Detection and Ownership

Detection and Ownership

Where candidates come from

Template: a saved Docker template references a path, but its container is no longer installed. Saved templates remain useful for reinstalling containers, so review before cleanup.

Discovery: a direct child folder is found inside a configured appdata source without a qualifying installed-container or saved-template reference. Discovery does not recursively label every nested directory an independent orphan.

ZFS dataset describes storage, not a separate ownership system. A dataset can also have a Template or Discovery source badge.

The detection reason summarizes why an item appeared. Details contains the supporting evidence and restrictions.

Specific ownership versus broad access

Example mount, source /mnt/user/appdata, candidate .../example-app	Interpretation
/mnt or /mnt/user	Broad access strictly above the source; informational
/mnt/user/appdata	Source-level reference; protective
/mnt/user/appdata/example-app	Exact reference; protective
A directory inside the candidate	Nested reference; protective

This distinction lets a backup/file-manager container see data without claiming every child as its own. Specific references still protect data even if the container is stopped. Physical/share aliases are considered. With multiple/nested roots, the broad-access test must remain safe for every containing source.

Docker inventory

The plugin queries all installed containers, including stopped ones. A successful HTTP response alone is not sufficient: the complete inventory must be usable. Malformed records trigger bounded inspect recovery. Known mounts remain protective when another record cannot be verified.

An incomplete inventory marks remaining candidates Unverified and blocks cleanup. Safe Mode off does not bypass this. Resolve Docker access/inventory issues and rescan.

Compose

Compose project references receive protection in addition to current containers, including supported short/long bind mounts, environment substitution and override files. This helps protect stopped stacks.

The scanner is deliberately conservative and is not a complete YAML/Compose interpreter. Unresolved variables, relative/traversing paths and unsupported include/extends, anchors/aliases or inline forms can prevent safe verification. Do not remove protective configuration just to make a row actionable; preserve the configuration and report a sanitized reproduction.

Other exclusions and rechecks

VM-managed data, roots, mount points, quarantine directories, symlinked segments and unsafe paths have additional protection. Installed references may suppress discovery or cause a visible candidate to be blocked depending on its source.

Ownership is checked again at cleanup time. A candidate can become blocked after scanning if Docker/Compose or the filesystem changed. See Safety Model.