HandleAPIDeleteApp calls h.appService.DeleteApp() which only deletes the database record (with CASCADE). It does not call h.cleanupContainer() to stop and remove the running Docker container.
Compare with the HTML handler HandleAppDelete (app.go:325) which correctly cleans up:
// app.go:325 — CORRECT: cleans up containerh.cleanupContainer(request.Context(),appID,application.Name)deleteErr:=application.Delete(request.Context())// api.go:299 — BUG: no container cleanupdeleteErr:=h.appService.DeleteApp(request.Context(),application)
Impact
Deleting an app via the API leaves its Docker container running forever. The container has restart: unless-stopped policy, so it will persist across Docker daemon restarts. Since the DB record is gone, upaas has no way to discover or manage the orphaned container.
Suggested Fix
Call h.cleanupContainer(request.Context(), appID, application.Name) before deleting the app record, same as the HTML handler.
## Severity: HIGH
## File & Line
`internal/handlers/api.go:283-305`
## Description
`HandleAPIDeleteApp` calls `h.appService.DeleteApp()` which only deletes the database record (with CASCADE). It does **not** call `h.cleanupContainer()` to stop and remove the running Docker container.
Compare with the HTML handler `HandleAppDelete` (app.go:325) which correctly cleans up:
```go
// app.go:325 — CORRECT: cleans up container
h.cleanupContainer(request.Context(), appID, application.Name)
deleteErr := application.Delete(request.Context())
// api.go:299 — BUG: no container cleanup
deleteErr := h.appService.DeleteApp(request.Context(), application)
```
## Impact
Deleting an app via the API leaves its Docker container running forever. The container has `restart: unless-stopped` policy, so it will persist across Docker daemon restarts. Since the DB record is gone, upaas has no way to discover or manage the orphaned container.
## Suggested Fix
Call `h.cleanupContainer(request.Context(), appID, application.Name)` before deleting the app record, same as the HTML handler.
clawbot
added this to the 1.0 milestone 2026-02-20 12:28:26 +01:00
clawbot
added the bug label 2026-02-20 12:28:26 +01:00
clawbot
self-assigned this 2026-02-20 12:28:26 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: HIGH
File & Line
internal/handlers/api.go:283-305Description
HandleAPIDeleteAppcallsh.appService.DeleteApp()which only deletes the database record (with CASCADE). It does not callh.cleanupContainer()to stop and remove the running Docker container.Compare with the HTML handler
HandleAppDelete(app.go:325) which correctly cleans up:Impact
Deleting an app via the API leaves its Docker container running forever. The container has
restart: unless-stoppedpolicy, so it will persist across Docker daemon restarts. Since the DB record is gone, upaas has no way to discover or manage the orphaned container.Suggested Fix
Call
h.cleanupContainer(request.Context(), appID, application.Name)before deleting the app record, same as the HTML handler.