release: v1.1.16

backend/internal/api/security.go

@@ -180,6 +180,12 @@ func (ss *SecurityScanner) monitorLoop() {
 	}
 }
 
+func (ss *SecurityScanner) alertCount() int {
+	ss.mu.Lock()
+	defer ss.mu.Unlock()
+	return len(ss.alerts)
+}
+
 func (ss *SecurityScanner) checkAllContainers() {
 	for _, c := range config.AppConfig.Containers {
 		if c.Status != "running" || c.IP == "" {
@@ -208,6 +214,7 @@ func (ss *SecurityScanner) checkContainer(name, ip string) {
 		return
 	}
 
+	alertBefore := ss.alertCount()
 	ss.detectPortScans(name, ip, stats)
 	ss.detectBruteForce(name, ip, stats)
 	ss.detectSpam(name, ip, stats)
@@ -216,6 +223,11 @@ func (ss *SecurityScanner) checkContainer(name, ip string) {
 	ss.detectMining(name, ip, stats)
 	ss.detectProxyAndTor(name, ip, stats)
 	ss.detectMalware(name, ip, stats)
+
+	// If new alerts were generated, snapshot the conntrack data for later retrieval.
+	if ss.alertCount() > alertBefore {
+		config.SaveConntrackSnapshot(ip, lines)
+	}
 }
 
 func newTrafficStats() *trafficStats {
@@ -759,28 +771,49 @@ func HandleSecurityLogs(w http.ResponseWriter, r *http.Request) {
 
 func getConnectionLogs(ip string) []map[string]interface{} {
 	logs := make([]map[string]interface{}, 0)
+	seen := map[string]bool{}
 
-	for _, line := range readConntrackLines(ip) {
+	parseLine := func(line string) map[string]interface{} {
 		srcIP := extractField(line, "src=")
 		dstIP := extractField(line, "dst=")
 		srcPort := extractField(line, "sport=")
 		dstPort := extractField(line, "dport=")
-
 		sPort, _ := strconv.Atoi(srcPort)
 		dPort, _ := strconv.Atoi(dstPort)
-
-		logs = append(logs, map[string]interface{}{
+		return map[string]interface{}{
 			"src_ip":   srcIP,
 			"dst_ip":   dstIP,
 			"src_port": sPort,
 			"dst_port": dPort,
 			"protocol": extractProtocol(line),
 			"state":    extractConnState(line),
-		})
+		}
+	}
 
+	// First, load stored snapshots from database (persisted at alert time).
+	for _, line := range config.GetConntrackSnapshotLines(ip) {
 		if len(logs) >= 100 {
 			break
 		}
+		key := strings.TrimSpace(line)
+		if key == "" || seen[key] {
+			continue
+		}
+		seen[key] = true
+		logs = append(logs, parseLine(line))
+	}
+
+	// Then, merge live conntrack data (deduplicated).
+	for _, line := range readConntrackLines(ip) {
+		if len(logs) >= 100 {
+			break
+		}
+		key := strings.TrimSpace(line)
+		if key == "" || seen[key] {
+			continue
+		}
+		seen[key] = true
+		logs = append(logs, parseLine(line))
 	}
 
 	return logs

backend/internal/cli/cli.go

@@ -34,7 +34,7 @@ var cliTranslations = map[string]string{
 	"请选择操作":             "Select an action",
 	"再见":                "Goodbye",
 	"无效选择":              "Invalid choice",
-	"CLICD - LXC 容器管理器": "CLICD - LXC Container Manager",
+	"CLICD - LXC 容器管理器": "CLICD - Container Manager",
 	"Web 面板":            "Web panel",
 	"端口":                "port",
 	"运行中":               "running",

backend/internal/config/store_sqlite.go

@@ -254,6 +254,14 @@ func ensureSchema() error {
 			success INTEGER,
 			error TEXT
 		)`,
+		`CREATE TABLE IF NOT EXISTS security_conntrack_snapshots (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			container_ip TEXT NOT NULL,
+			line TEXT NOT NULL,
+			captured_at TEXT NOT NULL
+		)`,
+		`CREATE INDEX IF NOT EXISTS idx_conntrack_snapshots_ip_time
+			ON security_conntrack_snapshots(container_ip, captured_at)`,
 		`CREATE TABLE IF NOT EXISTS tasks (
 			id TEXT PRIMARY KEY,
 			type TEXT,
@@ -642,6 +650,59 @@ func saveAPIKeys(tx *sql.Tx) error {
 	return nil
 }
 
+// SaveConntrackSnapshot stores raw conntrack lines for a container IP.
+func SaveConntrackSnapshot(containerIP string, lines []string) {
+	if db == nil || len(lines) == 0 || strings.TrimSpace(containerIP) == "" {
+		return
+	}
+	now := time.Now().Format("2006-01-02 15:04:05")
+	tx, err := db.Begin()
+	if err != nil {
+		return
+	}
+	defer tx.Rollback()
+	stmt, err := tx.Prepare(`INSERT INTO security_conntrack_snapshots (container_ip, line, captured_at) VALUES (?, ?, ?)`)
+	if err != nil {
+		return
+	}
+	defer stmt.Close()
+	for _, line := range lines {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		stmt.Exec(containerIP, line, now)
+	}
+	tx.Commit()
+
+	// Cleanup old snapshots (>1 hour)
+	db.Exec(`DELETE FROM security_conntrack_snapshots WHERE captured_at < ?`,
+		time.Now().Add(-1*time.Hour).Format("2006-01-02 15:04:05"))
+}
+
+// GetConntrackSnapshotLines returns stored conntrack lines for a container IP.
+func GetConntrackSnapshotLines(containerIP string) []string {
+	if db == nil || strings.TrimSpace(containerIP) == "" {
+		return nil
+	}
+	rows, err := db.Query(
+		`SELECT line FROM security_conntrack_snapshots WHERE container_ip = ? ORDER BY captured_at DESC LIMIT 200`,
+		containerIP,
+	)
+	if err != nil {
+		return nil
+	}
+	defer rows.Close()
+	var lines []string
+	for rows.Next() {
+		var line string
+		if rows.Scan(&line) == nil {
+			lines = append(lines, line)
+		}
+	}
+	return lines
+}
+
 func saveAuditLogs(tx *sql.Tx) error {
 	for _, log := range AppConfig.AuditLogs {
 		successSet := 0

