🐛 fix(watcher): re-derive label-driven fields on docker update events

updateContainerFromInspect previously updated containerFound.labels on
docker start/update/die events but did NOT recompute the derived fields
that depend on labels (tagFamily, includeTags, excludeTags, transformTags,
linkTemplate, triggerInclude, triggerExclude). After a `docker compose
up -d` recreate, the stored Container.tagFamily stayed undefined even
though containerFound.labels['dd.tag.family'] = 'loose', so
getTagFamilyPolicy() defaulted to 'strict' and the strict-family filter
fired the misleading "Strict tag-family policy filtered out..." warning.

The label→field derivation already had a canonical implementation
(resolveLabelsFromContainer in container-init.ts) consumed by the full
getContainers() path; this commit exposes it via a new
applyDerivedLabelFieldsToContainer helper and wires it into
updateContainerFromInspect so event-path updates stay consistent.

displayName, displayIcon, and lookupImage are intentionally excluded:
displayName has its own merge path via getCustomDisplayNameFromLabels,
and displayIcon / lookupImage require imgset/image-reference context
that's only available during the full watch cycle.

Fixes: GH-342

Author: s-b-e-n-s-o-n

app/watchers/providers/docker/Docker.ts

@@ -37,6 +37,7 @@ import Watcher from '../../Watcher.js';
 import { updateContainerFromInspect as updateContainerFromInspectState } from './container-event-update.js';
 import {
   type AliasFilterDecision,
+  applyDerivedLabelFieldsToContainer,
   filterRecreatedContainerAliases,
   getDockerWatcherRegistryId,
   getDockerWatcherSourceKey,
@@ -990,6 +991,7 @@ class Docker extends Watcher<DockerWatcherConfiguration> {
       getCustomDisplayNameFromLabels: (labels) => getLabel(labels, ddDisplayName, wudDisplayName),
       updateContainer: (container) => storeContainer.updateContainer(container),
       logInfo: (message) => logContainer.info(message),
+      applyDerivedLabelFieldsToContainer,
     });
   }
 

app/watchers/providers/docker/container-event-update.test.ts

@@ -619,4 +619,134 @@ describe('container event update helpers', () => {
     expect(container.labels).toEqual({ alpha: '1', beta: 'changed' });
     expect(updateContainer).toHaveBeenCalledWith(container);
   });
+
+  test('updateContainerFromInspect calls applyDerivedLabelFieldsToContainer when labels change', () => {
+    const container = createMockContainer({
+      name: 'my-app',
+      displayName: 'my-app',
+      status: 'running',
+      labels: {},
+      tagFamily: undefined,
+    });
+    const updateContainer = vi.fn();
+    const applyDerivedLabelFieldsToContainer = vi.fn();
+
+    updateContainerFromInspect(
+      container as any,
+      {
+        Name: '/my-app',
+        State: { Status: 'running' },
+        Config: { Labels: { 'dd.tag.family': 'loose' } },
+      },
+      {
+        getCustomDisplayNameFromLabels: () => undefined,
+        updateContainer,
+        applyDerivedLabelFieldsToContainer,
+      },
+    );
+
+    expect(applyDerivedLabelFieldsToContainer).toHaveBeenCalledWith(container, {
+      'dd.tag.family': 'loose',
+    });
+    expect(updateContainer).toHaveBeenCalledWith(container);
+  });
+
+  test('updateContainerFromInspect does not call applyDerivedLabelFieldsToContainer when labels are unchanged', () => {
+    const container = createMockContainer({
+      name: 'my-app',
+      displayName: 'my-app',
+      status: 'running',
+      labels: { 'dd.tag.family': 'loose' },
+    });
+    const updateContainer = vi.fn();
+    const applyDerivedLabelFieldsToContainer = vi.fn();
+
+    updateContainerFromInspect(
+      container as any,
+      {
+        Name: '/my-app',
+        State: { Status: 'running' },
+        Config: { Labels: { 'dd.tag.family': 'loose' } },
+      },
+      {
+        getCustomDisplayNameFromLabels: () => undefined,
+        updateContainer,
+        applyDerivedLabelFieldsToContainer,
+      },
+    );
+
+    expect(applyDerivedLabelFieldsToContainer).not.toHaveBeenCalled();
+    expect(updateContainer).not.toHaveBeenCalled();
+  });
+
+  test('updateContainerFromInspect works without applyDerivedLabelFieldsToContainer dependency (backward compat)', () => {
+    const container = createMockContainer({
+      name: 'my-app',
+      displayName: 'my-app',
+      status: 'running',
+      labels: {},
+    });
+    const updateContainer = vi.fn();
+
+    expect(() =>
+      updateContainerFromInspect(
+        container as any,
+        {
+          Name: '/my-app',
+          State: { Status: 'running' },
+          Config: { Labels: { 'dd.tag.family': 'loose' } },
+        },
+        {
+          getCustomDisplayNameFromLabels: () => undefined,
+          updateContainer,
+          // applyDerivedLabelFieldsToContainer intentionally omitted
+        },
+      ),
+    ).not.toThrow();
+
+    expect(updateContainer).toHaveBeenCalledWith(container);
+  });
+
+  test('updateContainerFromInspect re-derives multiple label fields when labels change', () => {
+    const container = createMockContainer({
+      name: 'my-app',
+      status: 'running',
+      labels: { 'dd.tag.include': '^1\\.' },
+      tagFamily: undefined,
+      includeTags: '^1\\.',
+      excludeTags: undefined,
+    });
+    const updateContainer = vi.fn();
+    const applyDerivedLabelFieldsToContainer = vi.fn((c, labels) => {
+      // Simulate what the real function does
+      c.includeTags = labels['dd.tag.include'];
+      c.excludeTags = labels['dd.tag.exclude'];
+      c.tagFamily = labels['dd.tag.family'];
+    });
+
+    updateContainerFromInspect(
+      container as any,
+      {
+        Name: '/my-app',
+        State: { Status: 'running' },
+        Config: {
+          Labels: {
+            'dd.tag.include': '^2\\.',
+            'dd.tag.exclude': '^alpha',
+            'dd.tag.family': 'loose',
+          },
+        },
+      },
+      {
+        getCustomDisplayNameFromLabels: () => undefined,
+        updateContainer,
+        applyDerivedLabelFieldsToContainer,
+      },
+    );
+
+    expect(container.includeTags).toBe('^2\\.');
+    expect(container.excludeTags).toBe('^alpha');
+    expect(container.tagFamily).toBe('loose');
+    expect(updateContainer).toHaveBeenCalledWith(container);
+  });
 });

