Publish curated Unraid-AppOps-Gateway source from a506550ef83ef2d81651e37c98a89f7ee330c730

backend/app/connectors/portainer.py

@@ -11,8 +11,22 @@ from ..core.config import settings
 from ..core.redaction import redact_message
 from .base import BaseConnector
 
-
 _PORTAINER_DEFAULT_TIMEOUT_SECONDS = 8.0
+_CONTROLLER_OWNED_CI_CONTAINER_NAMES = frozenset({
+    'itworx-ci-checks',
+    'itworx-ci-backend',
+    'itworx-ci-frontend',
+    'itworx-ci-security',
+    'itworx-ci-browser',
+    'itworx-ci-build',
+    'itworx-security-runner',
+    'itworx-validation-runner-2',
+    'itworx-validation-runner-3',
+    'itworx-docker-runner',
+    'itworx-browser-runner',
+    'itworx-validation-runner-burst-1',
+    'gitea-runner-dind',
+})
 
 
 @dataclass
@@ -213,6 +227,10 @@ class PortainerConnector(BaseConnector):
         if not selected:
             return {'status': 'not_found', 'reason': f'Container {target} not found'}
 
+        selected_name = str(selected.get('name', '')).strip().strip('/').lower()
+        if selected_name in _CONTROLLER_OWNED_CI_CONTAINER_NAMES:
+            return {'status': 'blocked', 'reason': 'controller_owned_ci_lifecycle'}
+
         container_name = selected.get('id') or selected.get('name')
         if not container_name:
             return {'status': 'error', 'reason': 'Unable to resolve container identifier'}