samber/lo v1.52.0/go.mod h1:4+MXEGsJzbKGaUEQFKBq2xtfuznW9oz/WrgyzMzRoM0=
 github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys=
 github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
 github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
@@ -224,6 +238,8 @@ github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spf13/afero v1.14.0 h1:9tH6MapGnn/j0eb0yIXiLjERO8RB6xIVZRDCX7PtqWA=
 github.com/spf13/afero v1.14.0/go.mod h1:acJQ8t0ohCGuMN3O+Pv0V0hgMxNYDlvdk+VTfyZmbYo=
+github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
+github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
@@ -318,6 +334,10 @@ golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
 golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
 golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
 golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
+golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
+golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
+golang.org/x/crypto v0.43.0 h1:dduJYIi3A3KOfdGOHX8AVZ/jGiyPa3IbBozJ5kNuE04=
+golang.org/x/crypto v0.43.0/go.mod h1:BFbav4mRNlXJL4wNeejLpWxB7wMbc79PdRGhWKncxR0=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
@@ -344,6 +364,10 @@ golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
 golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
 golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
 golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
+golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
+golang.org/x/net v0.45.0 h1:RLBg5JKixCy82FtLJpeNlVM0nrSqpCRYzVU1n8kj0tM=
+golang.org/x/net v0.45.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
 golang.org/x/oauth2 v0.26.0 h1:afQXWNNaeC4nvZ0Ed9XvCCzXM6UHJG7iCg0W4fPqSBE=
 golang.org/x/oauth2 v0.26.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
@@ -369,6 +393,8 @@ golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
 golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
 golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200831180312-196b9ba8737a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -393,6 +419,10 @@ golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
 golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
 golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
+golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
+golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -410,6 +440,10 @@ golang.org/x/term v0.33.0 h1:NuFncQrRcaRvVmgRkvM3j/F00gWIAlcmlB8ACEKmGIg=
 golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0=
 golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
 golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
+golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ=
+golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA=
+golang.org/x/term v0.36.0 h1:zMPR+aF8gfksFprF/Nc/rd1wRS1EI6nDBGyWAvDzx2Q=
+golang.org/x/term v0.36.0/go.mod h1:Qu394IJq6V6dCBRgwqshf3mPF85AqzYEzofzRdZkWss=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
@@ -429,6 +463,10 @@ golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
 golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
 golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
 golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
+golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
+golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
+golang.org/x/text v0.30.0 h1:yznKA/E9zq54KzlzBEAWn1NXSQ8DIp/NYMy88xJjl4k=
+golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM=
 golang.org/x/time v0.10.0 h1:3usCWA8tQn0L8+hFJQNgzpWbd89begxN66o1Ojdn5L4=
 golang.org/x/time v0.10.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -456,6 +494,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 h1:pFyd6EwwL2TqFf8emdthzeX+gZE1ElRq3iM8pui4KBY=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250804133106-a7a43d27e69b h1:zPKJod4w6F1+nRGDI9ubnXYhU9NSWoFAijkHkUXeTK8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250804133106-a7a43d27e69b/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
 google.golang.org/grpc v1.71.1 h1:ffsFWr7ygTUscGPI0KKK6TLrGz0476KUvvsbqWK0rPI=
 google.golang.org/grpc v1.71.1/go.mod h1:H0GRtasmQOh9LkFoCPDu3ZrwUtD1YGE+b2vYBYd/8Ec=
 google.golang.org/grpc v1.72.0 h1:S7UkcVa60b5AAQTaO6ZKamFp1zMZSU0fGDK2WZLbBnM=
@@ -470,12 +510,20 @@ google.golang.org/grpc v1.74.2 h1:WoosgB65DlWVC9FqI82dGsZhWFNBSLjQ84bjROOpMu4=
 google.golang.org/grpc v1.74.2/go.mod h1:CtQ+BGjaAIXHs/5YS3i473GqwBBa1zGQNevxdeBEXrM=
 google.golang.org/grpc v1.75.0 h1:+TW+dqTd2Biwe6KKfhE5JpiYIBWq865PhKGSXiivqt4=
 google.golang.org/grpc v1.75.0/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
+google.golang.org/grpc v1.75.1 h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI=
+google.golang.org/grpc v1.75.1/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
+google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A=
+google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c=
 google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
 google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A=
 google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
 google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
+google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
+google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
+google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
+google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
@@ -506,6 +554,8 @@ k8s.io/api v0.33.4 h1:oTzrFVNPXBjMu0IlpA2eDDIU49jsuEorGHB4cvKupkk=
 k8s.io/api v0.33.4/go.mod h1:VHQZ4cuxQ9sCUMESJV5+Fe8bGnqAARZ08tSTdHWfeAc=
 k8s.io/api v0.34.0 h1:L+JtP2wDbEYPUeNGbeSa/5GwFtIA662EmT2YSLOkAVE=
 k8s.io/api v0.34.0/go.mod h1:YzgkIzOOlhl9uwWCZNqpw6RJy9L2FK4dlJeayUoydug=
+k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
+k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
 k8s.io/apimachinery v0.32.3 h1:JmDuDarhDmA/Li7j3aPrwhpNBA94Nvk5zLeOge9HH1U=
 k8s.io/apimachinery v0.32.3/go.mod h1:GpHVgxoKlTxClKcteaeuF1Ul/lDVb74KpZcxcmLDElE=
 k8s.io/apimachinery v0.33.0 h1:1a6kHrJxb2hs4t8EE5wuR/WxKDwGN1FKH3JvDtA0CIQ=
@@ -520,6 +570,8 @@ k8s.io/apimachinery v0.33.4 h1:SOf/JW33TP0eppJMkIgQ+L6atlDiP/090oaX0y9pd9s=
 k8s.io/apimachinery v0.33.4/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
 k8s.io/apimachinery v0.34.0 h1:eR1WO5fo0HyoQZt1wdISpFDffnWOvFLOOeJ7MgIv4z0=
 k8s.io/apimachinery v0.34.0/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
+k8s.io/apimachinery v0.34.1 h1:dTlxFls/eikpJxmAC7MVE8oOeP1zryV7iRyIjB0gky4=
+k8s.io/apimachinery v0.34.1/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
 k8s.io/client-go v0.32.3 h1:RKPVltzopkSgHS7aS98QdscAgtgah/+zmpAogooIqVU=
 k8s.io/client-go v0.32.3/go.mod h1:3v0+3k4IcT9bXTc4V2rt+d2ZPPG700Xy6Oi0Gdl2PaY=
 k8s.io/client-go v0.33.0 h1:UASR0sAYVUzs2kYuKn/ZakZlcs2bEHaizrrHUZg0G98=
@@ -534,6 +586,8 @@ k8s.io/client-go v0.33.4 h1:TNH+CSu8EmXfitntjUPwaKVPN0AYMbc9F1bBS8/ABpw=
 k8s.io/client-go v0.33.4/go.mod h1:LsA0+hBG2DPwovjd931L/AoaezMPX9CmBgyVyBZmbCY=
 k8s.io/client-go v0.34.0 h1:YoWv5r7bsBfb0Hs2jh8SOvFbKzzxyNo0nSb0zC19KZo=
 k8s.io/client-go v0.34.0/go.mod h1:ozgMnEKXkRjeMvBZdV1AijMHLTh3pbACPvK7zFR+QQY=
+k8s.io/client-go v0.34.1 h1:ZUPJKgXsnKwVwmKKdPfw4tB58+7/Ik3CrjOEhsiZ7mY=
+k8s.io/client-go v0.34.1/go.mod h1:kA8v0FP+tk6sZA0yKLRG67LWjqufAoSHA2xVGKw9Of8=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/kube-openapi v0.0.0-20241212222426-2c72e554b1e7 h1:hcha5B1kVACrLujCKLbr8XWMxCxzQx42DY8QKYJrDLg=
@@ -556,6 +610,8 @@ k8s.io/metrics v0.33.4 h1:eJ6UdTpKTUQVZbKpUdm5ve39aPpAvvNwLrs13oQcWKc=
 k8s.io/metrics v0.33.4/go.mod h1:NO/lgFtyIPTurz56debdSh5qRqRfpO8MlkMpau1Ue8U=
 k8s.io/metrics v0.34.0 h1:nYSfG2+tnL6/MRC2I+sGHjtNEGoEoM/KktgGOoQFwws=
 k8s.io/metrics v0.34.0/go.mod h1:KCuXmotE0v4AvoARKUP8NC4lUnbK/Du1mluGdor5h4M=
+k8s.io/metrics v0.34.1 h1:374Rexmp1xxgRt64Bi0TsjAM8cA/Y8skwCoPdjtIslE=
+k8s.io/metrics v0.34.1/go.mod h1:Drf5kPfk2NJrlpcNdSiAAHn/7Y9KqxpRNagByM7Ei80=
 k8s.io/utils v0.0.0-20241210054802-24370beab758 h1:sdbE21q2nlQtFh65saZY+rRM6x6aJJI8IUa1AmH/qa0=
 k8s.io/utils v0.0.0-20241210054802-24370beab758/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=

