release: v0.1.5

Fixes a real bug in scripts/release.sh's per-package entity matching found while cutting this release: "podman"'s own glob also matched podman-compose's file (podman is a literal prefix of podman-compose), and find | head -n1's unsorted output order let podman-compose's package silently win the "podman" entity on this run. Now explicitly skips any match that actually belongs to a different, more specific component name also in the COMPONENTS list. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Rework Dashboard, add toasts, container folders/icons/WebUI links, detail tabs
2026-07-13 21:53:59 +00:00 · 2026-07-13 21:32:34 +00:00 · 2026-07-12 23:39:17 +00:00 · 2026-07-12 23:36:13 +00:00 · 2026-07-12 23:22:21 +00:00 · 2026-07-12 23:20:30 +00:00
51 changed files with 4536 additions and 670 deletions
@@ -2,7 +2,7 @@ name: Build Packages

 # Builds the eleven Slackware .txz packages defined under packages/
 # (podman, conmon, crun, netavark, aardvark-dns, passt, fuse-overlayfs,
-# catatonit, nftables, docker-compose, unraid-podman) inside a Slackware
+# catatonit, nftables, podman-compose, unraid-podman) inside a Slackware
 # container, verifies + consolidates their checksums, and uploads the
 # result as a workflow artifact.
 #
@@ -1,6 +1,10 @@
 name: Release

-# Publishes a GitHub Release for a version tag (vX.Y.Z).
+# Publishes a Gitea Release for a version tag (vX.Y.Z). This project lives
+# on a self-hosted Gitea instance (git.mp-mueller.de), not GitHub — despite
+# the .github/workflows/ path (kept there because Gitea Actions picks up
+# workflows from that path too, verified live: lint.yml/build-packages.yml
+# both already run from here without any .gitea/workflows/ copy).
 #
 # By design, this workflow does NOT bump versions or modify podman.plg
 # itself — that happens locally via `scripts/release.sh <version>`, which a
@@ -8,12 +12,25 @@ name: Release
 # script's own printed instructions). This workflow's only job is to:
 #   1. Rebuild all packages from the tagged commit in a clean Slackware
 #      container (reproducibility check + provenance — we don't trust
-#      whatever a maintainer happened to have in their local dist/).
+#      whatever a maintainer happened to have in their local dist/). This
+#      only actually verifies anything because
+#      scripts/lib/slackbuild-common.sh's sb_make_package() pins
+#      SOURCE_DATE_EPOCH to the tagged commit's timestamp before calling
+#      makepkg — without that, two separate builds of the identical commit
+#      produce byte-different .txz files (different file mtimes baked into
+#      the tar archive) and this whole verify step fails on the first
+#      package it happens to check, every time (found live: aardvark-dns).
 #   2. Verify checksums match what's already committed in plugin/podman.plg
 #      at this tag (catches a release.sh run that wasn't followed by a
 #      matching commit — see the "Verify plg matches build" step).
-#   3. Create the GitHub Release and attach the .txz packages, checksum
-#      manifests, and podman.plg.
+#   3. Create the Gitea Release and attach the .txz packages, checksum
+#      manifests, and podman.plg, via Gitea's own REST API — NOT
+#      softprops/action-gh-release, which talks to GitHub's API and simply
+#      cannot publish anywhere else. Gitea Actions injects a real,
+#      repo-scoped API token as secrets.GITHUB_TOKEN (the same env var
+#      name GitHub Actions uses, for exactly this kind of drop-in
+#      compatibility) — permissions: contents: write above is what scopes
+#      that token to allow creating releases.
 #
 # See docs/ARCHITECTURE.md section 13 (Updates).

@@ -25,13 +42,17 @@ on:
 permissions:
  contents: write

+env:
+  GITEA_HOST: git.mp-mueller.de
+  GITEA_REPO: magges/unraid-podman
+
 jobs:
  build:
    name: Build release packages
    uses: ./.github/workflows/build-packages.yml

  publish:
-    name: Publish GitHub Release
+    name: Publish Gitea Release
    needs: build
    runs-on: ubuntu-latest
    steps:
@@ -79,18 +100,52 @@ jobs:
          ' CHANGELOG.md > /tmp/release-notes.md
          echo "path=/tmp/release-notes.md" >> "$GITHUB_OUTPUT"

-      - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          name: "unraid-podman v${{ steps.version.outputs.value }}"
-          body_path: ${{ steps.changelog.outputs.path }}
-          # v0.x tags are treated as pre-releases until the plugin reaches a
-          # first stable 1.0.0 — see docs/ROADMAP.md.
-          prerelease: ${{ startsWith(steps.version.outputs.value, '0.') }}
-          files: |
-            dist/*.txz
-            dist/*.sha256
-            dist/*.md5
-            dist/CHECKSUMS.sha256
-            dist/CHECKSUMS.md5
-            plugin/podman.plg
+      - name: Publish Gitea Release
+        env:
+          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -eu
+          API="https://${GITEA_HOST}/api/v1/repos/${GITEA_REPO}"
+          # Every release is a normal release, not a "pre-release" — the
+          # earlier 0.x-is-always-prerelease default didn't match what
+          # this project actually wants published (v0.1.3 was explicitly
+          # corrected off "pre-release" after the fact).
+          prerelease=false
+
+          # Idempotent: if a release for this tag already exists (e.g. a
+          # re-run after a transient failure), delete it first rather than
+          # erroring on Gitea's own duplicate-tag conflict.
+          existing_id=$(curl -s -H "Authorization: token ${GITEA_TOKEN}" "${API}/releases/tags/${TAG}" | jq -r '.id // empty')
+          if [ -n "$existing_id" ]; then
+            echo "==> Deleting existing release id=$existing_id for tag $TAG"
+            curl -s -X DELETE -H "Authorization: token ${GITEA_TOKEN}" "${API}/releases/${existing_id}"
+          fi
+
+          body_json=$(jq -Rs '.' < "${{ steps.changelog.outputs.path }}")
+          payload=$(jq -n --arg tag "$TAG" --arg name "unraid-podman ${TAG}" --argjson body "$body_json" --argjson prerelease "$prerelease" \
+            '{tag_name: $tag, name: $name, body: $body, draft: false, prerelease: $prerelease}')
+
+          release_id=$(curl -s -X POST -H "Authorization: token ${GITEA_TOKEN}" -H "Content-Type: application/json" \
+            -d "$payload" "${API}/releases" | jq -r '.id')
+          if [ -z "$release_id" ] || [ "$release_id" = "null" ]; then
+            echo "!! Could not create release (no id in response)" >&2
+            exit 1
+          fi
+          echo "==> Created release id=$release_id, uploading assets..."
+
+          for f in dist/*.txz dist/*.sha256 dist/*.md5 dist/CHECKSUMS.sha256 dist/CHECKSUMS.md5 plugin/podman.plg; do
+            name=$(basename "$f")
+            code=$(curl -s -o /tmp/upload_resp.json -w '%{http_code}' -X POST \
+              -H "Authorization: token ${GITEA_TOKEN}" \
+              -F "attachment=@${f};filename=${name}" \
+              "${API}/releases/${release_id}/assets?name=${name}")
+            if [ "$code" != "201" ]; then
+              echo "!! Upload failed ($code) for $name:" >&2
+              cat /tmp/upload_resp.json >&2
+              exit 1
+            fi
+            echo "   uploaded: $name"
+          done
+
+          echo "==> Published: https://${GITEA_HOST}/${GITEA_REPO}/releases/tag/${TAG}"
@@ -9,6 +9,160 @@ see [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md#52-build-strategie)).

 ## [Unreleased]

+## [0.1.5] - 2026-07-13
+
+### Added
+- Containers panel: folders to group containers (name + optional icon
+  URL), purely cosmetic organizational metadata stored in the plugin's
+  own `folders.json` — podman itself has no such concept, same as
+  Unraid's own Docker page's folders. "+ New Folder", a "Move to Folder"
+  submenu on each container's row menu, and per-folder rename/delete
+  (deleting a folder only ungroups its containers, never touches them).
+  A folder with nothing assigned yet still shows up (so there's
+  somewhere to move a container into); one that's merely hidden by the
+  current search/filter does not. A folder's header always shows an
+  icon+name+status chip per member — collapsed or expanded, matching how
+  Unraid's own Docker page folders behave — rather than hiding everything
+  behind a bare count; clicking a chip opens the same row menu the "⋮"
+  button does (Details is now a menu item there too, alongside
+  Pause/Kill/Rename/Edit/Remove) rather than jumping straight to the
+  detail modal. "Move to Folder" only shows for a container that isn't
+  grouped yet — once it's in one, that item becomes a direct "Remove
+  from Folder" instead, since "move to a folder" reads as "add" and is
+  ambiguous/redundant once it's already in one. Containers can also
+  carry an icon URL (settable in the create/edit form, auto-filled when
+  creating from a template) shown in the table instead of the 2-letter
+  initials avatar.
+- Containers can now carry a WebUI URL too (create/edit form, preserved
+  through Update/Update All the same way the icon URL is), shown as a
+  small open-in-new-tab button next to the name in the Containers table
+  when set. Both this and the icon are stored as the plugin's own
+  container labels (`podman-webui.weburl`/`.icon`), read straight off
+  the already-fetched container list — no extra per-container calls.
+- Container detail modal: 5 new tabs (Resources, Logs, Console, Events,
+  Healthcheck), rounding it out from 6 to 11 of prompt.md's 12 requested
+  tabs (Volumes was left merged into the existing Mounts tab — same
+  underlying source/destination data, a separate tab would just repeat
+  it). Resources shows live CPU/memory alongside configured limits
+  (memory/swap/CPU/PIDs/block-I/O — a `0` in podman's own HostConfig
+  means "unlimited", not zero). Logs reuses the existing per-container
+  logs endpoint. Console opens a real ttyd/podman-exec session scoped to
+  the modal, cleaned up (killing the ttyd process server-side) on every
+  way of leaving — switching tabs, Close, backdrop click, or Escape —
+  not just on an explicit Disconnect, so peeking at a console doesn't
+  leak an orphaned ttyd process. Events and Healthcheck are both one-shot
+  historical queries (libpod's `/events?stream=false` for the last 7
+  days, and inspect's own `State.Health.Log`) rather than a live stream,
+  which stays out of scope (see dashboard.js's own note on why).
+- A real toast notification system (success/warning/error/info, auto-
+  dismissing, stacked bottom-right, dismissible early) replacing every
+  `alert()` used for one-way feedback across Containers, Images, Volumes,
+  Networks, Pods, Templates, Compose, and Settings — confirmations stay
+  native `confirm()` (a decision, not a notice), and long command output
+  (`podman compose up/down`, previously also an `alert()`) now goes to
+  the existing scrolling log-modal instead, which fits it better than a
+  toast ever could.
+- Dashboard reworked: a clean 6-tile row of plain counts (Running,
+  Stopped, Pods, Images, Volumes, Networks — colored green/red on
+  Running/Stopped so fleet health reads at a glance), a single "Resource
+  Usage" card with aligned CPU/Memory/Swap/Storage meter rows (bars shift
+  to warn/bad colors above 75%/90% instead of staying accent-colored at
+  any value), and an "Autostart Queue" table (reusing
+  `podman-autostart.sh`'s own per-container failure counters, so it shows
+  exactly what that script would decide, not a second tracked history).
+  Bar-and-percentage metrics were kept out of the plain-count tile grid
+  entirely after an earlier attempt at combining them (a tile spanning
+  multiple grid columns) left dead, empty cells in the layout.
+- Dashboard and Containers now auto-refresh every ~2s (paused while the
+  tab is hidden or a modal is open) instead of requiring a manual
+  Refresh click to see current state.
+- Settings: an "Add container" dropdown + button above the Autostart
+  order table — previously that table could only reorder/remove
+  containers already in the chain, with no way to add one in the first
+  place.
+- Containers: "Update All" now also removes the old, now-unused image
+  version each updated container leaves behind (only when at least one
+  container actually updated), instead of leaving stale images to pile up
+  on disk after every update run.
+
+### Fixed
+- Dashboard memory usage was calculated from libpod's raw `memFree` (which
+  excludes reclaimable buffers/cache), showing usage far higher than
+  reality — e.g. 67% "used" where `free -h` reported 19%. Now reads
+  `/proc/meminfo`'s `MemAvailable` directly, matching what `free -h` and
+  most monitoring tools show.
+- Dashboard CPU usage never changed — libpod's own `/info` computes
+  `cpuUtilization` once and never resamples it (confirmed live: three
+  calls seconds apart returned byte-identical numbers). Now computed from
+  `/proc/stat` deltas between successive requests, the same technique
+  `top`/`htop` use, which auto-refresh's ~2s cadence fits naturally.
+- Context menus (a container's "⋮", a folder's "⋮") always dropped down
+  from the anchor at a fixed position — opened from a row near the
+  bottom of the viewport, the menu ran off-screen with its last items
+  unreachable. Now measures its own actual rendered size (which varies
+  with item count) after appending and flips above the anchor instead
+  when there isn't enough room below, clamped horizontally too.
+- Expanding/collapsing a folder shifted every column (including the
+  header text) in the Containers table — its default `table-layout:
+  auto` sizes each column from the widest content among only the
+  currently-visible rows, so adding/removing a folder's rows changed
+  what counted as "widest" on every toggle. Columns now use explicit
+  fixed widths that don't depend on row content at all.
+- The Name column's content (icon + name + WebUI button) was
+  misaligned with its own header, drifting further off with every row —
+  putting `display:flex` directly on the `<td>` (to keep the WebUI
+  button on the same line as the name) pulls that cell out of
+  table-cell layout entirely, so with `table-layout:fixed` it stopped
+  respecting the column width its `<th>` assigns. The flex layout now
+  lives on a `<div>` inside the `<td>` instead, so the `<td>` itself
+  stays a normal, fixed-width table cell.
+
+## [0.1.3] - 2026-07-12
+
+### Added
+- Settings: a "Podman Service" card with live status plus Start/Stop/Restart,
+  each shown in a progress log modal — diagnosing and recovering a podman
+  that failed to start no longer needs SSH/terminal access at all.
+- Settings: "Format a Disk for Podman Storage", for a single-disk system
+  with no cache pool. Only ever lists disks with no existing partition,
+  filesystem, or RAID/ZFS membership signature, and never the Unraid boot
+  flash — both excluded by multiple independent checks, not just one.
+  Formatted disks are remounted by UUID on every boot.
+
+### Fixed
+- `STORAGE_PATH` was never auto-created, even when its parent (a real,
+  already-mounted cache pool) existed — only failed if genuinely nothing
+  was mounted at all. Root cause of a real "cannot reach the Podman API
+  socket" report on a fresh install with a perfectly normal cache pool.
+- Cache-busting for the WebUI's own JS/CSS never actually worked, at all,
+  the entire time — Unraid runs `.page` PHP through `eval()`, and
+  `__DIR__` inside `eval()`'d code resolves to the *eval() call site's*
+  directory, not the plugin's. Every "hard refresh" this project's own
+  docs/commits ever recommended only worked because Ctrl+Shift+R bypasses
+  the browser cache directly, independent of this (broken) mechanism.
+- Settings' service status chip showed "Not running" immediately after a
+  successful Start, because the "is it running" check only recognized
+  `rc.podman status`'s own wording, not `start`/`stop`/`restart`'s.
+- The Podman Service log showed `rc.podman`'s multi-line output as one
+  run-together paragraph (missing `white-space: pre-wrap` on the pane
+  itself, not just its per-line children).
+
+## [0.1.1] - 2026-07-12
+
+### Fixed
+- `plugin/podman.plg`'s `<URL>`/`<MD5>` entity values were split across their
+  own lines (`<URL>\n&baseURL;/...\n</URL>`) — Unraid's plugin manager passes
+  that text straight into a `wget ... -O <name> <url>` shell command without
+  trimming it, so the leading newline broke the command in two: `wget` saw no
+  URL argument at all, and the URL text ran on the next line as its own
+  (failing) shell command. Every real Unraid plugin (verified against
+  `unassigned.devices.plg` on a live host) keeps `<URL>...</URL>` on one
+  line — found by running the plugin installer's own CLI (`scripts/plugin
+  install`) directly on a real Unraid host and reading its raw output,
+  rather than trusting the webGUI's summarized install log.
+
+## [0.1.0] - 2026-07-12
+
 ### Added
 - Initial repository scaffolding: directory structure, documentation skeleton,
  CI workflow stubs, and community health files.
@@ -233,7 +233,7 @@ wählen können — mit deutlicher GUI-Warnung bzgl. Performance und Spin-up-Ver
 | `passt`/`pasta` | Rootless-Networking | Nachfolger von slirp4netns, Phase 2, aber Paket schon mitbauen (geringe Kosten) |
 | `catatonit` oder `tini` | Init-Prozess in Containern (optional, falls von Templates genutzt) | |
 | `nftables` | Firewall-Backend für `netavark` | Pflicht seit netavark 2.0 (iptables-Treiber entfernt); Unraid liefert kein `nft` mit — als offizielles Slackware-Paket vendored, nicht selbst gebaut |
-| `docker-compose` (CLI-Plugin) | External-Compose-Provider für `podman compose` | `podman compose` hat keine eigene Compose-Implementierung, sondern sucht ein `docker-compose`-Binary in festen CLI-Plugin-Pfaden; ohne dieses Paket schlägt jede Compose-Panel-Aktion auf einem frischen Unraid-Install fehl |
+| `podman-compose` | External-Compose-Provider für `podman compose` | `podman compose` hat keine eigene Compose-Implementierung, sondern sucht ein Kommando namens `podman-compose` auf `$PATH` (live verifiziert — anders als das ältere, ebenfalls unterstützte `docker-compose`, das stattdessen in festen CLI-Plugin-Pfaden gesucht wird); ohne dieses Paket schlägt jede Compose-Panel-Aktion auf einem frischen Unraid-Install fehl. Python-Skript, vendored zusammen mit PyYAML/python-dotenv als reines Python-Source (kein C-Build) |

 ### 5.2 Build-Strategie

@@ -1,31 +0,0 @@
-# packages/docker-compose/
-
-Pinned version: see `DOCKER_COMPOSE_VERSION` in [versions.env](../../versions.env).
-
-Not built from source — `docker-compose.SlackBuild` fetches and repackages
-upstream's own prebuilt static x86_64 release binary (`docker/compose`,
-the Go-based Compose v2 CLI plugin — a different project from the older
-Python `podman-compose`). It's a small, purely static ELF with zero
-runtime library dependencies (verified: `ldd` reports "not a dynamic
-executable"), so there's nothing meaningful to gain from a from-source
-build.
-
-`podman compose` (backing the WebUI's Compose panel, see
-`webui/plugins/podman/ajax/compose.php`) has no compose implementation of
-its own — it shells out to an "external compose provider" it discovers by
-searching a fixed list of CLI-plugin directories for a binary named
-`docker-compose`. Without one present, every Compose panel action fails
-outright. Installed to `/usr/local/lib/docker/cli-plugins/docker-compose`
-— one of podman's own search paths (extracted from the pinned podman
-binary: `strings /usr/bin/podman | grep cli-plugins`), chosen specifically
-under `/usr/local/` rather than `/usr/lib/docker/...` so this package
-never collides with (or gets silently shadowed by) a genuine Docker
-installation's own compose plugin on hosts that also run Unraid's
-built-in Docker support.
-
-Found by live-testing the Compose panel end-to-end against a real Unraid
-install: it happened to work only because that particular host already
-had Docker's own `docker-compose` plugin installed from an unrelated,
-pre-existing Docker setup — a clean Unraid install has no compose
-provider at all without this package. See
-[docs/ARCHITECTURE.md, section 5.1](../../docs/ARCHITECTURE.md#51-zu-paketierende-komponenten).
@@ -1,60 +0,0 @@
-#!/bin/bash
-# =============================================================================
-# packages/docker-compose/docker-compose.SlackBuild
-#
-# Packages the official prebuilt docker/compose v2 release binary — not
-# built from source, see versions.env's DOCKER_COMPOSE_* block for why.
-# `podman compose` (backing webui/plugins/podman/ajax/compose.php) has no
-# compose implementation of its own; it shells out to an "external compose
-# provider" it discovers by searching a fixed list of CLI-plugin
-# directories for a binary literally named `docker-compose` (paths
-# extracted from the pinned podman binary itself:
-# `strings /usr/bin/podman | grep cli-plugins`). Without one present,
-# every Compose panel action fails outright (found by live-testing against
-# a real Unraid install — it only worked there because that host happened
-# to already have Docker's own compose plugin from an unrelated setup).
-#
-# Installed to /usr/local/lib/docker/cli-plugins/docker-compose — one of
-# podman's search paths, deliberately the /usr/local/ one rather than
-# /usr/lib/docker/cli-plugins so this package never collides with (or
-# gets silently shadowed by) a genuine Docker installation's own compose
-# plugin on hosts that also run Unraid's built-in Docker support.
-# =============================================================================
-
-set -eu
-
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-# shellcheck source=/dev/null
-. "$REPO_ROOT/scripts/lib/slackbuild-common.sh"
-# shellcheck source=/dev/null
-. "$REPO_ROOT/versions.env"
-
-VERSION="$DOCKER_COMPOSE_VERSION"
-ARCH="$PKG_ARCH"
-BUILD="$PKG_BUILD"
-TAG="$PKG_TAG"
-
-sb_init "docker-compose"
-
-binary=$(sb_fetch_and_verify "$DOCKER_COMPOSE_SRC_URL" "$DOCKER_COMPOSE_SRC_SHA256" "docker-compose-$VERSION")
-
-install -D -m 0755 "$binary" "$PKG/usr/local/lib/docker/cli-plugins/docker-compose"
-
-# The release only ships the raw binary (+ checksum/signature files, no
-# LICENSE/README asset) — write minimal doc metadata by hand instead of
-# using sb_install_docs, which expects real files to copy from disk.
-docdir="$PKG/usr/doc/docker-compose-$VERSION"
-mkdir -p "$docdir"
-{
-  echo "docker-compose (docker/compose v2 CLI plugin) $VERSION"
-  echo "https://github.com/docker/compose"
-  echo "Prebuilt static binary, packaged as-is by unraid-podman — see"
-  echo "versions.env for the pinned release URL and SHA256."
-} > "$docdir/README"
-{
-  echo "Built by unraid-podman from upstream's prebuilt release binary."
-  echo "Package: docker-compose $VERSION"
-  echo "Built:   $(date -u +%Y-%m-%dT%H:%M:%SZ)"
-} > "$docdir/unraid-podman.build-info"
-
-sb_make_package "$VERSION" "$ARCH" "$BUILD" "$TAG"
@@ -1,19 +0,0 @@
-# HOW TO EDIT THIS FILE:
-# The "handy ruler" below makes it easier to edit a package description.
-# Line up the first '|' above the ':' following the base package name, and
-# the '|' on the right side marks the last column you can put a character in.
-# You must make exactly 11 lines for the formatting to be correct. It's also
-# customary to leave one space after the ':' except on otherwise blank lines.
-
-        |-----handy-ruler------------------------------------------------|
-docker-compose: docker-compose (external Compose provider for podman compose)
-docker-compose:
-docker-compose: The docker/compose v2 CLI-plugin binary, installed as a
-docker-compose: CLI-plugin so `podman compose` can find it. Required by the
-docker-compose: WebUI's Compose panel; packaged from upstream's prebuilt
-docker-compose: static binary release, not built from source.
-docker-compose:
-docker-compose: Homepage: https://github.com/docker/compose
-docker-compose:
-docker-compose:
-docker-compose:
@@ -0,0 +1,34 @@
+# packages/podman-compose/
+
+Pinned versions: see `PODMAN_COMPOSE_VERSION`/`PYYAML_VERSION`/
+`PYTHON_DOTENV_VERSION` in [versions.env](../../versions.env).
+
+`podman compose` (backing `webui/plugins/podman/ajax/compose.php`, the
+WebUI's Compose panel) has no compose implementation of its own — it
+needs an external "compose provider" command. This project previously
+vendored `docker/compose` (the Go CLI-plugin binary) for that role;
+this package replaces it with `podman-compose` instead.
+
+The two aren't discovered the same way — verified live against a real
+podman install (placing a fake executable and reading podman's own
+provider-search error output): `docker-compose` is searched for by exact
+path across a fixed list of CLI-plugin directories, while `podman-compose`
+is looked up as a plain command on `$PATH`. That's why this package
+installs to `/usr/local/bin/podman-compose` rather than under any
+`cli-plugins/` directory.
+
+Unlike `docker-compose`, `podman-compose` is a single Python script, not a
+compiled binary. Unraid ships Python3 itself but neither of its two
+runtime dependencies, so this package also vendors:
+
+- `PyYAML` — only the pure-Python `yaml/` package, not the `_yaml` C
+  extension (which would need libyaml plus a compiler). `yaml/__init__.py`
+  falls back gracefully when the C accelerator isn't importable, so the
+  pure-Python source is sufficient for what podman-compose needs from it.
+- `python-dotenv` — pure Python throughout, no C extensions at all.
+
+Verified end-to-end on a real Unraid host: the vendored bundle correctly
+runs `podman compose up`/`ps`/`down` against a real compose project
+(with the pre-existing `docker-compose` binary temporarily moved aside
+to confirm `podman-compose` was the one actually being invoked, not a
+leftover), including a live HTTP check against the started service.
@@ -0,0 +1,83 @@
+#!/bin/bash
+# =============================================================================
+# packages/podman-compose/podman-compose.SlackBuild
+#
+# Packages podman-compose (github.com/containers/podman-compose) — the
+# external "compose provider" `podman compose` shells out to (see
+# versions.env's PODMAN_COMPOSE_* block for the full story, including why
+# this replaces the project's earlier vendored docker-compose). Verified
+# live against a real podman install that podman-compose is looked up as a
+# plain $PATH command, unlike docker-compose's fixed CLI-plugin-directory
+# search — so this installs a wrapper at /usr/local/bin/podman-compose.
+#
+# podman-compose itself is a single Python script (not a compiled binary),
+# with two runtime dependencies — PyYAML and python-dotenv — vendored here
+# as plain pure-Python source (no C extension build) since Unraid ships
+# Python3 but neither of those modules.
+# =============================================================================
+
+set -eu
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/scripts/lib/slackbuild-common.sh"
+# shellcheck source=/dev/null
+. "$REPO_ROOT/versions.env"
+
+VERSION="$PODMAN_COMPOSE_VERSION"
+ARCH="$PKG_ARCH"
+BUILD="$PKG_BUILD"
+TAG="$PKG_TAG"
+
+sb_init "podman-compose"
+
+script=$(sb_fetch_and_verify "$PODMAN_COMPOSE_SRC_URL" "$PODMAN_COMPOSE_SRC_SHA256" "podman_compose-$VERSION.py")
+pyyaml_tarball=$(sb_fetch_and_verify "$PYYAML_SRC_URL" "$PYYAML_SRC_SHA256" "pyyaml-$PYYAML_VERSION.tar.gz")
+dotenv_tarball=$(sb_fetch_and_verify "$PYTHON_DOTENV_SRC_URL" "$PYTHON_DOTENV_SRC_SHA256" "python-dotenv-$PYTHON_DOTENV_VERSION.tar.gz")
+
+libdir="$PKG/usr/local/lib/podman-compose"
+mkdir -p "$libdir"
+install -m 0644 "$script" "$libdir/podman_compose.py"
+
+# Only the pure-Python "yaml" package, not the "_yaml" C extension (which
+# would need libyaml plus a compiler toolchain this build doesn't otherwise
+# require) — see the header comment on why the pure-Python fallback is
+# sufficient for what podman-compose actually needs from it.
+tar -xzf "$pyyaml_tarball" -C "$TMP" "pyyaml-$PYYAML_VERSION/lib/yaml"
+cp -r "$TMP/pyyaml-$PYYAML_VERSION/lib/yaml" "$libdir/yaml"
+
+tar -xzf "$dotenv_tarball" -C "$TMP" "python_dotenv-$PYTHON_DOTENV_VERSION/src/dotenv"
+cp -r "$TMP/python_dotenv-$PYTHON_DOTENV_VERSION/src/dotenv" "$libdir/dotenv"
+
+# A thin wrapper, not a symlink or bare shebang: podman_compose.py's own
+# shebang (whatever upstream wrote, a plain "#!/usr/bin/env python3") has
+# no idea the vendored yaml/dotenv sit right next to it, so PYTHONPATH has
+# to be set by whatever actually invokes the script.
+install -d "$PKG/usr/local/bin"
+cat > "$PKG/usr/local/bin/podman-compose" <<'WRAPPER'
+#!/bin/sh
+exec env PYTHONPATH="/usr/local/lib/podman-compose${PYTHONPATH:+:$PYTHONPATH}" \
+  /usr/bin/python3 /usr/local/lib/podman-compose/podman_compose.py "$@"
+WRAPPER
+chmod 0755 "$PKG/usr/local/bin/podman-compose"
+
+docdir="$PKG/usr/doc/podman-compose-$VERSION"
+mkdir -p "$docdir"
+{
+  echo "podman-compose $VERSION"
+  echo "https://github.com/containers/podman-compose"
+  echo
+  echo "Vendored alongside its two runtime dependencies (bundled as plain"
+  echo "pure-Python source, no C extensions built):"
+  echo "  PyYAML $PYYAML_VERSION - https://pypi.org/project/PyYAML/"
+  echo "  python-dotenv $PYTHON_DOTENV_VERSION - https://pypi.org/project/python-dotenv/"
+  echo
+  echo "See versions.env for pinned source URLs and SHA256 checksums."
+} > "$docdir/README"
+{
+  echo "Built by unraid-podman from upstream source."
+  echo "Package: podman-compose $VERSION"
+  echo "Built:   $(date -u +%Y-%m-%dT%H:%M:%SZ)"
+} > "$docdir/unraid-podman.build-info"
+
+sb_make_package "$VERSION" "$ARCH" "$BUILD" "$TAG"
@@ -0,0 +1,19 @@
+# HOW TO EDIT THIS FILE:
+# The "handy ruler" below makes it easier to edit a package description.
+# Line up the first '|' above the ':' following the base package name, and
+# the '|' on the right side marks the last column you can put a character in.
+# You must make exactly 11 lines for the formatting to be correct. It's also
+# customary to leave one space after the ':' except on otherwise blank lines.
+
+        |-----handy-ruler------------------------------------------------|
+podman-compose: podman-compose (external Compose provider for podman compose)
+podman-compose:
+podman-compose: A Python script that implements Docker Compose file support
+podman-compose: on top of podman, installed to /usr/local/bin so
+podman-compose: `podman compose` finds it as its external provider.
+podman-compose: Required by the WebUI's Compose panel. Bundled with its
+podman-compose: two runtime dependencies (PyYAML, python-dotenv) as plain
+podman-compose: pure-Python source.
+podman-compose:
+podman-compose: Homepage: https://github.com/containers/podman-compose
+podman-compose:
@@ -20,6 +20,12 @@
 # blocked on podman's full startup sequence (preflight, storage mount,
 # service start, autostart chain) — mirrors how unassigned.devices
 # backgrounds its own longer-running "started" hook.
+#
+# podman-mount-managed-disk.sh runs first, still within the same
+# backgrounded subshell: it's a no-op unless the WebUI's "Format a Disk
+# for Podman Storage" flow (ajax/disks.php) was ever used, and rc.podman
+# start's own storage step needs that disk already mounted at
+# $STORAGE_PATH to succeed — see that script's own header comment.
 # =============================================================================

-/etc/rc.d/rc.podman start > /dev/null 2>&1 & disown
+(/usr/local/sbin/podman-mount-managed-disk.sh; /etc/rc.d/rc.podman start) > /dev/null 2>&1 & disown
@@ -33,7 +33,7 @@
  Structure of this file:
    1. DOCTYPE entity block — plugin metadata + one version/file/md5 triple
       per package (the seven upstream components, catatonit/nftables/
-       docker-compose as vendored runtime dependencies, plus this
+       podman-compose as vendored runtime dependencies, plus this
       project's own "unraid-podman" scaffolding package, see
       packages/unraid-podman/).
       Entities are rewritten automatically by scripts/release.sh; never
@@ -50,20 +50,26 @@
 <!DOCTYPE PLUGIN [
 <!ENTITY name       "podman">
 <!ENTITY author     "unraid-podman contributors">
-<!ENTITY version    "0.0.0">
+<!ENTITY version    "0.1.5">
 <!-- "Podman" (no parent) — Podman.page declares Menu="Podman", making it
     its own top-level nav tab next to Docker/VMs, not nested under
     Settings — see webui/plugins/podman/Podman.page. -->
 <!ENTITY launch     "Podman">
-<!ENTITY github     "OWNER/unraid-podman">
-<!ENTITY gitURL     "https://raw.githubusercontent.com/&github;/main">
+<!-- This project is hosted on a self-hosted Gitea instance, not GitHub —
+     &github; is kept as the entity name (widely referenced below) but
+     holds the Gitea owner/repo slug; gitURL/supportURL/baseURL all point
+     at git.mp-mueller.de using Gitea's own raw-file and release-asset URL
+     conventions (structurally the same shape as GitHub's, different host
+     and raw-file path segment: /raw/branch/<ref>/ instead of /<ref>/). -->
+<!ENTITY github     "magges/unraid-podman">
+<!ENTITY gitURL     "https://git.mp-mueller.de/&github;/raw/branch/main">
 <!ENTITY pluginURL  "&gitURL;/plugin/podman.plg">
-<!ENTITY supportURL "https://github.com/&github;/discussions">
+<!ENTITY supportURL "https://git.mp-mueller.de/&github;/issues">

