github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-06 20:59:07 -05:00
Code Issues 564 Packages Projects Releases 72 Wiki Activity

[GH-ISSUE #1864] Resources created from Docker labels are not removed when labels are deleted, leaving services unintentionally exposed #3973

New Issue
Closed
opened 2026-04-20 08:19:45 -05:00 by GiteaMirror · 6 comments
GiteaMirror commented 2026-04-20 08:19:45 -05:00
Owner
Copy Link

Originally created by @hilsonp on GitHub (Nov 14, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1864

Describe the Bug

When a Pangolin resource is created via Docker labels, it correctly appears in the UI.
However, if those labels are later removed from the Docker Compose configuration and the container is restarted, the Pangolin resource remains active instead of being removed or disabled.

This results in a potentially dangerous situation where a service is still reachable from the public network even though the configuration-as-code source (Git) no longer defines any labels for it.
Users familiar with Traefik may assume resources are dynamically added/removed based on labels, potentially leading to accidental exposure.

This may relate to: https://github.com/orgs/fosrl/discussions/1648

Environment

  • OS Type & Version: 22.04.1-Ubuntu
  • Pangolin Version: 1.10.0
  • Gerbil Version: 1.2.1
  • Traefik Version: 3.4.0
  • Newt Version: 1.6.0

To Reproduce

  1. Deploy the following minimal Docker Compose configuration:
   services:
     hello:
       image: nginxdemos/hello:0.4
       container_name: hello
       labels:
         - pangolin.proxy-resources.hello.full-domain=hello.${DOMAIN}
         - pangolin.proxy-resources.hello.targets[0].method=http
       networks:
         - fossorial_newt

   networks:
     fossorial_newt:
       external: true
  1. Start the stack (docker compose up -d).
    ➜ The resource appears in Pangolin as expected.
  2. Remove the two Pangolin labels from the hello service.
  3. Restart the container.
  4. Check the Pangolin UI and test public accessibility.
    ➜ The resource is still present and the service remains reachable.

Expected Behavior

When labels defining a resource are removed:
•	The Pangolin resource should automatically disappear, or automatically disable itself.
•	The service should no longer be reachable via the proxy.
•	The UI should match the state defined in Docker Compose so Git remains the single source of truth.
Originally created by @hilsonp on GitHub (Nov 14, 2025). Original GitHub issue: https://github.com/fosrl/pangolin/issues/1864 ### Describe the Bug When a Pangolin resource is created via Docker labels, it correctly appears in the UI. However, if those labels are later removed from the Docker Compose configuration and the container is restarted, the Pangolin resource **remains active** instead of being removed or disabled. This results in a potentially dangerous situation where a service is still reachable from the public network even though the configuration-as-code source (Git) no longer defines any labels for it. Users familiar with Traefik may assume resources are dynamically added/removed based on labels, potentially leading to accidental exposure. This may relate to: https://github.com/orgs/fosrl/discussions/1648 ### Environment - OS Type & Version: 22.04.1-Ubuntu - Pangolin Version: 1.10.0 - Gerbil Version: 1.2.1 - Traefik Version: 3.4.0 - Newt Version: 1.6.0 ### To Reproduce 1. Deploy the following minimal Docker Compose configuration: ```yaml services: hello: image: nginxdemos/hello:0.4 container_name: hello labels: - pangolin.proxy-resources.hello.full-domain=hello.${DOMAIN} - pangolin.proxy-resources.hello.targets[0].method=http networks: - fossorial_newt networks: fossorial_newt: external: true ``` 2. Start the stack (docker compose up -d). ➜ The resource appears in Pangolin as expected. 3. Remove the two Pangolin labels from the hello service. 4. Restart the container. 5. Check the Pangolin UI and test public accessibility. ➜ The resource is still present and the service remains reachable. ### Expected Behavior When labels defining a resource are removed: • The Pangolin resource should automatically disappear, or automatically disable itself. • The service should no longer be reachable via the proxy. • The UI should match the state defined in Docker Compose so Git remains the single source of truth.
GiteaMirror commented 2026-04-20 08:19:48 -05:00
Author
Owner
Copy Link

@hilsonp commented on GitHub (Nov 14, 2025):

Upgraded and re-tested with:

OS Type & Version: 22.04.1-Ubuntu
Pangolin Version: 1.12.2
Gerbil Version: 1.2.2
Traefik Version: 3.6.1
Newt Version: 1.6.0
<!-- gh-comment-id:3534320262 --> @hilsonp commented on GitHub (Nov 14, 2025): Upgraded and re-tested with: OS Type & Version: 22.04.1-Ubuntu Pangolin Version: 1.12.2 Gerbil Version: 1.2.2 Traefik Version: 3.6.1 Newt Version: 1.6.0
GiteaMirror commented 2026-04-20 08:19:50 -05:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Nov 29, 2025):

This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.

<!-- gh-comment-id:3590741856 --> @github-actions[bot] commented on GitHub (Nov 29, 2025): This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
GiteaMirror commented 2026-04-20 08:19:52 -05:00
Author
Owner
Copy Link

@hilsonp commented on GitHub (Nov 29, 2025):

Hopefully, this will be considered.
Thank you for the great work.

<!-- gh-comment-id:3591931796 --> @hilsonp commented on GitHub (Nov 29, 2025): Hopefully, this will be considered. Thank you for the great work.
GiteaMirror commented 2026-04-20 08:19:53 -05:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Dec 15, 2025):

This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.

<!-- gh-comment-id:3652451302 --> @github-actions[bot] commented on GitHub (Dec 15, 2025): This issue has been automatically marked as stale due to 14 days of inactivity. It will be closed in 14 days if no further activity occurs.
GiteaMirror commented 2026-04-20 08:19:53 -05:00
Author
Owner
Copy Link

@hilsonp commented on GitHub (Dec 23, 2025):

Unstaled

<!-- gh-comment-id:3688194733 --> @hilsonp commented on GitHub (Dec 23, 2025): Unstaled
GiteaMirror commented 2026-04-20 08:19:54 -05:00
Author
Owner
Copy Link

@oschwartz10612 commented on GitHub (Dec 24, 2025):

Closing in favor of https://github.com/orgs/fosrl/discussions/1648 as mentioned in your post. I think this is a feature request.

Right now this is expected operation. Resources must be deleted from the UI or the API.

I agree with your statements though so we will consider this as soon as possible and track on the discussion!

<!-- gh-comment-id:3690024998 --> @oschwartz10612 commented on GitHub (Dec 24, 2025): Closing in favor of https://github.com/orgs/fosrl/discussions/1648 as mentioned in your post. I think this is a feature request. Right now this is expected operation. Resources must be deleted from the UI or the API. I agree with your statements though so we will consider this as soon as possible and track on the discussion!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#3973
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?