internal/agent/client.go

@@ -19,6 +19,7 @@ import (
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/encoding/gzip"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
@@ -45,7 +46,10 @@ func NewClient(endpoint string, certificates tls.Certificate, opts ...grpc.DialO
 	// Create the gRPC transport credentials
 	creds := credentials.NewTLS(tlsConfig)
 
-	opts = append(opts, grpc.WithTransportCredentials(creds))
+	opts = append(opts,
+		grpc.WithTransportCredentials(creds),
+		grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(10*1024*1024), grpc.UseCompressor(gzip.Name)),
+	)
 	conn, err := grpc.NewClient(endpoint, opts...)
 	if err != nil {
 		return nil, fmt.Errorf("failed to connect to %s: %w", endpoint, err)
@@ -88,7 +92,7 @@ func rpcErrToErr(err error) error {
 	}
 }
 
-func (c *Client) LogsBetweenDates(ctx context.Context, containerID string, since time.Time, until time.Time, std container.StdType) (<-chan *container.LogEvent, error) {
+func (c *Client) LogsBetweenDates(ctx context.Context, containerID string, since time.Time, until time.Time, std container.StdType) (<-chan container.LogEvent, error) {
 	stream, err := c.client.LogsBetweenDates(ctx, &pb.LogsBetweenDatesRequest{
 		ContainerId: containerID,
 		Since:       timestamppb.New(since),
@@ -100,7 +104,7 @@ func (c *Client) LogsBetweenDates(ctx context.Context, containerID string, since
 		return nil, err
 	}
 
-	events := make(chan *container.LogEvent)
+	events := make(chan container.LogEvent)
 
 	go func() {
 		sendLogs(stream, events)
@@ -110,7 +114,7 @@ func (c *Client) LogsBetweenDates(ctx context.Context, containerID string, since
 	return events, nil
 }
 
-func (c *Client) StreamContainerLogs(ctx context.Context, containerID string, since time.Time, std container.StdType, events chan<- *container.LogEvent) error {
+func (c *Client) StreamContainerLogs(ctx context.Context, containerID string, since time.Time, std container.StdType, events chan<- container.LogEvent) error {
 	stream, err := c.client.StreamLogs(ctx, &pb.StreamLogsRequest{
 		ContainerId: containerID,
 		Since:       timestamppb.New(since),
@@ -124,7 +128,7 @@ func (c *Client) StreamContainerLogs(ctx context.Context, containerID string, si
 	return sendLogs(stream, events)
 }
 
-func sendLogs(stream pb.AgentService_StreamLogsClient, events chan<- *container.LogEvent) error {
+func sendLogs(stream pb.AgentService_StreamLogsClient, events chan<- container.LogEvent) error {
 	for {
 		resp, err := stream.Recv()
 		if err != nil {
@@ -150,7 +154,7 @@ func sendLogs(stream pb.AgentService_StreamLogsClient, events chan<- *container.
 			continue
 		}
 
-		events <- &container.LogEvent{
+		events <- container.LogEvent{
 			Id:          resp.Event.Id,
 			ContainerID: resp.Event.ContainerId,
 			Message:     message,

internal/agent/server.go

@@ -65,7 +65,7 @@ func (s *server) StreamLogs(in *pb.StreamLogsRequest, out pb.AgentService_Stream
 
 	for event := range g.Events {
 		out.Send(&pb.StreamLogsResponse{
-			Event: logEventToPb(event),
+			Event: logEventToPb(&event),
 		})
 	}
 
@@ -95,7 +95,7 @@ func (s *server) LogsBetweenDates(in *pb.LogsBetweenDatesRequest, out pb.AgentSe
 		select {
 		case event := <-g.Events:
 			out.Send(&pb.StreamLogsResponse{
-				Event: logEventToPb(event),
+				Event: logEventToPb(&event),
 			})
 		case e := <-g.Errors:
 			return e

internal/auth/proxy.go

@@ -20,6 +20,7 @@ type proxyAuthContext struct {
 	headerEmail  string
 	headerName   string
 	headerFilter string
+	headerRoles  string
 }
 
 func hashEmail(email string) string {
@@ -30,12 +31,13 @@ func hashEmail(email string) string {
 	return hex.EncodeToString(hash[:])
 }
 
-func NewForwardProxyAuth(userHeader, emailHeader, nameHeader, filterHeader string) *proxyAuthContext {
+func NewForwardProxyAuth(userHeader, emailHeader, nameHeader, filterHeader, rolesHeader string) *proxyAuthContext {
 	return &proxyAuthContext{
 		headerUser:   userHeader,
 		headerEmail:  emailHeader,
 		headerName:   nameHeader,
 		headerFilter: filterHeader,
+		headerRoles:  rolesHeader,
 	}
 }
 
@@ -46,7 +48,11 @@ func (p *proxyAuthContext) AuthMiddleware(next http.Handler) http.Handler {
 			if err != nil {
 				log.Fatal().Str("filter", r.Header.Get(p.headerFilter)).Msg("Failed to parse container filter")
 			}
-			user := newUser(r.Header.Get(p.headerUser), r.Header.Get(p.headerEmail), r.Header.Get(p.headerName), containerFilter)
+			userRoles := All
+			if strings.TrimSpace(r.Header.Get(p.headerRoles)) != "" {
+				userRoles = ParseRole(r.Header.Get(p.headerRoles))
+			}
+			user := newUser(r.Header.Get(p.headerUser), r.Header.Get(p.headerEmail), r.Header.Get(p.headerName), containerFilter, userRoles)
 			ctx := context.WithValue(r.Context(), remoteUser, user)
 			next.ServeHTTP(w, r.WithContext(ctx))
 		} else {

internal/auth/roles.go

@@ -0,0 +1,65 @@
+package auth
+
+import (
+	"encoding/json"
+	"strings"
+
+	"github.com/rs/zerolog/log"
+)
+
+type Role int
+
+const (
+	None  Role = 0
+	Shell Role = 1 << iota
+	Actions
+	Download
+)
+
+const All = Shell | Actions | Download
+
+// ParseRole parses a comma-separated string of roles and returns the corresponding Role.
+func ParseRole(input string) Role {
+	var roles Role
+	var parts []string
+
+	// Check if input is valid JSON
+	trimmed := strings.TrimSpace(input)
+	if json.Valid([]byte(trimmed)) {
+		var jsonRoles []string
+		if err := json.Unmarshal([]byte(trimmed), &jsonRoles); err == nil {
+			parts = jsonRoles
+		} else {
+			log.Warn().Str("input", input).Msg("failed to parse JSON roles")
+			return None
+		}
+	} else {
+		// Split by both commas and pipes
+		parts = strings.FieldsFunc(input, func(c rune) bool {
+			return c == ',' || c == '|'
+		})
+	}
+
+	for _, r := range parts {
+		role := strings.TrimSpace(strings.ToLower(r))
+		switch role {
+		case "shell", "dozzle_shell":
+			roles |= Shell
+		case "actions", "dozzle_actions":
+			roles |= Actions
+		case "download", "dozzle_download":
+			roles |= Download
+		case "none", "dozzle_none":
+			return None
+		case "all", "dozzle_all":
+			return All
+		default:
+			log.Debug().Str("role", role).Msg("invalid role")
+		}
+	}
+	return roles
+}
+
+func (roles Role) Has(role Role) bool {
+	return roles&role != 0
+}