 <!-- Release asset base — matches scripts/release.sh's RELEASE_BASE_URL
     exactly; both must agree since release.sh is what publishes the
     packages this URL is expected to find. -->
-<!ENTITY baseURL "https://github.com/&github;/releases/download/v&version;">
+<!ENTITY baseURL "https://git.mp-mueller.de/magges/unraid-podman/releases/download/v0.1.5">

 <!-- Slackware package naming components — must match versions.env's
     PKG_ARCH/PKG_BUILD/PKG_TAG (see that file). Kept as entities here so
@@ -80,33 +86,33 @@
     fail to download anything — that is intentional; there is nothing to
     install before the first tagged release. -->

-<!ENTITY podman_txz_version "0.0.0">
-<!ENTITY podman_txz_file    "podman-&podman_txz_version;-&pkgArch;-&pkgBuild;&pkgTag;.txz">
-<!ENTITY podman_txz_md5     "00000000000000000000000000000000">
+<!ENTITY podman_txz_version "6.0.1">
+<!ENTITY podman_txz_file    "podman-6.0.1-x86_64-1_unraidpodman.txz">
+<!ENTITY podman_txz_md5     "692b8df0a1ac25544748dea4ff518705">

-<!ENTITY conmon_txz_version "0.0.0">
-<!ENTITY conmon_txz_file    "conmon-&conmon_txz_version;-&pkgArch;-&pkgBuild;&pkgTag;.txz">
-<!ENTITY conmon_txz_md5     "00000000000000000000000000000000">
+<!ENTITY conmon_txz_version "2.2.1">
+<!ENTITY conmon_txz_file    "conmon-2.2.1-x86_64-1_unraidpodman.txz">
+<!ENTITY conmon_txz_md5     "fc0af377c1beeee452040e8991c4aafa">

-<!ENTITY crun_txz_version "0.0.0">
-<!ENTITY crun_txz_file    "crun-&crun_txz_version;-&pkgArch;-&pkgBuild;&pkgTag;.txz">
-<!ENTITY crun_txz_md5     "00000000000000000000000000000000">
+<!ENTITY crun_txz_version "1.28">
+<!ENTITY crun_txz_file    "crun-1.28-x86_64-1_unraidpodman.txz">
+<!ENTITY crun_txz_md5     "2e787b0f6826fc61b7a76ca42573d6c4">

-<!ENTITY netavark_txz_version "0.0.0">
-<!ENTITY netavark_txz_file    "netavark-&netavark_txz_version;-&pkgArch;-&pkgBuild;&pkgTag;.txz">
-<!ENTITY netavark_txz_md5     "00000000000000000000000000000000">
+<!ENTITY netavark_txz_version "2.0.0">
+<!ENTITY netavark_txz_file    "netavark-2.0.0-x86_64-1_unraidpodman.txz">
+<!ENTITY netavark_txz_md5     "27a2128b2fcbeb590773c5dd004d911e">

-<!ENTITY aardvark_dns_txz_version "0.0.0">
-<!ENTITY aardvark_dns_txz_file    "aardvark-dns-&aardvark_dns_txz_version;-&pkgArch;-&pkgBuild;&pkgTag;.txz">
-<!ENTITY aardvark_dns_txz_md5     "00000000000000000000000000000000">
+<!ENTITY aardvark_dns_txz_version "2.0.0">
+<!ENTITY aardvark_dns_txz_file    "aardvark-dns-2.0.0-x86_64-1_unraidpodman.txz">
+<!ENTITY aardvark_dns_txz_md5     "f775f20903c2301736594fdde0081c6d">

-<!ENTITY passt_txz_version "0.0.0">
-<!ENTITY passt_txz_file    "passt-&passt_txz_version;-&pkgArch;-&pkgBuild;&pkgTag;.txz">
-<!ENTITY passt_txz_md5     "00000000000000000000000000000000">
+<!ENTITY passt_txz_version "git6ef3d1c">
+<!ENTITY passt_txz_file    "passt-git6ef3d1c-x86_64-1_unraidpodman.txz">
+<!ENTITY passt_txz_md5     "9257eb90fb218b047e9f099e9b2f0418">

-<!ENTITY fuse_overlayfs_txz_version "0.0.0">
-<!ENTITY fuse_overlayfs_txz_file    "fuse-overlayfs-&fuse_overlayfs_txz_version;-&pkgArch;-&pkgBuild;&pkgTag;.txz">
-<!ENTITY fuse_overlayfs_txz_md5     "00000000000000000000000000000000">
+<!ENTITY fuse_overlayfs_txz_version "1.17">
+<!ENTITY fuse_overlayfs_txz_file    "fuse-overlayfs-1.17-x86_64-1_unraidpodman.txz">
+<!ENTITY fuse_overlayfs_txz_md5     "431b1d3ab36d05f817379ef36ba70ae2">

 <!-- catatonit and nftables are runtime dependencies this plugin ships,
     not upstream podman-ecosystem components — see packages/catatonit/
@@ -114,20 +120,20 @@
     container init; netavark's only viable firewall driver, since it
     dropped iptables in 2.0 and Unraid has neither `nft` nor
     systemd/dbus for firewalld) and why neither is built from source. -->
-<!ENTITY catatonit_txz_version "0.0.0">
-<!ENTITY catatonit_txz_file    "catatonit-&catatonit_txz_version;-&pkgArch;-&pkgBuild;&pkgTag;.txz">
-<!ENTITY catatonit_txz_md5     "00000000000000000000000000000000">
+<!ENTITY catatonit_txz_version "0.2.1">
+<!ENTITY catatonit_txz_file    "catatonit-0.2.1-x86_64-1_unraidpodman.txz">
+<!ENTITY catatonit_txz_md5     "a335c4924f244a41662f891d79b1251d">

-<!ENTITY nftables_txz_version "0.0.0">
-<!ENTITY nftables_txz_file    "nftables-&nftables_txz_version;-&pkgArch;-&pkgBuild;&pkgTag;.txz">
-<!ENTITY nftables_txz_md5     "00000000000000000000000000000000">
+<!ENTITY nftables_txz_version "1.0.1">
+<!ENTITY nftables_txz_file    "nftables-1.0.1-x86_64-1_unraidpodman.txz">
+<!ENTITY nftables_txz_md5     "d9bb93b0bdc061681ffbd42a243bb5fc">

-<!-- docker-compose is the external Compose provider `podman compose`
-     shells out to (see packages/docker-compose/README.md) — without it
+<!-- podman-compose is the external Compose provider `podman compose`
+     shells out to (see packages/podman-compose/README.md) — without it
     every Compose panel action fails outright on a clean install. -->
-<!ENTITY docker_compose_txz_version "0.0.0">
-<!ENTITY docker_compose_txz_file    "docker-compose-&docker_compose_txz_version;-&pkgArch;-&pkgBuild;&pkgTag;.txz">
-<!ENTITY docker_compose_txz_md5     "00000000000000000000000000000000">
+<!ENTITY podman_compose_txz_version "1.6.0">
+<!ENTITY podman_compose_txz_file    "podman-compose-1.6.0-x86_64-1_unraidpodman.txz">
+<!ENTITY podman_compose_txz_md5     "f4344ec947cab1a73c50f9afa0b24bee">

 <!-- unraid-podman is this project's OWN scaffolding package (rc.podman,
     sbin/ scripts, event/ hooks, config templates — see
@@ -135,9 +141,9 @@
     version always equals the plugin's own &version; — see
     packages/unraid-podman/unraid-podman.SlackBuild, which reads it
     straight out of this very file rather than tracking it twice. -->
-<!ENTITY unraid_podman_txz_version "&version;">
-<!ENTITY unraid_podman_txz_file    "unraid-podman-&unraid_podman_txz_version;-&pkgArch;-&pkgBuild;&pkgTag;.txz">
-<!ENTITY unraid_podman_txz_md5     "00000000000000000000000000000000">
+<!ENTITY unraid_podman_txz_version "0.1.5">
+<!ENTITY unraid_podman_txz_file    "unraid-podman-0.1.5-x86_64-1_unraidpodman.txz">
+<!ENTITY unraid_podman_txz_md5     "750fc748b054865b41297a658864d261">
 ]>

 <PLUGIN name="&name;"
@@ -181,7 +187,7 @@ fi

 <!--
  The seven upstream component packages, plus catatonit, nftables, and
-  docker-compose (runtime dependencies vendored as-is — see the entity
+  podman-compose (runtime dependencies vendored as-is — see the entity
  block above for why). Each is downloaded straight into
  its backup slot under /boot/config/plugins/&name;/backup/packages/&version;/
  (grouped by PLUGIN version, not each component's own version — a rollback
@@ -195,93 +201,53 @@ fi
 -->

 <FILE Name="/boot/config/plugins/&name;/backup/packages/&version;/&podman_txz_file;" Run="upgradepkg --install-new --reinstall">
-<URL>
-&baseURL;/&podman_txz_file;
-</URL>
-<MD5>
-&podman_txz_md5;
-</MD5>
+<URL>&baseURL;/&podman_txz_file;</URL>
+<MD5>&podman_txz_md5;</MD5>
 </FILE>

 <FILE Name="/boot/config/plugins/&name;/backup/packages/&version;/&conmon_txz_file;" Run="upgradepkg --install-new --reinstall">
-<URL>
-&baseURL;/&conmon_txz_file;
-</URL>
-<MD5>
-&conmon_txz_md5;
-</MD5>
+<URL>&baseURL;/&conmon_txz_file;</URL>
+<MD5>&conmon_txz_md5;</MD5>
 </FILE>

 <FILE Name="/boot/config/plugins/&name;/backup/packages/&version;/&crun_txz_file;" Run="upgradepkg --install-new --reinstall">
-<URL>
-&baseURL;/&crun_txz_file;
-</URL>
-<MD5>
-&crun_txz_md5;
-</MD5>
+<URL>&baseURL;/&crun_txz_file;</URL>
+<MD5>&crun_txz_md5;</MD5>
 </FILE>

 <FILE Name="/boot/config/plugins/&name;/backup/packages/&version;/&netavark_txz_file;" Run="upgradepkg --install-new --reinstall">
-<URL>
-&baseURL;/&netavark_txz_file;
-</URL>
-<MD5>
-&netavark_txz_md5;
-</MD5>
+<URL>&baseURL;/&netavark_txz_file;</URL>
+<MD5>&netavark_txz_md5;</MD5>
 </FILE>

 <FILE Name="/boot/config/plugins/&name;/backup/packages/&version;/&aardvark_dns_txz_file;" Run="upgradepkg --install-new --reinstall">
-<URL>
-&baseURL;/&aardvark_dns_txz_file;
-</URL>
-<MD5>
-&aardvark_dns_txz_md5;
-</MD5>
+<URL>&baseURL;/&aardvark_dns_txz_file;</URL>
+<MD5>&aardvark_dns_txz_md5;</MD5>
 </FILE>

 <FILE Name="/boot/config/plugins/&name;/backup/packages/&version;/&passt_txz_file;" Run="upgradepkg --install-new --reinstall">
-<URL>
-&baseURL;/&passt_txz_file;
-</URL>
-<MD5>
-&passt_txz_md5;
-</MD5>
+<URL>&baseURL;/&passt_txz_file;</URL>
+<MD5>&passt_txz_md5;</MD5>
 </FILE>

 <FILE Name="/boot/config/plugins/&name;/backup/packages/&version;/&fuse_overlayfs_txz_file;" Run="upgradepkg --install-new --reinstall">
-<URL>
-&baseURL;/&fuse_overlayfs_txz_file;
-</URL>
-<MD5>
-&fuse_overlayfs_txz_md5;
-</MD5>
+<URL>&baseURL;/&fuse_overlayfs_txz_file;</URL>
+<MD5>&fuse_overlayfs_txz_md5;</MD5>
 </FILE>

 <FILE Name="/boot/config/plugins/&name;/backup/packages/&version;/&catatonit_txz_file;" Run="upgradepkg --install-new --reinstall">
-<URL>
-&baseURL;/&catatonit_txz_file;
-</URL>
-<MD5>
-&catatonit_txz_md5;
-</MD5>
+<URL>&baseURL;/&catatonit_txz_file;</URL>
+<MD5>&catatonit_txz_md5;</MD5>
 </FILE>

 <FILE Name="/boot/config/plugins/&name;/backup/packages/&version;/&nftables_txz_file;" Run="upgradepkg --install-new --reinstall">
-<URL>
-&baseURL;/&nftables_txz_file;
-</URL>
-<MD5>
-&nftables_txz_md5;
-</MD5>
+<URL>&baseURL;/&nftables_txz_file;</URL>
+<MD5>&nftables_txz_md5;</MD5>
 </FILE>

-<FILE Name="/boot/config/plugins/&name;/backup/packages/&version;/&docker_compose_txz_file;" Run="upgradepkg --install-new --reinstall">
-<URL>
-&baseURL;/&docker_compose_txz_file;
-</URL>
-<MD5>
-&docker_compose_txz_md5;
-</MD5>
+<FILE Name="/boot/config/plugins/&name;/backup/packages/&version;/&podman_compose_txz_file;" Run="upgradepkg --install-new --reinstall">
+<URL>&baseURL;/&podman_compose_txz_file;</URL>
+<MD5>&podman_compose_txz_md5;</MD5>
 </FILE>

 <!--
@@ -290,12 +256,8 @@ fi
  packages/unraid-podman/README.md.
 -->
 <FILE Name="/boot/config/plugins/&name;/backup/packages/&version;/&unraid_podman_txz_file;" Run="upgradepkg --install-new --reinstall">
-<URL>
-&baseURL;/&unraid_podman_txz_file;
-</URL>
-<MD5>
-&unraid_podman_txz_md5;
-</MD5>
+<URL>&baseURL;/&unraid_podman_txz_file;</URL>
+<MD5>&unraid_podman_txz_md5;</MD5>
 </FILE>

 <!--
@@ -345,7 +307,7 @@ echo "PASST_INSTALLED_VERSION=\"&passt_txz_version;\"" >> "$MANIFEST"
 echo "FUSE_OVERLAYFS_INSTALLED_VERSION=\"&fuse_overlayfs_txz_version;\"" >> "$MANIFEST"
 echo "CATATONIT_INSTALLED_VERSION=\"&catatonit_txz_version;\"" >> "$MANIFEST"
 echo "NFTABLES_INSTALLED_VERSION=\"&nftables_txz_version;\"" >> "$MANIFEST"
-echo "DOCKER_COMPOSE_INSTALLED_VERSION=\"&docker_compose_txz_version;\"" >> "$MANIFEST"
+echo "PODMAN_COMPOSE_INSTALLED_VERSION=\"&podman_compose_txz_version;\"" >> "$MANIFEST"
 echo "UNRAID_PODMAN_INSTALLED_VERSION=\"&unraid_podman_txz_version;\"" >> "$MANIFEST"

 echo "Seeding /boot/config/plugins/podman/ configuration (existing files left untouched)..."
@@ -408,7 +370,7 @@ removepkg &passt_txz_file;
 removepkg &fuse_overlayfs_txz_file;
 removepkg &catatonit_txz_file;
 removepkg &nftables_txz_file;
-removepkg &docker_compose_txz_file;
+removepkg &podman_compose_txz_file;
 removepkg &unraid_podman_txz_file;

 echo ""
@@ -168,6 +168,33 @@ podman_storage_path_is_safe() {
  return 0
 }

+# -----------------------------------------------------------------------------
+# podman_path_has_real_mount_ancestor <path>
+#
+# True if <path> itself, or its nearest EXISTING ancestor directory, lives
+# on a different filesystem than / (root) — i.e. something is genuinely
+# mounted along this path (a cache pool, a dedicated disk, ...), even if
+# the exact leaf directory doesn't exist yet. False only when nothing real
+# is mounted anywhere along the path (root/RAM all the way up), which is
+# the one case that's actually unsafe to silently `mkdir -p` into.
+#
+# This exists because this project never auto-created $STORAGE_PATH
+# itself (only podman.img inside it) — found live: a perfectly normal,
+# already-mounted cache pool still failed preflight/storage-create with
+# "does not exist", because the pool's own .../system/podman subdirectory
+# had simply never been created. "Does the exact leaf directory exist" was
+# always the wrong question; "is a real filesystem mounted somewhere along
+# this path" is the one that actually matters.
+# -----------------------------------------------------------------------------
+podman_path_has_real_mount_ancestor() {
+  local path="$1"
+  local parent="$path"
+  while [ ! -d "$parent" ] && [ "$parent" != "/" ]; do
+    parent="$(dirname "$parent")"
+  done
+  [ "$parent" != "/" ] && [ "$(stat -c %d "$parent")" != "$(stat -c %d /)" ]
+}
+
 # -----------------------------------------------------------------------------
 # podman_require_command <binary>
 #
@@ -0,0 +1,51 @@
+#!/bin/bash
+# =============================================================================
+# plugin/sbin/podman-mount-managed-disk.sh
+#
+# Remounts, on every boot, a disk the WebUI's "Format a Disk for Podman
+# Storage" flow (webui/plugins/podman/ajax/disks.php's "format" action)
+# formatted and mounted for a single-disk system with no cache pool —
+# that disk is deliberately outside Unraid's own array/cache pool
+# management (it's just a plain XFS filesystem on an otherwise-unassigned
+# disk), so nothing else on the system would remount it after a reboot.
+#
+# Called from plugin/event/disks_mounted, BEFORE rc.podman start, so
+# $STORAGE_PATH (pointed at this disk's mountpoint via Settings) is a real
+# mounted filesystem by the time podman-storage.sh's `create`/`mount`
+# steps run — see that script's "does not exist or is not mounted" check.
+#
+# Does nothing (exit 0) if the plugin was never used to format a disk —
+# /boot/config/plugins/podman/managed-disk.cfg only exists after that flow
+# has actually run at least once.
+# =============================================================================
+
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=./podman-common.sh
+. "$SCRIPT_DIR/podman-common.sh"
+
+MANAGED_DISK_CFG="$PODMAN_BOOT_DIR/managed-disk.cfg"
+[ -f "$MANAGED_DISK_CFG" ] || exit 0
+
+UUID=""
+MOUNTPOINT=""
+# shellcheck source=/dev/null
+. "$MANAGED_DISK_CFG"
+
+if [ -z "$UUID" ] || [ -z "$MOUNTPOINT" ]; then
+  podman_log_error "mount-managed-disk: $MANAGED_DISK_CFG is missing UUID/MOUNTPOINT, skipping"
+  exit 0
+fi
+
+if mountpoint -q "$MOUNTPOINT" 2> /dev/null; then
+  podman_log "mount-managed-disk: $MOUNTPOINT already mounted"
+  exit 0
+fi
+
+mkdir -p "$MOUNTPOINT"
+if mount "UUID=$UUID" "$MOUNTPOINT"; then
+  podman_log "mount-managed-disk: mounted UUID=$UUID at $MOUNTPOINT"
+else
+  podman_log_error "mount-managed-disk: failed to mount UUID=$UUID at $MOUNTPOINT (disk removed/renamed?)"
+fi
@@ -75,6 +75,14 @@ elif [ -d "$STORAGE_PATH" ]; then
  else
    fail "STORAGE_PATH ($STORAGE_PATH) does not appear to be on a mounted filesystem"
  fi
+elif podman_path_has_real_mount_ancestor "$STORAGE_PATH"; then
+  # The leaf directory doesn't exist yet, but a real filesystem IS mounted
+  # somewhere along its path (e.g. the cache pool itself) — podman-storage.sh
+  # create will mkdir -p it. Not a failure; see that check's own comment
+  # for the live bug this used to cause (a normal, already-mounted cache
+  # pool failing preflight just because its .../system/podman subdirectory
+  # had never been created).
+  ok "STORAGE_PATH ($STORAGE_PATH) doesn't exist yet, but resolves onto a mounted filesystem — will be created"
 else
  fail "STORAGE_PATH ($STORAGE_PATH) does not exist — is the configured cache pool/disk present and started?"
 fi
@@ -46,10 +46,14 @@ cmd_create() {
  fi

  if [ ! -d "$STORAGE_PATH" ]; then
+    if ! podman_path_has_real_mount_ancestor "$STORAGE_PATH"; then
      podman_log_error "storage: $STORAGE_PATH does not exist or is not mounted."
      podman_log_error "storage: check that the configured cache pool/disk is present before starting podman."
      return 1
    fi
+    podman_log "storage: $STORAGE_PATH doesn't exist yet under an already-mounted filesystem — creating it"
+    mkdir -p "$STORAGE_PATH"
+  fi

  # Free space check: refuse to create an image bigger than what's actually
  # available, with a small safety margin, rather than letting truncate
@@ -34,7 +34,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 . "$SCRIPT_DIR/podman-common.sh"

 INSTALLED_VERSIONS_FILE="/usr/local/share/unraid-podman/installed-versions.env"
-ALL_PACKAGES="podman conmon crun netavark aardvark-dns passt fuse-overlayfs catatonit nftables docker-compose unraid-podman"
+ALL_PACKAGES="podman conmon crun netavark aardvark-dns passt fuse-overlayfs catatonit nftables podman-compose unraid-podman"

 if [ ! -f "$INSTALLED_VERSIONS_FILE" ]; then
  podman_log_error "update-packages: $INSTALLED_VERSIONS_FILE missing — plugin install metadata not found"
@@ -34,7 +34,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 . "$SCRIPT_DIR/podman-common.sh"

 INSTALLED_VERSIONS_FILE="/usr/local/share/unraid-podman/installed-versions.env"
-PACKAGES="podman conmon crun netavark aardvark-dns passt fuse-overlayfs catatonit nftables docker-compose unraid-podman"
+PACKAGES="podman conmon crun netavark aardvark-dns passt fuse-overlayfs catatonit nftables podman-compose unraid-podman"

 QUIET=0
 [ "${1:-}" = "--quiet" ] && QUIET=1
@@ -4,7 +4,7 @@
 #
 # Orchestrates building all Slackware .txz packages this plugin ships
 # (podman, conmon, crun, netavark, aardvark-dns, passt, fuse-overlayfs,
-# catatonit, nftables, docker-compose), by running each package's
+# catatonit, nftables, podman-compose), by running each package's
 # <name>.SlackBuild in turn. See docs/ARCHITECTURE.md section 5.2
 # (Build-Strategie).
 #
@@ -38,12 +38,14 @@ DIST_DIR="$REPO_ROOT/dist"
 # see packages/unraid-podman/README.md) is built last since it's by far the
 # fastest and has nothing useful to report on failure that earlier package
 # failures wouldn't already explain.
-ALL_PACKAGES=(catatonit nftables docker-compose conmon crun netavark aardvark-dns passt fuse-overlayfs podman unraid-podman)
+ALL_PACKAGES=(catatonit nftables podman-compose conmon crun netavark aardvark-dns passt fuse-overlayfs podman unraid-podman)

-# catatonit, nftables, and docker-compose are listed first since they're
-# all a plain fetch-and-repackage of an already-built upstream artifact
-# (see their own README.md for why) — no compiler, fastest possible
-# signal if their pinned URL/checksum in versions.env ever goes stale.
+# catatonit, nftables, and podman-compose are listed first since none of
+# them involve a compiler — catatonit/nftables are a plain
+# fetch-and-repackage of an already-built upstream artifact, and
+# podman-compose is vendored pure-Python source with nothing to compile
+# (see their own README.md/SlackBuild for why) — fastest possible signal
+# if a pinned URL/checksum in versions.env ever goes stale.
 # Podman is listed second-to-last on purpose: among the compiled
 # components it is the slowest build and the one most likely to fail on
 # a dependency/tag mistake, so faster packages surface problems first
@@ -173,6 +173,23 @@ sb_make_package() {
  find "$PKG" -type f \( -perm -u+x -o -name '*.so*' \) -exec sh -c \
    'file "$1" | grep -q ELF && strip --strip-unneeded "$1" 2>/dev/null || true' _ {} \;

+  # Reproducible builds: Slackware's own makepkg already sorts its file
+  # list (LC_COLLATE=C sort) before archiving, so member ORDER is already
+  # deterministic — but it only clamps file mtimes in the resulting tar
+  # when $SOURCE_DATE_EPOCH is set (verified by reading a real
+  # /sbin/makepkg: `if [ -n "${SOURCE_DATE_EPOCH}" ]; then MTIME=
+  # "--clamp-mtime --mtime=@${SOURCE_DATE_EPOCH}"; fi`). Without it, every
+  # separate build run stamps freshly-compiled files with its own wall-clock
+  # time, so two builds of the *same* source produce byte-different .txz
+  # files — which is exactly what broke release.yml's "rebuild in CI and
+  # verify it matches the checksums committed in podman.plg" step (found
+  # live: aardvark-dns's checksum differed between two separate Gitea
+  # Actions runs of the identical tagged commit). Deriving it from the
+  # repo's last commit time (not `date`/a random per-build value) keeps it
+  # stable across any number of rebuilds of the same commit, while still
+  # changing whenever the source actually does.
+  export SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:-$(cd "$CWD/../.." && git log -1 --format=%ct 2>/dev/null || echo 0)}"
+
  local pkg_file="$PRGNAM-$version-$arch-$build$tag.txz"
  ( cd "$PKG" && makepkg --linkadd y --chown y "$OUTPUT/$pkg_file" )

@@ -45,21 +45,24 @@ if ! [[ "$NEW_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
  exit 1
 fi

-# The GitHub Release tag/URL this release's assets will be published under.
-# Must match whatever .github/workflows/release.yml actually creates the
-# release as (tag "v<version>") — see that workflow for the release job.
+# The release tag/URL this release's assets will be published under. This
+# project is hosted on a self-hosted Gitea instance (git.mp-mueller.de),
+# not GitHub — REPO_SLUG/RELEASE_HOST are overridable via env vars for a
+# future move, but default to where this repo actually lives today. Must
+# match plugin/podman.plg's &baseURL; entity exactly (see that file).
 RELEASE_TAG="v$NEW_VERSION"
-REPO_SLUG="${GITHUB_REPOSITORY:-OWNER/unraid-podman}"
-RELEASE_BASE_URL="https://github.com/$REPO_SLUG/releases/download/$RELEASE_TAG"
+REPO_SLUG="${GITEA_REPOSITORY:-${GITHUB_REPOSITORY:-magges/unraid-podman}}"
+RELEASE_HOST="${RELEASE_HOST:-git.mp-mueller.de}"
+RELEASE_BASE_URL="https://$RELEASE_HOST/$REPO_SLUG/releases/download/$RELEASE_TAG"

 # Component name -> the entity name prefix used in podman.plg. Must match
 # plugin/podman.plg's <!ENTITY NAME_txz_...> declarations exactly.
-# catatonit, nftables, and docker-compose are vendored runtime
+# catatonit, nftables, and podman-compose are vendored runtime
 # dependencies (not built from source, see their own packages/*/README.md)
 # and unraid-podman is the plugin's own scaffolding package (see
 # packages/unraid-podman/README.md), not an upstream component, but all
 # four are released and entity-updated exactly like the seven upstream ones.
-COMPONENTS=(podman conmon crun netavark aardvark-dns passt fuse-overlayfs catatonit nftables docker-compose unraid-podman)
+COMPONENTS=(podman conmon crun netavark aardvark-dns passt fuse-overlayfs catatonit nftables podman-compose unraid-podman)

 echo "==> Releasing unraid-podman plugin v$NEW_VERSION (packages tag: $RELEASE_TAG)"

@@ -82,7 +85,31 @@ sed -i -E "s|(<!ENTITY baseURL[[:space:]]+\")[^\"]*(\">)|\1${RELEASE_BASE_URL}\2
 for name in "${COMPONENTS[@]}"; do
  # dist/ contains files like podman-6.0.1-x86_64-1_unraidpodman.txz — find
  # the one for this component (there should be exactly one per release).
-  txz_path=$(find "$DIST_DIR" -maxdepth 1 -name "${name}-*-*-*.txz" | head -n1)
+  # NOT `find ... | head -n1`: "podman"'s own glob (podman-*-*-*.txz) also
+  # matches podman-compose's file (podman-compose-*-*-*.txz), since
+  # "podman" is a literal prefix of "podman-compose" — find's output order
+  # is filesystem-dependent, not sorted, so head -n1 silently picked
+  # podman-compose's package for the "podman" entity on one real run,
+  # publishing a release whose podman.plg pointed at the wrong .txz for
+  # the actual podman package entirely. Explicitly skip any match that
+  # actually belongs to a DIFFERENT, more specific name also in
+  # COMPONENTS (i.e. itself prefixed by another component's name).
+  txz_path=""
+  for candidate in "$DIST_DIR"/"${name}"-*-*-*.txz; do
+    [ -e "$candidate" ] || continue
+    base=$(basename "$candidate")
+    belongs_to_other=0
+    for other in "${COMPONENTS[@]}"; do
+      if [ "$other" != "$name" ] && [ "${base#"$other"-}" != "$base" ]; then
+        belongs_to_other=1
+        break
+      fi
+    done
+    if [ "$belongs_to_other" -eq 0 ]; then
+      txz_path="$candidate"
+      break
+    fi
+  done
  if [ -z "$txz_path" ]; then
    echo "!! No built .txz found for component '$name' in $DIST_DIR" >&2
    echo "!! Did scripts/build-packages.sh run successfully for it?" >&2
@@ -142,7 +169,8 @@ echo "      git add plugin/podman.plg CHANGELOG.md"
 echo "      git commit -m \"release: v$NEW_VERSION\""
 echo "      git tag $RELEASE_TAG"
 echo "      git push && git push origin $RELEASE_TAG"
-echo "==> Pushing the tag triggers .github/workflows/release.yml, which"
-echo "==> rebuilds artifacts in CI (for reproducibility/provenance) and"
-echo "==> publishes the GitHub Release with dist/*.txz + CHECKSUMS.* + the"
-echo "==> updated podman.plg attached."
+echo "==> .github/workflows/release.yml (softprops/action-gh-release) only"
+echo "==> knows how to publish to GitHub — this repo lives on Gitea"
+echo "==> ($RELEASE_HOST), so for now, publish the Gitea Release and attach"
+echo "==> dist/*.txz + CHECKSUMS.* + the updated podman.plg to it by hand"
+echo "==> (or via the Gitea API) after pushing the tag."
@@ -120,22 +120,36 @@ NFTABLES_VERSION="1.0.1"
 NFTABLES_SRC_URL="http://slackware.osuosl.org/slackware64-15.0/slackware64/n/nftables-${NFTABLES_VERSION}-x86_64-1.txz"
 NFTABLES_SRC_SHA256="239e70d48edd6667ce875ff0d339b6f63c1fc94c472524d58772310b1006d31c"

-# --- docker-compose ----------------------------------------------------------
-# https://github.com/docker/compose — the Compose v2 CLI-plugin binary
-# (Go, not the older Python podman-compose). `podman compose` (backing
+# --- podman-compose -----------------------------------------------------------
+# https://github.com/containers/podman-compose — `podman compose` (backing
 # webui/plugins/podman/ajax/compose.php, the WebUI's Compose panel) has no
-# compose implementation of its own — it searches a fixed set of
-# CLI-plugin directories for a binary named exactly "docker-compose" and
-# shells out to it. Without one present, every Compose panel action fails
-# outright (found by live-testing: it only worked on the test host because
-# that host happened to already have Docker's own compose plugin
-# installed from an unrelated, pre-existing Docker setup — a clean Unraid
-# install has none). Upstream publishes a prebuilt static x86_64 binary
-# release asset (verified via `ldd`: "not a dynamic executable") plus a
-# matching .sha256 sidecar — no from-source build needed.
-DOCKER_COMPOSE_VERSION="5.3.1"
-DOCKER_COMPOSE_SRC_URL="https://github.com/docker/compose/releases/download/v${DOCKER_COMPOSE_VERSION}/docker-compose-linux-x86_64"
-DOCKER_COMPOSE_SRC_SHA256="f9ebc6ebdb19d769b793c245a736caaeb198c62587f13b25c660c13b4987f959"
+# compose implementation of its own; it needs an external "compose
+# provider" command. This project previously vendored docker/compose (the
+# Go CLI-plugin binary) for that role, found by podman searching a fixed
+# set of CLI-plugin directories for a binary named exactly
+# "docker-compose". podman-compose is looked up differently — verified
+# live (placing a fake executable and watching podman's own error output
+# list its search order) that it's found as a plain command on $PATH,
+# not from those same CLI-plugin directories — so it's installed as
+# /usr/local/bin/podman-compose, not under any cli-plugins/ path.
+#
+# Unlike docker-compose, podman-compose is a single Python script, not a
+# compiled binary — Unraid ships Python3 itself, but not either of its two
+# runtime dependencies (PyYAML, python-dotenv), so those are vendored
+# alongside it as plain pure-Python source (no C extension build; PyYAML's
+# own __init__.py falls back gracefully when its optional C accelerator
+# isn't importable — verified by reading it, not assumed).
+PODMAN_COMPOSE_VERSION="1.6.0"
+PODMAN_COMPOSE_SRC_URL="https://raw.githubusercontent.com/containers/podman-compose/v${PODMAN_COMPOSE_VERSION}/podman_compose.py"
+PODMAN_COMPOSE_SRC_SHA256="10df1662477a673dc803c03e89c1bc1fba6c8c091e716fb6c7dd09c0081e1255"
+
+PYYAML_VERSION="6.0.3"
+PYYAML_SRC_URL="https://files.pythonhosted.org/packages/05/8e/961c0007c59b8dd7729d542c61a4d537767a59645b82a0b521206e1e25c2/pyyaml-${PYYAML_VERSION}.tar.gz"
+PYYAML_SRC_SHA256="d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f"
+
+PYTHON_DOTENV_VERSION="1.2.2"
+PYTHON_DOTENV_SRC_URL="https://files.pythonhosted.org/packages/82/ed/0301aeeac3e5353ef3d94b6ec08bbcabd04a72018415dcb29e588514bba8/python_dotenv-${PYTHON_DOTENV_VERSION}.tar.gz"
+PYTHON_DOTENV_SRC_SHA256="2c371a91fbd7ba082c2c1dc1f8bf89ca22564a087c2c287cd9b662adde799cf3"

