Add Apps/Store tab, template WebUI/URL import, container RO volumes/device passthrough/run-as-user, and in-app confirm dialogs

Replaces every native confirm() with a shared P.confirm() modal (a hung
native dialog was found live to block the whole tab, including
auto-refresh, and once even double-confirmed an unrelated deletion).
Also fixes Edit Container silently resetting to Bridge/blanking the
Static IP for any container on a custom network, and a context menu
losing its anchor to a mid-read auto-refresh.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

webui/plugins/podman/ajax/templates.php

@@ -23,9 +23,13 @@
  *                   Create Container form ("Use template")
  *   export   GET  (&name=...) -> {xml: "<raw XML text>"} for download
  *   save     POST {"name": "...", "image": "...", "icon": "...", "category": "...",
- *                   "overview": "...", "networkMode": "...", "privileged": false,
+ *                   "overview": "...", "webUrl": "...", "networkMode": "...", "privileged": false,
  *                   "restartPolicy": "...", "ports": [...], "volumes": [...], "env": [...]}
  *   import   POST {"xml": "<raw XML text>"} -> parses + saves as a new template
+ *   import_url    POST {"url": "https://..."} -> fetches the URL server-side
+ *                   (see template_fetch_url() for the SSRF protections this
+ *                   needs, since the URL comes straight from the client) and
+ *                   imports it the same way as `import`
  *   list_local    GET  -> [{file, name, image, icon}, ...] from Unraid's own
  *                   dockerMan template directories (real existing Docker
  *                   templates the user already has — see
@@ -34,11 +38,36 @@
  *   import_local  POST {"file": "gitea.xml"} -> imports one by filename
  *                   (validated against the same directories list_local
  *                   scanned, never an arbitrary path from the client)
+ *   apps_search   GET  (&q=...&page=1&sort=newest|alpha) -> {results:
+ *                   [{name, image, icon, overview, templateUrl}, ...],
+ *                   total, page, pageSize, feedUpdatedAt} — searches
+ *                   Community Applications' own public app feed (the same
+ *                   catalog CA's own plugin uses, see ca_feed_search()) by
+ *                   name, so a template doesn't have to already be known-by-
+ *                   URL or already sitting in dockerMan's local directories
+ *                   to import it. An empty/omitted q browses the whole feed
+ *                   instead of searching, ordered by `sort` (default
+ *                   "newest"); a non-empty q always sorts alphabetically
+ *                   regardless of `sort` (see ca_feed_search() for why).
+ *                   Importing a match is just `import_url` again with that
+ *                   result's templateUrl — no separate import path needed.
  *   remove   POST {"name": "..."}
  */
 
 declare(strict_types=1);
 
+/**
+ * The public catalog Unraid's own Community Applications plugin is built
+ * on — one JSON file listing every CA app (name, repository, icon,
+ * overview, and critically TemplateURL, the same kind of link
+ * template_fetch_url() already knows how to fetch). ~20MB and only
+ * updated a few times a day upstream, so it's cached to a temp file
+ * rather than re-downloaded on every search keystroke.
+ */
+const CA_FEED_URL = 'https://raw.githubusercontent.com/Squidly271/AppFeed/master/applicationFeed.json';
+const CA_FEED_MAX_AGE_SECONDS = 86400;
+const CA_FEED_PAGE_SIZE = 24;
+
 require __DIR__ . '/../include/bootstrap.php';
 
 $templatesDir = $podmanConfig->bootDir . '/templates';
@@ -78,6 +107,16 @@ switch ($action) {
         podman_json_response(['status' => 'imported', 'name' => $name]);
         break;
 
+    case 'import_url':
+        $body = podman_read_json_body();
+        $url = trim((string) ($body['url'] ?? ''));
+        if ($url === '') {
+            podman_json_error('Missing url in request body', 400);
+        }
+        $name = template_import($templatesDir, template_fetch_url($url));
+        podman_json_response(['status' => 'imported', 'name' => $name]);
+        break;
+
     case 'list_local':
         podman_json_response(local_dockerman_templates_list());
         break;
@@ -89,6 +128,16 @@ switch ($action) {
         podman_json_response(['status' => 'imported', 'name' => $name]);
         break;
 