internal/auth/roles_test.go

@@ -0,0 +1,80 @@
+package auth
+
+import (
+	"testing"
+)
+
+func TestParseRole(t *testing.T) {
+	testCases := []struct {
+		name     string
+		input    string
+		expected Role
+	}{
+		// Single role tests
+		{"Single shell role", "shell", Shell},
+		{"Single actions role", "actions", Actions},
+		{"Single download role", "download", Download},
+		{"None role", "none", None},
+		{"All role", "all", All},
+
+		// Single dozzle_ prefixed role tests
+		{"Single dozzle_shell role", "dozzle_shell", Shell},
+		{"Single dozzle_actions role", "dozzle_actions", Actions},
+		{"Single dozzle_download role", "dozzle_download", Download},
+		{"Dozzle_none role", "dozzle_none", None},
+		{"Dozzle_all role", "dozzle_all", All},
+
+		// Case insensitive tests
+		{"Shell uppercase", "SHELL", Shell},
+		{"Actions mixed case", "AcTiOnS", Actions},
+		{"Download with spaces", " download ", Download},
+		{"Dozzle_shell uppercase", "DOZZLE_SHELL", Shell},
+		{"Dozzle_actions mixed case", "DoZzLe_AcTiOnS", Actions},
+		{"Dozzle_download with spaces", " dozzle_download ", Download},
+
+		// Multiple roles with comma separator
+		{"Shell and actions", "shell,actions", Shell | Actions},
+		{"All three roles", "shell,actions,download", Shell | Actions | Download},
+		{"Roles with spaces", "shell , actions , download", Shell | Actions | Download},
+		{"Dozzle roles with comma", "dozzle_shell,dozzle_actions", Shell | Actions},
+		{"Mixed dozzle and regular", "shell,dozzle_actions,download", Shell | Actions | Download},
+
+		// Multiple roles with pipe separator
+		{"Shell and actions with pipe", "shell|actions", Shell | Actions},
+		{"All three with pipe", "shell|actions|download", Shell | Actions | Download},
+		{"Mixed separators", "shell,actions|download", Shell | Actions | Download},
+		{"Dozzle roles with pipe", "dozzle_shell|dozzle_actions", Shell | Actions},
+
+		// JSON format tests
+		{"JSON single role", `["shell"]`, Shell},
+		{"JSON multiple roles", `["shell", "actions"]`, Shell | Actions},
+		{"JSON all roles", `["shell", "actions", "download"]`, Shell | Actions | Download},
+		{"JSON with spaces", ` ["shell", "actions"] `, Shell | Actions},
+		{"JSON single dozzle role", `["dozzle_shell"]`, Shell},
+		{"JSON multiple dozzle roles", `["dozzle_shell", "dozzle_actions"]`, Shell | Actions},
+		{"JSON mixed dozzle and regular", `["shell", "dozzle_actions"]`, Shell | Actions},
+
+		// Edge cases
+		{"Empty string", "", None},
+		{"Whitespace only", "   ", None},
+		{"Invalid role", "invalid", None},
+		{"Mixed valid and invalid", "shell,invalid,actions", Shell | Actions},
+		{"None overrides others", "shell,none,actions", None},
+		{"All overrides others", "shell,all,actions", All},
+		{"Dozzle_none overrides others", "dozzle_shell,dozzle_none,dozzle_actions", None},
+		{"Dozzle_all overrides others", "dozzle_shell,dozzle_all,dozzle_actions", All},
+
+		// Invalid JSON
+		{"Invalid JSON format", `["shell"`, None},
+		{"Malformed JSON", `{shell: "test"}`, None},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := ParseRole(tc.input)
+			if result != tc.expected {
+				t.Errorf("ParseRole(%q) = %d, expected %d", tc.input, int(result), int(tc.expected))
+			}
+		})
+	}
+}

internal/auth/simple.go

@@ -21,6 +21,7 @@ func NewSimpleAuth(userDatabase UserDatabase, ttl time.Duration) *simpleAuthCont
 	h := sha256.New()
 	for _, user := range userDatabase.Users {
 		h.Write([]byte(user.Password))
+		h.Write([]byte(user.RolesConfigured))
 	}
 
 	tokenAuth := jwtauth.New("HS256", h.Sum(nil), nil)
@@ -38,7 +39,7 @@ func (a *simpleAuthContext) CreateToken(username, password string) (string, erro
 		return "", ErrInvalidCredentials
 	}
 
-	claims := map[string]interface{}{"username": user.Username, "email": user.Email, "name": user.Name, "filter": user.Filter}
+	claims := map[string]interface{}{"username": user.Username, "email": user.Email, "name": user.Name, "filter": user.Filter, "roles": user.Roles}
 	jwtauth.SetIssuedNow(claims)
 
 	if a.ttl > 0 {

internal/auth/users.go

@@ -9,6 +9,7 @@ import (
 	"net/http"
 	"net/url"
 	"os"
+	"strings"
 	"time"
 
 	"github.com/amir20/dozzle/internal/container"
@@ -24,7 +25,9 @@ type User struct {
 	Name            string                    `json:"name" yaml:"name"`
 	Password        string                    `json:"-" yaml:"password"`
 	Filter          string                    `json:"-" yaml:"filter"`
+	RolesConfigured string                    `json:"-" yaml:"roles"`
 	ContainerLabels container.ContainerLabels `json:"-" yaml:"-"`
+	Roles           Role                      `json:"-" yaml:"-"`
 }
 
 func (u User) AvatarURL() string {
@@ -35,12 +38,13 @@ func (u User) AvatarURL() string {
 	return fmt.Sprintf("https://gravatar.com/avatar/%s?d=https%%3A%%2F%%2Fui-avatars.com%%2Fapi%%2F/%s/128", hashEmail(u.Email), url.QueryEscape(name))
 }
 
-func newUser(username, email, name string, labels container.ContainerLabels) User {
+func newUser(username, email, name string, labels container.ContainerLabels, roles Role) User {
 	return User{
 		Username:        username,
 		Email:           email,
 		Name:            name,
 		ContainerLabels: labels,
+		Roles:           roles,
 	}
 }
 
@@ -109,6 +113,12 @@ func decodeUsersFromFile(path string) (UserDatabase, error) {
 		if user.Name == "" {
 			user.Name = username
 		}
+
+		if strings.TrimSpace(user.RolesConfigured) == "" {
+			user.RolesConfigured = "all"
+		}
+
+		user.Roles = ParseRole(user.RolesConfigured)
 	}
 
 	return users, nil
@@ -198,14 +208,21 @@ func UserFromContext(ctx context.Context) *User {
 			email := claims["email"].(string)
 			name := claims["name"].(string)
 			containerFilter := container.ContainerLabels{}
+
 			if filter, ok := claims["filter"].(string); ok {
 				containerFilter, err = container.ParseContainerFilter(filter)
 				if err != nil {
 					log.Fatal().Err(err).Str("filter", filter).Msg("Failed to parse container filter")
 				}
 			}
+			roles := None
+			if r, ok := claims["roles"].(float64); ok {
+				roles = Role(r)
+			} else {
+				log.Warn().Interface("roles", claims["roles"]).Msg("Failed to parse roles from JWT claims")
+			}
 