 # =============================================================================
 # Slackware package BUILD number (not upstream version). Bump this if a
@@ -1,4 +1,6 @@
-Menu="Podman"
+Menu="Tasks:66"
+Type="xmenu"
+Tabs="false"
 Title="Podman"
 Icon="podman"
 ---
@@ -21,14 +23,28 @@ Icon="podman"
 * Cache-busts every static asset with its own on-disk mtime. Unraid's
 * webserver sends no explicit no-cache headers for /plugins/ static
 * files, so without this, browsers can keep serving a stale app.js/
- * podman.css for a long time after a plugin update — verified live: a
- * bugfix to app.js's CSRF handling silently kept failing in a real
- * browser after redeploy until this was added, even though the deployed
- * file on disk was byte-for-byte correct.
+ * podman.css for a long time after a plugin update.
+ *
+ * Deliberately a hardcoded absolute path, NOT __DIR__ — Unraid's own
+ * PageBuilder runs every .page file's PHP through eval() (see
+ * webGui/include/DefaultPageLayout/evalContent.php: "eval($evalContent)"),
+ * and __DIR__/__FILE__ inside eval()'d code resolve to the eval() CALL
+ * SITE (that file's own directory), not to Podman.page's real location —
+ * a standard PHP eval() gotcha. Confirmed live: this made
+ * podman_asset_version() return '0' for every single asset, always,
+ * completely independent of any browser or PHP-FPM caching (ruled both
+ * out first: neither a hard-reload nor a php-fpm restart changed the
+ * result) — the version query string was never actually cache-busting
+ * anything all session; every "hard refresh fixed it" moment was the
+ * browser's own Ctrl+Shift+R bypass, not this mechanism. The rest of
+ * this codebase already hardcodes this same install path elsewhere
+ * (e.g. include/Config.php's $bootDir, plugin/podman.plg's event hook
+ * paths) — Unraid plugins always install to /usr/local/emhttp/plugins/
+ * <name>, so this isn't a new class of fragility.
 */
 function podman_asset_version(string $relPath): string
 {
-    $full = __DIR__ . $relPath;
+    $full = '/usr/local/emhttp/plugins/podman' . $relPath;
    return is_file($full) ? (string) filemtime($full) : '0';
 }
 ?>
@@ -71,11 +87,30 @@ function podman_asset_version(string $relPath): string
    <section class="podman-panel active" id="podman-panel-dashboard">
      <div class="podman-grid podman-stat-grid">
        <div class="podman-stat"><div class="label">Running</div><div class="value tnum"><span id="stat-running">—</span> <small id="stat-running-total"></small></div></div>
+        <div class="podman-stat"><div class="label">Stopped</div><div class="value tnum" id="stat-stopped">—</div></div>
        <div class="podman-stat"><div class="label">Pods</div><div class="value tnum" id="stat-pods">—</div></div>
        <div class="podman-stat"><div class="label">Images</div><div class="value tnum" id="stat-images">—</div></div>
        <div class="podman-stat"><div class="label">Volumes</div><div class="value tnum" id="stat-volumes">—</div></div>
        <div class="podman-stat"><div class="label">Networks</div><div class="value tnum" id="stat-networks">—</div></div>
-        <div class="podman-stat"><div class="label">Images on Disk</div><div class="value tnum" id="stat-images-size">—</div></div>
+      </div>
+
+      <div class="podman-card" style="margin-top: 14px;">
+        <div class="podman-card-head">
+          <div><h2>Resource Usage</h2><div class="sub">Live CPU, memory, swap, and storage from the Podman host.</div></div>
+        </div>
+        <div class="podman-card-pad" id="dashboard-resource-rows">—</div>
+      </div>
+
+      <div class="podman-card" style="margin-top: 14px;" id="dashboard-autostart-card">
+        <div class="podman-card-head">
+          <div><h2>Autostart Queue</h2><div class="sub">/boot/config/plugins/podman/autostart</div></div>
+        </div>
+        <div class="podman-table-wrap">
+          <table>
+            <thead><tr><th>#</th><th>Container</th><th>Delay</th><th>Last Result</th></tr></thead>
+            <tbody id="dashboard-autostart-tbody"></tbody>
+          </table>
+        </div>
      </div>
    </section>

@@ -84,16 +119,27 @@ function podman_asset_version(string $relPath): string
      <div class="podman-card">
        <div class="podman-toolbar">
          <input class="podman-search" id="containers-search" type="text" placeholder="Search containers by name or image…">
-          <div class="filterset" id="containers-filterset" style="display:flex; gap:4px; background:var(--surface-2); padding:3px; border-radius:8px;">
+          <div class="podman-segmented" id="containers-filterset">
            <button class="active" data-filter="all" id="containers-count-all">All</button>
            <button data-filter="running" id="containers-count-running">Running</button>
            <button data-filter="stopped" id="containers-count-stopped">Stopped</button>
          </div>
+          <button class="podman-btn podman-btn-primary" id="containers-check-updates-btn" style="margin-left:auto;">Check for Updates</button>
+          <button class="podman-btn podman-btn-primary" id="containers-update-all-btn" title="Also removes the old image versions this leaves unused">Update All</button>
+          <button class="podman-btn" id="containers-new-folder-btn">+ New Folder</button>
          <button class="podman-btn podman-btn-primary" id="containers-create-btn">+ New Container</button>
        </div>
        <div class="podman-table-wrap">
-          <table>
-            <thead><tr><th>Status</th><th>Name</th><th>Image</th><th>CPU/Mem</th><th>Ports</th><th>Uptime</th><th></th></tr></thead>
+          <table id="containers-table">
+            <thead><tr>
+              <th style="width:10%;">Status</th>
+              <th style="width:20%;">Name</th>
+              <th style="width:26%;">Image</th>
+              <th style="width:12%;">CPU/Mem</th>
+              <th style="width:16%;">Ports</th>
+              <th style="width:8%;">Uptime</th>
+              <th style="width:8%;"></th>
+            </tr></thead>
            <tbody id="containers-tbody"></tbody>
          </table>
        </div>
@@ -111,6 +157,7 @@ function podman_asset_version(string $relPath): string
      <div class="podman-card">
        <div class="podman-toolbar">
          <input class="podman-search" type="text" placeholder="Search images…" disabled title="Client-side filtering not yet wired up for Images">
+          <button class="podman-btn" id="images-prune-btn" style="margin-left:auto;">Prune unused</button>
          <button class="podman-btn" id="images-pull-btn">&#11015; Pull Image</button>
        </div>
        <div class="podman-table-wrap">
@@ -165,7 +212,7 @@ function podman_asset_version(string $relPath): string
          <div>
            <div class="podman-toolbar">
              <input class="podman-search" id="logs-filter" type="text" placeholder="Filter log output…" style="max-width:280px;">
-              <span id="logs-follow-toggle" style="display:flex; gap:4px; background:var(--surface-2); padding:3px; border-radius:8px;">
+              <span class="podman-segmented" id="logs-follow-toggle">
                <button class="active" data-follow="true">Follow</button>
                <button data-follow="false">Paused</button>
              </span>
@@ -179,12 +226,22 @@ function podman_asset_version(string $relPath): string
    <!-- ============================= TERMINAL ============================= -->
    <section class="podman-panel" id="podman-panel-terminal">
      <div class="podman-card">
+        <div class="podman-card-head"><h2>Live Terminal</h2></div>
        <div class="podman-card-pad">
-          <div style="display:flex; gap:8px; align-items:center; margin-bottom:12px; font-size:12.5px; color:var(--text-dim);">
-            Exec into: <select id="term-container-select"></select>
+          <div class="podman-term-launcher">
+            <label>Container <select class="podman-term-select" id="term-container-select"></select></label>
+            <label>Shell
+              <select class="podman-term-select" id="term-shell-select">
+                <option value="bash" selected>bash</option>
+                <option value="sh">sh</option>
+              </select>
+            </label>
+            <button class="podman-btn podman-btn-primary" id="term-open-btn">&#9654; Open Terminal</button>
+            <button class="podman-btn podman-btn-ghost podman-btn-danger" id="term-disconnect-btn" disabled>&#9632; Disconnect</button>
+          </div>
+          <div id="term-frame-wrap">
+            <p class="podman-empty-note">Pick a running container and click "Open Terminal" — the same live, fully interactive terminal Unraid's own Docker "Console" button opens (arrow-key history, tab completion, vim, etc. all work).</p>
          </div>
-          <div class="podman-term" id="term-output"></div>
-          <input class="podman-term-input" id="term-input" type="text" placeholder="Type a command and press Enter… (one-shot exec — see Compose panel note on API scope)" autocomplete="off">
        </div>
      </div>
    </section>
@@ -193,15 +250,22 @@ function podman_asset_version(string $relPath): string
    <section class="podman-panel" id="podman-panel-compose">
      <div class="podman-card">
        <div class="podman-compose-layout">
-          <div class="podman-compose-side" id="compose-sidebar"></div>
+          <div class="podman-compose-side">
+            <div class="podman-toolbar" style="border-bottom:1px solid var(--border); padding:10px;">
+              <button class="podman-btn podman-btn-primary" id="compose-new-btn" style="width:100%; justify-content:center;">+ New Project</button>
+            </div>
+            <div id="compose-sidebar"></div>
+          </div>
          <div>
            <div class="podman-toolbar">
              <strong id="compose-title" style="flex:1;">—</strong>
+              <button class="podman-btn podman-btn-ghost podman-btn-danger" id="compose-action-delete">Delete</button>
              <button class="podman-btn" id="compose-action-pull">&#11015; Pull</button>
              <button class="podman-btn" id="compose-action-down">&#9632; Down</button>
              <button class="podman-btn podman-btn-primary" id="compose-action-up">&#9654; Up</button>
+              <button class="podman-btn podman-btn-primary" id="compose-action-save">Save</button>
            </div>
-            <pre class="podman-yaml" id="compose-yaml"></pre>
+            <textarea class="podman-yaml podman-yaml-editor mono" id="compose-yaml" spellcheck="false"></textarea>
          </div>
        </div>
      </div>
@@ -209,9 +273,32 @@ function podman_asset_version(string $relPath): string

    <!-- ============================= SETTINGS ============================= -->
    <section class="podman-panel" id="podman-panel-settings">
+      <div class="podman-settings-actions">
+        <span class="hint" id="settings-save-hint">Changes to storage/enabled/timeout need <span class="mono">rc.podman restart</span> to take effect.</span>
+        <button class="podman-btn podman-btn-primary" id="settings-save-btn">Save Settings</button>
+      </div>
      <div class="podman-grid">
        <div class="podman-card">
-          <div class="podman-card-head"><h2>Storage</h2></div>
+          <div class="podman-card-head">
+            <div><h2>Podman Service</h2><div class="sub">Start, stop, restart, or check the podman.sock backend — no terminal needed.</div></div>
+          </div>
+          <div class="podman-card-pad">
+            <div class="podman-service-row">
+              <span class="podman-chip podman-chip-neutral" id="settings-service-chip"><span class="d"></span>Checking…</span>
+              <button class="podman-btn" id="settings-service-status-btn">Refresh Status</button>
+              <button class="podman-btn podman-btn-primary" id="settings-service-start-btn">&#9654; Start Podman</button>
+              <button class="podman-btn podman-btn-ghost podman-btn-danger" id="settings-service-stop-btn">&#9632; Stop Podman</button>
+              <button class="podman-btn" id="settings-service-restart-btn">&#8635; Restart Podman</button>
+            </div>
+            <div class="hint">Stop/Restart first stop all running containers (each gets its own configured grace period) — not just the API service.</div>
+            <div class="podman-log-pane" id="settings-service-log" style="display:none;"></div>
+          </div>
+        </div>
+
+        <div class="podman-card">
+          <div class="podman-card-head">
+            <div><h2>Storage</h2><div class="sub">Where podman keeps images, containers and volumes on disk.</div></div>
+          </div>
          <div class="podman-field-row">
            <label for="settings-storage-path">Storage path</label>
            <div>
@@ -219,42 +306,65 @@ function podman_asset_version(string $relPath): string
              <div class="hint">Cache pool or dedicated disk — never a path under /mnt/user (FUSE).</div>
            </div>
          </div>
+          <div class="podman-field-row">
+            <label>No cache pool?</label>
+            <div>
+              <button class="podman-btn" id="settings-format-disk-btn">Format a Disk for Podman Storage…</button>
+              <div class="hint">Formats an unused disk with XFS and mounts it, for a single-disk system with no cache pool set up yet.</div>
+            </div>
+          </div>
          <div class="podman-field-row">
            <label for="settings-storage-size">podman.img size</label>
-            <div><input type="number" id="settings-storage-size" style="max-width:100px;"> <span style="font-size:12px;color:var(--text-dim);">GB</span></div>
+            <div>
+              <div class="podman-input-suffix"><input type="number" id="settings-storage-size" min="1"> <span>GB</span></div>
+              <div class="hint">Overlay filesystem image size. Only applies the first time podman initializes storage at this path.</div>
+            </div>
          </div>
        </div>

        <div class="podman-card">
-          <div class="podman-card-head"><h2>Autostart &amp; Lifecycle</h2></div>
+          <div class="podman-card-head">
+            <div><h2>Autostart &amp; Lifecycle</h2><div class="sub">What runs when the array starts, and how containers shut down.</div></div>
+          </div>
          <div class="podman-field-row">
            <label for="settings-enabled">Start podman on array start</label>
-            <div><input type="checkbox" id="settings-enabled"></div>
+            <div>
+              <label class="podman-switch">
+                <input type="checkbox" id="settings-enabled"><span class="podman-switch-track"><span class="podman-switch-thumb"></span></span>
+              </label>
+            </div>
          </div>
          <div class="podman-field-row">
            <label for="settings-stop-timeout">Container stop timeout</label>
-            <div><input type="number" id="settings-stop-timeout" style="max-width:100px;"> <span style="font-size:12px;color:var(--text-dim);">seconds</span></div>
+            <div>
+              <div class="podman-input-suffix"><input type="number" id="settings-stop-timeout" min="0"> <span>seconds</span></div>
+              <div class="hint">Grace period before a stop/restart escalates to SIGKILL.</div>
+            </div>
          </div>
          <div class="podman-field-row">
            <label>Autostart order</label>
+            <div>
+              <div class="podman-term-launcher">
+                <label>Add container <select class="podman-term-select" id="autostart-add-select"><option value="">All containers already added</option></select></label>
+                <button class="podman-btn podman-btn-primary" id="autostart-add-btn">+ Add to Autostart</button>
+              </div>
              <div class="podman-table-wrap">
                <table>
                  <thead><tr><th>#</th><th>Container</th><th></th></tr></thead>
                  <tbody id="autostart-tbody"></tbody>
                </table>
              </div>
+              <div class="hint">Saved immediately on add/reorder/remove — no separate save step.</div>
            </div>
-          <div class="podman-field-row">
-            <label></label>
-            <div><button class="podman-btn podman-btn-primary" id="settings-save-btn">Save Settings</button></div>
          </div>
        </div>

        <div class="podman-card">
-          <div class="podman-card-head"><h2>Installed Packages</h2></div>
-          <div class="podman-field-row">
-            <label>Versions</label>
-            <div class="hint mono" id="settings-package-versions" style="max-width:none;">—</div>
+          <div class="podman-card-head">
+            <div><h2>Installed Packages</h2><div class="sub">Versions currently installed on this system.</div></div>
+          </div>
+          <div class="podman-card-pad">
+            <div class="podman-version-chips" id="settings-package-versions">—</div>
          </div>
        </div>
      </div>
@@ -27,6 +27,8 @@
 * Actions (?action=...):
 *   list   GET  -> known projects with up/down status
 *   get    GET  (&project=...) -> raw compose.yaml content
+ *   save   POST {"project": "...", "yaml": "..."} -> creates or overwrites a project's compose.yaml
+ *   remove POST {"project": "..."} -> `down` (best-effort) then deletes the project's directory
 *   up     POST {"project": "..."}
 *   down   POST {"project": "..."}
 *   pull   POST {"project": "..."}
@@ -49,6 +51,15 @@ switch ($action) {
        podman_json_response(['yaml' => compose_read($composeDir, $project)]);
        break;

+    case 'save':
+        $body = podman_read_json_body();
+        podman_json_response(compose_save($composeDir, require_project($body), (string) ($body['yaml'] ?? '')));
+        break;
+
+    case 'remove':
+        podman_json_response(compose_remove($composeDir, require_project(podman_read_json_body())));
+        break;
+
    case 'up':
        podman_json_response(compose_run($composeDir, require_project(podman_read_json_body()), ['up', '-d']));
        break;
@@ -136,6 +147,79 @@ function compose_status(string $composeDir, string $project): string
    return $running > 0 ? 'up' : 'down';
 }

+/**
+ * Creates a new project (directory doesn't exist yet) or overwrites an
+ * existing one's compose.yaml. Validated via the real tool — `podman
+ * compose ... config` parses and resolves the file, exiting non-zero with
+ * a specific line/column message on invalid YAML/schema (verified live)
+ * — rather than a hand-rolled YAML parser, since PHP has no YAML
+ * extension available here to begin with. Written to a *.new sibling
+ * file first and only renamed into place once validation passes, so a
+ * bad edit never corrupts a previously-working compose.yaml.
+ *
+ * @return array<string,mixed>
+ */
+function compose_save(string $composeDir, string $project, string $yaml): array
+{
+    if (trim($yaml) === '') {
+        podman_json_error('compose.yaml content cannot be empty', 400);
+    }
+
+    $projectDir = $composeDir . '/' . $project;
+    if (!is_dir($projectDir) && !mkdir($projectDir, 0755, true) && !is_dir($projectDir)) {
+        podman_json_error("Could not create project directory for '{$project}'", 500);
+    }
+
+    $yamlPath = $projectDir . '/compose.yaml';
+    $tmpName = 'compose.yaml.new';
+    if (file_put_contents($projectDir . '/' . $tmpName, $yaml) === false) {
+        podman_json_error('Could not write compose.yaml', 500);
+    }
+
+    $result = run_compose_command($composeDir, $project, ['config'], 30, $tmpName);
+    if ($result['exitCode'] !== 0) {
+        @unlink($projectDir . '/' . $tmpName);
+        podman_json_error("Invalid compose file:\n" . trim($result['output']), 400);
+    }
+
+    if (!rename($projectDir . '/' . $tmpName, $yamlPath)) {
+        podman_json_error('Could not save compose.yaml', 500);
+    }
+
+    return ['status' => 'saved'];
+}
+
+/**
+ * Best-effort `down` (ignored if it fails — e.g. already down, or the
+ * file was mid-edit and invalid) so deleting a running project's files
+ * doesn't leave orphaned containers/networks behind, then deletes just
+ * that one project's own directory. $project is validated by
+ * require_project() before this is ever called, so $projectDir can't
+ * escape $composeDir.
+ *
+ * @return array<string,mixed>
+ */
+function compose_remove(string $composeDir, string $project): array
+{
+    $projectDir = $composeDir . '/' . $project;
+    if (!is_dir($projectDir)) {
+        podman_json_error("Project '{$project}' not found", 404);
+    }
+
+    run_compose_command($composeDir, $project, ['down'], 60);
+
+    $it = new RecursiveIteratorIterator(
+        new RecursiveDirectoryIterator($projectDir, FilesystemIterator::SKIP_DOTS),
+        RecursiveIteratorIterator::CHILD_FIRST
+    );
+    foreach ($it as $file) {
+        $file->isDir() ? rmdir($file->getPathname()) : unlink($file->getPathname());
+    }
+    rmdir($projectDir);
+
+    return ['status' => 'removed'];
+}
+
 function compose_read(string $composeDir, string $project): string
 {
    if (!is_valid_project_name($project)) {
@@ -168,9 +252,9 @@ function compose_run(string $composeDir, string $project, array $subcommand): ar
 * @param array<int,string> $subcommand
 * @return array{exitCode:int,stdout:string,output:string}
 */
-function run_compose_command(string $composeDir, string $project, array $subcommand, int $timeoutSeconds): array
+function run_compose_command(string $composeDir, string $project, array $subcommand, int $timeoutSeconds, string $yamlFile = 'compose.yaml'): array
 {
-    $yamlPath = $composeDir . '/' . $project . '/compose.yaml';
+    $yamlPath = $composeDir . '/' . $project . '/' . $yamlFile;
    $argv = array_merge(['podman', 'compose', '-f', $yamlPath], $subcommand);

    $descriptors = [1 => ['pipe', 'w'], 2 => ['pipe', 'w']];
@@ -187,8 +271,12 @@ function run_compose_command(string $composeDir, string $project, array $subcomm
    $exitCode = proc_close($process);

    // 'stdout' (raw) for callers that need to parse machine-readable
-    // output (e.g. compose_status()'s JSON); 'output' (combined,
-    // trimmed) for human-facing success/error messages, where seeing
-    // podman's own stderr banner/warnings is actually useful context.
-    return ['exitCode' => $exitCode, 'stdout' => $stdout, 'output' => trim($stdout . $stderr)];
+    // output (e.g. compose_status()'s JSON); 'output' (combined, trimmed,
+    // ANSI-stripped) for human-facing success/error messages, where seeing
+    // podman's own stderr banner/warnings is actually useful context —
+    // just not the raw \x1b[4m/\x1b[0m escape codes wrapping it (found
+    // live: they showed up as literal garbage characters in the WebUI's
+    // error alerts).
+    $combined = preg_replace('/\x1b\[[0-9;]*m/', '', $stdout . $stderr) ?? ($stdout . $stderr);
+    return ['exitCode' => $exitCode, 'stdout' => $stdout, 'output' => trim($combined)];
 }
@@ -18,11 +18,21 @@
 *   kill      POST {"id": "...", "signal": "SIGKILL"}
 *   rename    POST {"id": "...", "name": "..."}
 *   logs      GET  (&id=...&tail=200) -> plain text
+ *   events    GET  (&id=...&since=<unix seconds, default 7d ago>) -> array
+ *             of this one container's already-happened events (create,
+ *             start, stop, died, ...) — a bounded historical query, not a
+ *             live stream; see PodmanClient::containerEvents()'s own doc
+ *             comment for why that distinction matters here.
+ *   list_gpus GET  -> detected AMD/Intel GPUs (/dev/dri), for the Create Container form's optional passthrough toggle
+ *   check_updates GET -> {"<image ref>": {"updateAvailable": bool, "error": "..."?}} for every image currently in use
 *   create    POST {"image": "...", "name": "...", "networkMode": "bridge"|"host"|"none"|"<custom-network-name>",
+ *                    "staticIp": "10.1.1.222" (only meaningful with a custom/macvlan networkMode),
 *                    "ports": [{"hostPort": 8080, "containerPort": 80, "protocol": "tcp"}],
 *                    "volumes": [{"kind": "named"|"path", "source": "myvol"|"/mnt/...", "containerPath": "/data"}],
- *                    "env": [{"key": "...", "value": "..."}], "restartPolicy": "no",
- *                    "privileged": false, "startAfterCreate": true}
+ *                    "env": [{"key": "...", "value": "..."}], "restartPolicy": "no", "pod": "<existing-pod-name>",
+ *                    "gpuDevices": ["/dev/dri/renderD128", "/dev/dri/card0"],
+ *                    "privileged": false, "startAfterCreate": true, "icon": "https://..." (optional),
+ *                    "webuiUrl": "http://10.1.1.1:8080/" (optional)}
 */

 declare(strict_types=1);
@@ -53,6 +63,15 @@ switch ($action) {
        podman_json_response(['text' => $client->containerLogs($id, $tail)]);
        break;

+    case 'events':
+        $id = (string) ($_GET['id'] ?? '');
+        if ($id === '') {
+            podman_json_error('Missing id', 400);
+        }
+        $since = (int) ($_GET['since'] ?? (time() - 7 * 86400));
+        podman_json_response($client->containerEvents($id, $since));
+        break;
+
    case 'start':
        $body = podman_read_json_body();
        $client->startContainer(require_id($body));
@@ -105,6 +124,14 @@ switch ($action) {
        podman_json_response(['status' => 'renamed']);
        break;

+    case 'list_gpus':
+        podman_json_response(gpu_list());
+        break;
+
+    case 'check_updates':
+        podman_json_response(check_image_updates($client));
+        break;
+
    case 'create':
        $body = podman_read_json_body();
        $image = trim((string) ($body['image'] ?? ''));
@@ -138,6 +165,102 @@ switch ($action) {
        podman_json_error("Unknown action '{$action}'", 400);
 }

+/**
+ * Checks every image currently backing a (non-infra) container against its
+ * origin registry — see RegistryClient for how, and why this isn't a
+ * podman/libpod feature at all. Deduplicated per unique image reference
+ * first (several containers commonly share the same image), so a host
+ * with e.g. five containers all on the same base image only makes one
+ * real registry request for it, not five.
+ *
+ * @return array<string,array<string,mixed>> keyed by image reference
+ */
+function check_image_updates(PodmanClient $client): array
+{
+    $digestByImageId = [];
+    foreach ($client->listImages() as $img) {
+        $digestByImageId[(string) ($img['Id'] ?? '')] = (string) ($img['Digest'] ?? '');
+    }
+
+    $localDigestByRef = [];
+    foreach ($client->listContainers(true) as $c) {
+        if ($c['IsInfra'] ?? false) {
+            continue;
+        }
+        $ref = (string) ($c['Image'] ?? '');
+        $imageId = (string) ($c['ImageID'] ?? '');
+        if ($ref === '' || !isset($digestByImageId[$imageId])) {
+            continue;
+        }
+        $localDigestByRef[$ref] = $digestByImageId[$imageId];
+    }
+
+    $out = [];
+    foreach ($localDigestByRef as $ref => $localDigest) {
+        $out[$ref] = $localDigest === ''
+            ? ['error' => 'No local digest recorded for this image.']
+            : RegistryClient::checkForUpdate($ref, $localDigest);
+    }
+    return $out;
+}
+
+/**
+ * Detects AMD/Intel GPUs via /dev/dri + sysfs — NOT via any podman/libpod
+ * API (libpod has no GPU inventory endpoint; this is plain host hardware
+ * detection). NVIDIA is deliberately excluded: it needs the separate
+ * nvidia-container-toolkit runtime, not a plain /dev/dri device passthrough,
+ * so listing it here would offer a checkbox that doesn't actually work.
+ * Verified live: card/render pairs from the same GPU share a "device"
+ * symlink target under /sys/class/drm, which is how they're grouped below;
+ * vendor 0x1002 = AMD, 0x8086 = Intel (PCI SIG IDs).
+ *
+ * @return array<int,array<string,mixed>>
+ */
+function gpu_list(): array
+{
+    if (!is_dir('/sys/class/drm')) {
+        return [];
+    }
+
+    $byDevice = [];
+    foreach (scandir('/sys/class/drm') ?: [] as $entry) {
+        if (!preg_match('/^(card\d+|renderD\d+)$/', $entry)) {
+            continue;
+        }
+        $devicePath = "/sys/class/drm/{$entry}/device";
+        $target = @readlink($devicePath);
+        if ($target === false) {
+            continue;
+        }
+        $vendorFile = "{$devicePath}/vendor";
+        if (!is_file($vendorFile)) {
+            continue;
+        }
+        $vendorId = trim((string) @file_get_contents($vendorFile));
+        $byDevice[$target]['vendorId'] ??= $vendorId;
+        $byDevice[$target][str_starts_with($entry, 'card') ? 'card' : 'render'] = "/dev/dri/{$entry}";
+    }
+
+    $vendorNames = ['0x1002' => 'AMD', '0x8086' => 'Intel', '0x10de' => 'NVIDIA'];
+    $out = [];
+    foreach ($byDevice as $group) {
+        $vendorId = $group['vendorId'] ?? '';
+        $vendorName = $vendorNames[$vendorId] ?? $vendorId;
+        // NVIDIA needs the nvidia-container-toolkit runtime, not a plain
+        // /dev/dri passthrough — excluded so the checkbox we offer always
+        // actually works (see function comment).
+        if ($vendorName === 'NVIDIA' || !isset($group['render'])) {
+            continue;
+        }
+        $out[] = [
+            'vendor' => $vendorName,
+            'card' => $group['card'] ?? null,
+            'render' => $group['render'],
+        ];
+    }
+    return $out;
+}
+
 /**
 * Builds a libpod SpecGenerator body (POST /containers/create) from the
 * WebUI's Create Container form fields. Field names/shapes here
@@ -170,6 +293,19 @@ function build_container_spec(string $image, array $body): array
        $spec['name'] = $name;
    }

+    $icon = trim((string) ($body['icon'] ?? ''));
+    $webuiUrl = trim((string) ($body['webuiUrl'] ?? ''));
+    $labels = [];
+    if ($icon !== '') {
+        $labels['podman-webui.icon'] = $icon;
+    }
+    if ($webuiUrl !== '') {
+        $labels['podman-webui.weburl'] = $webuiUrl;
+    }
+    if ($labels !== []) {
+        $spec['labels'] = $labels;
+    }
+
    $env = [];
    foreach (($body['env'] ?? []) as $row) {
        $key = trim((string) ($row['key'] ?? ''));
@@ -228,8 +364,22 @@ function build_container_spec(string $image, array $body): array
    if (in_array($networkMode, ['bridge', 'host', 'none'], true)) {
        $spec['netns'] = ['nsmode' => $networkMode];
    } elseif ($networkMode !== '') {
+        // A static IP only makes sense on a custom (typically macvlan)
+        // network — verified live that "networks":{"<name>":{"static_ips":
+        // [...]}} assigns it, same as podman itself does for --ip. Basic
+        // IPv4-shape validation only (not full RFC-correctness) — this
+        // goes straight into a create request against the local podman
+        // socket, not anywhere it could reach untrusted input otherwise.
+        $staticIp = trim((string) ($body['staticIp'] ?? ''));
+        if ($staticIp !== '') {
+            if (preg_match('/^(\d{1,3}\.){3}\d{1,3}$/', $staticIp) !== 1) {
+                podman_json_error("Static IP (\"{$staticIp}\") doesn't look like a valid IPv4 address.", 400);
+            }
+            $spec['networks'] = [$networkMode => ['static_ips' => [$staticIp]]];
+        } else {
            $spec['networks'] = [$networkMode => new \stdClass()];
        }
+    }

    if (isset($body['restartPolicy']) && $body['restartPolicy'] !== '') {
        $spec['restart_policy'] = (string) $body['restartPolicy'];
@@ -238,6 +388,29 @@ function build_container_spec(string $image, array $body): array
        $spec['privileged'] = true;
    }

+    $devices = [];
+    foreach (($body['gpuDevices'] ?? []) as $path) {
+        // Only ever pass through paths matching the exact shape gpu_list()
+        // itself reports — the client only ever gets those as checkbox
+        // values, but this is the boundary where a tampered/malicious
+        // request body gets rejected rather than handing arbitrary host
+        // device paths (e.g. "/dev/sda") straight into the container spec.
+        if (is_string($path) && preg_match('#^/dev/dri/(card|renderD)\d+$#', $path) === 1) {
+            $devices[] = ['path' => $path];
+        }
+    }
+    if ($devices !== []) {
+        $spec['devices'] = $devices;
+    }
+
+    $pod = trim((string) ($body['pod'] ?? ''));
+    if ($pod !== '') {
+        // "pod" joins an existing pod's shared network namespace — verified
+        // live that it can be sent alongside "netns" above without
+        // conflict (podman just defers to the pod's namespace).
+        $spec['pod'] = $pod;
+    }
+
    return $spec;
 }

@@ -265,6 +438,17 @@ function containers_list(PodmanClient $client): array
    $out = [];

    foreach ($raw as $c) {
+        // Every pod has a hidden "infra" container managing its shared
+        // network namespace — not something a user creates or can
+        // meaningfully stop/remove on its own (found live: it always
+        // shows "running" with no independent lifecycle, so Containers
+        // panel gets a permanently un-removable row once any pod exists;
+        // it already appears as its own row in the Pods panel). See
+        // ajax/pods.php for actual pod lifecycle management.
+        if ($c['IsInfra'] ?? false) {
+            continue;
+        }
+
        $names = $c['Names'] ?? [];
        $name = is_array($names) && count($names) > 0 ? ltrim((string) $names[0], '/') : podman_short_id((string) ($c['Id'] ?? ''));

@@ -280,6 +464,24 @@ function containers_list(PodmanClient $client): array
        $startedAt = podman_parse_time($c['StartedAt'] ?? null);
        $state = strtolower((string) ($c['State'] ?? 'unknown'));

