mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 20:00:08 +00:00
Anso
56 lines
4.8 KiB
Plaintext
56 lines
4.8 KiB
Plaintext
---
|
|
title: "Docker Label Audit"
|
|
description: "Audit Docker and Compose labels that drive external automation across the fleet and inside each stack."
|
|
---
|
|
|
|
Docker labels are metadata declared on Compose services or attached to running containers. They are different from Sencho Stack Labels used for organizing stacks and Node Labels used for Blueprint placement.
|
|
|
|
Sencho surfaces two read-only audit views for these labels:
|
|
|
|
- **Fleet · Docker Labels** for estate-wide visibility across every node
|
|
- **Stack · Compose Labels** for per-stack reconciliation between declared Compose labels and labels present on running containers
|
|
|
|
## Fleet Docker Labels tab
|
|
|
|
Open **Fleet** and select the **Docker Labels** tab (after **Map**). The panel is titled **Docker label audit** and offers two layouts:
|
|
|
|
| View | What it shows |
|
|
|------|----------------|
|
|
| **By container** | Each container with its label count. Expand a row to see every key, value, and provenance badge. |
|
|
| **By label** | Each unique `key=value` pair and every container that carries it, with node name chips on multi-node fleets. |
|
|
|
|
Use the search box to filter by label key, value, container name, stack, or node. When a container belongs to a known stack, **Open stack** jumps to that stack in the editor.
|
|
|
|
Every label carries a provenance badge so you can tell where it came from:
|
|
|
|
- **Image** for labels inherited from the container image (for example OCI `org.opencontainers.image.*` metadata)
|
|
- **Present at runtime** for other labels set on the running container
|
|
- **Docker Compose system label** for keys starting with `com.docker.compose.`
|
|
- **Unknown** when a container or its image could not be inspected
|
|
|
|
The fleet view reads container-level metadata and does not open the compose file, so it cannot tell a Compose-declared label from any other label set on the container: labels you declared in Compose appear here as **Present at runtime**. To see which labels come from the compose file, use the per-stack **Compose Labels** tab below. When a container or its image cannot be inspected, the affected labels show as **Unknown** and the panel names the nodes it could not fully inspect.
|
|
|
|
In the **By label** layout, open the **Filters** popover next to the search box. The **Defined by** section lists toggle pills for each provenance type present in the data (**Image**, **Runtime**, **System**, and **Unknown** when present). Turn a pill off to hide that source; the button shows a count badge while any filter is active, and **Clear filters** resets the popover. Automation tools such as Watchtower, Diun, and Traefik read these labels, so the audit makes it easy to confirm which containers are opted in or out.
|
|
|
|
Runtime labels are static until the container is recreated. Changes declared in Compose require save and redeploy before they appear on running containers.
|
|
|
|
## Stack Compose Labels tab
|
|
|
|
Inside the stack editor, open the **Compose Labels** tab in the anatomy strip. For each service you see:
|
|
|
|
- **Declared in Compose** labels from the effective rendered compose model
|
|
- **Present at runtime** labels read from each running replica, each with its provenance badge (Compose, Image, or runtime)
|
|
- Reconciliation hints: **only in Compose**, **only on running container**, **present in both**, or **value changed** when a key is declared and running but the values differ
|
|
|
|
Because this tab renders the compose model, it can identify Compose-declared labels accurately. A toolbar at the top combines a **search box** with a **Filters** popover. The search matches label keys and values as well as service and container names. The popover has a **Defined by** section with toggle pills for each provenance present (**Compose File**, **Image**, **Runtime**, **System**) and a **Services** section to show or hide individual service cards when the stack has more than one service. The Filters button shows a count badge for active facet and service filters; **Clear filters** resets both sections. Matching a service or container name reveals that parent's labels even when the text does not match a specific key or value. Reconciliation counts always reflect only the labels currently visible.
|
|
|
|
When Compose cannot be fully rendered, the panel warns that declared labels may be incomplete but still shows whatever runtime data is available. If a replica cannot be inspected, it is flagged with **Runtime labels unavailable** and the panel notes that provenance may be incomplete.
|
|
|
|
## Sensitive values
|
|
|
|
Some label keys look like secrets (for example keys containing `token`, `password`, or `auth`). Their values are redacted by default. Admins can reveal full values with the **Reveal** control, which re-fetches the inventory with elevated read access.
|
|
|
|
## Editing labels
|
|
|
|
Compose label editing from these panels is not available yet. To change labels today, edit the compose file directly and redeploy the stack.
|