-			user := newUser(username, email, name, containerFilter)
+			user := newUser(username, email, name, containerFilter, roles)
 			return &user
 		}
 		return nil

internal/container/event_generator.go

@@ -17,11 +17,11 @@ import (
 )
 
 type EventGenerator struct {
-	Events      chan *LogEvent
+	Events      chan LogEvent
 	Errors      chan error
 	reader      LogReader
 	next        *LogEvent
-	buffer      chan *LogEvent
+	buffer      chan LogEvent
 	wg          sync.WaitGroup
 	containerID string
 	ctx         context.Context
@@ -36,9 +36,9 @@ type LogReader interface {
 func NewEventGenerator(ctx context.Context, reader LogReader, container Container) *EventGenerator {
 	generator := &EventGenerator{
 		reader:      reader,
-		buffer:      make(chan *LogEvent, 100),
+		buffer:      make(chan LogEvent, 100),
 		Errors:      make(chan error, 1),
-		Events:      make(chan *LogEvent),
+		Events:      make(chan LogEvent),
 		containerID: container.ID,
 		ctx:         ctx,
 	}
@@ -49,24 +49,29 @@ func NewEventGenerator(ctx context.Context, reader LogReader, container Containe
 }
 
 func (g *EventGenerator) processBuffer() {
-	var current, next *LogEvent
+	var current, next LogEvent
+	var hasNext bool
 
 loop:
 	for {
 		if g.next != nil {
-			current = g.next
+			current = *g.next
 			g.next = nil
-			next = g.peek()
+			next, hasNext = g.peek()
 		} else {
 			event, ok := <-g.buffer
 			if !ok {
 				break loop
 			}
 			current = event
-			next = g.peek()
+			next, hasNext = g.peek()
 		}
 
-		checkPosition(current, next)
+		if hasNext {
+			checkPosition(&current, &next)
+		} else {
+			checkPosition(&current, nil)
+		}
 
 		select {
 		case g.Events <- current:
@@ -101,23 +106,23 @@ func (g *EventGenerator) consumeReader() {
 	g.wg.Done()
 }
 
-func (g *EventGenerator) peek() *LogEvent {
+func (g *EventGenerator) peek() (LogEvent, bool) {
 	if g.next != nil {
-		return g.next
+		return *g.next, true
 	}
 	select {
 	case event := <-g.buffer:
-		g.next = event
-		return g.next
+		g.next = &event
+		return event, true
 	case <-time.After(50 * time.Millisecond):
-		return nil
+		return LogEvent{}, false
 	}
 }
 
-func createEvent(message string, streamType StdType) *LogEvent {
+func createEvent(message string, streamType StdType) LogEvent {
 	h := fnv.New32a()
 	h.Write([]byte(message))
-	logEvent := &LogEvent{Id: h.Sum32(), Message: message, Stream: streamType.String()}
+	logEvent := LogEvent{Id: h.Sum32(), Message: message, Stream: streamType.String()}
 	if index := strings.IndexAny(message, " "); index != -1 {
 		logId := message[:index]
 		if timestamp, err := time.Parse(time.RFC3339Nano, logId); err == nil {
@@ -157,20 +162,20 @@ func createEvent(message string, streamType StdType) *LogEvent {
 }
 
 func checkPosition(currentEvent *LogEvent, nextEvent *LogEvent) {
-	currentLevel := guessLogLevel(currentEvent)
+	currentLevel := guessLogLevel(*currentEvent)
 	if nextEvent != nil {
-		if currentEvent.IsCloseToTime(nextEvent) && currentLevel != "unknown" && !nextEvent.HasLevel() {
+		if currentEvent.IsCloseToTime(*nextEvent) && currentLevel != "unknown" && !nextEvent.HasLevel() {
 			currentEvent.Position = Beginning
 			nextEvent.Position = Middle
 		}
 
 		// If next item is not close to current item or has level, set current item position to end
-		if currentEvent.Position == Middle && (nextEvent.HasLevel() || !currentEvent.IsCloseToTime(nextEvent)) {
+		if currentEvent.Position == Middle && (nextEvent.HasLevel() || !currentEvent.IsCloseToTime(*nextEvent)) {
 			currentEvent.Position = End
 		}
 
 		// If next item is close to current item and has no level, set next item position to middle
-		if currentEvent.Position == Middle && !nextEvent.HasLevel() && currentEvent.IsCloseToTime(nextEvent) {
+		if currentEvent.Position == Middle && !nextEvent.HasLevel() && currentEvent.IsCloseToTime(*nextEvent) {
 			nextEvent.Position = Middle
 		}
 		// Set next item level to current item level

internal/container/event_generator_test.go

@@ -96,14 +96,14 @@ func Test_createEvent(t *testing.T) {
 	tests := []struct {
 		name string
 		args args
-		want *LogEvent
+		want LogEvent
 	}{
 		{
 			name: "empty message",
 			args: args{
 				message: "",
 			},
-			want: &LogEvent{
+			want: LogEvent{
 				Message: "",
 			},
 		}, {
@@ -111,7 +111,7 @@ func Test_createEvent(t *testing.T) {
 			args: args{
 				message: "2020-05-13T18:55:37.772853839Z {\"xyz\": \"value\", \"abc\": \"value2\"}",
 			},
-			want: &LogEvent{
+			want: LogEvent{
 				Message: data,
 			},
 		},
@@ -120,7 +120,7 @@ func Test_createEvent(t *testing.T) {
 			args: args{
 				message: "2020-05-13T18:55:37.772853839Z {\"key\"}",
 			},
-			want: &LogEvent{
+			want: LogEvent{
 				Message: "{\"key\"}",
 			},
 		},
@@ -129,7 +129,7 @@ func Test_createEvent(t *testing.T) {
 			args: args{
 				message: "2020-05-13T18:55:37.772853839Z 123",
 			},
-			want: &LogEvent{
+			want: LogEvent{
 				Message: "123",
 			},
 		},
@@ -138,7 +138,7 @@ func Test_createEvent(t *testing.T) {
 			args: args{
 				message: "2020-05-13T18:55:37.772853839Z sample text with=equal sign",
 			},
-			want: &LogEvent{
+			want: LogEvent{
 				Message: "sample text with=equal sign",
 			},
 		},
@@ -147,7 +147,7 @@ func Test_createEvent(t *testing.T) {
 			args: args{
 				message: "2020-05-13T18:55:37.772853839Z null",
 			},
-			want: &LogEvent{
+			want: LogEvent{
 				Message: "",
 			},
 		},

internal/container/level_guesser.go

@@ -41,7 +41,7 @@ func init() {
 	SupportedLogLevels["unknown"] = struct{}{}
 }
 
-func guessLogLevel(logEvent *LogEvent) string {
+func guessLogLevel(logEvent LogEvent) string {
 	switch value := logEvent.Message.(type) {
 	case string:
 		value = stripANSI(value)

internal/container/level_guesser_test.go

@@ -72,7 +72,7 @@ func TestGuessLogLevel(t *testing.T) {
 	for _, test := range tests {
 		name, _ := json.Marshal(test.input)
 		t.Run(string(name), func(t *testing.T) {
-			actual := guessLogLevel(&LogEvent{Message: test.input})
+			actual := guessLogLevel(LogEvent{Message: test.input})
 			if actual != test.expected {
 				t.Errorf("Expected %s, got %s", test.expected, actual)
 			}

internal/container/types.go

@@ -176,14 +176,14 @@ type LogEvent struct {
 	ContainerID string      `json:"c,omitempty"`
 }
 
-func (l *LogEvent) HasLevel() bool {
+func (l LogEvent) HasLevel() bool {
 	return l.Level != "unknown"
 }
 
-func (l *LogEvent) IsCloseToTime(other *LogEvent) bool {
+func (l LogEvent) IsCloseToTime(other LogEvent) bool {
 	return math.Abs(float64(l.Timestamp-other.Timestamp)) < 10
 }
 
-func (l *LogEvent) MessageId() int64 {
+func (l LogEvent) MessageId() int64 {
 	return l.Timestamp
 }

internal/profile/disk.go

@@ -75,10 +75,10 @@ func UpdateFromReader(user auth.User, reader io.Reader) error {
 		return err
 	}
 