+        // One extra local-socket round trip per running container (~15ms
+        // each, verified live — negligible for a home host's container
+        // count). Best-effort: a container that stops between the list
+        // call above and this one shouldn't blank out the whole table.
+        $cpuPercent = null;
+        $memUsageBytes = null;
+        $memLimitBytes = null;
+        if ($state === 'running') {
+            try {
+                $stats = $client->containerStats((string) ($c['Id'] ?? ''));
+                $cpuPercent = isset($stats['cpu_stats']['cpu']) ? round((float) $stats['cpu_stats']['cpu'], 1) : null;
+                $memUsageBytes = isset($stats['memory_stats']['usage']) ? (int) $stats['memory_stats']['usage'] : null;
+                $memLimitBytes = isset($stats['memory_stats']['limit']) ? (int) $stats['memory_stats']['limit'] : null;
+            } catch (PodmanApiException $e) {
+                // leave stats null
+            }
+        }
+
        $out[] = [
            'id' => (string) ($c['Id'] ?? ''),
            'shortId' => podman_short_id((string) ($c['Id'] ?? '')),
@@ -293,6 +495,17 @@ function containers_list(PodmanClient $client): array
            'podName' => $c['PodName'] ?? null,
            'uptimeSeconds' => ($state === 'running' && $startedAt !== null) ? (time() - $startedAt) : null,
            'createdAt' => podman_parse_time($c['Created'] ?? null),
+            'cpuPercent' => $cpuPercent,
+            'memUsageBytes' => $memUsageBytes,
+            'memLimitBytes' => $memLimitBytes,
+            // Set at create time (see build_container_spec()) from either
+            // the template it was created from or a manually-entered URL —
+            // this plugin's own label, not Unraid's real Docker manager's
+            // net.unraid.docker.icon (this isn't Docker, so reusing that
+            // name would misleadingly imply real interop with tools that
+            // read it).
+            'icon' => $c['Labels']['podman-webui.icon'] ?? null,
+            'webUrl' => $c['Labels']['podman-webui.weburl'] ?? null,
        ];
    }

@@ -0,0 +1,289 @@
+<?php
+/**
+ * ajax/disks.php
+ *
+ * Backs the Settings panel's "Format a Disk for Podman Storage" flow — for
+ * a single-disk system with no cache pool set up yet, where podman's own
+ * storage path (see include/Config.php's $storagePath default,
+ * /mnt/cache/system/podman) has nowhere real to live, and podman never
+ * fully starts as a result (found live: a fresh install on a system with
+ * no cache pool failed with "cannot reach the Podman API socket" because
+ * podman-storage.sh's `create` step refuses to run against a path that
+ * isn't an actual mounted filesystem — see that script's header comment
+ * for why /mnt/user/... FUSE paths don't work either).
+ *
+ * This is the one place in the plugin that formats a physical disk —
+ * deliberately narrow and defensive: every candidate the "format" action
+ * is asked to touch is re-derived server-side from the same safe-listing
+ * logic "list_candidates" uses, never trusted from the request alone, and
+ * only ever a whole, currently-unmounted, non-array disk with no existing
+ * partitions is eligible in the first place.
+ *
+ * Actions (?action=...):
+ *   list_candidates  GET  -> [{device, sizeBytes, sizeFormatted, model, hasData}, ...]
+ *   format           POST {"device": "/dev/sdc"} -> {"mountPath": "/mnt/disks/podman-storage"}
+ */
+
+declare(strict_types=1);
+
+require __DIR__ . '/../include/bootstrap.php';
+
+const MOUNT_PATH = '/mnt/disks/podman-storage';
+const MANAGED_DISK_CFG = '/boot/config/plugins/podman/managed-disk.cfg';
+
+$action = $_GET['action'] ?? '';
+
+switch ($action) {
+    case 'list_candidates':
+        podman_json_response(list_candidate_disks());
+        break;
+
+    case 'format':
+        $body = podman_read_json_body();
+        $device = (string) ($body['device'] ?? '');
+        podman_json_response(format_disk($device));
+        break;
+
+    default:
+        podman_json_error("Unknown action '{$action}'", 400);
+}
+
+/**
+ * Runs a command and returns [exitCode, stdout+stderr combined]. Every
+ * caller here passes a fixed argv array (never a shell string built from
+ * request input), so there is no injection surface even before the
+ * device-path validation in format_disk() below.
+ *
+ * @param array<int,string> $argv
+ * @return array{0:int,1:string}
+ */
+function run(array $argv, int $timeoutSeconds = 30): array
+{
+    $descriptors = [1 => ['pipe', 'w'], 2 => ['pipe', 'w']];
+    $process = proc_open($argv, $descriptors, $pipes);
+    if (!is_resource($process)) {
+        return [127, "could not start {$argv[0]}"];
+    }
+    stream_set_timeout($pipes[1], $timeoutSeconds);
+    $out = (stream_get_contents($pipes[1]) ?: '') . (stream_get_contents($pipes[2]) ?: '');
+    fclose($pipes[1]);
+    fclose($pipes[2]);
+    $code = proc_close($process);
+    return [$code, trim($out)];
+}
+
+/**
+ * Every whole disk (not partition) libpod's host isn't already using —
+ * mounted anywhere (itself or any partition), part of Unraid's own
+ * array/cache pool (cross-checked against /var/local/emhttp/disks.ini,
+ * the same state file Unraid's own array management writes — the boot
+ * flash device is covered by this same check, since Unraid lists it there
+ * too), or the disk backing the currently-booted root/flash filesystem.
+ *
+ * @return array<int,array<string,mixed>>
+ */
+function list_candidate_disks(): array
+{
+    // Nested partitions come back automatically as a "children" array in
+    // -J's JSON tree — CHILDREN is not a real -o column (lsblk itself
+    // rejects it: "unknown column: CHILDREN"; verified live against a
+    // real host's lsblk). LABEL is included specifically to catch the
+    // Unraid boot flash drive, which FAT-labels itself "UNRAID" — see the
+    // safety note below for why that check exists at all.
+    [$code, $out] = run(['lsblk', '-J', '-b', '-p', '-o', 'NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT,MODEL,LABEL'], 10);
+    if ($code !== 0) {
+        podman_json_error('Could not list block devices: ' . $out, 500);
+    }
+    $tree = json_decode($out, true);
+    if (!is_array($tree) || !isset($tree['blockdevices'])) {
+        podman_json_error('Unexpected lsblk output', 500);
+    }
+
+    $arrayDevices = unraid_array_device_names();
+
+    $candidates = [];
+    foreach ($tree['blockdevices'] as $dev) {
+        if (($dev['type'] ?? '') !== 'disk') {
+            continue;
+        }
+        $name = (string) ($dev['name'] ?? '');
+        $baseName = basename($name);
+        if (in_array($baseName, $arrayDevices, true)) {
+            continue;
+        }
+        // zram devices report TYPE "disk" too (RAM-backed, not persistent
+        // storage — pointless and misleading to offer for this) and an
+        // empty card-reader slot with no card inserted reports as a real
+        // "disk" at 0 bytes; both are excluded outright rather than left
+        // for the size-based hasData check below.
+        if (str_starts_with($baseName, 'zram') || (int) ($dev['size'] ?? 0) <= 0) {
+            continue;
+        }
+        if (device_or_children_mounted($dev)) {
+            continue;
+        }
+        if (device_or_children_labeled_unraid($dev)) {
+            continue;
+        }
+        // Deliberately excludes (not just warns about) ANY disk that
+        // already has a filesystem, partition, or other signature on it
+        // or any of its partitions — not just ones lsblk reports as
+        // currently mounted. Found live: a real host's cache pool disks
+        // showed up here as "safe" with only a soft warning, because
+        // they're ZFS pool members (fstype "zfs_member"/partition
+        // present) rather than plain mounts, so the earlier
+        // mounted-only check missed them entirely — the same blind spot
+        // that also let the Unraid boot USB stick's own partition
+        // through (FAT, not reported as "mounted" by lsblk either). A
+        // disk being reused for podman storage must be genuinely blank;
+        // asking a user to wipe it themselves first is a small price for
+        // this being impossible to get wrong.
+        if (!empty($dev['fstype']) || !empty($dev['children'])) {
+            continue;
+        }
+
+        $candidates[] = [
+            'device' => $name,
+            'sizeBytes' => (int) ($dev['size'] ?? 0),
+            'sizeFormatted' => podman_format_bytes((int) ($dev['size'] ?? 0)),
+            'model' => trim((string) ($dev['model'] ?? '')) ?: null,
+        ];
+    }
+
+    return $candidates;
+}
+
+function device_or_children_mounted(array $dev): bool
+{
+    if (!empty($dev['mountpoint'])) {
+        return true;
+    }
+    foreach ($dev['children'] ?? [] as $child) {
+        if (device_or_children_mounted($child)) {
+            return true;
+        }
+    }
+    return false;
+}
+
+/**
+ * Catches the Unraid boot flash drive specifically: it FAT-labels itself
+ * "UNRAID" (verified live: `blkid` on a real host's boot partition shows
+ * LABEL_FATBOOT="UNRAID" LABEL="UNRAID") and — on at least one real,
+ * modern Unraid setup — /boot is actually backed by a ZFS dataset
+ * ("flash/boot"), not a direct mount of that partition, so it does NOT
+ * show up as "mounted" via lsblk's own MOUNTPOINT column at all. This
+ * label check is a second, independent layer specifically because that
+ * gap meant the boot drive briefly passed every other check here during
+ * development — never rely on a single signal for something this
+ * destructive.
+ */
+function device_or_children_labeled_unraid(array $dev): bool
+{
+    if (strtoupper(trim((string) ($dev['label'] ?? ''))) === 'UNRAID') {
+        return true;
+    }
+    foreach ($dev['children'] ?? [] as $child) {
+        if (device_or_children_labeled_unraid($child)) {
+            return true;
+        }
+    }
+    return false;
+}
+
+/**
+ * @return array<int,string> bare device names ("sda", "nvme0n1", ...) Unraid
+ *   itself has assigned to the array or a cache pool, read from the same
+ *   /var/local/emhttp/disks.ini Unraid's own array management writes —
+ *   NOT parsed/guessed, so this stays correct across whatever array
+ *   layout a given host actually has.
+ */
+function unraid_array_device_names(): array
+{
+    $path = '/var/local/emhttp/disks.ini';
+    if (!is_readable($path)) {
+        return [];
+    }
+    $ini = @parse_ini_file($path, true);
+    if (!is_array($ini)) {
+        return [];
+    }
+    $names = [];
+    foreach ($ini as $section) {
+        if (is_array($section) && !empty($section['device'])) {
+            $names[] = basename((string) $section['device']);
+        }
+    }
+    return $names;
+}
+
+/** @return array<string,mixed> */
+function format_disk(string $device): array
+{
+    if (!preg_match('#^/dev/(sd[a-z]+|nvme\d+n\d+|vd[a-z]+)$#', $device)) {
+        podman_json_error('Invalid or unsupported device path', 400);
+    }
+
+    $allowed = array_column(list_candidate_disks(), 'device');
+    if (!in_array($device, $allowed, true)) {
+        podman_json_error("{$device} is not a currently-eligible disk (already in use, part of the array, or not found) — refusing to format it.", 400);
+    }
+
+    $partDevice = preg_match('#nvme\d+n\d+$#', $device) ? "{$device}p1" : "{$device}1";
+
+    [$code, $out] = run(['wipefs', '-a', $device], 30);
+    if ($code !== 0) {
+        podman_json_error("wipefs failed: {$out}", 500);
+    }
+
+    [$code, $out] = run(['parted', '-s', $device, 'mklabel', 'gpt', 'mkpart', 'primary', '1MiB', '100%'], 30);
+    if ($code !== 0) {
+        podman_json_error("parted failed: {$out}", 500);
+    }
+
+    run(['partprobe', $device], 10);
+    // Partition device nodes can take a moment to appear after partprobe.
+    for ($i = 0; $i < 20 && !file_exists($partDevice); $i++) {
+        usleep(250000);
+    }
+    if (!file_exists($partDevice)) {
+        podman_json_error("Partition {$partDevice} did not appear after partitioning {$device}", 500);
+    }
+
+    [$code, $out] = run(['mkfs.xfs', '-f', '-n', 'ftype=1', '-L', 'podmanstorage', $partDevice], 60);
+    if ($code !== 0) {
+        podman_json_error("mkfs.xfs failed: {$out}", 500);
+    }
+
+    [$code, $uuid] = run(['blkid', '-s', 'UUID', '-o', 'value', $partDevice], 10);
+    $uuid = trim($uuid);
+    if ($code !== 0 || $uuid === '') {
+        podman_json_error('Could not determine filesystem UUID after formatting', 500);
+    }
+
+    if (!is_dir(MOUNT_PATH) && !mkdir(MOUNT_PATH, 0755, true) && !is_dir(MOUNT_PATH)) {
+        podman_json_error('Could not create ' . MOUNT_PATH, 500);
+    }
+    [$code, $out] = run(['mount', 'UUID=' . $uuid, MOUNT_PATH], 15);
+    if ($code !== 0) {
+        podman_json_error("mount failed: {$out}", 500);
+    }
+
+    // Persisted so plugin/sbin/podman-mount-managed-disk.sh (called from
+    // the disks_mounted event hook, before rc.podman start) can remount
+    // this same disk by UUID on every future boot — nothing else on the
+    // system knows about this disk, since it's deliberately outside
+    // Unraid's own array/cache pool management.
+    $cfgDir = dirname(MANAGED_DISK_CFG);
+    if (!is_dir($cfgDir) && !mkdir($cfgDir, 0755, true) && !is_dir($cfgDir)) {
+        podman_json_error('Could not create ' . $cfgDir, 500);
+    }
+    $cfgContent = "# Written by the unraid-podman WebUI (ajax/disks.php) — do not edit by hand.\n"
+        . 'UUID="' . $uuid . "\"\n"
+        . 'MOUNTPOINT="' . MOUNT_PATH . "\"\n";
+    if (file_put_contents(MANAGED_DISK_CFG, $cfgContent, LOCK_EX) === false) {
+        podman_json_error('Formatted and mounted, but could not persist ' . MANAGED_DISK_CFG . ' for future boots', 500);
+    }
+
+    return ['mountPath' => MOUNT_PATH];
+}
@@ -3,35 +3,49 @@
 * ajax/exec.php
 *
 * Backs the Terminal panel — and this is the one panel where "exclusively
- * via podman system service, no shell hacks" needs an honest caveat
- * spelled out rather than silently glossed over:
+ * via podman system service, no shell hacks" needs an honest caveat spelled
+ * out rather than silently glossed over (the same exception ajax/compose.php
+ * documents for the same underlying reason: some things have no REST
+ * equivalent).
 *
 * libpod's real exec API (POST /containers/{id}/exec, then
- * POST /exec/{id}/start) is used here — PodmanClient::execRun() never
- * shells out to the `podman` binary. But that API's interactive mode works
- * by HTTP connection hijacking: the HTTP connection is upgraded into a raw
- * bidirectional byte stream for the lifetime of the shell session. That
- * model assumes a long-lived process holding the socket open on both ends
- * (an actual terminal emulator, or a WebSocket bridge) — it does not fit
- * PHP-FPM's request/response lifecycle, where each AJAX call is a fresh,
- * independent, short-lived process with no memory of any previous one.
+ * POST /exec/{id}/start) works by HTTP connection hijacking: the connection
+ * is upgraded into a raw bidirectional byte stream for the lifetime of the
+ * shell session. That model assumes a long-lived process holding the socket
+ * open on both ends (an actual terminal emulator, or a WebSocket bridge) —
+ * it does not fit PHP-FPM's request/response lifecycle, where each AJAX call
+ * is a fresh, independent, short-lived process with no memory of any
+ * previous one. An earlier version of this file worked around that by
+ * offering one-shot "run a command, see its output" exec calls — honest
+ * about not being a real terminal, but not what a user expects when they
+ * open a "Console" tab (no history, no vim, no persistent `cd`).
 *
- * Rather than fake interactivity with something that would break on the
- * first multi-line prompt, `sudo`, or interactive editor, this endpoint
- * offers a deliberately simpler, honest contract: one command in, its
- * complete output back, using Tty=true so output reads like a real
- * terminal (colors, prompts-in-output, etc. survive) but with no
- * persistent shell state (`cd` does not carry over between calls — see
- * the "cwd" parameter below, which javascript/terminal.js tracks
- * client-side and resends every time instead).
+ * Unraid's own webGui already solves exactly this problem for its System
+ * Terminal and for `docker exec` (see
+ * /usr/local/emhttp/plugins/dynamix/include/OpenTerminal.php's 'docker'
+ * case, and /etc/nginx/conf.d/locations.conf's "logterminal" location
+ * block) — by spawning one `ttyd` instance per session, bound to a unix
+ * socket under /var/tmp, wrapping the real interactive command; nginx then
+ * proxies /logterminal/<name>/ to that socket with a WebSocket upgrade,
+ * generically, for ANY name. That proxy rule is already installed and
+ * already generic — this endpoint reuses it exactly the same way Unraid's
+ * own docker integration does, just with `podman exec -it` instead of
+ * `docker exec -it` as the wrapped command. `ttyd-exec` itself is a small
+ * wrapper script Unraid ships system-wide (sources /etc/default/ttyd for
+ * common xterm.js options, then execs ttyd in the background) — not
+ * something this plugin needs to vendor.
 *
- * A true interactive PTY (arrow-key history, tab completion, vim, ...)
- * would need a WebSocket-capable process sitting between the browser and
- * podman.sock — out of scope for this PHP/AJAX stack; tracked as a
- * follow-up rather than implemented as a shell-out workaround.
+ * This is the one place in the plugin that shells out to the `podman`
+ * binary via proc invocation rather than the REST API — container names
+ * are validated against a fixed safe pattern and passed through
+ * escapeshellarg(), never concatenated into a shell string.
 *
 * Actions (?action=...):
- *   run   POST {"id": "...", "cmd": "ls -la", "cwd": "/config"}
+ *   open    POST {"name": "...", "shell": "sh"|"bash"} -> {"sockName": "..."}
+ *           Caller then points an iframe/window at /logterminal/<sockName>/.
+ *   close   POST {"name": "..."} -> {"status": "closed"}
+ *           Kills the ttyd instance (and, via it, the `podman exec` it
+ *           wraps) for that container, if one is running.
 */

 declare(strict_types=1);
@@ -41,27 +55,103 @@ require __DIR__ . '/../include/bootstrap.php';
 $action = $_GET['action'] ?? '';

 switch ($action) {
-    case 'run':
+    case 'open':
        $body = podman_read_json_body();
-        $id = (string) ($body['id'] ?? '');
-        $commandLine = (string) ($body['cmd'] ?? '');
-        $cwd = (string) ($body['cwd'] ?? '');
+        $name = (string) ($body['name'] ?? '');
+        $shell = (string) ($body['shell'] ?? 'sh');

-        if ($id === '' || trim($commandLine) === '') {
-            podman_json_error('Missing id or cmd in request body', 400);
+        // Same character set libpod itself allows in container names —
+        // rejecting anything else here (BEFORE it's ever used to build a
+        // socket path or shell command) is what makes escapeshellarg() on
+        // top of it a defense in depth rather than the only line of
+        // defense.
+        if (!preg_match('/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/', $name)) {
+            podman_json_error('Missing or invalid container name', 400);
+        }
+        if (!in_array($shell, ['sh', 'bash'], true)) {
+            podman_json_error('Invalid shell', 400);
        }

-        // The command line is run through the container's own shell
-        // (sh -c) so the user can type ordinary shell syntax (pipes,
-        // globs, env vars) in the terminal box, exactly like a real
-        // shell prompt would accept — still one real exec API call, just
-        // with /bin/sh as the interpreter instead of us parsing shell
-        // syntax ourselves in PHP.
-        $output = $client->execRun($id, ['/bin/sh', '-c', $commandLine], $cwd);
+        podman_json_response(open_terminal($name, $shell));
+        break;

-        podman_json_response(['output' => $output]);
+    case 'close':
+        $body = podman_read_json_body();
+        $name = (string) ($body['name'] ?? '');
+        if (!preg_match('/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/', $name)) {
+            podman_json_error('Missing or invalid container name', 400);
+        }
+        close_terminal($name);
+        podman_json_response(['status' => 'closed']);
        break;

    default:
        podman_json_error("Unknown action '{$action}'", 400);
 }
+
+function sock_path_for(string $containerName): string
+{
+    // "podman." prefix keeps this plugin's per-container sockets under
+    // /var/tmp from ever colliding with Unraid's own docker-exec sockets
+    // (/var/tmp/<name>.sock), which are named after the same container
+    // names a user might also give their podman containers.
+    return '/var/tmp/podman.' . $containerName . '.sock';
+}
+
+/**
+ * @return array<string,mixed>
+ */
+function open_terminal(string $containerName, string $shell): array
+{
+    // Close out any previous session for this container first — sockets
+    // are named deterministically per-container (not per-open-call), so
+    // without this, re-opening the same container's terminal (or switching
+    // shells) would try to bind a second ttyd to the same path and leave
+    // the first one orphaned, still running, holding /dev resources for a
+    // client that will never come.
+    close_terminal($containerName);
+
+    $sockPath = sock_path_for($containerName);
+
+    // -s9: send SIGKILL to the wrapped command when the client disconnects
+    // (no orphaned `podman exec` process lingering after the window is
+    // closed). -o -m1: accept exactly one client, then exit instead of
+    // staying resident waiting for a next one — matching exactly the
+    // options Unraid's own OpenTerminal.php uses for `docker exec` (see
+    // that file's 'docker' case).
+    $cmd = sprintf(
+        'ttyd-exec -s9 -o -m1 -i %s podman exec -it %s %s',
+        escapeshellarg($sockPath),
+        escapeshellarg($containerName),
+        escapeshellarg($shell)
+    );
+
+    exec($cmd, $output, $exitCode);
+    if ($exitCode !== 0) {
+        podman_json_error('Could not start terminal session', 500);
+    }
+
+    return ['sockName' => 'podman.' . $containerName];
+}
+
+/**
+ * Kills the ttyd instance (if any) bound to this container's socket, and
+ * removes the socket file. Matched via `pgrep -f` against the socket path
+ * embedded in ttyd's own argv (the -i flag passed in open_terminal()) —
+ * that's a stable, unique needle since it includes the "podman." prefix
+ * and the validated container name. Killing ttyd itself (rather than
+ * just closing a client connection nothing is holding) tears down the
+ * `podman exec` child with it, same as closing a real terminal window
+ * would once a client was attached.
+ */
+function close_terminal(string $containerName): void
+{
+    $sockPath = sock_path_for($containerName);
+    exec('pgrep -f ' . escapeshellarg($sockPath) . ' 2>/dev/null', $pids);
+    foreach ($pids as $pid) {
+        if (ctype_digit($pid)) {
+            exec('kill ' . escapeshellarg($pid) . ' 2>/dev/null');
+        }
+    }
+    @unlink($sockPath);
+}
@@ -0,0 +1,91 @@
+<?php
+/**
+ * ajax/folders.php
+ *
+ * Container folders — a purely cosmetic, plugin-owned organizational
+ * feature for the Containers panel. podman/libpod itself has no concept
+ * of "folders"; this is grouping metadata only (name + icon + which
+ * container names belong to it), similar to Unraid's own Docker page's
+ * folders. Stored as JSON at PodmanConfig::$foldersFile — not a
+ * PodmanClient/libpod concern, see Config.php.
+ *
+ * Actions (?action=...):
+ *   list  GET  -> {"folders": [{"id": "...", "name": "...", "icon": "...", "containers": ["name", ...]}, ...]}
+ *   save  POST {"folders": [...]} -> persists the whole list (same
+ *         whole-list-replace pattern settings.php's autostart_save uses
+ *         — the frontend already holds the full, current structure in
+ *         memory after any add/rename/reassign, so there's no need for
+ *         narrower per-folder mutation endpoints)
+ */
+
+declare(strict_types=1);
+
+require __DIR__ . '/../include/bootstrap.php';
+
+$action = $_GET['action'] ?? '';
+
+switch ($action) {
+    case 'list':
+        podman_json_response(['folders' => folders_read($podmanConfig)]);
+        break;
+
+    case 'save':
+        $body = podman_read_json_body();
+        podman_json_response(['folders' => folders_save($podmanConfig, is_array($body['folders'] ?? null) ? $body['folders'] : [])]);
+        break;
+
+    default:
+        podman_json_error("Unknown action '{$action}'", 400);
+}
+
+/** @return array<int,array<string,mixed>> */
+function folders_read(PodmanConfig $config): array
+{
+    if (!is_readable($config->foldersFile)) {
+        return [];
+    }
+    $decoded = json_decode((string) file_get_contents($config->foldersFile), true);
+    return is_array($decoded) ? $decoded : [];
+}
+
+/**
+ * Re-validates and normalizes before writing — a folder with no name (or
+ * whose name became empty through some client-side bug) is silently
+ * dropped rather than persisted as junk that would then need cleaning up
+ * by hand in the JSON file directly.
+ *
+ * @param array<int,mixed> $folders
+ * @return array<int,array<string,mixed>> the normalized list actually written
+ */
+function folders_save(PodmanConfig $config, array $folders): array
+{
+    $clean = [];
+    foreach ($folders as $f) {
+        if (!is_array($f)) {
+            continue;
+        }
+        $name = trim((string) ($f['name'] ?? ''));
+        if ($name === '') {
+            continue;
+        }
+        $containers = [];
+        foreach (($f['containers'] ?? []) as $n) {
+            $n = trim((string) $n);
+            if ($n !== '') {
+                $containers[] = $n;
+            }
+        }
+        $clean[] = [
+            'id' => (string) ($f['id'] ?? '') !== '' ? (string) $f['id'] : bin2hex(random_bytes(6)),
+            'name' => $name,
+            'icon' => trim((string) ($f['icon'] ?? '')),
+            'containers' => $containers,
+        ];
+    }
+
+    if (file_put_contents($config->foldersFile, json_encode($clean, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES), LOCK_EX) === false) {
+        podman_json_error("Could not write {$config->foldersFile}", 500);
+    }
+
+    return $clean;
+}
@@ -8,6 +8,8 @@
 *   list     GET  -> normalized image list
 *   pull     POST {"reference": "docker.io/library/postgres:16"}
 *   remove   POST {"id": "...", "force": false}
+ *   prune    POST {} -> removes every image not used by any container
+ *   tag      POST {"id": "...", "repo": "...", "tag": "latest"}
 */

 declare(strict_types=1);
@@ -40,6 +42,27 @@ switch ($action) {
        podman_json_response(['status' => 'removed']);
        break;

+    case 'prune':
+        $removed = $client->pruneImages();
+        $reclaimed = 0;
+        foreach ($removed as $r) {
+            $reclaimed += (int) ($r['Size'] ?? 0);
+        }
+        podman_json_response(['removedCount' => count($removed), 'reclaimedBytes' => $reclaimed]);
+        break;
+
+    case 'tag':
+        $body = podman_read_json_body();
+        $id = (string) ($body['id'] ?? '');
+        $repo = trim((string) ($body['repo'] ?? ''));
+        $tag = trim((string) ($body['tag'] ?? '')) ?: 'latest';
+        if ($id === '' || $repo === '') {
+            podman_json_error('Missing id or repo in request body', 400);
+        }
+        $client->tagImage($id, $repo, $tag);
+        podman_json_response(['status' => 'tagged']);
+        break;
+
    default:
        podman_json_error("Unknown action '{$action}'", 400);
 }
@@ -8,7 +8,9 @@
 *
 * Actions (?action=...):
 *   list                  GET  -> normalized network list with subnet/gateway/usage
- *   create   POST {"name": "...", "driver": "bridge", "subnet": "...", "gateway": "..."}
+ *   list_parent_interfaces GET -> host bridge/VLAN interfaces available as a macvlan parent
+ *   create                POST {"name": "...", "driver": "bridge"|"macvlan", "subnet": "...",
+ *                                "gateway": "...", "parentInterface": "br0"}
 *   remove                POST {"name": "...", "force": false}
 */

@@ -23,17 +25,40 @@ switch ($action) {
        podman_json_response(networks_list($client));
        break;

+    case 'list_parent_interfaces':
+        podman_json_response(macvlan_parent_interfaces());
+        break;
+
    case 'create':
        $body = podman_read_json_body();
        $name = (string) ($body['name'] ?? '');
        if ($name === '') {
            podman_json_error('Missing name in request body', 400);
        }
+        $driver = (string) ($body['driver'] ?? 'bridge');
+
+        $parentInterface = null;
+        if ($driver === 'macvlan') {
+            $parentInterface = (string) ($body['parentInterface'] ?? '');
+            // Only ever accept an interface this same host reported via
+            // macvlan_parent_interfaces() — the boundary preventing a
+            // tampered request from asking podman to attach to an
+            // arbitrary/unexpected interface name.
+            $known = array_column(macvlan_parent_interfaces(), 'interface');
+            if (!in_array($parentInterface, $known, true)) {
+                podman_json_error('Unknown parent interface — refresh the page and try again.', 400);
+            }
+            if (!isset($body['subnet']) || (string) $body['subnet'] === '') {
+                podman_json_error('Subnet is required for a macvlan network.', 400);
+            }
+        }
+
        podman_json_response($client->createNetwork(
            $name,
-            (string) ($body['driver'] ?? 'bridge'),
+            $driver,
            isset($body['subnet']) ? (string) $body['subnet'] : null,
-            isset($body['gateway']) ? (string) $body['gateway'] : null
+            isset($body['gateway']) ? (string) $body['gateway'] : null,
+            $parentInterface
        ));
        break;

@@ -54,6 +79,61 @@ switch ($action) {
        podman_json_error("Unknown action '{$action}'", 400);
 }

+/**
+ * Reads Unraid's own /boot/config/network.cfg (BRNAME[i]/VLANID[i,j]/
+ * DESCRIPTION[i,j]) to list the same host bridge + VLAN interfaces
+ * Unraid's own Docker Manager offers as "Custom: br0" / "Custom: br0.3
+ * (VPN)" network types — reusing Unraid's own config instead of guessing
+ * from raw `ip link` output, so the list always matches what Docker
+ * Manager shows for the same host. Verified live: this host's
+ * network.cfg has BRNAME[0]="br0" and VLANID[0,1]="3"/DESCRIPTION[0,1]=
+ * "VPN", producing "br0" and "br0.3 (VPN)" — matching the interface
+ * names shown in that other plugin's own network-type dropdown exactly.
+ * Each candidate is confirmed to actually exist in /sys/class/net before
+ * being offered, in case network.cfg mentions an interface that isn't
+ * currently up.
+ *
+ * @return array<int,array{interface:string,label:string}>
+ */
+function macvlan_parent_interfaces(): array
+{
+    $cfgFile = '/boot/config/network.cfg';
+    if (!is_file($cfgFile)) {
+        return [];
+    }
+
+    $cfg = [];
+    foreach (file($cfgFile, FILE_IGNORE_NEW_LINES) ?: [] as $line) {
+        if (preg_match('/^([A-Z0-9_]+)\[(\d+)(?:,(\d+))?\]="([^"]*)"$/', $line, $m) !== 1) {
+            continue;
+        }
+        [, $key, $i, $j, $value] = $m + [3 => ''];
+        $i = (int) $i;
+        if ($j === '') {
+            $cfg[$key][$i] = $value;
+        } else {
+            $cfg[$key][$i][(int) $j] = $value;
+        }
+    }
+
+    $out = [];
+    foreach (($cfg['BRNAME'] ?? []) as $i => $brname) {
+        if (!is_string($brname) || $brname === '' || !is_dir("/sys/class/net/{$brname}")) {
+            continue;
+        }
+        $out[] = ['interface' => $brname, 'label' => $brname];
+        foreach (($cfg['VLANID'][$i] ?? []) as $j => $vlanId) {
+            $iface = "{$brname}.{$vlanId}";
+            if (!is_dir("/sys/class/net/{$iface}")) {
+                continue;
+            }
+            $desc = $cfg['DESCRIPTION'][$i][$j] ?? '';
+            $out[] = ['interface' => $iface, 'label' => $iface . ($desc !== '' ? " ({$desc})" : '')];
+        }
+    }
+    return $out;
+}
+
 /** @return array<int,array<string,mixed>> */
 function networks_list(PodmanClient $client): array
 {
@@ -9,8 +9,10 @@
 *
 * Actions (?action=...):
 *   list     GET  -> pods with nested container summaries
+ *   create   POST {"name": "...", "ports": [{"hostPort": 8080, "containerPort": 80, "protocol": "tcp"}]}
 *   start    POST {"name": "..."}
 *   stop     POST {"name": "...", "timeout": 10}
+ *   restart  POST {"name": "...", "timeout": 10}
 *   remove   POST {"name": "...", "force": false}
 */

@@ -25,6 +27,12 @@ switch ($action) {
        podman_json_response(pods_list($client));
        break;

+    case 'create':
+        $body = podman_read_json_body();
+        $id = $client->createPod(build_pod_spec($body));
+        podman_json_response(['id' => $id, 'status' => 'created']);
+        break;
+
    case 'start':
        $body = podman_read_json_body();
        $client->startPod(require_name($body));
@@ -37,6 +45,12 @@ switch ($action) {
        podman_json_response(['status' => 'stopped']);
        break;

+    case 'restart':
+        $body = podman_read_json_body();
+        $client->restartPod(require_name($body), (int) ($body['timeout'] ?? $podmanConfig->stopTimeoutSeconds));
+        podman_json_response(['status' => 'restarted']);
+        break;
+
    case 'remove':
        $body = podman_read_json_body();
        $client->removePod(require_name($body), (bool) ($body['force'] ?? false));
@@ -47,6 +61,55 @@ switch ($action) {
        podman_json_error("Unknown action '{$action}'", 400);
 }

