BUG: API delete endpoint does not stop/remove Docker container — orphaned containers #106

New Issue

clawbot · 2026-02-20T12:28:26+01:00

clawbot commented

2026-02-20 12:28:26 +01:00

Severity: HIGH

File & Line

internal/handlers/api.go:283-305

Description

HandleAPIDeleteApp calls h.appService.DeleteApp() which only deletes the database record (with CASCADE). It does not call h.cleanupContainer() to stop and remove the running Docker container.

Compare with the HTML handler HandleAppDelete (app.go:325) which correctly cleans up:

// app.go:325 — CORRECT: cleans up container
h.cleanupContainer(request.Context(), appID, application.Name)
deleteErr := application.Delete(request.Context())

// api.go:299 — BUG: no container cleanup
deleteErr := h.appService.DeleteApp(request.Context(), application)

Impact

Deleting an app via the API leaves its Docker container running forever. The container has restart: unless-stopped policy, so it will persist across Docker daemon restarts. Since the DB record is gone, upaas has no way to discover or manage the orphaned container.

Suggested Fix

Call h.cleanupContainer(request.Context(), appID, application.Name) before deleting the app record, same as the HTML handler.

## Severity: HIGH ## File & Line `internal/handlers/api.go:283-305` ## Description `HandleAPIDeleteApp` calls `h.appService.DeleteApp()` which only deletes the database record (with CASCADE). It does **not** call `h.cleanupContainer()` to stop and remove the running Docker container. Compare with the HTML handler `HandleAppDelete` (app.go:325) which correctly cleans up: ```go // app.go:325 — CORRECT: cleans up container h.cleanupContainer(request.Context(), appID, application.Name) deleteErr := application.Delete(request.Context()) // api.go:299 — BUG: no container cleanup deleteErr := h.appService.DeleteApp(request.Context(), application) ``` ## Impact Deleting an app via the API leaves its Docker container running forever. The container has `restart: unless-stopped` policy, so it will persist across Docker daemon restarts. Since the DB record is gone, upaas has no way to discover or manage the orphaned container. ## Suggested Fix Call `h.cleanupContainer(request.Context(), appID, application.Name)` before deleting the app record, same as the HTML handler.

clawbot added this to the 1.0 milestone 2026-02-20 12:28:26 +01:00

clawbot added the

bug

label 2026-02-20 12:28:26 +01:00

clawbot self-assigned this 2026-02-20 12:28:26 +01:00

clawbot referenced this issue from a commit

2026-02-20 12:35:50 +01:00

fix: API delete endpoint cleans up Docker container before DB deletion (closes #106)

clawbot referenced this issue

2026-02-20 12:36:00 +01:00

fix: resolve 1.0 audit bugs (closes #104, #105, #106, #107, #108) #109

clawbot referenced this issue