-	return Save(user, existingProfile)
+	return save(user, existingProfile)
 }
 
-func Save(user auth.User, profile Profile) error {
+func save(user auth.User, profile Profile) error {
 	path := filepath.Join(dataPath, user.Username)
 	if _, err := os.Stat(path); os.IsNotExist(err) {
 		if err := os.Mkdir(path, 0755); err != nil {

internal/support/cli/args.go

@@ -21,11 +21,14 @@ type Args struct {
 	AuthHeaderEmail  string              `arg:"--auth-header-email,env:DOZZLE_AUTH_HEADER_EMAIL" default:"Remote-Email" help:"sets the HTTP Header to use for email in Forward Proxy configuration."`
 	AuthHeaderName   string              `arg:"--auth-header-name,env:DOZZLE_AUTH_HEADER_NAME" default:"Remote-Name" help:"sets the HTTP Header to use for name in Forward Proxy configuration."`
 	AuthHeaderFilter string              `arg:"--auth-header-filter,env:DOZZLE_AUTH_HEADER_FILTER" default:"Remote-Filter" help:"sets the HTTP Header to use for filtering in Forward Proxy configuration."`
+	AuthHeaderRoles  string              `arg:"--auth-header-roles,env:DOZZLE_AUTH_HEADER_ROLES" default:"Remote-Roles" help:"sets the HTTP Header to use for roles in Forward Proxy configuration."`
+	AuthLogoutUrl    string              `arg:"--auth-logout-url,env:DOZZLE_AUTH_LOGOUT_URL" help:"sets the Logout URL used with Forward Proxy."`
 	EnableActions    bool                `arg:"--enable-actions,env:DOZZLE_ENABLE_ACTIONS" default:"false" help:"enables essential actions on containers from the web interface."`
 	EnableShell      bool                `arg:"--enable-shell,env:DOZZLE_ENABLE_SHELL" default:"false" help:"enables shell access to containers from the web interface."`
 	DisableAvatars   bool                `arg:"--disable-avatars,env:DOZZLE_DISABLE_AVATARS" default:"false" help:"disables avatars for authenticated users."`
 	FilterStrings    []string            `arg:"env:DOZZLE_FILTER,--filter,separate" help:"filters docker containers using Docker syntax."`
 	Filter           map[string][]string `arg:"-"`
+	ReleaseCheckMode string              `arg:"--release-check-mode,env:DOZZLE_RELEASE_CHECK_MODE" default:"automatic" help:"sets the release check mode. When manual, releases will not be automatically fetched."`
 	RemoteHost       []string            `arg:"env:DOZZLE_REMOTE_HOST,--remote-host,separate" help:"list of hosts to connect remotely"`
 	RemoteAgent      []string            `arg:"env:DOZZLE_REMOTE_AGENT,--remote-agent,separate" help:"list of agents to connect remotely"`
 	NoAnalytics      bool                `arg:"--no-analytics,env:DOZZLE_NO_ANALYTICS" help:"disables anonymous analytics"`

internal/support/cli/generate_command.go

@@ -11,11 +11,12 @@ import (
 )
 
 type GenerateCmd struct {
-	Username string `arg:"positional"`
-	Password string `arg:"--password, -p" help:"sets the password for the user"`
-	Name     string `arg:"--name, -n" help:"sets the display name for the user"`
-	Email    string `arg:"--email, -e" help:"sets the email for the user"`
-	Filter   string `arg:"--user-filter" help:"sets the filter for the user. This can be a comma separated list of filters."`
+	Username        string `arg:"positional"`
+	Password        string `arg:"--password, -p" help:"sets the password for the user"`
+	Name            string `arg:"--name, -n" help:"sets the display name for the user"`
+	Email           string `arg:"--email, -e" help:"sets the email for the user"`
+	Filter          string `arg:"--user-filter" help:"sets the filter for the user. This can be a comma separated list of filters."`
+	RolesConfigured string `arg:"--user-roles" help:"sets the roles for the user. This can be a comma separated list of roles."`
 }
 
 func (g *GenerateCmd) Run(args Args, embeddedCerts embed.FS) error {
@@ -27,11 +28,12 @@ func (g *GenerateCmd) Run(args Args, embeddedCerts embed.FS) error {
 	}
 
 	buffer := auth.GenerateUsers(auth.User{
-		Username: args.Generate.Username,
-		Password: args.Generate.Password,
-		Name:     args.Generate.Name,
-		Email:    args.Generate.Email,
-		Filter:   args.Generate.Filter,
+		Username:        args.Generate.Username,
+		Password:        args.Generate.Password,
+		Name:            args.Generate.Name,
+		Email:           args.Generate.Email,
+		Filter:          args.Generate.Filter,
+		RolesConfigured: args.Generate.RolesConfigured,
 	}, true)
 
 	if _, err := os.Stdout.Write(buffer.Bytes()); err != nil {

internal/support/container/agent_service.go

@@ -32,11 +32,11 @@ func (a *agentService) RawLogs(ctx context.Context, container container.Containe
 	return a.client.StreamRawBytes(ctx, container.ID, from, to, stdTypes)
 }
 
-func (a *agentService) LogsBetweenDates(ctx context.Context, container container.Container, from time.Time, to time.Time, stdTypes container.StdType) (<-chan *container.LogEvent, error) {
+func (a *agentService) LogsBetweenDates(ctx context.Context, container container.Container, from time.Time, to time.Time, stdTypes container.StdType) (<-chan container.LogEvent, error) {
 	return a.client.LogsBetweenDates(ctx, container.ID, from, to, stdTypes)
 }
 
-func (a *agentService) StreamLogs(ctx context.Context, container container.Container, from time.Time, stdTypes container.StdType, events chan<- *container.LogEvent) error {
+func (a *agentService) StreamLogs(ctx context.Context, container container.Container, from time.Time, stdTypes container.StdType, events chan<- container.LogEvent) error {
 	return a.client.StreamContainerLogs(ctx, container.ID, from, stdTypes, events)
 }
 

internal/support/container/client_service.go

@@ -15,7 +15,7 @@ type ClientService interface {
 	ListContainers(ctx context.Context, filter container.ContainerLabels) ([]container.Container, error)
 	Host(ctx context.Context) (container.Host, error)
 	ContainerAction(ctx context.Context, container container.Container, action container.ContainerAction) error
-	LogsBetweenDates(ctx context.Context, container container.Container, from time.Time, to time.Time, stdTypes container.StdType) (<-chan *container.LogEvent, error)
+	LogsBetweenDates(ctx context.Context, container container.Container, from time.Time, to time.Time, stdTypes container.StdType) (<-chan container.LogEvent, error)
 	RawLogs(context.Context, container.Container, time.Time, time.Time, container.StdType) (io.ReadCloser, error)
 
 	// Subscriptions
@@ -24,7 +24,7 @@ type ClientService interface {
 	SubscribeContainersStarted(context.Context, chan<- container.Container)
 
 	// Blocking streaming functions that should be used in a goroutine
-	StreamLogs(context.Context, container.Container, time.Time, container.StdType, chan<- *container.LogEvent) error
+	StreamLogs(context.Context, container.Container, time.Time, container.StdType, chan<- container.LogEvent) error
 
 	// Terminal
 	Attach(context.Context, container.Container, io.Reader, io.Writer) error

internal/support/container/container_service.go

@@ -24,11 +24,11 @@ func (c *ContainerService) RawLogs(ctx context.Context, from time.Time, to time.
 	return c.clientService.RawLogs(ctx, c.Container, from, to, stdTypes)
 }
 
-func (c *ContainerService) LogsBetweenDates(ctx context.Context, from time.Time, to time.Time, stdTypes container.StdType) (<-chan *container.LogEvent, error) {
+func (c *ContainerService) LogsBetweenDates(ctx context.Context, from time.Time, to time.Time, stdTypes container.StdType) (<-chan container.LogEvent, error) {
 	return c.clientService.LogsBetweenDates(ctx, c.Container, from, to, stdTypes)
 }
 
-func (c *ContainerService) StreamLogs(ctx context.Context, from time.Time, stdTypes container.StdType, events chan<- *container.LogEvent) error {
+func (c *ContainerService) StreamLogs(ctx context.Context, from time.Time, stdTypes container.StdType, events chan<- container.LogEvent) error {
 	return c.clientService.StreamLogs(ctx, c.Container, from, stdTypes, events)
 }
 

internal/support/docker/docker_service.go

@@ -52,7 +52,7 @@ func (d *DockerClientService) RawLogs(ctx context.Context, container container.C
 