+/**
+ * Builds a libpod pod-create body from the "New Pod" form fields. Verified
+ * live against a real podman system service — {"name": "...",
+ * "portmappings": [...]} creates a pod with a shared infra container whose
+ * port bindings apply to every member container.
+ *
+ * @param array<string,mixed> $body
+ * @return array<string,mixed>
+ */
+function build_pod_spec(array $body): array
+{
+    $name = trim((string) ($body['name'] ?? ''));
+    if ($name === '') {
+        podman_json_error('Missing name in request body', 400);
+    }
+    // Same character set podman enforces for container names (define.NameRegex
+    // in libpod applies to pods too) — validated here for the same reason
+    // ajax/containers.php validates it: a clear message instead of podman's
+    // raw "names must match ...: invalid argument".
+    if (preg_match('/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/', $name) !== 1) {
+        podman_json_error(
+            "Pod name (\"{$name}\") can only contain letters, digits, \".\", \"_\", \"-\" — no spaces. Try \"" .
+            preg_replace('/[^a-zA-Z0-9_.-]+/', '-', $name) . '" instead.',
+            400
+        );
+    }
+
+    $spec = ['name' => $name];
+
+    $ports = [];
+    foreach (($body['ports'] ?? []) as $row) {
+        $hostPort = (int) ($row['hostPort'] ?? 0);
+        $containerPort = (int) ($row['containerPort'] ?? 0);
+        if ($hostPort > 0 && $containerPort > 0) {
+            $ports[] = [
+                'host_ip' => '',
+                'host_port' => $hostPort,
+                'container_port' => $containerPort,
+                'protocol' => (string) ($row['protocol'] ?? 'tcp'),
+            ];
+        }
+    }
+    if ($ports !== []) {
+        $spec['portmappings'] = $ports;
+    }
+
+    return $spec;
+}
+
 /** @param array<string,mixed> $body */
 function require_name(array $body): string
 {
@@ -16,12 +16,18 @@
 *   save            POST {"storagePath": "...", "storageImageSizeGb": 20,
 *                          "enabled": true, "stopTimeoutSeconds": 10}
 *   autostart_save  POST {"names": ["postgres", "nextcloud", ...]}
+ *   service_status  GET  -> {"running": bool, "output": "..."}
+ *   service_start   POST -> {"running": bool, "output": "..."}
+ *   service_stop    POST -> {"running": bool, "output": "..."}
+ *   service_restart POST -> {"running": bool, "output": "..."}
 */

 declare(strict_types=1);

 require __DIR__ . '/../include/bootstrap.php';

+const RC_PODMAN = '/etc/rc.d/rc.podman';
+
 $action = $_GET['action'] ?? '';

 switch ($action) {
@@ -45,10 +51,77 @@ switch ($action) {
        podman_json_response(['status' => 'saved']);
        break;

+    case 'service_status':
+        podman_json_response(rc_podman('status', 15));
+        break;
+
+    case 'service_start':
+        podman_json_response(rc_podman('start', 120));
+        break;
+
+    case 'service_stop':
+        podman_json_response(rc_podman('stop', 120));
+        break;
+
+    case 'service_restart':
+        podman_json_response(rc_podman('restart', 120));
+        break;
+
    default:
        podman_json_error("Unknown action '{$action}'", 400);
 }

+/**
+ * Shells out to /etc/rc.d/rc.podman <verb> — the plugin's own real
+ * start/stop/status script, the SAME one the array-start event hook and
+ * a terminal `rc.podman status` use (see plugin/rc.d/rc.podman's header
+ * comment). This exists specifically so a fresh install where podman
+ * failed to start (e.g. no cache pool configured yet, see
+ * podman-storage.sh's "does not exist or is not mounted" error) can be
+ * diagnosed and retried from the WebUI itself — no SSH/terminal access
+ * needed, which is exactly what was missing when this was first needed
+ * live (a fresh install on a different Unraid box with nobody able to
+ * reach a terminal to run `rc.podman start` by hand).
+ *
+ * @return array{running: bool, output: string}
+ */
+function rc_podman(string $verb, int $timeoutSeconds): array
+{
+    $output = run_rc_podman($verb, $timeoutSeconds);
+
+    // Only `rc.podman status` prints the "service:             running
+    // (pid ..., socket ...)" line this regex looks for — start/stop/
+    // restart's OWN messages are worded differently ("start: already
+    // running (pid ...)", "stop: stopped", ...), so relying on THIS same
+    // regex against THEIR output silently reported "not running" right
+    // after a successful start (found live: a start that printed "start:
+    // already running" turned the status chip red). Always running a
+    // fresh `status` afterward — regardless of which verb was actually
+    // requested — is the one output format this check can trust.
+    $statusOutput = $verb === 'status' ? $output : run_rc_podman('status', 15);
+    $running = (bool) preg_match('/service:\s+running/', $statusOutput);
+
+    return ['running' => $running, 'output' => $output];
+}
+
+function run_rc_podman(string $verb, int $timeoutSeconds): string
+{
+    $descriptors = [1 => ['pipe', 'w'], 2 => ['pipe', 'w']];
+    $process = proc_open([RC_PODMAN, $verb], $descriptors, $pipes);
+    if (!is_resource($process)) {
+        podman_json_error("Could not run rc.podman {$verb}", 500);
+    }
+
+    stream_set_timeout($pipes[1], $timeoutSeconds);
+    $stdout = stream_get_contents($pipes[1]) ?: '';
+    $stderr = stream_get_contents($pipes[2]) ?: '';
+    fclose($pipes[1]);
+    fclose($pipes[2]);
+    proc_close($process);
+
+    return trim($stdout . $stderr);
+}
+
 /** @return array<string,mixed> */
 function settings_get(PodmanConfig $config): array
 {
@@ -58,7 +131,7 @@ function settings_get(PodmanConfig $config): array
        'enabled' => $config->enabled,
        'stopTimeoutSeconds' => $config->stopTimeoutSeconds,
        'autostart' => autostart_read($config),
-        'packageVersions' => installed_package_versions(),
+        'packageVersions' => podman_read_installed_versions(),
    ];
 }

@@ -129,31 +202,3 @@ function autostart_save(PodmanConfig $config, array $names): void
    }
 }

-/**
- * Reads /usr/local/share/unraid-podman/installed-versions.env — the same
- * manifest plugin/sbin/podman-verify-packages.sh and
- * podman-update-packages.sh use (see plugin/podman.plg's postinstall step,
- * which generates it) — so Settings shows exactly what those tools would
- * report, not a second, possibly-diverging source of truth.
- *
- * @return array<string,string>
- */
-function installed_package_versions(): array
-{
-    $path = '/usr/local/share/unraid-podman/installed-versions.env';
-    if (!is_readable($path)) {
-        return [];
-    }
-    $lines = file($path, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) ?: [];
-    $out = [];
-    foreach ($lines as $line) {
-        $line = trim($line);
-        if ($line === '' || str_starts_with($line, '#')) {
-            continue;
-        }
-        if (preg_match('/^([A-Z_][A-Z0-9_]*)="?([^"]*)"?$/', $line, $m)) {
-            $out[$m[1]] = $m[2];
-        }
-    }
-    return $out;
-}
@@ -9,6 +9,10 @@
 *
 * Actions (?action=...):
 *   summary          GET -> counts, storage usage, engine version, ping status
+ *   autostart_queue  GET -> the autostart list in start order, each entry's
+ *                     configured delay, and its last-known outcome (reusing
+ *                     plugin/sbin/podman-autostart.sh's own failure-counter
+ *                     files rather than tracking a second copy of that state)
 */

 declare(strict_types=1);
@@ -22,6 +26,10 @@ switch ($action) {
        podman_json_response(system_summary($client, $podmanConfig));
        break;

+    case 'autostart_queue':
+        podman_json_response(system_autostart_queue($client, $podmanConfig));
+        break;
+
    default:
        podman_json_error("Unknown action '{$action}'", 400);
 }
@@ -56,6 +64,23 @@ function system_summary(PodmanClient $client, PodmanConfig $config): array
        $imagesSize += (int) ($img['Size'] ?? 0);
    }

+    $host = $info['host'] ?? [];
+    $store = $info['store'] ?? [];
+    $meminfo = podman_read_meminfo();
+    // libpod's host.memFree/swapFree are the kernel's raw "free" counters —
+    // they exclude reclaimable buffers/cache, so on a host that's been up a
+    // while they make used memory look dramatically higher than reality
+    // (found live: 67% "used" here vs. the 19% `free -h` actually reports).
+    // /proc/meminfo's MemAvailable is the same estimate `free -h`'s
+    // "available" column and most monitoring tools use, so read it
+    // directly instead of trusting libpod's numbers for this.
+    $memTotal = $meminfo['MemTotal'] ?? (int) ($host['memTotal'] ?? 0);
+    $memAvailable = $meminfo['MemAvailable'] ?? (int) ($host['memFree'] ?? 0);
+    $swapTotal = $meminfo['SwapTotal'] ?? (int) ($host['swapTotal'] ?? 0);
+    $swapFree = $meminfo['SwapFree'] ?? (int) ($host['swapFree'] ?? 0);
+    $graphAllocated = (int) ($store['graphRootAllocated'] ?? 0);
+    $graphUsed = (int) ($store['graphRootUsed'] ?? 0);
+
    return [
        'reachable' => true,
        'socketPath' => $config->socketPath,
@@ -66,6 +91,7 @@ function system_summary(PodmanClient $client, PodmanConfig $config): array
        'containers' => [
            'total' => count($containers),
            'running' => $running,
+            'stopped' => count($containers) - $running,
        ],
        'pods' => count($pods),
        'images' => count($images),
@@ -74,6 +100,170 @@ function system_summary(PodmanClient $client, PodmanConfig $config): array
        'storage' => [
            'imagesSizeBytes' => $imagesSize,
            'imagesSizeFormatted' => podman_format_bytes($imagesSize),
+            'graphUsedBytes' => $graphUsed,
+            'graphAllocatedBytes' => $graphAllocated,
+            'graphUsedFormatted' => podman_format_bytes($graphUsed),
+            'graphAllocatedFormatted' => podman_format_bytes($graphAllocated),
+            'graphUsedPercent' => $graphAllocated > 0 ? round($graphUsed / $graphAllocated * 100, 1) : null,
+        ],
+        'host' => [
+            'cpuCount' => (int) ($host['cpus'] ?? 0),
+            'cpuPercent' => podman_read_cpu_percent() ?? (isset($host['cpuUtilization']['idlePercent'])
+                ? round(100 - (float) $host['cpuUtilization']['idlePercent'], 1)
+                : null),
+            'memUsedBytes' => max(0, $memTotal - $memAvailable),
+            'memTotalBytes' => $memTotal,
+            'memUsedFormatted' => podman_format_bytes(max(0, $memTotal - $memAvailable)),
+            'memTotalFormatted' => podman_format_bytes($memTotal),
+            'memPercent' => $memTotal > 0 ? round(($memTotal - $memAvailable) / $memTotal * 100, 1) : null,
+            'swapUsedBytes' => max(0, $swapTotal - $swapFree),
+            'swapTotalBytes' => $swapTotal,
+            'uptime' => (string) ($host['uptime'] ?? ''),
        ],
    ];
 }
+
+/**
+ * The Dashboard's "Autostart Queue" table: same list/order Settings already
+ * reads via autostart_read() in settings.php, enriched with each entry's
+ * configured post-start delay and its last-known outcome — derived from
+ * plugin/sbin/podman-autostart.sh's own per-container failure-counter
+ * files (under autostart-failures/<name>) plus the container's actual
+ * current state, rather than a second, separately-tracked history.
+ *
+ * @return array<string,mixed>
+ */
+function system_autostart_queue(PodmanClient $client, PodmanConfig $config): array
+{
+    if (!is_readable($config->autostartFile)) {
+        return ['entries' => []];
+    }
+
+    $names = [];
+    foreach (file($config->autostartFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) ?: [] as $line) {
+        $line = trim(preg_replace('/#.*$/', '', $line) ?? '');
+        if ($line !== '') {
+            $names[] = $line;
+        }
+    }
+    if (!$names) {
+        return ['entries' => []];
+    }
+
+    $delays = [];
+    if (is_readable($config->autostartDelayFile)) {
+        foreach (file($config->autostartDelayFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) ?: [] as $line) {
+            if (preg_match('/^([^=]+)=(\d+)$/', trim($line), $m)) {
+                $delays[$m[1]] = (int) $m[2];
+            }
+        }
+    }
+
+    // Mirrors podman-autostart.sh's own MAX_CONSECUTIVE_FAILURES — that
+    // script is what actually decides when a container is Safe-Mode-paused;
+    // this only needs to agree on the same threshold to describe it
+    // accurately, not to make the decision itself.
+    $maxFailures = 3;
+    $failuresDir = $config->bootDir . '/autostart-failures';
+
+    $stateByName = [];
+    foreach ($client->listContainers(true) as $c) {
+        foreach (($c['Names'] ?? []) as $n) {
+            $stateByName[ltrim((string) $n, '/')] = strtolower((string) ($c['State'] ?? ''));
+        }
+    }
+
+    $entries = [];
+    foreach ($names as $i => $name) {
+        $failCount = 0;
+        $failFile = $failuresDir . '/' . $name;
+        if (is_readable($failFile)) {
+            $failCount = (int) trim((string) file_get_contents($failFile));
+        }
+
+        if ($failCount >= $maxFailures) {
+            $status = 'safe-mode';
+            $label = "Safe-Mode ({$failCount} failures)";
+        } elseif ($failCount > 0) {
+            $status = 'failed';
+            $label = "Failed ({$failCount}/{$maxFailures})";
+        } elseif (($stateByName[$name] ?? '') === 'running') {
+            $status = 'started';
+            $label = 'Started';
+        } elseif (array_key_exists($name, $stateByName)) {
+            $status = 'stopped';
+            $label = 'Not running';
+        } else {
+            $status = 'unknown';
+            $label = 'Container not found';
+        }
+
+        $entries[] = [
+            'position' => $i + 1,
+            'name' => $name,
+            'delaySeconds' => $delays[$name] ?? 0,
+            'status' => $status,
+            'statusLabel' => $label,
+        ];
+    }
+
+    return ['entries' => $entries];
+}
+
+/**
+ * Reads the fields we need out of /proc/meminfo directly, in bytes.
+ * ajax/*.php runs as PHP-FPM on the Unraid host itself (not inside a
+ * container), so this is just a local file read — no shelling out needed.
+ *
+ * @return array<string,int>
+ */
+function podman_read_meminfo(): array
+{
+    $lines = @file('/proc/meminfo', FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) ?: [];
+    $out = [];
+    foreach ($lines as $line) {
+        if (preg_match('/^(MemTotal|MemAvailable|SwapTotal|SwapFree):\s*(\d+)\s*kB$/', $line, $m)) {
+            $out[$m[1]] = ((int) $m[2]) * 1024;
+        }
+    }
+    return $out;
+}
+
+/**
+ * Live CPU usage via the classic /proc/stat delta technique: libpod's own
+ * /info.host.cpuUtilization turned out to be a value computed once and
+ * never resampled (verified live — three /info calls several seconds
+ * apart returned byte-identical numbers), which is why the Dashboard's
+ * CPU tile never moved. A single instantaneous read of /proc/stat can't
+ * give a percentage on its own either (its counters are cumulative
+ * jiffies since boot) — it needs two samples to diff. Since the Dashboard
+ * already re-fetches this endpoint every ~2s via auto-refresh, the
+ * previous sample is persisted to a small state file and diffed against
+ * the current one on each call, exactly like `top`/`htop` do between
+ * their own refresh ticks. Returns null (falls back to libpod's static
+ * figure) only on the very first call, before any previous sample exists.
+ */
+function podman_read_cpu_percent(): ?float
+{
+    $stat = @file_get_contents('/proc/stat');
+    if ($stat === false || !preg_match('/^cpu\s+(\d+) (\d+) (\d+) (\d+) (\d+) (\d+) (\d+) (\d+)/m', $stat, $m)) {
+        return null;
+    }
+    [, $user, $nice, $system, $idle, $iowait, $irq, $softirq, $steal] = array_map('intval', $m);
+    $total = $user + $nice + $system + $idle + $iowait + $irq + $softirq + $steal;
+    $idleAll = $idle + $iowait;
+
+    $stateFile = '/var/tmp/podman-cpu-sample';
+    $prevRaw = @file_get_contents($stateFile);
+    @file_put_contents($stateFile, $total . ' ' . $idleAll, LOCK_EX);
+
+    if ($prevRaw === false || !preg_match('/^(\d+) (\d+)$/', trim($prevRaw), $pm)) {
+        return null;
+    }
+    $deltaTotal = $total - (int) $pm[1];
+    $deltaIdle = $idleAll - (int) $pm[2];
+    if ($deltaTotal <= 0) {
+        return null;
+    }
+    return round((1 - $deltaIdle / $deltaTotal) * 100, 1);
+}
@@ -21,6 +21,7 @@ final class PodmanConfig
    public string $bootDir;
    public string $autostartFile;
    public string $autostartDelayFile;
+    public string $foldersFile;

    private function __construct()
    {
@@ -33,6 +34,7 @@ final class PodmanConfig
        $this->socketPath = '/var/run/podman/podman.sock';
        $this->autostartFile = $this->bootDir . '/autostart';
        $this->autostartDelayFile = $this->bootDir . '/autostart-delay';
+        $this->foldersFile = $this->bootDir . '/folders.json';
    }

    public static function load(): self
@@ -114,7 +114,15 @@ final class PodmanClient
     */
    public function createContainer(array $spec): string
    {
-        $result = $this->request('POST', '/containers/create', [], false, $spec);
+        // Longer than this client's normal 15s operation timeout as cheap
+        // insurance: creating a container involves setting up its mounts
+        // (often onto Unraid array/spinning-disk shares, not the cache
+        // pool) and network namespace, which can occasionally run past 15s
+        // even with the image already pulled — found live via a real
+        // "Operation timed out after 15001 milliseconds" error creating a
+        // container. Same 600s ceiling as pullImage(), safely under
+        // nginx's 640s fastcgi_read_timeout.
+        $result = $this->request('POST', '/containers/create', [], false, $spec, 600);
        return (string) ($result['Id'] ?? '');
    }

@@ -177,6 +185,41 @@ final class PodmanClient
        return self::demuxStream($raw);
    }

+    /**
+     * GET /events?stream=false&since=...&filters={"container":["<id>"]} —
+     * a bounded, already-happened event history for one container, NOT a
+     * live stream (stream=false makes libpod return what already matched
+     * and close the connection immediately, verified live). This is
+     * enough for a container's "Events" detail tab without needing the
+     * persistent-connection event-streaming infrastructure a live,
+     * fleet-wide event feed would require (see dashboard.js's own header
+     * comment on why that's out of scope for now).
+     *
+     * @return array<int,array<string,mixed>>
+     */
+    public function containerEvents(string $id, int $sinceUnixSeconds): array
+    {
+        $query = [
+            'stream' => 'false',
+            'since' => (string) $sinceUnixSeconds,
+            'filters' => json_encode(['container' => [$id]]),
+        ];
+        $raw = $this->requestRaw('GET', '/events', $query);
+        // Newline-delimited JSON, not a single JSON array — each line is
+        // its own event object.
+        $events = [];
+        foreach (explode("\n", trim($raw)) as $line) {
+            if ($line === '') {
+                continue;
+            }
+            $decoded = json_decode($line, true);
+            if (is_array($decoded)) {
+                $events[] = $decoded;
+            }
+        }
+        return $events;
+    }
+
    // -------------------------------------------------------------------
    // Exec — see webui/plugins/podman/ajax/exec.php for the important
    // caveat: this implements one-shot "run a command, return its output"
@@ -185,41 +228,6 @@ final class PodmanClient
    // have — see that file's header comment for the full explanation).
    // -------------------------------------------------------------------

-    /**
-     * Creates and immediately runs one command inside a container via the
-     * real libpod exec API (POST /containers/{id}/exec, then
-     * POST /exec/{id}/start) and returns its combined stdout+stderr output.
-     * Tty=true is used deliberately so the response is a plain byte stream
-     * with no frame-header demultiplexing needed (see containerLogs() for
-     * the non-TTY case, which does need it).
-     */
-    public function execRun(string $containerId, array $cmd, string $workingDir = ''): string
-    {
-        $createBody = [
-            'AttachStdin' => false,
-            'AttachStdout' => true,
-            'AttachStderr' => true,
-            'Tty' => true,
-            'Cmd' => $cmd,
-        ];
-        if ($workingDir !== '') {
-            $createBody['WorkingDir'] = $workingDir;
-        }
-
-        $created = $this->request('POST', '/containers/' . rawurlencode($containerId) . '/exec', [], false, $createBody);
-        $execId = $created['Id'] ?? null;
-        if (!is_string($execId) || $execId === '') {
-            throw new PodmanApiException('exec create response did not include an Id');
-        }
-
-        $output = $this->requestRaw('POST', '/exec/' . rawurlencode($execId) . '/start', [], [
-            'Detach' => false,
-            'Tty' => true,
-        ]);
-
-        return $output;
-    }
-
    // -------------------------------------------------------------------
    // Pods
    // -------------------------------------------------------------------
@@ -234,6 +242,22 @@ final class PodmanClient
        return $this->request('GET', '/pods/' . rawurlencode($name) . '/json');
    }

+    /**
+     * POST /pods/create — takes a body of {name, portmappings, ...}.
+     * Verified live against a real podman system service: {"name":"...",
+     * "portmappings":[{"host_port":...,"container_port":...,"protocol":...}]}
+     * creates a pod with a shared infra container whose port bindings apply
+     * to every member container — see ajax/pods.php's build_pod_spec().
+     *
+     * @param array<string,mixed> $spec
+     * @return string the new pod's ID
+     */
+    public function createPod(array $spec): string
+    {
+        $result = $this->request('POST', '/pods/create', [], false, $spec);
+        return (string) ($result['Id'] ?? '');
+    }
+
    public function startPod(string $name): void
    {
        $this->request('POST', '/pods/' . rawurlencode($name) . '/start', [], true);
@@ -244,6 +268,11 @@ final class PodmanClient
        $this->request('POST', '/pods/' . rawurlencode($name) . '/stop', ['t' => (string) $timeoutSeconds], true);
    }

+    public function restartPod(string $name, int $timeoutSeconds = 10): void
+    {
+        $this->request('POST', '/pods/' . rawurlencode($name) . '/restart', ['t' => (string) $timeoutSeconds], true);
+    }
+
    public function removePod(string $name, bool $force = false): void
    {
        $this->request('DELETE', '/pods/' . rawurlencode($name), ['force' => $force ? 'true' : 'false'], true);
@@ -279,7 +308,14 @@ final class PodmanClient
     */
    public function pullImage(string $reference): array
    {
-        $raw = $this->requestRaw('POST', '/images/pull', ['reference' => $reference]);
+        // A real image (e.g. a Plex/media-server image, easily several
+        // hundred MB) routinely takes far longer than this client's normal
+        // 15s operation timeout to download — found live: a pull aborted
+        // mid-stream with "Operation timed out after 15001 milliseconds"
+        // after only ~1.4KB of progress data. nginx's own fastcgi_read_timeout
+        // (640s, see /etc/nginx/nginx.conf) already anticipates long-running
+        // plugin requests, so 600s here stays safely under that.
+        $raw = $this->requestRaw('POST', '/images/pull', ['reference' => $reference], null, 600);

        $last = null;
        foreach (explode("\n", trim($raw)) as $line) {
@@ -313,6 +349,28 @@ final class PodmanClient
        $this->request('DELETE', '/images/' . rawurlencode($id), ['force' => $force ? 'true' : 'false'], true);
    }

+    /**
+     * POST /images/prune?all=true — removes every image with zero containers
+     * (running or stopped) referencing it, matching this app's own "Used By"
+     * column — not just dangling/untagged images. Verified live: a tagged
+     * but unused image IS removed with all=true (found the hard way: it
+     * also removed every image on a host with no containers at all, which
+     * is correct behavior, just aggressive — see ajax/images.php's prune
+     * action for the confirmation-copy this justifies).
+     *
+     * @return array<int,array{Id:string,Size:int}> one entry per removed image
+     */
+    public function pruneImages(): array
+    {
+        return $this->request('POST', '/images/prune', ['all' => 'true']);
+    }
+
+    /** POST /images/{id}/tag?repo=...&tag=... — adds a new repo:tag pointing at an existing image. */
+    public function tagImage(string $id, string $repo, string $tag): void
+    {
+        $this->request('POST', '/images/' . rawurlencode($id) . '/tag', ['repo' => $repo, 'tag' => $tag], true);
+    }
+
    // -------------------------------------------------------------------
    // Volumes
    // -------------------------------------------------------------------
@@ -353,12 +411,25 @@ final class PodmanClient
        return $this->request('GET', '/networks/json');
    }

-    public function createNetwork(string $name, string $driver, ?string $subnet = null, ?string $gateway = null): array
+    /**
+     * $parentInterface (only meaningful for driver="macvlan") attaches the
+     * network directly to an existing host bridge/VLAN interface (e.g.
+     * Unraid's own "br0" or a VLAN sub-interface like "br0.3") via
+     * libpod's "network_interface" field — verified live: containers on
+     * such a network get a real address on that LAN/VLAN's own subnet,
+     * not a NATed one, matching Unraid Docker Manager's "Custom: br0"
+     * network type. See ajax/networks.php's macvlan_parent_interfaces()
+     * for where the interface list itself comes from.
+     */
+    public function createNetwork(string $name, string $driver, ?string $subnet = null, ?string $gateway = null, ?string $parentInterface = null): array
    {
        $body = ['name' => $name, 'driver' => $driver];
        if ($subnet !== null) {
            $body['subnets'] = [array_filter(['subnet' => $subnet, 'gateway' => $gateway])];
        }
+        if ($parentInterface !== null && $parentInterface !== '') {
+            $body['network_interface'] = $parentInterface;
+        }
        return $this->request('POST', '/networks/create', [], false, $body);
    }

@@ -379,9 +450,9 @@ final class PodmanClient
     * @param array<mixed>|null $jsonBody request body to send as JSON, for POST/PUT endpoints that take one
     * @return array<mixed>
     */
-    private function request(string $method, string $path, array $query = [], bool $expectEmptyBody = false, ?array $jsonBody = null): array
+    private function request(string $method, string $path, array $query = [], bool $expectEmptyBody = false, ?array $jsonBody = null, ?int $timeoutSeconds = null): array
    {
-        $raw = $this->requestRaw($method, $path, $query, $jsonBody);
+        $raw = $this->requestRaw($method, $path, $query, $jsonBody, $timeoutSeconds);
        if ($expectEmptyBody || trim($raw) === '') {
            return [];
        }
@@ -400,7 +471,7 @@ final class PodmanClient
     * @param array<string,string> $query
     * @param array<mixed>|null $jsonBody
     */
-    private function requestRaw(string $method, string $path, array $query = [], ?array $jsonBody = null): string
+    private function requestRaw(string $method, string $path, array $query = [], ?array $jsonBody = null, ?int $timeoutSeconds = null): string
    {
        $url = 'http://d/' . self::API_VERSION . '/libpod' . $path;
        if (!empty($query)) {
@@ -413,7 +484,7 @@ final class PodmanClient
            CURLOPT_URL => $url,
            CURLOPT_CUSTOMREQUEST => $method,
            CURLOPT_RETURNTRANSFER => true,
-            CURLOPT_TIMEOUT => $this->timeoutSeconds,
+            CURLOPT_TIMEOUT => $timeoutSeconds ?? $this->timeoutSeconds,
            CURLOPT_HTTPHEADER => ['Accept: application/json'],
        ]);

@@ -0,0 +1,172 @@
+<?php
+/**
+ * RegistryClient.php
+ *
+ * "Is a newer image available?" — deliberately NOT a podman/libpod feature
+ * (verified live: no libpod endpoint exists for this; every tool that
+ * offers it, Watchtower/Diun/Unraid's own Docker Manager included,
+ * re-implements the same registry-side check). This talks directly to the
+ * target image's own registry using the standard Docker Registry HTTP API
+ * V2: a GET on the manifest returns a "Docker-Content-Digest" header
+ * without downloading any image layers, which is compared against the
+ * digest of the image already pulled locally (PodmanClient::listImages()'s
+ * own "Digest" field) — no local image ever needs pulling just to check.
+ *
+ * The auth flow is the generic Bearer-challenge dance every compliant
+ * registry follows (RFC-ish, not just a Docker Hub thing): an
+ * unauthenticated request gets a 401 with a WWW-Authenticate header naming
+ * a token realm/service/scope, a token is fetched from that realm, and the
+ * manifest request is retried with it. Verified live against three
+ * different registries with three different auth setups — Docker Hub,
+ * ghcr.io, and a self-hosted Gitea registry — using this exact same code
+ * path for all three, not registry-specific special-casing.
+ */
+
+declare(strict_types=1);
+
+final class RegistryClient
+{
+    /**
+     * @return array{updateAvailable?:bool,remoteDigest?:string,error?:string}
+     */
+    public static function checkForUpdate(string $reference, string $localDigest): array
+    {
+        [$registry, $repo, $tag] = self::parseReference($reference);
+        $manifestUrl = "https://{$registry}/v2/{$repo}/manifests/{$tag}";
+        $accept = 'application/vnd.docker.distribution.manifest.v2+json, ' .
+            'application/vnd.docker.distribution.manifest.list.v2+json, ' .
+            'application/vnd.oci.image.manifest.v1+json, ' .
+            'application/vnd.oci.image.index.v1+json';
+
+        [$status, $headers] = self::httpRequest($manifestUrl, $accept, null);
+
+        if ($status === 401) {
+            $challenge = self::parseAuthChallenge($headers['www-authenticate'] ?? '');
+            if ($challenge === null) {
+                return ['error' => 'Registry requires authentication this app cannot satisfy.'];
+            }
+            $token = self::fetchToken($challenge);
+            if ($token === null) {
+                return ['error' => 'Could not authenticate with the registry.'];
+            }
+            [$status, $headers] = self::httpRequest($manifestUrl, $accept, $token);
+        }
+
+        if ($status !== 200) {
+            return ['error' => "Registry returned HTTP {$status}."];
+        }
+
+        $remoteDigest = $headers['docker-content-digest'] ?? null;
+        if ($remoteDigest === null) {
+            return ['error' => 'Registry response did not include a digest.'];
+        }
+
+        return ['remoteDigest' => $remoteDigest, 'updateAvailable' => $remoteDigest !== $localDigest];
+    }
+
+    /**
+     * Splits "docker.io/library/nginx:alpine" (or shorthand forms like
+     * "nginx:alpine" or "someuser/repo:tag") into [registryHost, repoPath,
+     * tag] — same reference-parsing convention every registry client
+     * (including podman/Docker themselves) uses: the first path segment is
+     * a registry host only if it contains a "." or ":" or is "localhost";
+     * otherwise the whole reference is a Docker Hub repo, implicitly under
+     * "library/" if it has no namespace of its own. docker.io's actual API
+     * host is registry-1.docker.io, not docker.io itself — a Docker-Hub-
+     * specific quirk, not something inferred from the general rule above.
+     *
+     * @return array{0:string,1:string,2:string}
+     */
+    private static function parseReference(string $reference): array
+    {
+        $reference = explode('@', $reference, 2)[0]; // strip any @sha256:... suffix
+        $tag = 'latest';
+        $lastSlash = strrpos($reference, '/');
+        $lastColon = strrpos($reference, ':');
+        if ($lastColon !== false && ($lastSlash === false || $lastColon > $lastSlash)) {
+            $tag = substr($reference, $lastColon + 1);
+            $reference = substr($reference, 0, $lastColon);
+        }
+
+        $parts = explode('/', $reference);
+        $first = $parts[0];
+        $looksLikeHost = str_contains($first, '.') || str_contains($first, ':') || $first === 'localhost';
+
+        if ($looksLikeHost) {
+            $registry = $first;
+            $repo = implode('/', array_slice($parts, 1));
+        } else {
+            $registry = 'docker.io';
+            $repo = str_contains($reference, '/') ? $reference : "library/{$reference}";
+        }
+
+        if ($registry === 'docker.io') {
+            $registry = 'registry-1.docker.io';
+        }
+
+        return [$registry, $repo, $tag];
+    }
+
+    /** @return array{realm:string,service:string,scope:string}|null */
+    private static function parseAuthChallenge(string $header): ?array
+    {
+        if (preg_match('/realm="([^"]+)"/', $header, $m) !== 1) {
+            return null;
+        }
+        $service = preg_match('/service="([^"]+)"/', $header, $sm) === 1 ? $sm[1] : '';
+        $scope = preg_match('/scope="([^"]+)"/', $header, $om) === 1 ? $om[1] : '';
+        return ['realm' => $m[1], 'service' => $service, 'scope' => $scope];
+    }
+
+    /** @param array{realm:string,service:string,scope:string} $challenge */
+    private static function fetchToken(array $challenge): ?string
+    {
+        $params = array_filter(['service' => $challenge['service'], 'scope' => $challenge['scope']]);
+        $url = $challenge['realm'] . '?' . http_build_query($params);
+        [$status, , $body] = self::httpRequest($url, 'application/json', null, true);
+        if ($status !== 200 || $body === null) {
+            return null;
+        }
+        $decoded = json_decode($body, true);
+        // The spec allows either key; registries are inconsistent about
+        // which one they actually send.
+        return is_array($decoded) ? (string) ($decoded['token'] ?? $decoded['access_token'] ?? '') ?: null : null;
+    }
+
+    /**
+     * @return array{0:int,1:array<string,string>,2:?string} [status, lowercased response headers, body (only when $withBody)]
+     */
+    private static function httpRequest(string $url, string $accept, ?string $token, bool $withBody = false): array
+    {
+        $ch = curl_init($url);
+        $headers = ['Accept: ' . $accept];
+        if ($token !== null) {
+            $headers[] = "Authorization: Bearer {$token}";
+        }
+        curl_setopt_array($ch, [
+            CURLOPT_HTTPHEADER => $headers,
+            CURLOPT_RETURNTRANSFER => true,
+            CURLOPT_HEADER => true,
+            CURLOPT_TIMEOUT => 15,
+            CURLOPT_FOLLOWLOCATION => true,
+        ]);
+        $raw = curl_exec($ch);
+        $status = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
+        $headerSize = (int) curl_getinfo($ch, CURLINFO_HEADER_SIZE);
+        curl_close($ch);
+
+        if ($raw === false) {
+            return [0, [], null];
+        }
+
+        $parsedHeaders = [];
+        foreach (explode("\r\n", substr($raw, 0, $headerSize)) as $line) {
+            if (str_contains($line, ':')) {
+                [$k, $v] = explode(':', $line, 2);
+                $parsedHeaders[strtolower(trim($k))] = trim($v);
+            }
+        }
+        $body = $withBody ? substr($raw, $headerSize) : null;
+        return [$status, $parsedHeaders, $body];
+    }
+}
@@ -20,6 +20,7 @@ declare(strict_types=1);
 require_once __DIR__ . '/PodmanClient.php';
 require_once __DIR__ . '/Config.php';
 require_once __DIR__ . '/helpers.php';
+require_once __DIR__ . '/RegistryClient.php';

 set_exception_handler(static function (\Throwable $e): void {
    if ($e instanceof PodmanApiException) {
@@ -11,6 +11,37 @@

 declare(strict_types=1);