+    case 'apps_search':
+        $q = trim((string) ($_GET['q'] ?? ''));
+        if ($q !== '' && mb_strlen($q) < 2) {
+            podman_json_error('Search term must be at least 2 characters', 400);
+        }
+        $page = max(1, (int) ($_GET['page'] ?? 1));
+        $sort = (string) ($_GET['sort'] ?? 'newest');
+        podman_json_response(ca_feed_search($q, $page, $sort));
+        break;
+
     case 'remove':
         $body = podman_read_json_body();
         $path = require_template_path($templatesDir, (string) ($body['name'] ?? ''));
@@ -193,6 +242,12 @@ function template_read(string $path): array
                     'kind' => 'path',
                     'source' => $value,
                     'containerPath' => $target !== '' ? $target : $value,
+                    // dockerMan's own convention for a read-only bind — this
+                    // plugin's own exports write it the same way (see
+                    // template_write() below), and real CA templates use it
+                    // too (e.g. a storage-stats sidecar mounting /mnt/user
+                    // read-only rather than read-write for no reason).
+                    'readOnly' => strtolower((string) ($attrs['Mode'] ?? 'rw')) === 'ro',
                 ];
                 break;
             case 'Variable':
@@ -208,6 +263,7 @@ function template_read(string $path): array
         'icon' => (string) $xml->Icon,
         'category' => (string) $xml->Category,
         'overview' => (string) $xml->Overview,
+        'webUrl' => (string) $xml->WebUI,
         'ports' => $ports,
         'volumes' => $volumes,
         'env' => $env,
@@ -245,6 +301,7 @@ function template_write(string $templatesDir, string $name, array $body): void
     $append('Overview', (string) ($body['overview'] ?? ''));
     $append('Category', (string) ($body['category'] ?? ''));
     $append('Icon', (string) ($body['icon'] ?? ''));
+    $append('WebUI', (string) ($body['webUrl'] ?? ''));
 
     foreach (($body['ports'] ?? []) as $row) {
         $hostPort = (string) ($row['hostPort'] ?? '');
@@ -268,7 +325,7 @@ function template_write(string $templatesDir, string $name, array $body): void
         $cfg = $doc->createElement('Config', $source);
         $cfg->setAttribute('Name', basename($containerPath));
         $cfg->setAttribute('Target', $containerPath);
-        $cfg->setAttribute('Mode', 'rw');
+        $cfg->setAttribute('Mode', ($row['readOnly'] ?? false) ? 'ro' : 'rw');
         $cfg->setAttribute('Type', 'Path');
         $root->appendChild($cfg);
     }
@@ -317,6 +374,241 @@ function template_import(string $templatesDir, string $xmlText): string
     return (string) $name;
 }
 