 }
 
-func (d *DockerClientService) LogsBetweenDates(ctx context.Context, c container.Container, from time.Time, to time.Time, stdTypes container.StdType) (<-chan *container.LogEvent, error) {
+func (d *DockerClientService) LogsBetweenDates(ctx context.Context, c container.Container, from time.Time, to time.Time, stdTypes container.StdType) (<-chan container.LogEvent, error) {
 	reader, err := d.client.ContainerLogsBetweenDates(ctx, c.ID, from, to, stdTypes)
 	if err != nil {
 		return nil, err
@@ -63,7 +63,7 @@ func (d *DockerClientService) LogsBetweenDates(ctx context.Context, c container.
 	return g.Events, nil
 }
 
-func (d *DockerClientService) StreamLogs(ctx context.Context, c container.Container, from time.Time, stdTypes container.StdType, events chan<- *container.LogEvent) error {
+func (d *DockerClientService) StreamLogs(ctx context.Context, c container.Container, from time.Time, stdTypes container.StdType, events chan<- container.LogEvent) error {
 	reader, err := d.client.ContainerLogs(ctx, c.ID, from, stdTypes)
 	if err != nil {
 		return err
@@ -122,7 +122,6 @@ func (d *DockerClientService) Attach(ctx context.Context, container container.Co
 	var wg sync.WaitGroup
 
 	wg.Go(func() {
-		defer wg.Done()
 		if _, err := io.Copy(containerWriter, stdin); err != nil {
 			log.Error().Err(err).Msg("error while reading from ws")
 		}

internal/support/k8s/k8s_service.go

@@ -45,7 +45,7 @@ func (k *K8sClientService) ContainerAction(ctx context.Context, container contai
 	return k.client.ContainerActions(ctx, action, container.ID)
 }
 
-func (k *K8sClientService) LogsBetweenDates(ctx context.Context, c container.Container, from time.Time, to time.Time, stdTypes container.StdType) (<-chan *container.LogEvent, error) {
+func (k *K8sClientService) LogsBetweenDates(ctx context.Context, c container.Container, from time.Time, to time.Time, stdTypes container.StdType) (<-chan container.LogEvent, error) {
 	reader, err := k.client.ContainerLogsBetweenDates(ctx, c.ID, from, to, stdTypes)
 	if err != nil {
 		return nil, err
@@ -60,7 +60,7 @@ func (k *K8sClientService) RawLogs(ctx context.Context, container container.Cont
 	return k.client.ContainerLogsBetweenDates(ctx, container.ID, from, to, stdTypes)
 }
 
-func (k *K8sClientService) StreamLogs(ctx context.Context, c container.Container, from time.Time, stdTypes container.StdType, events chan<- *container.LogEvent) error {
+func (k *K8sClientService) StreamLogs(ctx context.Context, c container.Container, from time.Time, stdTypes container.StdType, events chan<- container.LogEvent) error {
 	reader, err := k.client.ContainerLogs(ctx, c.ID, from, stdTypes)
 	if err != nil {
 		return err

internal/support/web/search.go

@@ -16,7 +16,7 @@ func ParseRegex(search string) (*regexp.Regexp, error) {
 	return CreateRegex(search, search == strings.ToLower(search))
 }
 
-func Search(re *regexp.Regexp, logEvent *container.LogEvent) bool {
+func Search(re *regexp.Regexp, logEvent container.LogEvent) bool {
 	matcher := NewPatternMatcher(re, MarkerStart, MarkerEnd)
-	return matcher.MarkInLogEvent(logEvent)
+	return matcher.MarkInLogEvent(&logEvent)
 }

internal/web/actions.go

@@ -14,11 +14,19 @@ func (h *handler) containerActions(w http.ResponseWriter, r *http.Request) {
 	id := chi.URLParam(r, "id")
 
 	userLabels := h.config.Labels
+	permit := true
 	if h.config.Authorization.Provider != NONE {
 		user := auth.UserFromContext(r.Context())
 		if user.ContainerLabels.Exists() {
 			userLabels = user.ContainerLabels
 		}
+		permit = user.Roles.Has(auth.Actions)
+	}
+
+	if !permit {
+		log.Warn().Msg("user is not permitted to perform actions on container")
+		http.Error(w, http.StatusText(http.StatusForbidden), http.StatusForbidden)
+		return
 	}
 
 	containerService, err := h.hostService.FindContainer(hostKey(r), id, userLabels)

internal/web/auth_proxy_test.go

@@ -20,7 +20,7 @@ func Test_createRoutes_proxy_missing_headers(t *testing.T) {
 	handler := createHandler(nil, afero.NewIOFS(fs), Config{Base: "/",
 		Authorization: Authorization{
 			Provider:   FORWARD_PROXY,
-			Authorizer: auth.NewForwardProxyAuth("Remote-User", "Remote-Email", "Remote-Name", "Remote-Filter"),
+			Authorizer: auth.NewForwardProxyAuth("Remote-User", "Remote-Email", "Remote-Name", "Remote-Filter", "Remote-RolesConfigured"),
 		},
 	})
 	req, err := http.NewRequest("GET", "/", nil)
@@ -39,7 +39,7 @@ func Test_createRoutes_proxy_happy(t *testing.T) {
 	handler := createHandler(nil, afero.NewIOFS(fs), Config{Base: "/",
 		Authorization: Authorization{
 			Provider:   FORWARD_PROXY,
-			Authorizer: auth.NewForwardProxyAuth("Remote-User", "Remote-Email", "Remote-Name", "Remote-Filter"),
+			Authorizer: auth.NewForwardProxyAuth("Remote-User", "Remote-Email", "Remote-Name", "Remote-Filter", "Remote-RolesConfigured"),
 		},
 	})
 	req, err := http.NewRequest("GET", "/", nil)

internal/web/download.go

@@ -23,11 +23,19 @@ func (h *handler) downloadLogs(w http.ResponseWriter, r *http.Request) {
 	}
 
 	userLabels := h.config.Labels
+	permit := true
 	if h.config.Authorization.Provider != NONE {
 		user := auth.UserFromContext(r.Context())
 		if user.ContainerLabels.Exists() {
 			userLabels = user.ContainerLabels
 		}
+		permit = user.Roles.Has(auth.Download)
+	}
+
+	if !permit {
+		log.Warn().Msg("user is not permitted to download logs from container")
+		http.Error(w, http.StatusText(http.StatusForbidden), http.StatusForbidden)
+		return
 	}
 
 	now := time.Now()

internal/web/index.go

@@ -4,6 +4,7 @@ import (
 	"html/template"
 	"io"
 	"sort"
+	"strings"
 
 	"encoding/json"
 
@@ -12,7 +13,6 @@ import (
 
 	"github.com/amir20/dozzle/internal/auth"
 	"github.com/amir20/dozzle/internal/profile"
-
 	"github.com/rs/zerolog/log"
 )
 
@@ -45,13 +45,26 @@ func (h *handler) executeTemplate(w http.ResponseWriter, req *http.Request) {
 	user := auth.UserFromContext(req.Context())
 
 	if h.config.Authorization.Provider == NONE || user != nil {
+		if user != nil {
+			config["enableShell"] = h.config.EnableShell && user.Roles.Has(auth.Shell)
+			config["enableActions"] = h.config.EnableActions && user.Roles.Has(auth.Actions)
+			config["enableDownload"] = user.Roles.Has(auth.Download)
+		} else {
+			config["enableShell"] = h.config.EnableShell
+			config["enableActions"] = h.config.EnableActions
+			config["enableDownload"] = true
+		}
+
+		if h.config.Authorization.Provider == FORWARD_PROXY && strings.TrimSpace(h.config.Authorization.LogoutUrl) != "" {
+			config["logoutUrl"] = strings.TrimSpace(h.config.Authorization.LogoutUrl)
+		}
+
 		config["authProvider"] = h.config.Authorization.Provider
 		config["version"] = h.config.Version
 		config["hostname"] = h.config.Hostname
 		config["hosts"] = hosts
-		config["enableActions"] = h.config.EnableActions
-		config["enableShell"] = h.config.EnableShell
 		config["disableAvatars"] = h.config.DisableAvatars
+		config["releaseCheckMode"] = h.config.ReleaseCheckMode
 	}
 