+/**
+ * Reads /usr/local/share/unraid-podman/installed-versions.env — the same
+ * manifest plugin/sbin/podman-verify-packages.sh and
+ * podman-update-packages.sh use (see plugin/podman.plg's postinstall step,
+ * which generates it) — shared here so settings.php (package version
+ * chips) and system.php (Dashboard's plugin version chip) both report
+ * exactly what those tools would, not two possibly-diverging readers of
+ * the same file.
+ *
+ * @return array<string,string>
+ */
+function podman_read_installed_versions(): array
+{
+    $path = '/usr/local/share/unraid-podman/installed-versions.env';
+    if (!is_readable($path)) {
+        return [];
+    }
+    $lines = file($path, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) ?: [];
+    $out = [];
+    foreach ($lines as $line) {
+        $line = trim($line);
+        if ($line === '' || str_starts_with($line, '#')) {
+            continue;
+        }
+        if (preg_match('/^([A-Z_][A-Z0-9_]*)="?([^"]*)"?$/', $line, $m)) {
+            $out[$m[1]] = $m[2];
+        }
+    }
+    return $out;
+}
+
 function podman_format_bytes(int $bytes): string
 {
    if ($bytes <= 0) {
@@ -126,6 +126,60 @@ window.Podman = (function () {
    return '<tr><td colspan="' + colspan + '" class="podman-error">' + escapeHtml(message) + '</td></tr>';
  }

+  // --- Toast notifications ----------------------------------------------------
+  //
+  // Replaces alert() for one-way feedback ("Saved.", "Removed 3 image(s)",
+  // "Save failed: ..."). Confirmations stay native confirm() — a toast is
+  // for telling the user something happened, not for asking them a
+  // yes/no question. Command output that can run to hundreds of lines
+  // (e.g. `podman compose up`) stays in the existing openLogModal()
+  // pattern instead — a toast has to stay short and auto-dismiss, which
+  // doesn't fit a scrolling log.
+
+  const TOAST_ICON = { success: '✓', warn: '!', error: '✕', info: 'ℹ' };
+  const TOAST_DURATION_MS = { success: 4000, warn: 5000, error: 7000, info: 4000 };
+  let toastContainer = null;
+
+  function toastRoot() {
+    if (!toastContainer) {
+      toastContainer = document.createElement('div');
+      toastContainer.className = 'podman-toast-container';
+      (document.querySelector('.podman-plugin') || document.body).appendChild(toastContainer);
+    }
+    return toastContainer;
+  }
+
+  /**
+   * @param {string} message
+   * @param {('success'|'warn'|'error'|'info')} [type='info']
+   */
+  function toast(message, type) {
+    const kind = TOAST_ICON[type] ? type : 'info';
+    const root = toastRoot();
+
+    const node = document.createElement('div');
+    node.className = 'podman-toast podman-toast-' + kind;
+    node.innerHTML =
+      '<span class="ico">' + TOAST_ICON[kind] + '</span>' +
+      '<span class="msg"></span>' +
+      '<button type="button" class="close" aria-label="Dismiss">&#10005;</button>';
+    node.querySelector('.msg').textContent = message;
+    root.appendChild(node);
+
+    let dismissed = false;
+    function dismiss() {
+      if (dismissed) return;
+      dismissed = true;
+      node.classList.add('leaving');
+      // Not animationend — that never fires when prefers-reduced-motion
+      // disables the animation (podman.css sets animation:none for it),
+      // which would leave the toast stuck on screen forever.
+      setTimeout(function () { node.remove(); }, 160);
+    }
+    node.querySelector('.close').addEventListener('click', dismiss);
+    setTimeout(dismiss, TOAST_DURATION_MS[kind]);
+  }
+
  // --- Modal form dialog -----------------------------------------------------

  /**
@@ -229,6 +283,53 @@ window.Podman = (function () {
    });
  }

+  /**
+   * Small modal with a scrolling monospace log pane — for actions that run
+   * several steps in sequence (checking/updating containers) where a plain
+   * confirm()/alert() at the very end leaves the user with no feedback
+   * that anything is happening while it runs. Returns {log, done} rather
+   * than closing itself, since the caller knows when the whole sequence
+   * (not just one call) has actually finished.
+   *
+   * @param {string} title
+   * @returns {{log: (line: string) => void, done: (closeLabel?: string) => void}}
+   */
+  function openLogModal(title) {
+    const backdrop = document.createElement('div');
+    backdrop.className = 'podman-modal-backdrop';
+    backdrop.innerHTML = '' +
+      '<div class="podman-modal podman-modal-wide" role="dialog" aria-modal="true">' +
+      '<div class="podman-modal-head"><h3>' + escapeHtml(title) + '</h3></div>' +
+      '<div class="podman-modal-body"><div class="podman-log-pane" id="podman-log-modal-pane"></div></div>' +
+      '<div class="podman-modal-actions"><button type="button" class="podman-btn podman-btn-primary" data-role="close" disabled>Working…</button></div>' +
+      '</div>';
+
+    (document.querySelector('.podman-plugin') || document.body).appendChild(backdrop);
+    const pane = backdrop.querySelector('#podman-log-modal-pane');
+    const closeBtn = backdrop.querySelector('[data-role="close"]');
+
+    function close() { backdrop.remove(); }
+    closeBtn.addEventListener('click', close);
+    backdrop.addEventListener('click', function (e) { if (e.target === backdrop) close(); });
+    document.addEventListener('keydown', function onKey(e) {
+      if (e.key === 'Escape' && !closeBtn.disabled) { close(); document.removeEventListener('keydown', onKey); }
+    });
+
+    function log(line) {
+      const row = document.createElement('div');
+      row.textContent = line;
+      pane.appendChild(row);
+      pane.scrollTop = pane.scrollHeight;
+    }
+
+    function done(closeLabel) {
+      closeBtn.disabled = false;
+      closeBtn.textContent = closeLabel || 'Close';
+    }
+
+    return { log: log, done: done };
+  }
+
  /**
   * Small anchored dropdown menu — used for secondary per-row actions
   * (pause/kill/rename/...) that would otherwise clutter a table row with
@@ -252,15 +353,45 @@ window.Podman = (function () {
        (item.disabled ? ' disabled' : '') + '>' + escapeHtml(item.label) + '</button>';
    }).join('');

-    const rect = anchorEl.getBoundingClientRect();
-    menu.style.top = (rect.bottom + window.scrollY + 4) + 'px';
-    menu.style.left = (rect.right + window.scrollX - 180) + 'px';
    (document.querySelector('.podman-plugin') || document.body).appendChild(menu);

+    // Viewport-relative (see the "position: fixed" comment on
+    // .podman-context-menu in podman.css) — no scrollY/scrollX added.
+    // Measured AFTER appending (not assumed) since the menu's height
+    // varies with its item count — a long menu (e.g. a container's row
+    // menu with Details/Pause/Kill/Rename/Edit/Remove) opened from a row
+    // near the bottom of the viewport used to run off-screen with no way
+    // to reach its last few items. Flips above the anchor instead when
+    // there isn't enough room below, and clamps horizontally the same way.
+    const rect = anchorEl.getBoundingClientRect();
+    const menuRect = menu.getBoundingClientRect();
+    const margin = 8;
+
+    let top = rect.bottom + 4;
+    if (top + menuRect.height > window.innerHeight - margin) {
+      top = rect.top - menuRect.height - 4;
+    }
+    top = Math.max(margin, top);
+
+    let left = rect.right - menuRect.width;
+    left = Math.min(left, window.innerWidth - menuRect.width - margin);
+    left = Math.max(margin, left);
+
+    menu.style.top = top + 'px';
+    menu.style.left = left + 'px';
+
+    // menu.children includes the separator <div>s too, so indexing into it
+    // directly (by a counter that only advances for real items) drifts by
+    // one after every separator — e.g. "Remove" (after a separator) ended
+    // up wired to the separator <div> instead of its own <button>, so
+    // clicking it did nothing. querySelectorAll('button') only ever
+    // returns the actual buttons, in the same order as the non-separator
+    // items, so indexing into that stays aligned regardless of separators.
+    const buttons = menu.querySelectorAll('button');
    let buttonIndex = 0;
    items.forEach(function (item) {
      if (item === 'separator') return;
-      const btn = menu.children[buttonIndex];
+      const btn = buttons[buttonIndex];
      buttonIndex++;
      if (item.disabled) return;
      btn.addEventListener('click', function (e) {
@@ -342,6 +473,29 @@ window.Podman = (function () {
    // (Dashboard, by default — see Podman.page).
    const initial = document.querySelector('.podman-subnav button.active');
    activatePanel(initial ? initial.dataset.panel : 'dashboard');
+
+    setInterval(autoRefreshTick, AUTO_REFRESH_INTERVAL_MS);
+  }
+
+  // Only panels that opt in via `autoRefresh: true` (Dashboard, Containers)
+  // get polled — most panels (Settings, Compose, Terminal, ...) have
+  // in-progress forms or connections an unexpected refresh would disrupt.
+  // Paused while the tab is hidden (nothing to look at) and while any
+  // modal is open (a full-panel re-render mid-edit would be jarring),
+  // rather than fighting those cases with more state.
+  const AUTO_REFRESH_INTERVAL_MS = 2000;
+
+  function autoRefreshTick() {
+    if (document.hidden) return;
+    if (document.querySelector('.podman-modal-backdrop')) return;
+
+    const activeBtn = document.querySelector('.podman-subnav button.active');
+    if (!activeBtn) return;
+    const name = activeBtn.dataset.panel;
+    const module = panelModules[name];
+    if (module && module.autoRefresh && initialized[name] && typeof module.refresh === 'function') {
+      module.refresh();
+    }
  }

  document.addEventListener('DOMContentLoaded', boot);
@@ -357,7 +511,9 @@ window.Podman = (function () {
    stateChipClass: stateChipClass,
    loadingRow: loadingRow,
    errorRow: errorRow,
+    toast: toast,
    openFormModal: openFormModal,
+    openLogModal: openLogModal,
    openContextMenu: openContextMenu,
    registerPanel: registerPanel,
    activatePanel: activatePanel,
@@ -1,10 +1,10 @@
 /**
 * javascript/compose.js
 *
- * Compose panel: project list + read-only YAML view + up/down/pull,
- * backed by ajax/compose.php. See that file's header comment — this is
- * the one panel whose backend shells out to the `podman compose` CLI,
- * because no REST equivalent for Compose exists in libpod.
+ * Compose panel: project list + an editable YAML view + save/up/down/pull/
+ * delete, backed by ajax/compose.php. See that file's header comment —
+ * this is the one panel whose backend shells out to the `podman compose`
+ * CLI, because no REST equivalent for Compose exists in libpod.
 */
 (function () {
  'use strict';
@@ -12,6 +12,13 @@
  let projects = [];
  let selected = null;

+  const STARTER_YAML =
+    'services:\n' +
+    '  app:\n' +
+    '    image: docker.io/library/nginx:alpine\n' +
+    '    ports:\n' +
+    '      - "8080:80"\n';
+
  function statusChip(status) {
    const cls = status === 'up' ? 'podman-chip-good' : (status === 'down' ? 'podman-chip-neutral' : 'podman-chip-warn');
    return '<span class="podman-chip ' + cls + '"><span class="d"></span>' + P.escapeHtml(status) + '</span>';
@@ -23,21 +30,32 @@
        '<div class="name" style="display:flex; justify-content:space-between; gap:8px;">' + P.escapeHtml(p.name) + ' ' + statusChip(p.status) + '</div>' +
        '<div class="path">' + P.escapeHtml(p.path) + '</div>' +
        '</div>';
-    }).join('') || '<div class="podman-empty-note">No compose projects under /boot/config/plugins/podman/compose/</div>';
+    }).join('') || '<div class="podman-empty-note">No compose projects yet — click "+ New Project".</div>';
+  }
+
+  // Up/Down/Pull/Save/Delete all need an actual selected project to act on
+  // — disabled (rather than left clickable and erroring) whenever nothing
+  // is selected, e.g. right after deleting the last project.
+  function setToolbarEnabled(enabled) {
+    ['compose-action-up', 'compose-action-down', 'compose-action-pull', 'compose-action-save', 'compose-action-delete'].forEach(function (id) {
+      P.el(id).disabled = !enabled;
+    });
+    P.el('compose-yaml').disabled = !enabled;
  }

  function loadYaml(name) {
    P.el('compose-title').textContent = name + ' / compose.yaml';
-    P.el('compose-yaml').textContent = 'Loading…';
+    P.el('compose-yaml').value = 'Loading…';
    return P.get('compose', 'get', { project: name }).then(function (data) {
-      P.el('compose-yaml').textContent = data.yaml;
+      P.el('compose-yaml').value = data.yaml;
    }).catch(function (err) {
-      P.el('compose-yaml').textContent = 'Error: ' + err.message;
+      P.el('compose-yaml').value = 'Error: ' + err.message;
    });
  }

  function selectProject(name) {
    selected = name;
+    setToolbarEnabled(true);
    renderSidebar();
    loadYaml(name);
  }
@@ -45,9 +63,19 @@
  function loadProjects() {
    return P.get('compose', 'list').then(function (data) {
      projects = data;
+      if (selected && !projects.some(function (p) { return p.name === selected; })) {
+        selected = null;
+      }
      if (!selected && projects.length > 0) selected = projects[0].name;
      renderSidebar();
-      if (selected) loadYaml(selected);
+      if (selected) {
+        setToolbarEnabled(true);
+        loadYaml(selected);
+      } else {
+        setToolbarEnabled(false);
+        P.el('compose-title').textContent = '—';
+        P.el('compose-yaml').value = '';
+      }
    }).catch(function (err) {
      P.el('compose-sidebar').innerHTML = '<div class="podman-error" style="padding:14px;">' + P.escapeHtml(err.message) + '</div>';
    });
@@ -57,25 +85,84 @@
    if (!selected) return;
    const btn = P.el('compose-action-' + action);
    btn.disabled = true;
+    // `podman compose` output can run to many lines — a log modal (same
+    // pattern as Settings' service Start/Stop/Restart) fits that; a toast
+    // has to stay short and auto-dismiss.
+    const modal = P.openLogModal('podman compose ' + action + ' — ' + selected);
    P.post('compose', action, { project: selected }).then(function (data) {
-      alert((data.output || 'Done.').slice(0, 2000));
+      (data.output || 'Done.').split('\n').forEach(function (line) { modal.log(line); });
+      modal.done();
      return loadProjects();
    }).catch(function (err) {
-      alert('podman compose ' + action + ' failed: ' + err.message);
+      modal.log('Failed: ' + err.message);
+      modal.done('Close');
    }).finally(function () {
      btn.disabled = false;
    });
  }

+  function saveYaml() {
+    if (!selected) return;
+    const btn = P.el('compose-action-save');
+    btn.disabled = true;
+    P.post('compose', 'save', { project: selected, yaml: P.el('compose-yaml').value }).then(function () {
+      P.toast('Saved ' + selected + '.', 'success');
+      return loadProjects();
+    }).catch(function (err) {
+      P.toast('Save failed: ' + err.message, 'error');
+    }).finally(function () {
+      btn.disabled = false;
+    });
+  }
+
+  function deleteProject() {
+    if (!selected) return;
+    if (!confirm('Delete project "' + selected + '"? This stops it (if running) and permanently removes its compose.yaml.')) return;
+    const btn = P.el('compose-action-delete');
+    btn.disabled = true;
+    const name = selected;
+    P.post('compose', 'remove', { project: selected }).then(function () {
+      selected = null;
+      P.toast('Deleted ' + name + '.', 'success');
+      return loadProjects();
+    }).catch(function (err) {
+      P.toast('Delete failed: ' + err.message, 'error');
+      btn.disabled = false;
+    });
+  }
+
+  function openNewProjectModal() {
+    P.openFormModal({
+      title: 'New Compose Project',
+      submitLabel: 'Create',
+      fields: [
+        { name: 'name', label: 'Project name', required: true, placeholder: 'my-stack', hint: 'Letters, digits, "_", "-" only — no spaces.' },
+      ],
+      onSubmit: function (values) {
+        if (!/^[a-zA-Z0-9_-]+$/.test(values.name)) {
+          return Promise.reject(new Error('Project name can only contain letters, digits, "_", "-" — no spaces.'));
+        }
+        return P.post('compose', 'save', { project: values.name, yaml: STARTER_YAML }).then(function () {
+          selected = values.name;
+          return loadProjects();
+        });
+      },
+    });
+  }
+
  function init() {
    P.el('compose-sidebar').addEventListener('click', function (e) {
      const item = e.target.closest('.podman-compose-proj[data-name]');
      if (item) selectProject(item.dataset.name);
    });
+    P.el('compose-new-btn').addEventListener('click', openNewProjectModal);
    P.el('compose-action-up').addEventListener('click', function () { runAction('up'); });
    P.el('compose-action-down').addEventListener('click', function () { runAction('down'); });
    P.el('compose-action-pull').addEventListener('click', function () { runAction('pull'); });
+    P.el('compose-action-save').addEventListener('click', saveYaml);
+    P.el('compose-action-delete').addEventListener('click', deleteProject);

+    setToolbarEnabled(false);
    return loadProjects();
  }

@@ -1,15 +1,18 @@
 /**
 * javascript/dashboard.js
 *
- * Dashboard panel: summary stat tiles fed by ajax/system.php?action=summary.
- * The Activity list and the CPU/Memory sparkline in the mockup were
- * illustrative sample data with no backing API (libpod has no "recent
- * events for a container fleet" convenience endpoint beyond raw
- * /events streaming, which is a separate follow-up — see the note
- * rendered in place of it below) — rather than fake data pretending to be
- * live, this real implementation shows what's genuinely available now
- * (the summary counts) and a clear placeholder for what needs the events
- * stream, so nobody mistakes a mock for a working feature.
+ * Dashboard panel: plain-count stat tiles (Running/Stopped/Pods/Images/
+ * Volumes/Networks) plus a single "Resource Usage" card (CPU/Memory/Swap/
+ * Storage as meter rows) — kept as two visually distinct groups rather
+ * than forcing bar-and-percentage metrics into the same tile shape as
+ * simple counts, which is what produced the awkward spanning-tile/dead-
+ * grid-cell layout this replaced. Both fed by ajax/system.php?action=
+ * summary, plus the Autostart Queue table fed by action=autostart_queue.
+ * A live scrolling event feed is deliberately out of scope here — libpod
+ * has no "recent events for a container fleet" convenience endpoint, only
+ * raw /events streaming, which is a separate feature (its own connection
+ * lifecycle, not a snapshot this summary call can produce) rather than
+ * something to fake with sample data.
 */
 (function () {
  'use strict';
@@ -26,12 +29,16 @@
    }

    P.el('stat-running').textContent = summary.containers.running;
+    P.el('stat-running').className = summary.containers.running > 0 ? 'tone-good' : '';
    P.el('stat-running-total').textContent = '/ ' + summary.containers.total;
+    P.el('stat-stopped').textContent = summary.containers.stopped;
+    P.el('stat-stopped').classList.toggle('tone-bad', summary.containers.stopped > 0);
    P.el('stat-pods').textContent = summary.pods;
    P.el('stat-images').textContent = summary.images;
    P.el('stat-volumes').textContent = summary.volumes;
    P.el('stat-networks').textContent = summary.networks;
-    P.el('stat-images-size').textContent = summary.storage.imagesSizeFormatted;
+
+    renderResourceUsage(summary.host, summary.storage);

    const meta = P.el('podman-header-meta');
    if (meta) {
@@ -42,11 +49,96 @@
    }
  }

+  // Bars stay accent-colored under normal load and only shift to warn/bad
+  // once usage is high enough to actually be worth noticing at a glance —
+  // a bar that's always the same color regardless of value doesn't tell
+  // you anything a number alone didn't.
+  function barSeverityClass(percent) {
+    if (percent === null || percent === undefined) {
+      return '';
+    }
+    if (percent >= 90) {
+      return 'bad';
+    }
+    if (percent >= 75) {
+      return 'warn';
+    }
+    return '';
+  }
+
+  function resourceRow(label, valueText, percent) {
+    const pct = percent === null || percent === undefined ? 0 : percent;
+    return (
+      '<div class="podman-resource-row">' +
+      '<span class="k">' + P.escapeHtml(label) + '</span>' +
+      '<div class="podman-usage-mini" style="flex:1;">' +
+      '<div class="track"><span class="' + barSeverityClass(percent) + '" style="width:' + pct + '%"></span></div>' +
+      '<span class="num">' + pct + '%</span>' +
+      '</div>' +
+      '<span class="v">' + P.escapeHtml(valueText) + '</span>' +
+      '</div>'
+    );
+  }
+
+  function renderResourceUsage(host, storage) {
+    if (!host || !storage) {
+      return;
+    }
+    let html = resourceRow('CPU (' + host.cpuCount + ')', '', host.cpuPercent) +
+      resourceRow('Memory', P.formatBytes(host.memUsedBytes) + ' / ' + P.formatBytes(host.memTotalBytes), host.memPercent);
+    if (host.swapTotalBytes > 0) {
+      html += resourceRow('Swap', P.formatBytes(host.swapUsedBytes) + ' / ' + P.formatBytes(host.swapTotalBytes),
+        Math.round(host.swapUsedBytes / host.swapTotalBytes * 100));
+    }
+    html += resourceRow('Storage',
+      storage.graphUsedFormatted + (storage.graphAllocatedBytes ? ' / ' + storage.graphAllocatedFormatted : '') +
+      ' (' + storage.imagesSizeFormatted + ' images)',
+      storage.graphUsedPercent);
+    if (host.uptime) {
+      html += '<div class="hint" style="margin-top:10px;">Uptime: ' + P.escapeHtml(host.uptime) + '</div>';
+    }
+    P.el('dashboard-resource-rows').innerHTML = html;
+  }
+
+  const STATUS_CHIP_CLASS = {
+    started: 'podman-chip-good',
+    stopped: 'podman-chip-neutral',
+    failed: 'podman-chip-bad',
+    'safe-mode': 'podman-chip-warn',
+    unknown: 'podman-chip-neutral',
+  };
+
+  function renderAutostartQueue(data) {
+    const tbody = P.el('dashboard-autostart-tbody');
+    if (!tbody) {
+      return;
+    }
+    const entries = data.entries || [];
+    if (!entries.length) {
+      tbody.innerHTML = '<tr><td colspan="4" class="podman-empty-note">No containers configured for autostart.</td></tr>';
+      return;
+    }
+    tbody.innerHTML = entries.map(function (e) {
+      const chipClass = STATUS_CHIP_CLASS[e.status] || 'podman-chip-neutral';
+      return '<tr>' +
+        '<td class="tnum">' + e.position + '</td>' +
+        '<td>' + P.escapeHtml(e.name) + '</td>' +
+        '<td class="tnum">' + (e.delaySeconds > 0 ? e.delaySeconds + 's' : '—') + '</td>' +
+        '<td><span class="podman-chip ' + chipClass + '"><span class="d"></span>' + P.escapeHtml(e.statusLabel) + '</span></td>' +
+        '</tr>';
+    }).join('');
+  }
+
  function load() {
-    return P.get('system', 'summary').then(render).catch(function (err) {
+    return P.get('system', 'summary').then(function (summary) {
+      render(summary);
+      if (summary.reachable) {
+        return P.get('system', 'autostart_queue').then(renderAutostartQueue);
+      }
+    }).catch(function (err) {
      P.el('podman-panel-dashboard').innerHTML = '<div class="podman-card"><div class="podman-error">' + P.escapeHtml(err.message) + '</div></div>';
    });
  }

-  P.registerPanel('dashboard', { init: load, refresh: load });
+  P.registerPanel('dashboard', { init: load, refresh: load, autoRefresh: true });
 })();
@@ -18,8 +18,10 @@
      '<td class="tnum">' + P.escapeHtml(img.sizeFormatted) + '</td>' +
      '<td class="tnum">' + created + '</td>' +
      '<td class="tnum">' + img.usedBy + '</td>' +
-      '<td class="podman-actions"><button class="podman-btn podman-btn-icon" data-action="remove"' +
-      (img.usedBy > 0 ? ' disabled title="In use by a container"' : ' title="Remove"') + '>&#128465;</button></td>' +
+      '<td class="podman-actions"><div class="podman-actions-row">' +
+      '<button class="podman-btn podman-btn-icon" data-action="tag" title="Add tag">&#127991;</button>' +
+      '<button class="podman-btn podman-btn-icon podman-btn-danger" data-action="remove"' +
+      (img.usedBy > 0 ? ' disabled title="In use by a container"' : ' title="Remove"') + '>&#128465;</button></div></td>' +
      '</tr>';
  }

@@ -55,16 +57,66 @@
      });
    });

+    P.el('images-prune-btn').addEventListener('click', function () {
+      // Computed client-side from the list already on screen — no extra
+      // round trip needed, and it lets the confirm() be specific instead
+      // of a generic warning. "Unused" here matches libpod's own
+      // definition (zero containers, running or stopped, referencing the
+      // image) — the same "Used By" count already shown in the table, not
+      // just dangling/untagged images. Found live that this can be far
+      // more aggressive than expected: with no containers at all, it
+      // removes every image on the host.
+      const unused = images.filter(function (img) { return img.usedBy === 0; });
+      if (!unused.length) {
+        P.toast('No unused images to remove — every image is referenced by at least one container.', 'info');
+        return;
+      }
+      const totalBytes = unused.reduce(function (sum, img) { return sum + img.sizeBytes; }, 0);
+      if (!confirm(
+        'Remove ' + unused.length + ' image(s) not used by any container (' + P.formatBytes(totalBytes) + ')?\n\n' +
+        'This removes any tagged image with zero containers using it, not just dangling ones.'
+      )) return;
+
+      const btn = this;
+      btn.disabled = true;
+      P.post('images', 'prune').then(function (result) {
+        btn.disabled = false;
+        P.toast('Removed ' + result.removedCount + ' image(s), reclaimed ' + P.formatBytes(result.reclaimedBytes) + '.', 'success');
+        return load();
+      }).catch(function (err) {
+        btn.disabled = false;
+        P.toast('Prune failed: ' + err.message, 'error');
+      });
+    });
+
    P.el('images-tbody').addEventListener('click', function (e) {
-      const btn = e.target.closest('button[data-action="remove"]');
+      const btn = e.target.closest('button[data-action]');
      if (!btn || btn.disabled) return;
      const id = btn.closest('tr').dataset.id;
+
+      if (btn.dataset.action === 'tag') {
+        P.openFormModal({
+          title: 'Add Tag',
+          submitLabel: 'Add tag',
+          fields: [
+            { name: 'repo', label: 'Repository', required: true, placeholder: 'my-registry.local/my-image' },
+            { name: 'tag', label: 'Tag', placeholder: 'latest' },
+          ],
+          onSubmit: function (values) {
+            return P.post('images', 'tag', { id: id, repo: values.repo, tag: values.tag || 'latest' }).then(load);
+          },
+        });
+        return;
+      }
+
+      if (btn.dataset.action === 'remove') {
        if (!confirm('Remove this image?')) return;
        btn.disabled = true;
        P.post('images', 'remove', { id: id }).then(load).catch(function (err) {
-        alert('Remove failed: ' + err.message);
+          P.toast('Remove failed: ' + err.message, 'error');
          btn.disabled = false;
        });
+      }
    });

    return load();
@@ -20,8 +20,8 @@
      '<td class="mono">' + P.escapeHtml(n.subnet || '&mdash;') + '</td>' +
      '<td class="mono">' + P.escapeHtml(n.gateway || '&mdash;') + '</td>' +
      '<td class="tnum">' + n.containers + '</td>' +
-      '<td class="podman-actions"><button class="podman-btn podman-btn-icon" data-action="remove"' +
-      (removeDisabled ? ' disabled' : '') + ' title="Remove">&#128465;</button></td>' +
+      '<td class="podman-actions"><div class="podman-actions-row"><button class="podman-btn podman-btn-icon podman-btn-danger" data-action="remove"' +
+      (removeDisabled ? ' disabled' : '') + ' title="Remove">&#128465;</button></div></td>' +
      '</tr>';
  }

@@ -43,20 +43,119 @@
    });
  }

+  // Purpose-built modal (not app.js's generic openFormModal, which only
+  // supports flat always-visible text fields) — the parent-interface
+  // dropdown and gateway field only make sense for "macvlan" and need to
+  // show/hide based on the driver choice.
+  function openCreateNetworkModal() {
+    const backdrop = document.createElement('div');
+    backdrop.className = 'podman-modal-backdrop';
+    backdrop.innerHTML = '' +
+      '<div class="podman-modal" role="dialog" aria-modal="true">' +
+      '<div class="podman-modal-head"><h3>New Network</h3></div>' +
+      '<form class="podman-modal-body">' +
+      '<div class="podman-modal-field"><label>Network name</label>' +
+      '<input type="text" id="cn-name" placeholder="my-network"></div>' +
+      '<div class="podman-modal-field"><label>Type</label>' +
+      '<select id="cn-driver">' +
+      '<option value="bridge">Bridge (isolated, NAT — default)</option>' +
+      '<option value="macvlan">Macvlan (containers get a real IP on your LAN)</option>' +
+      '</select></div>' +
+      '<div class="podman-modal-field" id="cn-parent-field" style="display:none;">' +
+      '<label>Parent interface</label><select id="cn-parent"></select>' +
+      '<div class="hint">Same interface Docker Manager\'s "Custom: br0"-style networks use.</div></div>' +
+      '<div class="podman-modal-field"><label id="cn-subnet-label">Subnet (optional)</label>' +
+      '<input type="text" class="mono" id="cn-subnet" placeholder="10.89.2.0/24"></div>' +
+      '<div class="podman-modal-field" id="cn-gateway-field" style="display:none;">' +
+      '<label>Gateway</label><input type="text" class="mono" id="cn-gateway" placeholder="10.1.1.1"></div>' +
+      '</form>' +
+      '<div class="podman-modal-actions">' +
+      '<button type="button" class="podman-btn podman-btn-ghost" data-role="cancel">Cancel</button>' +
+      '<button type="button" class="podman-btn podman-btn-primary" data-role="submit">Create</button>' +
+      '</div></div>';
+
+    (document.querySelector('.podman-plugin') || document.body).appendChild(backdrop);
+
+    let parentInterfaces = [];
+    P.get('networks', 'list_parent_interfaces').then(function (interfaces) {
+      parentInterfaces = interfaces;
+      const select = backdrop.querySelector('#cn-parent');
+      select.innerHTML = interfaces.map(function (i) {
+        return '<option value="' + P.escapeHtml(i.interface) + '">' + P.escapeHtml(i.label) + '</option>';
+      }).join('');
+    }).catch(function () { /* macvlan option just won't have anything to pick if this fails */ });
+
+    backdrop.querySelector('#cn-driver').addEventListener('change', function (e) {
+      const isMacvlan = e.target.value === 'macvlan';
+      backdrop.querySelector('#cn-parent-field').style.display = isMacvlan ? '' : 'none';
+      backdrop.querySelector('#cn-gateway-field').style.display = isMacvlan ? '' : 'none';
+      backdrop.querySelector('#cn-subnet-label').textContent = isMacvlan ? 'Subnet' : 'Subnet (optional)';
+    });
+
+    backdrop.querySelector('#cn-name').focus();
+
+    function close() { backdrop.remove(); }
+
+    function showError(message) {
+      let box = backdrop.querySelector('.podman-modal-error');
+      if (!box) {
+        box = document.createElement('div');
+        box.className = 'podman-modal-error';
+        backdrop.querySelector('.podman-modal-body').appendChild(box);
+      }
+      box.textContent = message;
+    }
+
+    function submit() {
+      const name = backdrop.querySelector('#cn-name').value.trim();
+      if (!name) {
+        showError('"Network name" is required.');
+        return;
+      }
+      const driver = backdrop.querySelector('#cn-driver').value;
+      const subnet = backdrop.querySelector('#cn-subnet').value.trim();
+      const gateway = backdrop.querySelector('#cn-gateway').value.trim();
+      const parentInterface = backdrop.querySelector('#cn-parent').value;
+
+      if (driver === 'macvlan') {
+        if (!subnet) {
+          showError('"Subnet" is required for a macvlan network.');
+          return;
+        }
+        if (!parentInterfaces.length) {
+          showError('No host bridge/VLAN interface available to attach to.');
+          return;
+        }
+      }
+
+      const submitBtn = backdrop.querySelector('[data-role="submit"]');
+      submitBtn.disabled = true;
+      P.post('networks', 'create', {
+        name: name,
+        driver: driver,
+        subnet: subnet || undefined,
+        gateway: gateway || undefined,
+        parentInterface: driver === 'macvlan' ? parentInterface : undefined,
+      }).then(function () {
+        close();
+        return load();
+      }).catch(function (err) {
+        submitBtn.disabled = false;
+        showError(err.message);
+      });
+    }
+
+    backdrop.querySelector('[data-role="cancel"]').addEventListener('click', close);
+    backdrop.querySelector('[data-role="submit"]').addEventListener('click', submit);
+    backdrop.querySelector('form').addEventListener('submit', function (e) { e.preventDefault(); submit(); });
+    backdrop.addEventListener('click', function (e) { if (e.target === backdrop) close(); });
+    document.addEventListener('keydown', function onKey(e) {
+      if (e.key === 'Escape') { close(); document.removeEventListener('keydown', onKey); }
+    });
+  }
+
  function init() {
-    P.el('networks-create-btn').addEventListener('click', function () {
-      P.openFormModal({
-        title: 'New Network',
-        submitLabel: 'Create',
-        fields: [
-          { name: 'name', label: 'Network name', required: true, placeholder: 'my-network' },
-          { name: 'subnet', label: 'Subnet (optional)', placeholder: '10.89.2.0/24' },
-        ],
-        onSubmit: function (values) {
-          return P.post('networks', 'create', { name: values.name, driver: 'bridge', subnet: values.subnet || undefined }).then(load);
-        },
-      });
-    });
+    P.el('networks-create-btn').addEventListener('click', openCreateNetworkModal);