+/**
+ * Fetches a template XML from a user-supplied URL for "Import from URL".
+ * Only plain http(s) with a hostname that resolves EXCLUSIVELY to public
+ * addresses is allowed — checked with FILTER_FLAG_NO_PRIV_RANGE |
+ * FILTER_FLAG_NO_RES_RANGE, which also covers loopback/link-local, not
+ * just RFC1918. curl is then pinned to that exact validated IP via
+ * CURLOPT_RESOLVE rather than letting it resolve the host itself again:
+ * resolving once here and connecting separately would leave a window for
+ * a DNS answer that changes between the check and the request (DNS
+ * rebinding) to point curl at an internal address anyway. Redirects are
+ * not followed for the same reason — a redirect target needs this same
+ * validation, and silently trusting one would reopen the hole this whole
+ * function exists to close. Response size is capped well above what any
+ * real template XML needs.
+ */
+function template_fetch_url(string $url): string
+{
+    $parts = parse_url($url);
+    $scheme = strtolower((string) ($parts['scheme'] ?? ''));
+    $host = (string) ($parts['host'] ?? '');
+    if (!in_array($scheme, ['http', 'https'], true) || $host === '') {
+        podman_json_error('URL must be a plain http:// or https:// address', 400);
+    }
+    $port = (int) ($parts['port'] ?? ($scheme === 'https' ? 443 : 80));
+
+    $ips = [];
+    if (filter_var($host, FILTER_VALIDATE_IP) !== false) {
+        $ips[] = $host;
+    } else {
+        foreach (@dns_get_record($host, DNS_A + DNS_AAAA) ?: [] as $rec) {
+            $ip = $rec['type'] === 'AAAA' ? ($rec['ipv6'] ?? '') : ($rec['ip'] ?? '');
+            if ($ip !== '') {
+                $ips[] = $ip;
+            }
+        }
+    }
+    if (empty($ips)) {
+        podman_json_error("Could not resolve host '{$host}'", 400);
+    }
+    foreach ($ips as $ip) {
+        if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) {
+            podman_json_error("Refusing to fetch from '{$host}': resolves to a private/reserved address ({$ip})", 400);
+        }
+    }
+
+    $maxBytes = 512 * 1024; // a template XML is a few KB; this is generous headroom
+    $received = '';
+    $ch = curl_init($url);
+    curl_setopt_array($ch, [
+        CURLOPT_RESOLVE => ["{$host}:{$port}:{$ips[0]}"],
+        CURLOPT_RETURNTRANSFER => false,
+        CURLOPT_FOLLOWLOCATION => false,
+        CURLOPT_TIMEOUT => 10,
+        CURLOPT_CONNECTTIMEOUT => 5,
+        CURLOPT_PROTOCOLS => CURLPROTO_HTTP | CURLPROTO_HTTPS,
+        CURLOPT_HTTPHEADER => ['Accept: application/xml, text/xml, */*'],
+        CURLOPT_WRITEFUNCTION => function ($ch, $chunk) use (&$received, $maxBytes) {
+            $received .= $chunk;
+            return strlen($received) > $maxBytes ? 0 : strlen($chunk);
+        },
+    ]);
+    curl_exec($ch);
+    $status = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
+    $error = curl_error($ch);
+    curl_close($ch);
+
+    if ($status >= 300 && $status < 400) {
+        podman_json_error('The URL returned a redirect — fetch its final target URL directly instead (redirects are not followed here, to keep this from becoming a way around the checks above).', 400);
+    }
+    if ($status !== 200) {
+        podman_json_error('Fetching the URL failed (HTTP ' . $status . ($error !== '' ? ": {$error}" : '') . ')', 400);
+    }
+    if (trim($received) === '') {
+        podman_json_error('The URL returned an empty response', 400);
+    }
+    return $received;
+}
+
+/**
+ * Path of the cached CA app feed. Deliberately sys_get_temp_dir(), not
+ * $bootDir — this is a large (~20MB), frequently-refreshed derived
+ * artifact, not source-of-truth config, so it doesn't belong on the flash
+ * drive (see ARCHITECTURE.md 4.1 on what belongs on /boot vs. not) and is
+ * fine to just re-download after a reboot.
+ */
+function ca_feed_cache_path(): string
+{
+    return sys_get_temp_dir() . '/podman-ca-appfeed.json';
+}
+
+/**
+ * Downloads the CA feed if the cache is missing or older than
+ * CA_FEED_MAX_AGE_SECONDS, returning the path to a usable (possibly
+ * stale) cache file. A failed download falls back to a stale cache
+ * rather than failing the search outright — an out-of-date app list is
+ * still far more useful than none, and the feed realistically doesn't
+ * change meaningfully within a day anyway.
+ */
+function ca_feed_ensure_cached(): string
+{
+    $path = ca_feed_cache_path();
+    if (is_file($path) && (time() - filemtime($path)) < CA_FEED_MAX_AGE_SECONDS) {
+        return $path;
+    }
+
+    $tmpPath = $path . '.' . getmypid() . '.tmp';
+    $fh = fopen($tmpPath, 'wb');
+    if ($fh === false) {
+        if (is_file($path)) {
+            return $path;
+        }
+        podman_json_error('Could not write app feed cache', 500);
+    }
+
+    $ch = curl_init(CA_FEED_URL);
+    curl_setopt_array($ch, [
+        CURLOPT_FILE => $fh,
+        CURLOPT_TIMEOUT => 30,
+        CURLOPT_FOLLOWLOCATION => true,
+        CURLOPT_PROTOCOLS => CURLPROTO_HTTPS,
+    ]);