 	if user != nil {

internal/web/logs.go

@@ -82,7 +82,7 @@ func (h *handler) fetchLogsBetweenDates(w http.ResponseWriter, r *http.Request)
 	}
 
 	minimum := 0
-	buffer := utils.NewRingBuffer[*container.LogEvent](500)
+	buffer := utils.NewRingBuffer[container.LogEvent](500)
 	if r.URL.Query().Has("min") {
 		minimum, err = strconv.Atoi(r.URL.Query().Get("min"))
 		if err != nil {
@@ -94,7 +94,7 @@ func (h *handler) fetchLogsBetweenDates(w http.ResponseWriter, r *http.Request)
 			http.Error(w, errors.New("minimum must be between 0 and buffer size").Error(), http.StatusBadRequest)
 			return
 		}
-		buffer = utils.NewRingBuffer[*container.LogEvent](minimum)
+		buffer = utils.NewRingBuffer[container.LogEvent](minimum)
 	}
 
 	maxStart := math.MaxInt
@@ -177,7 +177,7 @@ func (h *handler) fetchLogsBetweenDates(w http.ResponseWriter, r *http.Request)
 					break
 				}
 
-				support_web.EscapeHTMLValues(event)
+				support_web.EscapeHTMLValues(&event)
 				buffer.Push(event)
 			}
 		}
@@ -294,9 +294,9 @@ func (h *handler) streamLogsForContainers(w http.ResponseWriter, r *http.Request
 
 	absoluteTime := time.Time{}
 	var regex *regexp.Regexp
-	liveLogs := make(chan *container.LogEvent)
+	liveLogs := make(chan container.LogEvent)
 	events := make(chan *container.ContainerEvent, 1)
-	backfill := make(chan []*container.LogEvent)
+	backfill := make(chan []container.LogEvent)
 
 	levels := make(map[string]struct{})
 	for _, level := range r.URL.Query()["levels"] {
@@ -318,7 +318,7 @@ func (h *handler) streamLogsForContainers(w http.ResponseWriter, r *http.Request
 			delta := -10 * time.Second
 			to := absoluteTime
 			for minimum > 0 {
-				events := make([]*container.LogEvent, 0)
+				events := make([]container.LogEvent, 0)
 				stillRunning := false
 				for _, container := range existingContainers {
 					containerService, err := h.hostService.FindContainer(container.Host, container.ID, userLabels)
@@ -418,7 +418,7 @@ loop:
 				continue
 			}
 
-			support_web.EscapeHTMLValues(logEvent)
+			support_web.EscapeHTMLValues(&logEvent)
 			sseWriter.Message(logEvent)
 		case c := <-newContainers:
 			if _, err := h.hostService.FindContainer(c.Host, c.ID, userLabels); err == nil {
@@ -433,8 +433,8 @@ loop:
 			}
 
 		case backfillEvents := <-backfill:
-			for _, event := range backfillEvents {
-				support_web.EscapeHTMLValues(event)
+			for i := range backfillEvents {
+				support_web.EscapeHTMLValues(&backfillEvents[i])
 			}
 			if err := sseWriter.Event("logs-backfill", backfillEvents); err != nil {
 				log.Error().Err(err).Msg("error encoding container event")

internal/web/routes.go

@@ -17,6 +17,13 @@ import (
 	"github.com/rs/zerolog/log"
 )
 
+type ReleaseCheckMode string
+
+const (
+	Automatic ReleaseCheckMode = "automatic"
+	Manual    ReleaseCheckMode = "manual"
+)
+
 type AuthProvider string
 
 const (
@@ -27,23 +34,25 @@ const (
 
 // Config is a struct for configuring the web service
 type Config struct {
-	Base           string
-	Addr           string
-	Version        string
-	Hostname       string
-	NoAnalytics    bool
-	Dev            bool
-	Authorization  Authorization
-	EnableActions  bool
-	EnableShell    bool
-	DisableAvatars bool
-	Labels         container.ContainerLabels
+	Base             string
+	Addr             string
+	Version          string
+	Hostname         string
+	NoAnalytics      bool
+	Dev              bool
+	Authorization    Authorization
+	EnableActions    bool
+	EnableShell      bool
+	DisableAvatars   bool
+	ReleaseCheckMode ReleaseCheckMode
+	Labels           container.ContainerLabels
 }
 
 type Authorization struct {
 	Provider   AuthProvider
 	Authorizer Authorizer
 	TTL        time.Duration
+	LogoutUrl  string
 }
 
 type Authorizer interface {

internal/web/terminal.go

@@ -27,15 +27,22 @@ func (h *handler) attach(w http.ResponseWriter, r *http.Request) {
 
 	id := chi.URLParam(r, "id")
 	userLabels := h.config.Labels
+	permit := true
 	if h.config.Authorization.Provider != NONE {
 		user := auth.UserFromContext(r.Context())
 		if user.ContainerLabels.Exists() {
 			userLabels = user.ContainerLabels
 		}
+		permit = user.Roles.Has(auth.Shell)
+	}
+
+	if !permit {
+		log.Warn().Msg("user is not permitted to attach to container")
+		conn.WriteMessage(websocket.TextMessage, []byte("⛔ Access denied: attaching to this container is forbidden\r\n"))
+		return
 	}
 
 	containerService, err := h.hostService.FindContainer(hostKey(r), id, userLabels)
-
 	if err != nil {
 		log.Error().Err(err).Msg("error while trying to find container")
 		return
@@ -60,11 +67,19 @@ func (h *handler) exec(w http.ResponseWriter, r *http.Request) {
 
 	id := chi.URLParam(r, "id")
 	userLabels := h.config.Labels
+	permit := true
 	if h.config.Authorization.Provider != NONE {
 		user := auth.UserFromContext(r.Context())
 		if user.ContainerLabels.Exists() {
 			userLabels = user.ContainerLabels
 		}
+		permit = user.Roles.Has(auth.Shell)
+	}
+
+	if !permit {
+		log.Warn().Msg("user is not permitted to exec into container")
+		conn.WriteMessage(websocket.TextMessage, []byte("⛔ Access denied: attaching to this container is forbidden\r\n"))
+		return
 	}
 
 	containerService, err := h.hostService.FindContainer(hostKey(r), id, userLabels)

main.go

@@ -130,40 +130,51 @@ func main() {
 }
 
 func fileExists(filename string) bool {
-    _, err := os.Stat(filename)
-    if os.IsNotExist(err) {
-        return false
-    }
-    return err == nil
+	_, err := os.Stat(filename)
+	if os.IsNotExist(err) {
+		return false
+	}
+	return err == nil
 }
 
 func createServer(args cli.Args, hostService web.HostService) *http.Server {
 	_, dev := os.LookupEnv("DEV")
 
+	var releaseCheckMode web.ReleaseCheckMode = web.Automatic
+
+	switch args.ReleaseCheckMode {
+	case "automatic":
+		releaseCheckMode = web.Automatic
+	case "manual":
+		releaseCheckMode = web.Manual
+	default:
+		log.Fatal().Str("releaseCheckMode", args.ReleaseCheckMode).Msg("Invalid release check mode")
+	}
+
 	var provider web.AuthProvider = web.NONE
 	var authorizer web.Authorizer
 	if args.AuthProvider == "forward-proxy" {
 		log.Debug().Msg("Using forward proxy authentication")
 		provider = web.FORWARD_PROXY
-		authorizer = auth.NewForwardProxyAuth(args.AuthHeaderUser, args.AuthHeaderEmail, args.AuthHeaderName, args.AuthHeaderFilter)
+		authorizer = auth.NewForwardProxyAuth(args.AuthHeaderUser, args.AuthHeaderEmail, args.AuthHeaderName, args.AuthHeaderFilter, args.AuthHeaderRoles)
 	} else if args.AuthProvider == "simple" {
 		log.Debug().Msg("Using simple authentication")
 		provider = web.SIMPLE
-		
-        userFilePath := "./data/users.yml"
-        if !fileExists(userFilePath) {
-            userFilePath = "./data/users.yaml"
-            if !fileExists(userFilePath) {
-                log.Fatal().Msg("No users.yaml or users.yml file found.")
-            }
-        }
 
