fix(dashboard): report genuine Docker daemon availability in /api/v1/docker/status (MCP-2478) (#683)

Root cause: GetDockerRecoveryStatus() short-circuits when Docker recovery is disabled
(isolation off) and returns synthetic DockerAvailable:true. The dashboard bound its
'Docker isolation active' badge to docker_available, so hosts with no Docker daemon
and isolation disabled showed 'active'.

Backend:
- Add IsDockerAvailable() to ServerController interface; delegates to
  Runtime.IsDockerAvailable() (the same time-cached probe telemetry uses).
- /api/v1/docker/status now reports the genuine probe result instead of the
  synthetic recovery-state value.
- Add isolation_enabled field (config docker_isolation.enabled) so the UI can
  check both conditions independently.

Frontend (Dashboard.vue):
- Show 'active' only when docker_available && isolation_enabled.
- Remove the :538 stdio-connected workaround that faked availability.

TDD: docker_status_test.go covers all three acceptance cases:
  no-Docker+isolation-off -> disabled
  Docker+isolation-on -> active
  stdio-connected != active

Author: Dumbris

docs/api/rest-api.md

@@ -745,6 +745,19 @@ MCPProxy automatically checks for updates every 4 hours. The update information
 
 Get Docker isolation status.
 
+**Response fields:**
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `docker_available` | bool | Genuine Docker daemon reachability (result of a real `docker info` probe). |
+| `isolation_enabled` | bool | Whether `docker_isolation.enabled` is set in config. The UI treats isolation as "active" only when both this and `docker_available` are true. |
+| `recovery_mode` | bool | Whether the Docker recovery monitor is actively retrying. |
+| `failure_count` | int | Consecutive recovery failures. |
+| `attempts_since_up` | int | Recovery attempts since the daemon was last seen available. |
+| `last_attempt` | string | Timestamp of the last recovery attempt. |
+| `last_error` | string | Last recovery error message, if any. |
+| `last_successful_at` | string | Timestamp of the last successful daemon contact. |
+
 ### Secrets
 
 #### GET /api/v1/secrets

frontend/src/services/api.ts

@@ -510,6 +510,7 @@ class APIService {
   // Docker status
   async getDockerStatus(): Promise<APIResponse<{
     docker_available: boolean
+    isolation_enabled: boolean
     recovery_mode: boolean
     failure_count: number
     attempts_since_up: number

frontend/src/views/Dashboard.vue

@@ -528,17 +528,16 @@ const {
 
 const loadSecurityStatus = async () => {
   try {
-    // Docker status from dedicated endpoint
+    // Docker status from dedicated endpoint. The badge reads "active" only when
+    // Docker isolation is genuinely in effect: the user enabled it AND a real
+    // Docker daemon is reachable. docker_available now reflects a genuine daemon
+    // probe (MCP-2478) — we must NOT fake it from connected stdio servers, which
+    // do not imply isolation is on.
     const dockerResponse = await api.getDockerStatus()
     if (dockerResponse.success && dockerResponse.data) {
-      let available = dockerResponse.data.docker_available ?? false
-      // Workaround: Docker health checker can get stuck at 'max retries exceeded'
-      // even when Docker containers are running. If API says unavailable but
-      // we have connected stdio servers (which use Docker), treat as available.
-      if (!available && serversStore.servers.some(s => s.connected && s.protocol === 'stdio')) {
-        available = true
-      }
-      dockerStatus.value = { available }
+      const daemonAvailable = dockerResponse.data.docker_available ?? false
+      const isolationEnabled = dockerResponse.data.isolation_enabled ?? false
+      dockerStatus.value = { available: daemonAvailable && isolationEnabled }
     }
   } catch {
     // Docker endpoint may not exist - treat as unavailable

internal/httpapi/contracts_test.go

@@ -168,6 +168,7 @@ func (m *MockServerController) GetDockerRecoveryStatus() *storage.DockerRecovery
 		LastError:       "",
 	}
 }
+func (m *MockServerController) IsDockerAvailable() bool { return true }
 func (m *MockServerController) GetRecentSessions(_ int) ([]*contracts.MCPSession, int, error) {
 	return []*contracts.MCPSession{}, 0, nil
 }

