improve docker tab

Author: root

backend/docs/openapi/api.yaml

@@ -71,7 +71,8 @@ groups:
     description: Docker operations including compose, image, container, network and volume management.
     apiType: Ext
     extSurface:
-      - /api/ext/docker/*
+      - /api/servers/{serverId}/docker/*
+      - GET /api/servers/docker-targets
     nativeSurface: []
     sources:
       extRouteFiles:
@@ -363,7 +364,7 @@ groups:
     description: Server registry CRUD and remote operations APIs for connectivity, power, ports, monitor-agent deployment, and systemd management.
     apiType: Mixed
     extSurface:
-      - GET /api/ext/docker/servers
+      - GET /api/servers/docker-targets
       - GET /api/servers/connection
       - GET /api/servers/local/docker-bridge
       - GET /api/servers/{serverId}/ops/connectivity

backend/docs/openapi/ext-api.yaml

@@ -71,7 +71,7 @@ func doDocker(t *testing.T, te *testEnv, method, url, body, token string) *httpt
 		t.Fatal(err)
 	}
 
-	g := r.Group("/api/ext")
+	g := r.Group("/api/servers")
 	g.Bind(apis.RequireAuth())
 	registerDockerRoutes(g)
 
@@ -118,12 +118,12 @@ func TestDockerRoutesRequireSuperuser(t *testing.T) {
 
 	userToken := createRegularUserToken(t, te)
 
-	rec := doDocker(t, te, http.MethodGet, "/api/ext/docker/servers", "", userToken)
+	rec := doDocker(t, te, http.MethodGet, "/api/servers/docker-targets", "", userToken)
 	if rec.Code != http.StatusForbidden {
 		t.Fatalf("expected 403 for non-superuser, got %d: %s", rec.Code, rec.Body.String())
 	}
 
-	rec = doDocker(t, te, http.MethodGet, "/api/ext/docker/servers", "", te.token)
+	rec = doDocker(t, te, http.MethodGet, "/api/servers/docker-targets", "", te.token)
 	if rec.Code != http.StatusOK {
 		t.Fatalf("expected 200 for superuser, got %d: %s", rec.Code, rec.Body.String())
 	}

backend/docs/openapi/group-matrix.yaml

@@ -1,7 +1,6 @@
 // Package routes registers all custom API routes for AppOS.
 //
 // Route groups:
-//   - /api/ext/docker     — Docker operations (compose, images, containers, networks, volumes)
 //   - /api/ext/proxy      — reverse proxy domain/SSL management
 //   - /api/ext/system     — system metrics, file browser
 //   - /api/ext/backup     — backup/restore operations
@@ -17,7 +16,7 @@
 //   - /api/topics         — Topic share management (authenticated + public share token)
 //   - /api/ext/iac        — IaC file management (Epic 14, superuser-only)
 //   - /api/tunnel         — tunnel setup and operations APIs (Epic 16)
-//   - /api/servers        — Server catalog: ops, ports, systemd (Epic 20)
+//   - /api/servers        — Server catalog plus server-scoped Docker/ops/software routes (Epic 4, Epic 20)
 //   - /api/software       — AppOS-local software inventory APIs
 //   - /api/terminal       — Interactive terminal sessions: SSH, Docker, SFTP, local (Epic 20)
 package routes
@@ -86,7 +85,6 @@ func Register(se *core.ServeEvent) {
 	terminalGroup.Bind(wsTokenAuth())
 	terminalGroup.Bind(apis.RequireSuperuserAuth())
 
-	registerDockerRoutes(g)
 	registerProxyRoutes(g)
 	registerSystemRoutes(g)
 	registerBackupRoutes(g)
@@ -104,6 +102,7 @@ func Register(se *core.ServeEvent) {
 	registerExposureRoutes(deployments)
 	registerIaCRoutes(g)
 	registerServerRoutes(servers)
+	registerDockerRoutes(servers)
 	registerSoftwareRoutes(servers)
 	registerLocalSoftwareRoutes(softwareGroup)
 	registerTerminalRoutes(terminalGroup)

backend/domain/routes/docker.go

@@ -454,6 +454,7 @@ Establish the `servers` collection and its full CRUD surface. This is a pure dat
 | 20.4 | SFTP Enhancements | file properties, symlink, copy/move progress, upload limits |
 | 20.5 | Server Ops | connectivity check (with error category), power, ports, systemd backend route family |
 | 20.8 | Server Detail Systemd Tab | server-detail `Systemd` tab UX, paginated service inventory, search, featured services |
+| 20.11 | Server Detail Docker Tabs | server-detail `Docker` tab shell, inherited server context, inner tab IA, `/docker` transition direction |
 
 | Story | Status |
 |-------|--------|
@@ -463,6 +464,7 @@ Establish the `servers` collection and its full CRUD surface. This is a pure dat
 | 20.4 | ✅ Complete |
 | 20.5 | 🟡 In Review |
 | 20.8 | Draft |
+| 20.11 | Draft |
 
 ---
 

backend/domain/routes/docker_test.go

@@ -18,6 +18,10 @@ This epic adopts a Netdata-plus-control-plane-pull model:
 
 The goal is not to build a full observability platform. The goal is to provide a small, reliable operator signal surface that answers: what is unhealthy, why, and since when.
 
+For Docker specifically, Epic 28 is a consumer of Docker runtime objects, not the owner of Docker inventory or Docker actions.
+Epic 4 remains the control-plane surface for listing, inspecting, logging, and operating Docker resources.
+Epic 28 should only add runtime evidence and status judgment on top of those objects.
+
 ---
 
 ## Scope Boundaries
@@ -32,6 +36,12 @@ The goal is not to build a full observability platform. The goal is to provide a
 | AppOS self metrics and monitor pipeline health | Large historical analytics or BI-style reporting |
 | Minimal overview and detail-page observability surfaces | Highly customized dashboards |
 
+Docker boundary for MVP:
+
+- in scope: container runtime telemetry, telemetry freshness, and monitor-backed status summaries
+- out of scope: replacing Docker inventory APIs for containers, images, networks, volumes, or compose
+- out of scope: moving Docker actions such as start, stop, restart, remove, pull, prune, or compose up/down into monitor
+
 ---
 
 ## Monitoring Model
@@ -349,6 +359,8 @@ Exact route placement can still shift during implementation, but the separation
 - `story28.3-active-checks.md`
 - `story28.4-operator-surfaces.md`
 - `story28.5-platform-status-frontend.md`
+- `story28.6-container-stats-ui.md`
+- `story28.7-docker-monitor-handoff.md`
 
 ---
 
@@ -376,6 +388,8 @@ Implement this epic in the following order:
 3. `28.3 Active Checks for Resource and App Availability`
 4. `28.4 Minimal Operator Surfaces`
 5. `28.5 Platform Status Frontend Page`
+6. `28.6 Container Stats UI in Server Detail`
+7. `28.7 Docker and Monitor Surface Handoff`
 
 Reasoning:
 
@@ -384,6 +398,8 @@ Reasoning:
 - 28.3 adds AppOS-owned judgment so monitoring does not depend only on self-report.
 - 28.4 should consume stable read contracts instead of inventing UI-specific logic.
 - 28.5 converges the operator-facing platform status experience into one simple page after the monitor contracts are stable.
+- 28.6 brings monitor-backed container evidence into existing Docker-facing server detail without changing Docker control-plane ownership.
+- 28.7 standardizes the handoff between Docker and Monitor surfaces after both sides already have stable destinations.
 
 ## First Delivery Slice