-        log.Debug().Msgf("Reading %s file", filepath.Base(userFilePath))
+		userFilePath := "./data/users.yml"
+		if !fileExists(userFilePath) {
+			userFilePath = "./data/users.yaml"
+			if !fileExists(userFilePath) {
+				log.Fatal().Msg("No users.yaml or users.yml file found.")
+			}
+		}
 
-        db, err := auth.ReadUsersFromFile(userFilePath)
-        if err != nil {
-            log.Fatal().Err(err).Msgf("Could not read users file: %s", userFilePath)
-        }
+		log.Debug().Msgf("Reading %s file", filepath.Base(userFilePath))
+
+		db, err := auth.ReadUsersFromFile(userFilePath)
+		if err != nil {
+			log.Fatal().Err(err).Msgf("Could not read users file: %s", userFilePath)
+		}
 
 		log.Debug().Int("users", len(db.Users)).Msg("Loaded users")
 		ttl := time.Duration(0)
@@ -197,11 +208,13 @@ func createServer(args cli.Args, hostService web.HostService) *http.Server {
 			Provider:   provider,
 			Authorizer: authorizer,
 			TTL:        authTTL,
+			LogoutUrl:  args.AuthLogoutUrl,
 		},
-		EnableActions:  args.EnableActions,
-		EnableShell:    args.EnableShell,
-		DisableAvatars: args.DisableAvatars,
-		Labels:         args.Filter,
+		EnableActions:    args.EnableActions,
+		EnableShell:      args.EnableShell,
+		DisableAvatars:   args.DisableAvatars,
+		ReleaseCheckMode: releaseCheckMode,
+		Labels:           args.Filter,
 	}
 
 	assets, err := fs.Sub(content, "dist")

package.json

@@ -1,12 +1,12 @@
 {
   "name": "dozzle",
-  "version": "8.13.11",
+  "version": "8.14.4",
   "description": "Realtime log viewer for docker containers.",
   "homepage": "https://github.com/amir20/dozzle#readme",
   "bugs": {
     "url": "https://github.com/amir20/dozzle/issues"
   },
-  "packageManager": "pnpm@10.15.0",
+  "packageManager": "pnpm@10.18.2",
   "type": "module",
   "repository": {
     "type": "git",
@@ -29,22 +29,22 @@
     "docs:preview": "vitepress preview docs"
   },
   "dependencies": {
-    "@duckdb/duckdb-wasm": "1.29.1-dev132.0",
-    "@iconify-json/carbon": "^1.2.13",
+    "@duckdb/duckdb-wasm": "1.30.0",
+    "@iconify-json/carbon": "^1.2.14",
     "@iconify-json/cil": "^1.2.3",
     "@iconify-json/ic": "^1.2.4",
-    "@iconify-json/material-symbols": "^1.2.33",
+    "@iconify-json/material-symbols": "^1.2.41",
     "@iconify-json/mdi": "^1.2.3",
     "@iconify-json/mdi-light": "^1.2.2",
-    "@iconify-json/octicon": "^1.2.12",
+    "@iconify-json/octicon": "^1.2.16",
     "@iconify-json/ph": "^1.2.2",
-    "@intlify/unplugin-vue-i18n": "^6.0.8",
-    "@tailwindcss/typography": "^0.5.16",
-    "@tailwindcss/vite": "4.1.12",
-    "@vueuse/components": "^13.8.0",
-    "@vueuse/core": "^13.8.0",
-    "@vueuse/integrations": "^13.8.0",
-    "@vueuse/router": "^13.8.0",
+    "@intlify/unplugin-vue-i18n": "^11.0.1",
+    "@tailwindcss/typography": "^0.5.19",
+    "@tailwindcss/vite": "4.1.14",
+    "@vueuse/components": "^13.9.0",
+    "@vueuse/core": "^13.9.0",
+    "@vueuse/integrations": "^13.9.0",
+    "@vueuse/router": "14.0.0-beta.1",
     "@xterm/addon-web-links": "^0.11.0",
     "@xterm/xterm": "^5.5.0",
     "ansi-to-html": "^0.7.2",
@@ -54,60 +54,60 @@
     "d3-selection": "^3.0.0",
     "d3-shape": "^3.2.0",
     "d3-transition": "^3.0.1",
-    "daisyui": "5.0.54",
-    "entities": "^6.0.1",
+    "daisyui": "5.2.3",
+    "entities": "^7.0.0",
     "fuse.js": "^7.1.0",
     "lodash.debounce": "^4.0.8",
     "pinia": "^3.0.3",
     "sortablejs": "^1.15.6",
     "splitpanes": "^4.0.4",
-    "strip-ansi": "^7.1.0",
-    "tailwindcss": "4.1.12",
-    "unplugin-auto-import": "^20.1.0",
-    "unplugin-icons": "^22.2.0",
-    "unplugin-vue-components": "^29.0.0",
+    "strip-ansi": "^7.1.2",
+    "tailwindcss": "4.1.14",
+    "unplugin-auto-import": "^20.2.0",
+    "unplugin-icons": "^22.4.2",
+    "unplugin-vue-components": "^29.1.0",
     "unplugin-vue-macros": "^2.14.5",
     "unplugin-vue-router": "^0.15.0",
-    "vite": "7.1.3",
+    "vite": "7.1.9",
     "vite-plugin-vue-layouts": "^0.11.0",
     "vite-svg-loader": "^5.1.0",
     "vitepress": "1.6.4",
-    "vue": "^3.5.20",
-    "vue-i18n": "^11.1.11",
+    "vue": "^3.5.22",
+    "vue-i18n": "^11.1.12",
     "vue-router": "^4.5.1"
   },
   "devDependencies": {
-    "@apache-arrow/esnext-esm": "^21.0.0",
+    "@apache-arrow/esnext-esm": "^21.1.0",
     "@iconify-json/ion": "^1.2.6",
-    "@iconify-json/material-symbols-light": "^1.2.33",
-    "@iconify-json/ri": "^1.2.5",
+    "@iconify-json/material-symbols-light": "^1.2.41",
+    "@iconify-json/ri": "^1.2.6",
     "@pinia/testing": "^1.0.2",
-    "@playwright/test": "^1.55.0",
-    "@types/d3-array": "^3.2.1",
+    "@playwright/test": "^1.56.0",
+    "@types/d3-array": "^3.2.2",
     "@types/d3-ease": "^3.0.2",
     "@types/d3-scale": "^4.0.9",
     "@types/d3-selection": "^3.0.11",
     "@types/d3-shape": "^3.1.7",
     "@types/d3-transition": "^3.0.9",
     "@types/lodash.debounce": "^4.0.9",
-    "@types/node": "^24.3.0",
+    "@types/node": "^24.7.2",
     "@vitejs/plugin-vue": "6.0.1",
-    "@vue/compiler-sfc": "^3.5.20",
+    "@vue/compiler-sfc": "^3.5.22",
     "@vue/test-utils": "^2.4.6",
-    "bumpp": "^10.2.3",
+    "bumpp": "^10.3.1",
     "c8": "^10.1.3",
     "concurrently": "^9.2.1",
     "eventsourcemock": "^2.0.0",
-    "jsdom": "^26.1.0",
-    "lint-staged": "^16.1.5",
+    "jsdom": "^27.0.0",
+    "lint-staged": "^16.2.4",
     "prettier": "^3.6.2",
     "prettier-plugin-tailwindcss": "^0.6.14",
     "simple-git-hooks": "^2.13.1",
     "ts-node": "^10.9.2",
-    "typescript": "^5.9.2",
+    "typescript": "^5.9.3",
     "vitest": "^3.2.4",
-    "vue-component-type-helpers": "3.0.6",
-    "vue-tsc": "3.0.6"
+    "vue-component-type-helpers": "3.1.1",
+    "vue-tsc": "3.1.1"
   },
   "lint-staged": {
     "*.{js,vue,css,ts,html,md}": [