internal/httpapi/docker_status_test.go

@@ -0,0 +1,120 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/config"
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/storage"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap"
+)
+
+// mockDockerStatusController lets a test drive the genuine daemon probe and the
+// configured docker_isolation.enabled flag independently, while keeping
+// GetDockerRecoveryStatus returning the synthetic DockerAvailable:true that
+// production returns when Docker recovery is disabled (isolation off). This
+// proves /api/v1/docker/status reports the GENUINE probe value, not the
+// synthetic recovery-state value (MCP-2478).
+type mockDockerStatusController struct {
+	baseController
+	apiKey           string
+	dockerAvailable  bool
+	isolationEnabled bool
+}
+
+func (m *mockDockerStatusController) GetCurrentConfig() any {
+	return &config.Config{APIKey: m.apiKey}
+}
+
+func (m *mockDockerStatusController) IsDockerAvailable() bool { return m.dockerAvailable }
+
+func (m *mockDockerStatusController) GetDockerRecoveryStatus() *storage.DockerRecoveryState {
+	// Mirror the production short-circuit: when recovery is disabled the manager
+	// returns a synthetic DockerAvailable:true. The endpoint must NOT forward
+	// this as genuine availability.
+	return &storage.DockerRecoveryState{DockerAvailable: true}
+}
+
+func (m *mockDockerStatusController) GetConfig() (*config.Config, error) {
+	return &config.Config{
+		APIKey:          m.apiKey,
+		DockerIsolation: &config.DockerIsolationConfig{Enabled: m.isolationEnabled},
+	}, nil
+}
+
+func TestHandleGetDockerStatus_GenuineAvailability(t *testing.T) {
+	logger := zap.NewNop().Sugar()
+	const apiKey = "test-docker-status-key"
+
+	tests := []struct {
+		name             string
+		dockerAvailable  bool
+		isolationEnabled bool
+		wantAvailable    bool
+		wantIsolationOn  bool
+	}{
+		{
+			// The reported bug: no Docker daemon + isolation disabled must NOT
+			// report docker_available:true (which the synthetic recovery state
+			// would).
+			name:             "no docker daemon and isolation disabled",
+			dockerAvailable:  false,
+			isolationEnabled: false,
+			wantAvailable:    false,
+			wantIsolationOn:  false,
+		},
+		{
+			name:             "docker present and isolation enabled",
+			dockerAvailable:  true,
+			isolationEnabled: true,
+			wantAvailable:    true,
+			wantIsolationOn:  true,
+		},
+		{
+			name:             "docker present but isolation disabled",
+			dockerAvailable:  true,
+			isolationEnabled: false,
+			wantAvailable:    true,
+			wantIsolationOn:  false,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ctrl := &mockDockerStatusController{
+				apiKey:           apiKey,
+				dockerAvailable:  tc.dockerAvailable,
+				isolationEnabled: tc.isolationEnabled,
+			}
+			srv := NewServer(ctrl, logger, nil)
+
+			req := httptest.NewRequest("GET", "/api/v1/docker/status?apikey="+apiKey, nil)
+			w := httptest.NewRecorder()
+			srv.ServeHTTP(w, req)
+
+			require.Equal(t, http.StatusOK, w.Code, "body: %s", w.Body.String())
+
+			var resp struct {
+				Success bool `json:"success"`
+				Data    struct {
+					DockerAvailable  bool `json:"docker_available"`
+					IsolationEnabled bool `json:"isolation_enabled"`
+				} `json:"data"`
+			}
+			require.NoError(t, json.NewDecoder(w.Body).Decode(&resp))
+			require.True(t, resp.Success)
+
+			// docker_available must reflect the GENUINE probe, not the synthetic
+			// DockerAvailable:true returned by GetDockerRecoveryStatus.
+			assert.Equal(t, tc.wantAvailable, resp.Data.DockerAvailable,
+				"docker_available should report genuine daemon availability")
+			assert.Equal(t, tc.wantIsolationOn, resp.Data.IsolationEnabled,
+				"isolation_enabled should report docker_isolation.enabled")
+		})
+	}
+}

internal/httpapi/security_test.go

@@ -244,6 +244,7 @@ func (m *baseController) ForceReconnectAllServers(reason string) error       { r
 func (m *baseController) GetDockerRecoveryStatus() *storage.DockerRecoveryState {
 	return nil
 }
+func (m *baseController) IsDockerAvailable() bool { return false }
 func (m *baseController) QuarantineServer(serverName string, quarantined bool) error {
 	return nil
 }

internal/httpapi/server.go

@@ -70,6 +70,10 @@ type ServerController interface {
 	RestartServer(serverName string) error
 	ForceReconnectAllServers(reason string) error
 	GetDockerRecoveryStatus() *storage.DockerRecoveryState
+	// IsDockerAvailable reports genuine Docker daemon reachability via a real
+	// probe (not the synthetic recovery-state value returned when isolation is
+	// off). Used by /api/v1/docker/status — see MCP-2478.
+	IsDockerAvailable() bool
 	QuarantineServer(serverName string, quarantined bool) error
 	GetQuarantinedServers() ([]map[string]interface{}, error)
 	UnquarantineServer(serverName string) error
@@ -4612,8 +4616,24 @@ func (s *Server) handleGetDockerStatus(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Report GENUINE daemon availability from a real probe, not the synthetic
+	// DockerAvailable:true that GetDockerRecoveryStatus returns when Docker
+	// recovery is disabled (isolation off). See MCP-2478: the dashboard bound
+	// its "Docker isolation active" badge to docker_available and lit up on
+	// hosts that have no Docker daemon at all. The recovery fields below stay
+	// purely diagnostic.
+	dockerAvailable := s.controller.IsDockerAvailable()
+
+	// isolation_enabled lets the UI label the badge "active" only when the user
+	// actually turned Docker isolation on AND the daemon is reachable.
+	isolationEnabled := false
+	if cfg, err := s.controller.GetConfig(); err == nil && cfg != nil && cfg.DockerIsolation != nil {
+		isolationEnabled = cfg.DockerIsolation.Enabled
+	}
+
 	response := map[string]interface{}{
-		"docker_available":   status.DockerAvailable,
+		"docker_available":   dockerAvailable,
+		"isolation_enabled":  isolationEnabled,
 		"recovery_mode":      status.RecoveryMode,
 		"failure_count":      status.FailureCount,
 		"attempts_since_up":  status.AttemptsSinceUp,

internal/server/server.go

@@ -308,6 +308,13 @@ func (s *Server) GetDockerRecoveryStatus() *storage.DockerRecoveryState {
 	return s.runtime.GetDockerRecoveryStatus()
 }
 
+// IsDockerAvailable reports whether the host has a reachable Docker daemon via
+// a real probe. The /api/v1/docker/status endpoint uses this for genuine
+// availability rather than the synthetic recovery-state value (MCP-2478).
+func (s *Server) IsDockerAvailable() bool {
+	return s.runtime.IsDockerAvailable()
+}
+
 // StatusChannel returns a channel that receives status updates
 func (s *Server) StatusChannel() <-chan interface{} {
 	return s.statusCh