app/watchers/providers/docker/container-event-update.ts

@@ -173,6 +173,14 @@ interface UpdateContainerFromInspectDependencies {
   getCustomDisplayNameFromLabels: (labels: Record<string, string>) => string | undefined;
   updateContainer: (container: Container) => void;
   logInfo?: (message: string) => void;
+  /**
+   * Re-derive label-driven fields (tagFamily, includeTags, etc.) from a fresh
+   * label set and write them onto the container. Called when labels change.
+   */
+  applyDerivedLabelFieldsToContainer?: (
+    container: Container,
+    labels: Record<string, string>,
+  ) => void;
 }
 
 function areLabelsEqual(labelsA: Record<string, string>, labelsB: Record<string, string>): boolean {
@@ -238,6 +246,7 @@ export function updateContainerFromInspect(
 
   if (labelsChanged) {
     containerFound.labels = labelsToApply;
+    dependencies.applyDerivedLabelFieldsToContainer?.(containerFound, labelsToApply);
     changed = true;
   }
 

app/watchers/providers/docker/container-init-coverage.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, test, vi } from 'vitest';
 import {
+  applyDerivedLabelFieldsToContainer,
   filterRecreatedContainerAliases,
   getLabel,
   getMatchingImgsetConfiguration,
@@ -330,6 +331,99 @@ describe('container-init coverage', () => {
     ]);
   });
 