    P.el('networks-tbody').addEventListener('click', function (e) {
      const btn = e.target.closest('button[data-action="remove"]');
@@ -65,7 +164,7 @@
      if (!confirm('Remove network "' + name + '"?')) return;
      btn.disabled = true;
      P.post('networks', 'remove', { name: name }).then(load).catch(function (err) {
-        alert('Remove failed: ' + err.message);
+        P.toast('Remove failed: ' + err.message, 'error');
        btn.disabled = false;
      });
    });
@@ -8,6 +8,107 @@
 (function () {
  'use strict';
  const P = window.Podman;
+  let allPods = [];
+
+  function portRowHtml() {
+    return '' +
+      '<div class="podman-row-group-item">' +
+      '<input type="text" class="mono podman-input-narrow" data-field="hostPort" placeholder="Host port">' +
+      '<span>&rarr;</span>' +
+      '<input type="text" class="mono podman-input-narrow" data-field="containerPort" placeholder="Container port">' +
+      '<select data-field="protocol"><option value="tcp">TCP</option><option value="udp">UDP</option></select>' +
+      '<button type="button" class="podman-btn podman-btn-icon podman-row-remove-btn" data-remove-row title="Remove">&times;</button>' +
+      '</div>';
+  }
+
+  function addRow(groupEl) {
+    const div = document.createElement('div');
+    div.innerHTML = portRowHtml();
+    const row = div.firstElementChild;
+    row.querySelector('[data-remove-row]').addEventListener('click', function () { row.remove(); });
+    groupEl.appendChild(row);
+  }
+
+  function readRows(groupEl) {
+    return Array.from(groupEl.children).map(function (row) {
+      const values = {};
+      row.querySelectorAll('[data-field]').forEach(function (input) {
+        values[input.dataset.field] = input.value.trim();
+      });
+      return values;
+    });
+  }
+
+  function openCreatePodModal() {
+    const backdrop = document.createElement('div');
+    backdrop.className = 'podman-modal-backdrop';
+    backdrop.innerHTML = '' +
+      '<div class="podman-modal" role="dialog" aria-modal="true">' +
+      '<div class="podman-modal-head"><h3>New Pod</h3></div>' +
+      '<form class="podman-modal-body">' +
+      '<div class="podman-modal-field"><label>Name</label>' +
+      '<input type="text" id="cp-name" placeholder="my-pod">' +
+      '<div class="hint">Letters, digits, ".", "_", "-" only — no spaces.</div></div>' +
+      '<div class="podman-modal-field"><label>Port mappings</label>' +
+      '<div class="podman-row-group" id="cp-ports"></div>' +
+      '<button type="button" class="podman-btn podman-btn-ghost" data-add="port">+ Add port</button>' +
+      '<div class="hint">Shared by every container later added to this pod.</div></div>' +
+      '</form>' +
+      '<div class="podman-modal-actions">' +
+      '<button type="button" class="podman-btn podman-btn-ghost" data-role="cancel">Cancel</button>' +
+      '<button type="button" class="podman-btn podman-btn-primary" data-role="submit">Create</button>' +
+      '</div></div>';
+
+    (document.querySelector('.podman-plugin') || document.body).appendChild(backdrop);
+
+    const portsGroup = backdrop.querySelector('#cp-ports');
+    addRow(portsGroup);
+    backdrop.querySelector('[data-add="port"]').addEventListener('click', function () { addRow(portsGroup); });
+    backdrop.querySelector('#cp-name').focus();
+
+    function close() { backdrop.remove(); }
+
+    function showError(message) {
+      let box = backdrop.querySelector('.podman-modal-error');
+      if (!box) {
+        box = document.createElement('div');
+        box.className = 'podman-modal-error';
+        backdrop.querySelector('.podman-modal-body').appendChild(box);
+      }
+      box.textContent = message;
+    }
+
+    function submit() {
+      const name = backdrop.querySelector('#cp-name').value.trim();
+      if (!name) {
+        showError('"Name" is required.');
+        return;
+      }
+      if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(name)) {
+        showError('"Name" can only contain letters, digits, ".", "_", "-" — no spaces. Try "' + name.replace(/[^a-zA-Z0-9_.-]+/g, '-') + '" instead.');
+        return;
+      }
+      const ports = readRows(portsGroup).filter(function (r) { return r.hostPort && r.containerPort; });
+
+      const submitBtn = backdrop.querySelector('[data-role="submit"]');
+      submitBtn.disabled = true;
+      P.post('pods', 'create', { name: name, ports: ports }).then(function () {
+        close();
+        return load();
+      }).catch(function (err) {
+        submitBtn.disabled = false;
+        showError(err.message);
+      });
+    }
+
+    backdrop.querySelector('[data-role="cancel"]').addEventListener('click', close);
+    backdrop.querySelector('[data-role="submit"]').addEventListener('click', submit);
+    backdrop.querySelector('form').addEventListener('submit', function (e) { e.preventDefault(); submit(); });
+    backdrop.addEventListener('click', function (e) { if (e.target === backdrop) close(); });
+    document.addEventListener('keydown', function onKey(e) {
+      if (e.key === 'Escape') { close(); document.removeEventListener('keydown', onKey); }
+    });
+  }

  function memberRow(m) {
    return '' +
@@ -24,27 +125,77 @@
      : '<tr><td colspan="3" class="podman-empty-note">No member containers</td></tr>';

    return '' +
-      '<div class="podman-pod-card">' +
+      '<div class="podman-pod-card" data-name="' + P.escapeHtml(pod.name) + '">' +
      '<div class="podman-pod-head">' +
      '<span class="podman-chip ' + P.stateChipClass(pod.status) + '"><span class="d"></span>' + P.escapeHtml(pod.status) + '</span>' +
      '<span class="name">' + P.escapeHtml(pod.name) + '</span>' +
      '<span class="infra">' + pod.containersTotal + ' container(s)</span>' +
+      '<button type="button" class="podman-btn podman-btn-icon" data-action="menu" title="More">&#8942;</button>' +
      '</div>' +
      '<div class="podman-table-wrap"><table><thead><tr><th>Container</th><th>Image</th><th>Status</th></tr></thead>' +
      '<tbody>' + members + '</tbody></table></div>' +
      '</div>';
  }

+  function render() {
+    const grid = P.el('pods-grid');
+    grid.innerHTML = allPods.length
+      ? allPods.map(podCard).join('')
+      : '<div class="podman-empty-note">No pods yet — create one, or run a container with a "pod" set from the Create Container form.</div>';
+  }
+
  function load() {
    const container = P.el('podman-panel-pods');
-    return P.get('pods', 'list').then(function (pods) {
-      container.innerHTML = pods.length
-        ? pods.map(podCard).join('')
-        : '<div class="podman-card"><div class="podman-empty-note">No pods yet.</div></div>';
+    if (!P.el('pods-grid')) {
+      container.innerHTML = '' +
+        '<div class="podman-card">' +
+        '<div class="podman-toolbar">' +
+        '<strong style="flex:1;">Group containers sharing network/storage namespaces</strong>' +
+        '<button class="podman-btn podman-btn-primary" id="pods-create-btn">+ New Pod</button>' +
+        '</div>' +
+        '<div id="pods-grid"></div>' +
+        '</div>';
+      P.el('pods-create-btn').addEventListener('click', openCreatePodModal);
+      P.el('pods-grid').addEventListener('click', handleCardClick);
+    }
+    return P.get('pods', 'list').then(function (data) {
+      allPods = data;
+      render();
    }).catch(function (err) {
-      container.innerHTML = '<div class="podman-card"><div class="podman-error">' + P.escapeHtml(err.message) + '</div></div>';
+      P.el('pods-grid').innerHTML = '<div class="podman-error">' + P.escapeHtml(err.message) + '</div>';
    });
  }

+  function handleAction(name, action, extra) {
+    return P.post('pods', action, Object.assign({ name: name }, extra)).then(load).catch(function (err) {
+      P.toast('Action failed: ' + err.message, 'error');
+    });
+  }
+
+  function handleCardClick(e) {
+    const btn = e.target.closest('button[data-action="menu"]');
+    if (!btn) return;
+    const pod = allPods.find(function (p) { return p.name === btn.closest('.podman-pod-card').dataset.name; });
+    if (!pod) return;
+
+    const items = [];
+    if (pod.status === 'running') {
+      items.push({ label: 'Stop', onClick: function () { handleAction(pod.name, 'stop', { timeout: 10 }); } });
+      items.push({ label: 'Restart', onClick: function () { handleAction(pod.name, 'restart', { timeout: 10 }); } });
+    } else {
+      items.push({ label: 'Start', onClick: function () { handleAction(pod.name, 'start'); } });
+    }
+    items.push('separator');
+    items.push({
+      label: 'Remove',
+      danger: true,
+      onClick: function () {
+        if (!confirm('Remove pod "' + pod.name + '" and all its member containers?')) return;
+        handleAction(pod.name, 'remove', { force: true });
+      },
+    });
+    P.openContextMenu(btn, items);
+  }
+
  P.registerPanel('pods', { init: load, refresh: load });
 })();
@@ -9,6 +9,7 @@
  'use strict';
  const P = window.Podman;
  let autostartNames = [];
+  let allContainerNames = [];

  function renderAutostart() {
    const tbody = P.el('autostart-tbody');
@@ -17,18 +18,31 @@
        return '<tr data-index="' + i + '">' +
          '<td class="tnum">' + (i + 1) + '</td>' +
          '<td>' + P.escapeHtml(name) + '</td>' +
-          '<td class="podman-actions">' +
+          '<td class="podman-actions"><div class="podman-actions-row">' +
          '<button class="podman-btn podman-btn-icon" data-action="up"' + (i === 0 ? ' disabled' : '') + ' title="Move up">&#8593;</button>' +
          '<button class="podman-btn podman-btn-icon" data-action="down"' + (i === autostartNames.length - 1 ? ' disabled' : '') + ' title="Move down">&#8595;</button>' +
          '<button class="podman-btn podman-btn-icon" data-action="remove" title="Remove from autostart">&#128465;</button>' +
-          '</td></tr>';
+          '</div></td></tr>';
      }).join('')
      : '<tr><td colspan="3" class="podman-empty-note">No containers in the autostart chain.</td></tr>';
+    renderAddOptions();
+  }
+
+  // Repopulated after every add/remove so it only ever offers containers
+  // that exist and aren't already in the chain — avoids duplicate entries
+  // and offering a container name that no longer exists.
+  function renderAddOptions() {
+    const select = P.el('autostart-add-select');
+    const available = allContainerNames.filter(function (name) { return autostartNames.indexOf(name) === -1; });
+    select.innerHTML = available.length
+      ? available.map(function (name) { return '<option value="' + P.escapeHtml(name) + '">' + P.escapeHtml(name) + '</option>'; }).join('')
+      : '<option value="">All containers already added</option>';
+    P.el('autostart-add-btn').disabled = !available.length;
  }

  function saveAutostart() {
    return P.post('settings', 'autostart_save', { names: autostartNames }).catch(function (err) {
-      alert('Could not save autostart order: ' + err.message);
+      P.toast('Could not save autostart order: ' + err.message, 'error');
    });
  }

@@ -43,17 +57,156 @@

    const versions = settings.packageVersions || {};
    const order = ['PODMAN', 'CONMON', 'CRUN', 'NETAVARK', 'AARDVARK_DNS', 'PASST', 'FUSE_OVERLAYFS'];
-    P.el('settings-package-versions').textContent = order
-      .map(function (k) { return k.toLowerCase().replace('_', '-') + ' ' + (versions[k + '_INSTALLED_VERSION'] || '?'); })
-      .join(' · ');
+    const chipsHtml = order.map(function (k) {
+      const name = k.toLowerCase().replace(/_/g, '-');
+      const version = versions[k + '_INSTALLED_VERSION'];
+      return '<span class="podman-version-chip">' + P.escapeHtml(name) + ' <b>' + P.escapeHtml(version || '?') + '</b></span>';
+    }).join('');
+    P.el('settings-package-versions').innerHTML = chipsHtml || '<span class="podman-empty-note">No version manifest found.</span>';
  }

  function load() {
-    return P.get('settings', 'get').then(fillForm).catch(function (err) {
-      alert('Could not load settings: ' + err.message);
+    return Promise.all([
+      P.get('settings', 'get').then(fillForm),
+      // Needed for the "Add container" dropdown — a separate, tolerant
+      // fetch so a containers.php hiccup doesn't also break the rest of
+      // Settings (autostart reorder/remove don't need this list at all).
+      P.get('containers', 'list').then(function (containers) {
+        allContainerNames = containers.map(function (c) { return c.name; }).sort();
+        renderAddOptions();
+      }).catch(function () {
+        allContainerNames = [];
+      }),
+    ]).catch(function (err) {
+      P.toast('Could not load settings: ' + err.message, 'error');
    });
  }

+  // --- Podman service status/start/stop/restart ------------------------------
+
+  function renderServiceChip(data) {
+    const chip = P.el('settings-service-chip');
+    chip.className = 'podman-chip ' + (data.running ? 'podman-chip-good' : 'podman-chip-bad');
+    chip.innerHTML = '<span class="d"></span>' + (data.running ? 'Running' : 'Not running');
+  }
+
+  function serviceButtons() {
+    return ['settings-service-status-btn', 'settings-service-start-btn', 'settings-service-stop-btn', 'settings-service-restart-btn']
+      .map(function (id) { return P.el(id); });
+  }
+
+  // "Refresh Status" is quick and read-only — shown inline, no modal needed.
+  function refreshServiceStatus() {
+    const buttons = serviceButtons();
+    buttons.forEach(function (b) { b.disabled = true; });
+    return P.get('settings', 'service_status').then(function (data) {
+      renderServiceChip(data);
+      const log = P.el('settings-service-log');
+      log.style.display = '';
+      log.textContent = data.output || '';
+      log.scrollTop = log.scrollHeight;
+    }).catch(function (err) {
+      P.el('settings-service-chip').className = 'podman-chip podman-chip-bad';
+      P.el('settings-service-chip').innerHTML = '<span class="d"></span>Unknown';
+      P.el('settings-service-log').style.display = '';
+      P.el('settings-service-log').textContent = err.message;
+    }).finally(function () {
+      buttons.forEach(function (b) { b.disabled = false; });
+    });
+  }
+
+  // Start/Stop/Restart can take a while (storage checks, container
+  // stop grace periods, ...) and are exactly the actions someone reaches
+  // for when something's actually wrong — a small log modal (same pattern
+  // as container update checking) shows what's happening instead of
+  // leaving the button just spinning with no feedback.
+  function runServiceAction(action, title) {
+    const buttons = serviceButtons();
+    buttons.forEach(function (b) { b.disabled = true; });
+    const modal = P.openLogModal(title);
+    return P.post('settings', action, {}).then(function (data) {
+      renderServiceChip(data);
+      (data.output || '').split('\n').forEach(function (line) { modal.log(line); });
+      modal.done();
+    }).catch(function (err) {
+      modal.log('Error: ' + err.message);
+      modal.done('Close');
+    }).finally(function () {
+      buttons.forEach(function (b) { b.disabled = false; });
+    });
+  }
+
+  // --- Format a disk for podman storage --------------------------------------
+
+  function openFormatDiskModal() {
+    const backdrop = document.createElement('div');
+    backdrop.className = 'podman-modal-backdrop';
+    backdrop.innerHTML = '' +
+      '<div class="podman-modal" role="dialog" aria-modal="true">' +
+      '<div class="podman-modal-head"><h3>Format a Disk for Podman Storage</h3></div>' +
+      '<div class="podman-modal-body">' +
+      '<div class="podman-modal-field"><label>Disk</label><select id="fd-device"><option value="">Loading…</option></select>' +
+      '<div class="hint" id="fd-warning">Only disks with no existing partitions or filesystem are listed — anything already in use, part of the array/cache, or the boot flash is never shown here.</div></div>' +
+      '<div class="podman-modal-field">' +
+      '<label style="display:flex; align-items:flex-start; gap:8px; font-weight:400;">' +
+      '<input type="checkbox" id="fd-confirm" style="margin-top:3px;">' +
+      '<span>I understand this permanently erases all data on this disk, with no undo.</span>' +
+      '</label></div>' +
+      '</div>' +
+      '<div class="podman-modal-actions">' +
+      '<button type="button" class="podman-btn podman-btn-ghost" data-role="cancel">Cancel</button>' +
+      '<button type="button" class="podman-btn podman-btn-ghost podman-btn-danger" data-role="submit" disabled>Format Disk</button>' +
+      '</div></div>';
+
+    (document.querySelector('.podman-plugin') || document.body).appendChild(backdrop);
+
+    const select = backdrop.querySelector('#fd-device');
+    const warning = backdrop.querySelector('#fd-warning');
+    const confirmBox = backdrop.querySelector('#fd-confirm');
+    const submitBtn = backdrop.querySelector('[data-role="submit"]');
+
+    function updateSubmitEnabled() {
+      submitBtn.disabled = !(select.value && confirmBox.checked);
+    }
+
+    P.get('disks', 'list_candidates').then(function (list) {
+      select.innerHTML = list.length
+        ? list.map(function (d) {
+          return '<option value="' + P.escapeHtml(d.device) + '">' + P.escapeHtml(d.device) +
+            ' — ' + P.escapeHtml(d.sizeFormatted) + (d.model ? ' (' + P.escapeHtml(d.model) + ')' : '') + '</option>';
+        }).join('')
+        : '<option value="">No eligible blank disks found</option>';
+      updateSubmitEnabled();
+    }).catch(function (err) {
+      select.innerHTML = '<option value="">Error loading disks</option>';
+      warning.textContent = err.message;
+    });
+
+    select.addEventListener('change', updateSubmitEnabled);
+    confirmBox.addEventListener('change', updateSubmitEnabled);
+
+    function close() { backdrop.remove(); }
+
+    submitBtn.addEventListener('click', function () {
+      if (!select.value || !confirmBox.checked) return;
+      if (!confirm('Format ' + select.value + '? This cannot be undone.')) return;
+      submitBtn.disabled = true;
+      submitBtn.textContent = 'Formatting…';
+      P.post('disks', 'format', { device: select.value }).then(function (data) {
+        close();
+        P.el('settings-storage-path').value = data.mountPath;
+        P.toast('Formatted and mounted at ' + data.mountPath + '. Click "Save Settings" below, then Restart Podman.', 'warn');
+      }).catch(function (err) {
+        submitBtn.disabled = false;
+        submitBtn.textContent = 'Format Disk';
+        P.toast('Format failed: ' + err.message, 'error');
+      });
+    });
+
+    backdrop.querySelector('[data-role="cancel"]').addEventListener('click', close);
+    backdrop.addEventListener('click', function (e) { if (e.target === backdrop) close(); });
+  }
+
  function save() {
    const body = {
      storagePath: P.el('settings-storage-path').value.trim(),
@@ -62,15 +215,24 @@
      stopTimeoutSeconds: parseInt(P.el('settings-stop-timeout').value, 10) || 10,
    };
    return P.post('settings', 'save', body).then(function () {
-      alert('Saved. Restart podman (rc.podman restart) to apply storage/enabled changes.');
+      P.toast('Saved. Restart podman (rc.podman restart) to apply storage/enabled changes.', 'warn');
    }).catch(function (err) {
-      alert('Save failed: ' + err.message);
+      P.toast('Save failed: ' + err.message, 'error');
    });
  }

  function init() {
    P.el('settings-save-btn').addEventListener('click', save);

+    P.el('autostart-add-btn').addEventListener('click', function () {
+      const select = P.el('autostart-add-select');
+      const name = select.value;
+      if (!name) return;
+      autostartNames.push(name);
+      renderAutostart();
+      saveAutostart();
+    });
+
    P.el('autostart-tbody').addEventListener('click', function (e) {
      const btn = e.target.closest('button[data-action]');
      if (!btn) return;
@@ -88,6 +250,19 @@
      saveAutostart();
    });

+    P.el('settings-service-status-btn').addEventListener('click', refreshServiceStatus);
+    P.el('settings-service-start-btn').addEventListener('click', function () { runServiceAction('service_start', 'Starting Podman'); });
+    P.el('settings-service-stop-btn').addEventListener('click', function () {
+      if (!confirm('Stop podman? All running containers will be stopped first (each with its own configured grace period).')) return;
+      runServiceAction('service_stop', 'Stopping Podman');
+    });
+    P.el('settings-service-restart-btn').addEventListener('click', function () {
+      if (!confirm('Restart podman? All running containers will be stopped and podman.sock will be unavailable until it comes back up.')) return;
+      runServiceAction('service_restart', 'Restarting Podman');
+    });
+    P.el('settings-format-disk-btn').addEventListener('click', openFormatDiskModal);
+
+    refreshServiceStatus();
    return load();
  }

@@ -29,7 +29,6 @@
      '<div class="podman-template-body">' +
      '<div class="podman-template-name">' + P.escapeHtml(t.name) + '</div>' +
      '<div class="podman-row-sub mono">' + P.escapeHtml(t.image) + '</div>' +
-      (t.category ? '<span class="podman-badge">' + P.escapeHtml(t.category) + '</span>' : '') +
      (overview ? '<div class="podman-template-overview">' + P.escapeHtml(overview) + '</div>' : '') +
      '</div>' +
      '<div class="podman-template-actions">' +
@@ -80,7 +79,7 @@
        P.openCreateContainerModal(config);
      }).catch(function (err) {
        btn.disabled = false;
-        alert('Could not load template: ' + err.message);
+        P.toast('Could not load template: ' + err.message, 'error');
      });
      return;
    }
@@ -98,7 +97,7 @@
        URL.revokeObjectURL(url);
      }).catch(function (err) {
        btn.disabled = false;
-        alert('Export failed: ' + err.message);
+        P.toast('Export failed: ' + err.message, 'error');
      });
      return;
    }
@@ -108,7 +107,7 @@
      btn.disabled = true;
      P.post('templates', 'remove', { name: name }).then(load).catch(function (err) {
        btn.disabled = false;
-        alert('Delete failed: ' + err.message);
+        P.toast('Delete failed: ' + err.message, 'error');
      });
    }
  }
@@ -1,89 +1,97 @@
 /**
 * javascript/terminal.js
 *
- * Terminal panel: one-command-at-a-time exec via ajax/exec.php. See that
- * file's header comment for the full, honest explanation of why this is
- * "type a command, see its output" rather than a true interactive PTY —
- * the short version is that libpod's interactive exec needs a persistent
- * bidirectional connection this PHP/AJAX stack doesn't have, and faking
- * interactivity on top of that would break the moment a user ran anything
- * that expects a real terminal (vim, an interactive prompt, etc).
+ * Terminal panel: opens a real, fully interactive terminal inline (as an
+ * <iframe>, not a popup window) — the same mechanism Unraid's own webGui
+ * uses for its System Terminal and for `docker exec` (see ajax/exec.php's
+ * header comment for the full explanation). This module's own job is just:
 *
- * `cd` is handled client-side: this module tracks a per-session `cwd` and
- * passes it as the exec's working directory on every call, so at least
- * directory navigation feels persistent even though nothing else is.
+ *   1. Ask ajax/exec.php to spawn a ttyd instance wrapping
+ *      `podman exec -it <container> <shell>`, bound to a unix socket.
+ *   2. Point an <iframe> at /logterminal/<sockName>/ — nginx's own
+ *      "logterminal" location block (already installed system-wide by
+ *      Unraid, not something this plugin configures) proxies that,
+ *      WebSocket upgrade included, straight to ttyd's socket.
+ *   3. Track which container's session (if any) is currently open, so
+ *      "Disconnect" — or opening a different container/shell — can kill
+ *      the right ttyd process server-side instead of just discarding the
+ *      iframe and leaving it running.
 */
 (function () {
  'use strict';
  const P = window.Podman;
-  let cwd = '/';
-  let containerId = null;
+  let openName = null;

-  function appendLine(html) {
-    const out = P.el('term-output');
-    const div = document.createElement('div');
-    div.innerHTML = html;
-    out.appendChild(div);
-    out.scrollTop = out.scrollHeight;
+  function populateContainerSelect(list) {
+    const select = P.el('term-container-select');
+    if (!select) return;
+    const running = list.filter(function (c) { return c.state === 'running'; });
+    select.innerHTML = running
+      .map(function (c) { return '<option value="' + P.escapeHtml(c.name) + '">' + P.escapeHtml(c.name) + '</option>'; })
+      .join('') || '<option value="">No running containers</option>';
  }

-  function promptHtml() {
-    return '<span class="prompt">root</span>:<span class="path">' + P.escapeHtml(cwd) + '</span>$';
+  function loadContainers() {
+    return P.get('containers', 'list').then(populateContainerSelect);
  }

-  function runCommand(cmd) {
-    appendLine(promptHtml() + ' ' + P.escapeHtml(cmd));
-
-    // `cd <dir>` is intercepted client-side (see file header) rather than
-    // sent as a real command, since a one-shot exec has no way to report
-    // "the working directory changed" back to us otherwise.
-    const cdMatch = cmd.trim().match(/^cd\s+(\S+)$/);
-    if (cdMatch) {
-      cwd = cdMatch[1].startsWith('/') ? cdMatch[1] : (cwd.replace(/\/$/, '') + '/' + cdMatch[1]);
-      return Promise.resolve();
+  function resetFrame(message) {
+    P.el('term-frame-wrap').innerHTML = '<p class="podman-empty-note">' + message + '</p>';
+    P.el('term-disconnect-btn').disabled = true;
+    openName = null;
  }

-    return P.post('exec', 'run', { id: containerId, cmd: cmd, cwd: cwd }).then(function (data) {
-      if (data.output) appendLine('<span class="mono">' + P.escapeHtml(data.output).replace(/\n/g, '<br>') + '</span>');
+  /** Best-effort: tells the backend to kill the ttyd/podman-exec session, if any is open. Never rejects. */
+  function closeCurrent() {
+    if (!openName) return Promise.resolve();
+    const name = openName;
+    return P.post('exec', 'close', { name: name }).catch(function () {});
+  }
+
+  function openLiveTerminal() {
+    const name = P.el('term-container-select').value;
+    if (!name) return;
+    const shell = P.el('term-shell-select').value;
+    const wrap = P.el('term-frame-wrap');
+    const btn = P.el('term-open-btn');
+
+    wrap.innerHTML = '<p class="podman-empty-note">Opening terminal…</p>';
+    btn.disabled = true;
+    closeCurrent().then(function () {
+      return P.post('exec', 'open', { name: name, shell: shell });
+    }).then(function (data) {
+      openName = name;
+      P.el('term-disconnect-btn').disabled = false;
+      // Matches the ~200ms delay Unraid's own openTerminal() uses between
+      // asking the backend to spawn ttyd and navigating to its socket —
+      // ttyd needs a brief moment to bind before nginx can proxy to it.
+      setTimeout(function () {
+        wrap.innerHTML = '<iframe class="podman-term-frame" src="/logterminal/' + encodeURIComponent(data.sockName) + '/"></iframe>';
+      }, 200);
    }).catch(function (err) {
-      appendLine('<span style="color:#ef6470;">' + P.escapeHtml(err.message) + '</span>');
+      resetFrame('Could not open terminal: ' + P.escapeHtml(err.message));
+    }).finally(function () {
+      btn.disabled = false;
    });
  }

-  function populateContainerSelect(containers) {
-    const select = P.el('term-container-select');
-    select.innerHTML = containers
-      .filter(function (c) { return c.state === 'running'; })
-      .map(function (c) { return '<option value="' + P.escapeHtml(c.id) + '">' + P.escapeHtml(c.name) + '</option>'; })
-      .join('');
-    containerId = select.value || null;
+  function disconnect() {
+    if (!openName) return;
+    const btn = P.el('term-disconnect-btn');
+    btn.disabled = true;
+    closeCurrent().finally(function () {
+      resetFrame('Disconnected. Pick a container and click "Open Terminal" to start a new session.');
+    });
  }

  function init() {
-    const input = P.el('term-input');
-
-    P.el('term-container-select').addEventListener('change', function (e) {
-      containerId = e.target.value;
-      cwd = '/';
-      P.el('term-output').innerHTML = '';
-    });
-
-    input.addEventListener('keydown', function (e) {
-      if (e.key !== 'Enter') return;
-      const cmd = input.value;
-      input.value = '';
-      if (!containerId) {
-        appendLine('<span style="color:#ef6470;">No running container selected.</span>');
-        return;
-      }
-      if (cmd.trim() === '') return;
-      runCommand(cmd);
-    });
-
-    return P.get('containers', 'list').then(populateContainerSelect).catch(function (err) {
-      appendLine('<span style="color:#ef6470;">' + P.escapeHtml(err.message) + '</span>');
-    });
+    P.el('term-open-btn').addEventListener('click', openLiveTerminal);
+    P.el('term-disconnect-btn').addEventListener('click', disconnect);
+    return loadContainers();
  }

-  P.registerPanel('terminal', { init: init });
+  // refresh() only repopulates the container select — it must never touch
+  // #term-frame-wrap, or an already-open terminal would be torn down out
+  // from under the user just by switching tabs and back.
+  P.registerPanel('terminal', { init: init, refresh: loadContainers });
 })();
@@ -24,8 +24,8 @@
      '<td><span class="podman-chip podman-chip-neutral">' + P.escapeHtml(v.driver) + '</span></td>' +
      '<td class="mono podman-row-sub">' + pathCell + '</td>' +
      '<td class="tnum">' + v.usedBy + '</td>' +
-      '<td class="podman-actions"><button class="podman-btn podman-btn-icon" data-action="remove"' +
-      (v.usedBy > 0 ? ' disabled title="In use by a container"' : ' title="Remove"') + '>&#128465;</button></td>' +
+      '<td class="podman-actions"><div class="podman-actions-row"><button class="podman-btn podman-btn-icon podman-btn-danger" data-action="remove"' +
+      (v.usedBy > 0 ? ' disabled title="In use by a container"' : ' title="Remove"') + '>&#128465;</button></div></td>' +
      '</tr>';
  }