+    $ok = curl_exec($ch);
+    $status = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
+    curl_close($ch);
+    fclose($fh);
+
+    if (!$ok || $status !== 200 || filesize($tmpPath) < 1000) {
+        @unlink($tmpPath);
+        if (is_file($path)) {
+            return $path;
+        }
+        podman_json_error('Could not download the Community Applications feed', 502);
+    }
+    rename($tmpPath, $path);
+    return $path;
+}
+
+/**
+ * Searches the CA feed by name (and its ExtraSearchTerms, the same field
+ * CA's own search matches against) and returns one page of just enough
+ * per result to render a picker + import it — never the raw feed itself,
+ * which is far too large to ship to the client for what is, per page, a
+ * couple dozen entries.
+ *
+ * An empty query is "browse" mode instead of "search": ordered by
+ * $sort — "newest" (default, by the feed's own FirstSeen timestamp — when
+ * CA's feed first picked the template up) or "alpha". A non-empty query
+ * always sorts alphabetically regardless of $sort: the feed's "downloads"
+ * figure (the only other candidate) turns out to just be the underlying
+ * Docker image's Docker Hub pull count (verified live: dozens of unrelated
+ * templates that all happen to wrap the official nginx/postgres/redis
+ * images share the exact same, enormous number), which would make search
+ * results look ranked by relevance while actually just favoring whichever
+ * match wraps the most-pulled base image.
+ *
+ * @return array{results: array<int,array<string,string>>, total: int, page: int, pageSize: int, feedUpdatedAt: int}
+ */
+function ca_feed_search(string $query, int $page = 1, string $sort = 'newest'): array
+{
+    $path = ca_feed_ensure_cached();
+
+    // Parsing ~20MB of JSON into PHP arrays needs more headroom than the
+    // default limit on some setups; scoped to this request only.
+    ini_set('memory_limit', '256M');
+
+    $data = json_decode((string) file_get_contents($path), true);
+    $apps = is_array($data) ? ($data['applist'] ?? []) : [];
+
+    $needle = mb_strtolower($query);
+    $matches = [];
+    foreach ($apps as $app) {
+        $name = (string) ($app['Name'] ?? '');
+        $templateUrl = (string) ($app['TemplateURL'] ?? '');
+        if ($name === '' || $templateUrl === '') {
+            continue;
+        }
+        // CA's feed lists real Unraid OS plugins (.plg installers — system
+        // add-ons like GPU drivers, mover tuning, Unraid Connect) alongside
+        // actual Docker app templates, both under the same "applist" — the
+        // giveaway is a Repository ending in ".plg" instead of a Docker
+        // image reference (verified against every one of the 268 entries
+        // tagged with CA's own "Plugins" category — every single one had
+        // exactly this). Podman only runs containers, so these would just
+        // fail nonsensically if "installed" as one.
+        if (str_ends_with(strtolower((string) ($app['Repository'] ?? '')), '.plg')) {
+            continue;
+        }
+        if ($needle !== '') {
+            $haystack = mb_strtolower($name . ' ' . (string) ($app['ExtraSearchTerms'] ?? ''));
+            if (mb_strpos($haystack, $needle) === false) {
+                continue;
+            }
+        }
+        // CA's own overview text uses forum-style bbcode ([b]/[br]/[li]/…)
+        // rather than plain text or HTML — strip the tags for a clean,
+        // short plain-text excerpt instead of showing the raw markup.
+        $overview = trim((string) preg_replace('/\s+/', ' ', (string) preg_replace('/\[[^\]]*\]/', ' ', (string) ($app['Overview'] ?? ''))));
+        if (mb_strlen($overview) > 140) {
+            $overview = mb_substr($overview, 0, 137) . '…';
+        }
+        $matches[] = [
+            'name' => $name,
+            'image' => (string) ($app['Repository'] ?? ''),
+            'icon' => (string) ($app['Icon'] ?? ''),
+            'overview' => $overview,
+            'templateUrl' => $templateUrl,
+            'firstSeen' => (int) ($app['FirstSeen'] ?? 0),
+        ];
+    }
+
+    if ($needle !== '' || $sort === 'alpha') {
+        usort($matches, static fn($a, $b) => strcasecmp($a['name'], $b['name']));
+    } else {
+        usort($matches, static fn($a, $b) => $b['firstSeen'] <=> $a['firstSeen']);
+    }
+
+    $total = count($matches);
+    $pageSize = CA_FEED_PAGE_SIZE;
+    $lastPage = max(1, (int) ceil($total / $pageSize));
+    $page = min(max(1, $page), $lastPage);
+    $slice = array_slice($matches, ($page - 1) * $pageSize, $pageSize);
+    foreach ($slice as &$m) {
+        unset($m['firstSeen']);
+    }
+    unset($m);
+
+    return [
+        'results' => $slice,
+        'total' => $total,
+        'page' => $page,
+        'pageSize' => $pageSize,
+        'feedUpdatedAt' => filemtime($path),
+    ];
+}
+
 /**
  * Unraid's own Docker Manager plugin stores every template a user has
  * ever saved/customized under templates-user/, plus a local cache of