An expired session no longer summons the browser's password box
Leave a tab open overnight, come back to it, and you were greeted by the browser's own login dialog — the exact thing the login page was built to replace (#60, @NotRetarded, who left a tab open and bothered to say so).
These pages fetch in the background: the Settings page asks /api/cron_preview as it loads, so it can tell you when your cron expression next fires. A fetch() sends Accept: */* rather than text/html, so that call took the branch meant for scripts and got a 401 with WWW-Authenticate — and that header is precisely what makes a browser open its password box. Refreshing helped because a real navigation does send Accept: text/html, which is why it took you to the proper login page.
Browsers set Sec-Fetch-Mode on every fetch and XHR, and no command-line client sends it. So a background call from one of our own pages now gets a plain 401 with no such header and therefore no dialog, and app.js turns that into a trip to the login page with next= set, so a stale tab puts you back where you were instead of quietly failing.
curl -u and any scraper you have are untouched, and a normal navigation redirects exactly as before.
Documentation for containers behind a VPN sidecar
The README has advertised this from the beginning — Gluetun updated first, then the containers sharing its network namespace, "the case that breaks naive updaters" — and docs/ did not contain the word "gluetun" once, across all nine files. The strongest thing this does was the worst-documented thing in it.
There is a section under Container Groups now: why network_mode: container:gluetun breaks on update (Docker stores the head's container ID, which dies with the head), what happens instead (the dependents are recreated against the head's name, which survives), and the three things you have to get right — the head is the group's first member, the "restart dependents" tick is what switches the mechanism on, and nothing else needs configuring because the namespace check runs per update rather than being stored.
Writing it caught two things I had believed and not checked: grouping alone is not enough without that tick, and the wait for the head is the group's own wait time rather than a flat 30 seconds. Both are in the page, and a test now pins each claim against the code so it cannot quietly drift.
Nothing to do on upgrade.