@@ -73,7 +73,7 @@
      if (!confirm('Remove volume "' + name + '"? This deletes its data.')) return;
      btn.disabled = true;
      P.post('volumes', 'remove', { name: name }).then(load).catch(function (err) {
-        alert('Remove failed: ' + err.message);
+        P.toast('Remove failed: ' + err.message, 'error');
        btn.disabled = false;
      });
    });
@@ -20,7 +20,7 @@
  --border: #dde1e6; --text: #1c2024; --text-dim: #5b6572; --text-faint: #8a94a1;
  --accent: #d8541a; --accent-strong: #b8420f; --accent-contrast: #fff8f3;
  --good: #1a8f4c; --good-bg: #e4f6ea; --warn: #9a6b00; --warn-bg: #fdf1d6;
-  --bad: #c22b3a; --bad-bg: #fbe6e8; --neutral: #5b6572; --neutral-bg: #e9ebee;
+  --bad: #c22b3a; --bad-bg: #fbe6e8; --bad-strong: #9c1f2c; --bad-contrast: #fff5f6; --neutral: #5b6572; --neutral-bg: #e9ebee;
  --shadow: 0 1px 2px rgba(20, 22, 26, .06), 0 4px 12px rgba(20, 22, 26, .05);
  --font-ui: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
  --font-mono: ui-monospace, "SF Mono", "Cascadia Code", "Roboto Mono", Consolas, "Liberation Mono", monospace;
@@ -35,7 +35,7 @@
    --border: #34383f; --text: #e7e9ec; --text-dim: #9aa1ab; --text-faint: #6b7280;
    --accent: #ef7f3f; --accent-strong: #f6975f; --accent-contrast: #1a1002;
    --good: #4cc785; --good-bg: #123322; --warn: #e0b23d; --warn-bg: #3a2e0d;
-    --bad: #ef6470; --bad-bg: #3a1519; --neutral: #9aa1ab; --neutral-bg: #2b2f36;
+    --bad: #ef6470; --bad-bg: #3a1519; --bad-strong: #f6838c; --bad-contrast: #2a0a0d; --neutral: #9aa1ab; --neutral-bg: #2b2f36;
    --shadow: 0 1px 2px rgba(0,0,0,.3), 0 8px 24px rgba(0,0,0,.35);
  }
 }
@@ -44,7 +44,7 @@
  --border: #34383f; --text: #e7e9ec; --text-dim: #9aa1ab; --text-faint: #6b7280;
  --accent: #ef7f3f; --accent-strong: #f6975f; --accent-contrast: #1a1002;
  --good: #4cc785; --good-bg: #123322; --warn: #e0b23d; --warn-bg: #3a2e0d;
-  --bad: #ef6470; --bad-bg: #3a1519; --neutral: #9aa1ab; --neutral-bg: #2b2f36;
+  --bad: #ef6470; --bad-bg: #3a1519; --bad-strong: #f6838c; --bad-contrast: #2a0a0d; --neutral: #9aa1ab; --neutral-bg: #2b2f36;
  --shadow: 0 1px 2px rgba(0,0,0,.3), 0 8px 24px rgba(0,0,0,.35);
 }
 :root[data-theme="light"] .podman-plugin {
@@ -52,7 +52,7 @@
  --border: #dde1e6; --text: #1c2024; --text-dim: #5b6572; --text-faint: #8a94a1;
  --accent: #d8541a; --accent-strong: #b8420f; --accent-contrast: #fff8f3;
  --good: #1a8f4c; --good-bg: #e4f6ea; --warn: #9a6b00; --warn-bg: #fdf1d6;
-  --bad: #c22b3a; --bad-bg: #fbe6e8; --neutral: #5b6572; --neutral-bg: #e9ebee;
+  --bad: #c22b3a; --bad-bg: #fbe6e8; --bad-strong: #9c1f2c; --bad-contrast: #fff5f6; --neutral: #5b6572; --neutral-bg: #e9ebee;
  --shadow: 0 1px 2px rgba(20,22,26,.06), 0 4px 12px rgba(20,22,26,.05);
 }

@@ -76,11 +76,20 @@
 .podman-pagehead .meta .dot-good { color: var(--good); }
 .podman-pagehead .meta .dot-bad { color: var(--bad); }

+/*
+ * margin: 0 — Unraid's own webGui theme applies a 10px top/bottom margin
+ * to plain <button> elements site-wide. Without resetting it, every
+ * .podman-btn carries an invisible 10px gap above and below its own box,
+ * which silently breaks flex cross-axis alignment anywhere a button sits
+ * next to a non-button sibling (e.g. align-items: flex-end next to a
+ * <select> — verified live: the button's margin, not its content, was
+ * what left it floating 10px above the dropdown it should line up with).
+ */
 .podman-btn {
  appearance: none; border: 1px solid var(--border); background: var(--surface); color: var(--text);
  padding: 8px 14px; border-radius: 7px; font-size: 13px; font-weight: 600; cursor: pointer;
  display: inline-flex; align-items: center; gap: 6px; transition: border-color .12s, background .12s;
-  font-family: var(--font-ui);
+  font-family: var(--font-ui); margin: 0;
 }
 .podman-btn:hover { border-color: var(--text-faint); }
 /*
@@ -100,7 +109,7 @@
 }
 .podman-btn-danger { color: var(--bad); }
 .podman-btn-danger:hover { border-color: var(--bad); }
-.podman-btn-icon { padding: 6px 8px; }
+.podman-btn-icon { padding: 6px 8px; min-width: 32px; min-height: 32px; justify-content: center; font-size: 15px; line-height: 1; }
 .podman-btn[disabled] { opacity: .4; cursor: not-allowed; }
 /*
 * Secondary action (Cancel, "+ Add row") — every button previously shared
@@ -123,11 +132,31 @@
  background: var(--surface-2) !important; border-color: transparent !important;
  color: var(--text) !important; box-shadow: none !important;
 }
-/* A ghost button can still carry danger intent (e.g. a template's
-   "Delete") — needs its own !important since .podman-btn-ghost's color
-   would otherwise win by rule order. */
-.podman-btn-ghost.podman-btn-danger { color: var(--bad) !important; }
-.podman-btn-ghost.podman-btn-danger:hover { background: var(--bad-bg) !important; color: var(--bad) !important; }
+/*
+ * A ghost button can still carry danger intent (Disconnect, Delete,
+ * template "Delete") — needs its own !important since .podman-btn-ghost's
+ * color/background/border would otherwise win by rule order. Solid fill
+ * at rest (not just a tint, and not just on hover) so it reads with the
+ * same weight as .podman-btn-primary, just in red instead of accent —
+ * a merely tinted/outlined button still read as "just another secondary
+ * action" per live feedback.
+ */
+.podman-btn-ghost.podman-btn-danger {
+  color: var(--bad-contrast) !important; background: var(--bad) !important; border-color: var(--bad) !important;
+}
+.podman-btn-ghost.podman-btn-danger:hover {
+  background: var(--bad-strong) !important; border-color: var(--bad-strong) !important; color: var(--bad-contrast) !important;
+}
+.podman-btn-ghost.podman-btn-danger[disabled] {
+  color: var(--text-faint) !important; background: transparent !important; border-color: var(--border) !important;
+}
+/* Icon-only danger buttons (row "remove" trash icons) carry an emoji
+   glyph, not text — .podman-btn-danger's `color` alone doesn't recolor an
+   emoji, so these get the same solid red fill instead, at rest not just
+   on hover, so "destructive" reads at a glance across a whole table. */
+.podman-btn-icon.podman-btn-danger { border-color: var(--bad) !important; background: var(--bad) !important; }
+.podman-btn-icon.podman-btn-danger:hover { background: var(--bad-strong) !important; border-color: var(--bad-strong) !important; }
+.podman-btn-icon.podman-btn-danger[disabled] { border-color: var(--border) !important; background: transparent !important; }

 .podman-subnav {
  margin: 14px 0 0; padding: 0; display: flex; gap: 4px; border-bottom: 1px solid var(--border);
@@ -157,12 +186,25 @@
@media (max-width: 1080px) { .podman-stat-grid { grid-template-columns: repeat(3, 1fr); } }
@media (max-width: 620px) { .podman-stat-grid { grid-template-columns: repeat(2, 1fr); } }

-.podman-stat { background: var(--surface); border: 1px solid var(--border); border-radius: 10px; padding: 14px 16px; box-shadow: var(--shadow); }
+.podman-stat {
+  background: var(--surface); border: 1px solid var(--border); border-radius: 10px; padding: 14px 16px;
+  box-shadow: var(--shadow); transition: transform .12s ease, box-shadow .12s ease;
+}
+.podman-stat:hover { transform: translateY(-1px); box-shadow: 0 2px 4px rgba(20, 22, 26, .08), 0 8px 20px rgba(20, 22, 26, .08); }
 .podman-stat .label { font-size: 11px; text-transform: uppercase; letter-spacing: .05em; color: var(--text-faint); font-weight: 700; }
 .podman-stat .value { font-size: 24px; font-weight: 700; margin-top: 6px; }
 .podman-stat .value small { font-size: 13px; color: var(--text-dim); font-weight: 600; }
-.podman-stat .bar { height: 5px; border-radius: 3px; background: var(--surface-3); margin-top: 10px; overflow: hidden; }
-.podman-stat .bar > span { display: block; height: 100%; background: var(--accent); border-radius: 3px; }
+.podman-stat .tone-good { color: var(--good); }
+.podman-stat .tone-warn { color: var(--warn); }
+.podman-stat .tone-bad { color: var(--bad); }
+.podman-usage-mini .track > span.warn { background: var(--warn); }
+.podman-usage-mini .track > span.bad { background: var(--bad); }
+
+.podman-resource-rows { margin-top: 8px; }
+.podman-resource-row { display: flex; align-items: center; gap: 12px; padding: 7px 0; }
+.podman-resource-row + .podman-resource-row { border-top: 1px solid var(--border); }
+.podman-resource-row .k { font-size: 12.5px; color: var(--text-dim); font-weight: 600; min-width: 84px; flex: none; }
+.podman-resource-row .v { font-size: 12.5px; color: var(--text-faint); font-weight: 600; white-space: nowrap; flex: none; font-variant-numeric: tabular-nums; }

 .podman-chip {
  display: inline-flex; align-items: center; gap: 5px; padding: 3px 9px; border-radius: 100px;
@@ -183,27 +225,117 @@
 .podman-plugin tbody tr:last-child td { border-bottom: none; }
 .podman-plugin tbody tr:hover { background: var(--surface-2); }
 .podman-table-wrap { overflow-x: auto; }
-.podman-row-name { display: flex; align-items: center; gap: 10px; font-weight: 600; }
+/*
+ * table-layout: auto (the default) sizes every column from the widest
+ * content across only the CURRENTLY VISIBLE rows — so expanding/
+ * collapsing a folder (which adds/removes rows) changed what counted as
+ * "widest" and shifted every column, including the header text, on
+ * every toggle (found live). Fixed widths (set on the <th>s in
+ * Podman.page) make column sizing depend only on those, never on row
+ * content, so toggling a folder can no longer move anything.
+ */
+#containers-table { table-layout: fixed; }
+/* Only the plain-text columns truncate with an ellipsis (Image/Ports —
+   both are just escaped text directly in the <td>, so ellipsis renders
+   correctly) — NOT the Name column (its text sits inside a flex
+   button+icon, where overflow:hidden would hard-clip instead of
+   ellipsis-truncate), the folder-header row's colspan cell (its member
+   chips need to wrap, see .podman-folder-members), or the actions
+   column (icon buttons, not text, would otherwise get clipped if they
+   ever didn't quite fit). */
+#containers-table tbody > tr:not(.podman-folder-row) > td:nth-child(3),
+#containers-table tbody > tr:not(.podman-folder-row) > td:nth-child(5) {
+  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+}
+/* .podman-name-cell is a <div> INSIDE the <td>, not the <td> itself —
+   display:flex directly on a table cell pulls it out of table-cell
+   layout entirely, so with table-layout:fixed it stops respecting the
+   column width the <th> assigns and throws off alignment with every
+   other column (found live: the whole Name column visibly drifted).
+   The div gives the same flex row (so a WebUI link, see
+   .podman-webui-link, sits on the same line as the name button instead
+   of wrapping below it — .podman-row-name-btn's own display:flex makes
+   IT block-level by default, which would otherwise push everything
+   after it in the cell onto its own line) without that side effect.
+   min-width:0 lets the button actually shrink instead of forcing the
+   cell wider than its fixed column width; .text (not the plain text
+   node it used to be) is what actually ellipsis-truncates, since
+   text-overflow only applies to the element whose own inline content
+   overflows, not a nested flex child's. */
+.podman-name-cell { display: flex; align-items: center; gap: 6px; }
+.podman-row-name { display: flex; align-items: center; gap: 10px; font-weight: 600; min-width: 0; }
+.podman-row-name .text { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .podman-row-name-btn {
-  appearance: none; border: none; background: none; padding: 0; cursor: pointer;
-  color: var(--text); font-family: var(--font-ui); font-size: 13px; text-align: left;
+  /* !important for the same reason as .podman-btn-ghost/-primary — Unraid's
+     own site-wide button theme otherwise still shows its default border
+     at rest (only losing to plain rules on hover), so a name link one
+     click away from every table row still looked like a bordered button
+     forever, not a plain label. */
+  appearance: none; border: none !important; background: none !important; padding: 0; cursor: pointer;
+  color: var(--text); font-family: var(--font-ui); font-size: 13px; text-align: left; min-width: 0;
 }
 .podman-row-name-btn:hover { color: var(--accent-strong); }
 .podman-row-name-btn:hover .ico { border-color: var(--accent); }
 .podman-row-name .ico {
  width: 26px; height: 26px; border-radius: 6px; flex: none; background: var(--surface-3);
  display: grid; place-items: center; font-size: 12px; border: 1px solid var(--border); color: var(--text-dim);
+  overflow: hidden;
 }
+.podman-row-name .ico img { width: 100%; height: 100%; object-fit: cover; }
 .podman-row-sub { font-size: 11.5px; color: var(--text-faint); font-weight: 500; margin-top: 1px; }
-.podman-actions { display: flex; gap: 4px; justify-content: flex-end; }
+/*
+ * The actions <td> itself stays a plain table-cell (default display) so
+ * every row's column width is computed the same way by the table's layout
+ * algorithm — putting "display: flex" directly on the <td> used to take it
+ * out of that algorithm, so browsers could size/position it slightly
+ * differently row to row (found live: the trash-can button in Images drifted
+ * a few pixels between rows instead of lining up in one column). The actual
+ * flex/gap/alignment lives on this inner wrapper instead.
+ */
+.podman-actions { text-align: right; white-space: nowrap; }
+.podman-actions-row { display: inline-flex; gap: 4px; justify-content: flex-end; }
+
+/*
+ * Segmented toggle (Containers' All/Running/Stopped filter, Logs' Follow/
+ * Paused) — previously just an inline-styled wrapper <div> around plain
+ * <button>s with no CSS of their own at all, so every option (not just the
+ * active one) showed Unraid's own default button border permanently,
+ * all three chips looking identically "selected". !important for the same
+ * site-wide-theme-override reason as .podman-btn-ghost/-primary.
+ */
+.podman-segmented { display: flex; gap: 2px; background: var(--surface-3); border: 1px solid var(--text-faint); padding: 3px; border-radius: 8px; }
+.podman-segmented button {
+  appearance: none; border: none !important; background: transparent !important; color: var(--text-dim) !important;
+  padding: 6px 12px; border-radius: 6px; font-size: 12px; font-weight: 700; cursor: pointer;
+  font-family: var(--font-ui); transition: background .12s, color .12s;
+}
+.podman-segmented button:hover { color: var(--text) !important; }
+/* Filled with the accent color (not just a slightly different neutral
+   shade) — the previous var(--surface) vs. var(--surface-2) contrast
+   between active/inactive was too close in the dark theme to notice at a
+   glance (found live). */
+.podman-segmented button.active { background: var(--accent) !important; color: var(--accent-contrast) !important; box-shadow: var(--shadow); }

 .podman-usage-mini { display: flex; align-items: center; gap: 8px; min-width: 110px; }
 .podman-usage-mini .track { flex: 1; height: 5px; border-radius: 3px; background: var(--surface-3); overflow: hidden; }
 .podman-usage-mini .track > span { display: block; height: 100%; background: var(--accent); }
-.podman-usage-mini .num { font-size: 11.5px; color: var(--text-dim); width: 34px; text-align: right; }
+.podman-usage-mini .num { font-size: 11.5px; color: var(--text-dim); width: 34px; text-align: right; font-variant-numeric: tabular-nums; }

 .podman-toolbar { display: flex; align-items: center; gap: 10px; padding: 14px 18px; border-bottom: 1px solid var(--border); flex-wrap: wrap; }
-.podman-search { flex: 1; min-width: 180px; background: var(--surface-2); border: 1px solid var(--border); border-radius: 7px; padding: 7px 11px; font-size: 13px; color: var(--text); font-family: var(--font-ui); }
+/*
+ * !important throughout: Unraid's own webGui/styles/default-base.css
+ * targets input[type="text"] with an attribute selector (higher
+ * specificity than our single .podman-search class, :where() around it
+ * notwithstanding) forcing border-width:0 / border-bottom-width:1px /
+ * background:transparent — an underline-only text field, not a boxed one.
+ * Found live: our border/background were being silently dropped even
+ * though this rule appears later in the stylesheet.
+ */
+.podman-search {
+  flex: 1; min-width: 180px; max-width: 320px; font-size: 13px; color: var(--text); font-family: var(--font-ui);
+  background: var(--surface-3) !important; border: 1px solid var(--text-faint) !important;
+  border-radius: 7px !important; padding: 7px 11px !important;
+}
 .podman-search::placeholder { color: var(--text-faint); }

 .podman-two-col { display: grid; grid-template-columns: 1.3fr 1fr; gap: 14px; align-items: start; }
@@ -220,7 +352,7 @@
 .podman-pod-card { border: 1px solid var(--border); border-radius: 10px; overflow: hidden; margin-bottom: 14px; background: var(--surface); box-shadow: var(--shadow); }
 .podman-pod-head { display: flex; align-items: center; gap: 10px; padding: 13px 16px; background: var(--surface-2); border-bottom: 1px solid var(--border); }
 .podman-pod-head .name { font-weight: 700; font-size: 13.5px; }
-.podman-pod-head .infra { font-size: 11.5px; color: var(--text-faint); }
+.podman-pod-head .infra { font-size: 11.5px; color: var(--text-faint); margin-right: auto; }

 .podman-badge { display: inline-block; font-size: 10.5px; font-weight: 700; color: var(--text-dim); background: var(--surface-3); padding: 2px 8px; border-radius: 100px; margin-top: 6px; }

@@ -237,8 +369,18 @@
 }
 .podman-template-name { font-weight: 700; font-size: 13.5px; }
 .podman-template-overview { font-size: 12px; color: var(--text-dim); line-height: 1.4; }
-.podman-template-actions { display: flex; gap: 8px; margin-top: auto; padding-top: 4px; }
-.podman-template-actions .podman-btn { flex: 1; justify-content: center; padding: 6px 10px; font-size: 12px; }
+.podman-template-actions { display: flex; gap: 6px; margin-top: auto; padding-top: 4px; }
+/*
+ * min-width: 0 overrides the flex-item default of min-width: auto, which
+ * otherwise refuses to shrink a button below its own label's intrinsic
+ * width — without it, "Delete" (the widest label, and uppercased by
+ * Unraid's own site-wide button theme) pushed past the card's right edge
+ * instead of actually sharing the row evenly with Use/Export (found live).
+ */
+.podman-template-actions .podman-btn {
+  flex: 1; min-width: 0; justify-content: center; padding: 6px 8px; font-size: 11.5px;
+  white-space: nowrap; overflow: hidden; text-overflow: ellipsis;
+}

 .podman-local-template-list { max-height: 220px; overflow-y: auto; border: 1px solid var(--border); border-radius: 7px; margin-top: 8px; }
 .podman-local-template-item {
@@ -257,19 +399,35 @@
 .podman-log-pane {
  background: #0f1114; color: #c7ccd4; font-family: var(--font-mono); font-size: 12.3px;
  padding: 14px 16px; height: 400px; overflow-y: auto; line-height: 1.65;
+  /* Settings' service log (and the log modal) set .textContent directly
+     on this element rather than wrapping every line in a child .l div —
+     needs its own white-space here too, or real newlines in rc.podman's
+     output collapse into one run-together line (found live: the whole
+     multi-line `rc.podman status` output rendered as a single paragraph). */
+  white-space: pre-wrap;
 }
 .podman-log-pane .l { white-space: pre-wrap; word-break: break-word; }
 .podman-log-pane .ts { color: #6b7280; }
 .podman-log-pane .lvl-warn { color: #e0b23d; }
 .podman-log-pane .lvl-error { color: #ef6470; }

-.podman-term { background: #0f1114; color: #d7dbe0; font-family: var(--font-mono); font-size: 12.6px; border-radius: 8px; padding: 14px 16px; height: 380px; overflow-y: auto; line-height: 1.7; }
-.podman-term .prompt { color: #4cc785; }
-.podman-term .path { color: #6fb2f5; }
-.podman-term-input {
-  width: 100%; margin-top: 10px; background: #0f1114; color: #d7dbe0; border: 1px solid var(--border);
-  border-radius: 6px; padding: 8px 10px; font-family: var(--font-mono); font-size: 12.6px;
+.podman-term-launcher {
+  display: flex; align-items: flex-end; gap: 16px; flex-wrap: wrap; margin-bottom: 14px;
+  padding: 12px 14px; background: var(--surface-2); border: 1px solid var(--border); border-radius: 8px;
 }
+.podman-term-launcher label { display: flex; flex-direction: column; gap: 4px; font-size: 12.5px; font-weight: 600; color: var(--text-dim); }
+/*
+ * !important here for the same reason as .podman-search's: Unraid's own
+ * webGui/styles/default-base.css has `select:where(:not(.unapi *))` rules
+ * for background/border/padding that would otherwise still show through
+ * around this class's box-model properties.
+ */
+.podman-term-select {
+  min-width: 180px !important; padding: 7px 12px !important; font-size: 13px !important;
+  font-family: var(--font-mono) !important; color: var(--text) !important;
+  background: var(--surface-3) !important; border: 1px solid var(--accent) !important; border-radius: 6px !important;
+}
+.podman-term-frame { display: block; width: 100%; height: 480px; border: 1px solid var(--border); border-radius: 8px; background: #0f1114; }

 .podman-compose-layout { display: grid; grid-template-columns: 230px 1fr; min-height: 480px; }
@media (max-width: 800px) { .podman-compose-layout { grid-template-columns: 1fr; } }
@@ -278,6 +436,19 @@
 .podman-compose-proj.active { background: var(--surface-2); box-shadow: inset 2px 0 0 var(--accent); }
 .podman-compose-proj .path { font-size: 11px; color: var(--text-faint); margin-top: 2px; font-family: var(--font-mono); }
 .podman-yaml { background: #0f1114; color: #c7ccd4; font-family: var(--font-mono); font-size: 12.4px; padding: 16px 18px; height: 420px; overflow: auto; line-height: 1.7; white-space: pre-wrap; }
+/*
+ * !important: this is now a real <textarea>, not a read-only <pre> —
+ * Unraid's own webGui/styles/default-base.css targets textarea the same
+ * way it targets input[type="text"] (see .podman-search's comment for
+ * the exact rule), forcing border-width:0/border-bottom-width:1px/
+ * background:transparent/border-radius:0, which would otherwise make the
+ * whole editor look like a barely-visible underline instead of an actual
+ * text area.
+ */
+.podman-yaml-editor {
+  display: block; width: 100%; box-sizing: border-box; resize: vertical;
+  border: none !important; border-radius: 0 !important; outline: none;
+}

 .podman-field-row { display: grid; grid-template-columns: 220px 1fr; gap: 16px; padding: 14px 18px; border-bottom: 1px solid var(--border); align-items: start; }
 .podman-field-row:last-child { border-bottom: none; }
@@ -288,11 +459,68 @@
  font-size: 13px; color: var(--text); width: 100%; max-width: 340px; font-family: var(--font-ui);
 }
 .podman-danger-card { border-color: color-mix(in srgb, var(--bad) 40%, var(--border)); }
+
+/* Settings panel: a shared save action above all cards (Storage's and
+   Autostart & Lifecycle's fields save together in one call — see
+   settings.js's save() — so one button belongs above both, not buried in
+   either card, and definitely not in its own row with an empty label).
+   Framed as its own small bar (background/border), not bare text+button
+   floating at the top of the page. */
+.podman-settings-actions {
+  display: flex; align-items: center; justify-content: space-between; gap: 16px; margin-bottom: 14px;
+  padding: 12px 16px; background: var(--surface-2); border: 1px solid var(--border); border-radius: 10px;
+}
+.podman-settings-actions .hint { margin: 0; max-width: 52ch; color: var(--text-dim); }
+.podman-card-head .sub { margin-top: 3px; }
+/* Number field + unit label (GB, seconds) — the input itself stays compact
+   instead of stretching to .podman-field-row's normal 340px text-field width. */
+.podman-input-suffix { display: flex; align-items: center; gap: 8px; }
+.podman-input-suffix input[type="number"] { max-width: 100px; width: auto; }
+.podman-input-suffix span { font-size: 12px; color: var(--text-dim); }
+
+.podman-service-row { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; margin-bottom: 12px; }
+.podman-service-row:last-child { margin-bottom: 0; }
+
+/*
+ * Toggle switch — a plain checkbox reads as a leftover form control next
+ * to everything else in this panel getting a designed treatment; this
+ * hides the native checkbox (still the real, accessible input driving
+ * state) and draws a track+thumb off its :checked state instead. Sized in
+ * em off the track's own font-size so it scales if that ever changes.
+ */
+.podman-switch { position: relative; display: inline-flex; align-items: center; cursor: pointer; font-size: 22px; }
+.podman-switch input { position: absolute; opacity: 0; width: 1px; height: 1px; }
+.podman-switch-track {
+  display: inline-block; width: 1.9em; height: 1.05em; border-radius: 999px;
+  background: var(--surface-3); border: 1px solid var(--border); transition: background .15s, border-color .15s;
+}
+.podman-switch-thumb {
+  display: block; width: 0.75em; height: 0.75em; margin: 0.13em; border-radius: 50%;
+  background: var(--text-faint); transition: transform .15s, background .15s;
+}
+.podman-switch input:checked + .podman-switch-track { background: var(--accent); border-color: var(--accent); }
+.podman-switch input:checked + .podman-switch-track .podman-switch-thumb { background: var(--accent-contrast); transform: translateX(0.85em); }
+.podman-switch input:focus-visible + .podman-switch-track { outline: 2px solid var(--accent); outline-offset: 2px; }
+
+.podman-version-chips { display: flex; flex-wrap: wrap; gap: 8px; }
+.podman-version-chip {
+  font-size: 11.5px; font-family: var(--font-mono); background: var(--surface-3); color: var(--text-dim);
+  border: 1px solid var(--border); padding: 5px 11px; border-radius: 100px;
+}
+.podman-version-chip b { color: var(--text); font-weight: 600; margin-left: 5px; }
 .podman-danger-card .podman-card-head { border-bottom-color: color-mix(in srgb, var(--bad) 30%, var(--border)); }
 .podman-danger-card .podman-card-head h2 { color: var(--bad); }

 .podman-badge-update { font-size: 10px; font-weight: 700; color: var(--accent-strong); background: color-mix(in srgb, var(--accent) 16%, transparent); padding: 2px 7px; border-radius: 100px; margin-left: 8px; }

+.podman-webui-link {
+  display: inline-flex; align-items: center; justify-content: center; height: 20px; padding: 0 7px;
+  border-radius: 5px; color: var(--text-faint); text-decoration: none; font-size: 10px; font-weight: 700;
+  letter-spacing: .03em; flex: none; border: 1px solid var(--border); background: var(--surface-3);
+  vertical-align: middle;
+}
+.podman-webui-link:hover { color: var(--accent-strong); border-color: var(--accent); }
+
 .podman-loading, .podman-error { padding: 32px 18px; text-align: center; color: var(--text-faint); font-size: 13px; }

 /**
@@ -368,7 +596,18 @@

 /* Anchored dropdown context menu — see app.js openContextMenu(). */
 .podman-context-menu {
-  position: absolute; width: 180px; background: var(--surface); border: 1px solid var(--border);
+  /*
+   * "fixed", not "absolute": this menu is appended to .podman-plugin, not
+   * document.body, and Unraid's own page wrapper around .podman-plugin
+   * turned out to have its own positioned ancestor — with "absolute" the
+   * menu was positioning itself relative to THAT ancestor's box while the
+   * JS math (getBoundingClientRect + scrollY/X) assumed the viewport,
+   * so it rendered far from the button that opened it (found live: it
+   * appeared well below and to the side of the anchor). "fixed" is always
+   * viewport-relative regardless of any ancestor, which is what the JS
+   * math actually assumes.
+   */
+  position: fixed; width: 180px; background: var(--surface); border: 1px solid var(--border);
  border-radius: 9px; box-shadow: var(--shadow); z-index: 1001; padding: 4px; display: grid; gap: 1px;
 }
 .podman-context-menu button {
@@ -377,7 +616,8 @@
  font-family: var(--font-ui); width: 100%;
 }
 .podman-context-menu button:hover { background: var(--surface-2); }
-.podman-context-menu button.danger { color: var(--bad); }
+.podman-context-menu button.danger { color: var(--bad); background: var(--bad-bg); }
+.podman-context-menu button.danger:hover { background: var(--bad); color: var(--bad-contrast); }
 .podman-context-menu button[disabled] { opacity: .4; cursor: not-allowed; }
 .podman-context-menu-sep { height: 1px; background: var(--border); margin: 4px 2px; }

@@ -403,3 +643,84 @@
  padding: 14px 16px; border-radius: 8px; white-space: pre-wrap; word-break: break-all; line-height: 1.6;
 }
 .podman-detail-empty { color: var(--text-faint); font-size: 12.5px; padding: 8px 0; }
+
+/*
+ * Toast notifications — replaces alert() for one-way feedback (saved,
+ * removed, failed, ...) across every panel. Confirmations stay native
+ * confirm() (a decision, not a notice); long-running command output
+ * stays in the existing log-modal pattern (a toast has to stay short to
+ * be readable while it's animating/auto-dismissing). z-index above the
+ * modal backdrop (1000) so a toast fired from within a modal's own
+ * action (e.g. "Save failed") is never hidden behind it.
+ */
+.podman-toast-container {
+  position: fixed; right: 20px; bottom: 20px; z-index: 1100;
+  display: flex; flex-direction: column-reverse; gap: 10px; pointer-events: none;
+  max-width: min(380px, calc(100vw - 40px));
+}
+.podman-toast {
+  pointer-events: auto; display: flex; align-items: flex-start; gap: 10px;
+  background: var(--surface); border: 1px solid var(--border); border-left: 3px solid var(--neutral);
+  border-radius: 9px; box-shadow: var(--shadow); padding: 12px 14px; font-size: 13px; color: var(--text);
+  animation: podman-toast-in .18s ease-out;
+}
+.podman-toast.leaving { animation: podman-toast-out .16s ease-in forwards; }
+.podman-toast-success { border-left-color: var(--good); }
+.podman-toast-warn { border-left-color: var(--warn); }
+.podman-toast-error { border-left-color: var(--bad); }
+.podman-toast .ico { flex: none; margin-top: 1px; font-size: 15px; line-height: 1; }
+.podman-toast-success .ico { color: var(--good); }
+.podman-toast-warn .ico { color: var(--warn); }
+.podman-toast-error .ico { color: var(--bad); }
+.podman-toast .msg { flex: 1; line-height: 1.45; word-break: break-word; }
+.podman-toast .close {
+  appearance: none; background: none; border: none; color: var(--text-faint); cursor: pointer;
+  font-size: 15px; line-height: 1; padding: 0; flex: none; font-family: var(--font-ui);
+}
+.podman-toast .close:hover { color: var(--text); }
+@keyframes podman-toast-in { from { opacity: 0; transform: translateY(8px); } to { opacity: 1; transform: translateY(0); } }
+@keyframes podman-toast-out { from { opacity: 1; transform: translateY(0); } to { opacity: 0; transform: translateY(8px); } }
+@media (prefers-reduced-motion: reduce) {
+  .podman-toast, .podman-toast.leaving { animation: none; }
+}
+
+/* Container folders — a group header row spanning the full table width,
+   sitting between normal <tr>s in the same <tbody> (see containers.js's
+   renderTable()) rather than a separate nested table, so column
+   alignment with member rows stays free. */
+.podman-folder-row td { padding: 0; background: var(--surface-2); border-bottom: 1px solid var(--border); }
+.podman-folder-head { display: flex; align-items: center; gap: 14px; padding: 9px 16px; flex-wrap: wrap; }
+.podman-folder-toggle {
+  appearance: none; background: none; border: none; display: flex; align-items: center; gap: 10px;
+  cursor: pointer; font-family: var(--font-ui); color: var(--text); padding: 0; flex: none; text-align: left;
+}
+.podman-folder-toggle .chevron { color: var(--text-faint); font-size: 10px; width: 10px; flex: none; }
+.podman-folder-toggle .ico {
+  width: 22px; height: 22px; border-radius: 6px; flex: none; background: var(--surface-3);
+  display: grid; place-items: center; font-size: 10.5px; border: 1px solid var(--border); color: var(--text-dim);
+  overflow: hidden;
+}
+.podman-folder-toggle .ico img { width: 100%; height: 100%; object-fit: cover; }
+.podman-folder-toggle .name { font-weight: 700; font-size: 12.5px; }
+.podman-folder-toggle .count {
+  font-size: 11px; color: var(--text-faint); font-weight: 700; background: var(--surface-3);
+  padding: 1px 8px; border-radius: 100px; font-variant-numeric: tabular-nums; white-space: nowrap;
+}
+
+/* The always-visible per-member preview inside a folder's header row —
+   see containers.js's folderMemberChipHtml(). Each chip opens that
+   container's detail modal directly, without needing to expand the
+   folder first. */
+.podman-folder-members { display: flex; align-items: center; gap: 6px; flex-wrap: wrap; flex: 1; min-width: 0; }
+.podman-folder-member {
+  appearance: none; display: inline-flex; align-items: center; gap: 6px; border: 1px solid var(--border);
+  background: var(--surface); border-radius: 100px; padding: 3px 10px 3px 4px; cursor: pointer;
+  font-family: var(--font-ui); color: var(--text-dim); font-size: 11.5px;
+}
+.podman-folder-member:hover { border-color: var(--accent); color: var(--text); }
+.podman-folder-member .ico { width: 18px; height: 18px; border-radius: 5px; font-size: 9px; }
+.podman-folder-member .name { font-weight: 600; }
+.podman-folder-member .dot { width: 6px; height: 6px; border-radius: 50%; flex: none; }
+.podman-folder-member .dot.good { background: var(--good); }
+.podman-folder-member .dot.bad { background: var(--bad); }
+.podman-folder-member .state { color: var(--text-faint); }