+  describe('applyDerivedLabelFieldsToContainer', () => {
+    function makeContainer(overrides: Record<string, any> = {}) {
+      return {
+        id: 'ctr1',
+        name: 'my-app',
+        displayName: 'my-app',
+        status: 'running',
+        watcher: 'local',
+        image: { name: 'library/nginx', tag: { value: '1.0', semver: true } },
+        labels: {},
+        updateAvailable: false,
+        updateKind: { kind: 'unknown' },
+        ...overrides,
+      } as any;
+    }
+
+    test('derives tagFamily from dd.tag.family label', () => {
+      const container = makeContainer();
+      applyDerivedLabelFieldsToContainer(container, { 'dd.tag.family': 'loose' });
+      expect(container.tagFamily).toBe('loose');
+    });
+
+    test('derives includeTags from dd.tag.include label', () => {
+      const container = makeContainer();
+      applyDerivedLabelFieldsToContainer(container, { 'dd.tag.include': '^1\\..*' });
+      expect(container.includeTags).toBe('^1\\..*');
+    });
+
+    test('derives excludeTags from dd.tag.exclude label', () => {
+      const container = makeContainer();
+      applyDerivedLabelFieldsToContainer(container, { 'dd.tag.exclude': '^alpha' });
+      expect(container.excludeTags).toBe('^alpha');
+    });
+
+    test('derives transformTags from dd.tag.transform label', () => {
+      const container = makeContainer();
+      applyDerivedLabelFieldsToContainer(container, { 'dd.tag.transform': 's/v//' });
+      expect(container.transformTags).toBe('s/v//');
+    });
+
+    test('derives linkTemplate from dd.link.template label', () => {
+      const container = makeContainer();
+      applyDerivedLabelFieldsToContainer(container, {
+        'dd.link.template': 'https://example.com/${major}',
+      });
+      expect(container.linkTemplate).toBe('https://example.com/${major}');
+    });
+
+    test('derives triggerInclude from dd.action.include label', () => {
+      const container = makeContainer();
+      applyDerivedLabelFieldsToContainer(container, { 'dd.action.include': 'my-action' });
+      expect(container.triggerInclude).toBe('my-action');
+    });
+
+    test('derives triggerExclude from dd.notification.exclude label', () => {
+      const container = makeContainer();
+      applyDerivedLabelFieldsToContainer(container, { 'dd.notification.exclude': 'slack' });
+      expect(container.triggerExclude).toBe('slack');
+    });
+
+    test('falls back to wud.* label when dd.* label is absent', () => {
+      const container = makeContainer();
+      applyDerivedLabelFieldsToContainer(container, { 'wud.tag.include': '^v' });
+      expect(container.includeTags).toBe('^v');
+    });
+
+    test('clears derived fields when labels are removed', () => {
+      const container = makeContainer({
+        tagFamily: 'loose',
+        includeTags: '^1\\..*',
+        excludeTags: '^alpha',
+      });
+      applyDerivedLabelFieldsToContainer(container, {});
+      expect(container.tagFamily).toBeUndefined();
+      expect(container.includeTags).toBeUndefined();
+      expect(container.excludeTags).toBeUndefined();
+    });
+
+    test('handles undefined labels gracefully by treating as empty object', () => {
+      const container = makeContainer({ tagFamily: 'loose' });
+      // Pass empty record (undefined labels are normalized upstream before this point)
+      applyDerivedLabelFieldsToContainer(container, {});
+      expect(container.tagFamily).toBeUndefined();
+    });
+
+    test('does not modify displayName (managed separately by event handler)', () => {
+      const container = makeContainer({ displayName: 'My Custom App' });
+      applyDerivedLabelFieldsToContainer(container, { 'dd.display.name': 'New Display Name' });
+      // displayName is intentionally NOT updated by applyDerivedLabelFieldsToContainer
+      expect(container.displayName).toBe('My Custom App');
+    });
+  });
+
   test('filterRecreatedContainerAliases skips aliases that are still fresh', () => {
     const aliasName = '/7ea6b8a42686_termix';
     const container = {

app/watchers/providers/docker/container-init.ts

@@ -602,6 +602,45 @@ export function resolveLabelsFromContainer(
   return resolvedOverrides;
 }
 
+/**
+ * Re-derive label-driven container fields from a fresh label set and write
+ * them back onto the stored container record.
+ *
+ * Used on the Docker-event update path (start/die/update events) where the
+ * container already exists in the store but its labels may have changed since
+ * it was first registered — e.g. after `docker compose up -d` recreates a
+ * service with a new `dd.tag.family` label.
+ *
+ * Note: imgset configuration is intentionally NOT re-applied here because
+ * imgset matching requires a parsed image reference that is not available on
+ * the event path. The imgset defaults established during the last full watch
+ * cycle remain in effect; only direct label values are refreshed.
+ */
+export function applyDerivedLabelFieldsToContainer(
+  container: Container,
+  labels: Record<string, string>,
+): void {
+  const resolved = resolveLabelsFromContainer(labels);
+  container.includeTags = resolved.includeTags;
+  container.excludeTags = resolved.excludeTags;
+  container.transformTags = resolved.transformTags;
+  container.tagFamily = resolved.tagFamily;
+  container.linkTemplate = resolved.linkTemplate;
+  container.triggerInclude = resolved.triggerInclude;
+  container.triggerExclude = resolved.triggerExclude;
+  // displayName is managed separately by updateContainerFromInspect via
+  // getCustomDisplayNameFromLabels, which handles the "no custom name →
+  // fall back to container name" logic. We do not overwrite it here.
+  //
+  // displayIcon is stored but not re-derived on the event path because
+  // Docker events do not carry image metadata needed to validate icon refs.
+  // It will be refreshed on the next full watch cycle.
+  //
+  // lookupImage / registryLookupUrl flow into image.registry.lookupImage
+  // which is part of the image reference block — only re-derived during a
+  // full addImageDetailsToContainer pass, not on lightweight event updates.
+}
+
 function resolveLookupImageFromContainerLabels(
   containerLabels: Record<string, string>,
   overrides: ContainerLabelOverrides,