backend/internal/kvm/kvm.go

@@ -432,7 +432,8 @@ func (m *Manager) defineContainer(id int, vmName string, cfg lxc.ContainerConfig
 	}
 	ipv6List := configIPv6AssignmentAddresses(ipv6Assignments)
 	ipv4List := configIPv4AssignmentAddresses(publicIPv4s)
-	defaultHostIP := lxc.DefaultPortMappingHostIP(publicIPv4s)
+	// NAT4 port mappings should bind to the host IP, not the VM's independent public IPv4.
+	defaultHostIP := ""
 
 	var xml string
 	winAdminPassword := ""
@@ -588,7 +589,7 @@ func (m *Manager) StartContainer(id int) error {
 			}
 		}
 	}
-	config.UpdateContainerStatus(id, "running")
+	config.UpdateContainerStatus(id, "initializing")
 	// Detect VNC port
 	if _, err := m.RefreshVNCPort(id); err != nil {
 		fmt.Printf("Warning: failed to refresh VNC port for %s: %v\n", name, err)
@@ -625,6 +626,11 @@ func (m *Manager) StartContainer(id int) error {
 			return err
 		}
 	}
+	// Wait for cloud-init to finish and SSH to be reachable (password-only mode)
+	if !isWindows && c.IP != "" {
+		m.waitForCloudInitReady(name, c.IP, c.SSHPassword)
+	}
+	config.UpdateContainerStatus(id, "running")
 	if c.IPv6 != "" || len(c.IPv6Addresses) > 0 {
 		if err := m.applyIPv6Runtime(c); err != nil {
 			return err
@@ -635,6 +641,50 @@ func (m *Manager) StartContainer(id int) error {
 	return nil
 }
 
+// waitForCloudInitReady waits for cloud-init to finish and SSH to be reachable.
+func (m *Manager) waitForCloudInitReady(vmName, ip, password string) {
+	if ip == "" || password == "" {
+		return
+	}
+	deadline := time.Now().Add(3 * time.Minute)
+	target := net.JoinHostPort(ip, "22")
+	sshWasUp := false
+	qgaAttempted := false
+
+	for time.Now().Before(deadline) {
+		client, err := ssh.Dial("tcp", target, &ssh.ClientConfig{
+			User:            "root",
+			Auth:            []ssh.AuthMethod{ssh.Password(password)},
+			HostKeyCallback: ssh.InsecureIgnoreHostKey(),
+			Timeout:         5 * time.Second,
+		})
+		if err == nil {
+			client.Close()
+			if !sshWasUp {
+				sshWasUp = true
+				fmt.Printf("KVM %s SSH up, waiting for cloud-init to settle...\n", vmName)
+				time.Sleep(10 * time.Second)
+				continue
+			}
+			fmt.Printf("KVM %s ready\n", vmName)
+			return
+		}
+
+		// Try guest agent ONCE to speed things up, with timeout to avoid blocking
+		if !qgaAttempted && qemuGuestPing(vmName) == nil {
+			qgaAttempted = true
+			ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+			cmd := exec.CommandContext(ctx, "virsh", "qemu-agent-command", vmName,
+				`{"execute":"guest-exec","arguments":{"path":"/bin/sh","arg":["-c","cloud-init status --wait 2>/dev/null; systemctl restart sshd 2>/dev/null || systemctl restart ssh 2>/dev/null; true"],"capture-output":false}}`)
+			cmd.Run()
+			cancel()
+		}
+
+		time.Sleep(5 * time.Second)
+	}
+	fmt.Printf("Warning: KVM %s not ready after 3 minutes\n", vmName)
+}
+
 func (m *Manager) StopContainer(id int) error {
 	c := config.FindContainer(id)
 	if c == nil {
@@ -1801,8 +1851,7 @@ func windowsIPv6PowerShell(ipv6s []string) string {
 	}
 	return strings.Join([]string{
 		"$clicdIPv6=@(" + strings.Join(quoted, ",") + ")",
-		"$iface=$null",
-		"for ($i=0; $i -lt 60 -and -not $iface; $i++) { $iface=Get-NetAdapter | Where-Object { $_.Status -eq 'Up' -and $_.HardwareInterface } | Sort-Object ifIndex | Select-Object -First 1; if (-not $iface) { Start-Sleep -Seconds 5 } }",
+		// Reuse $iface already found by the main script
 		"if ($iface) {",
 		"  foreach ($ip in $clicdIPv6) {",
 		"    Get-NetIPAddress -InterfaceIndex $iface.ifIndex -AddressFamily IPv6 -ErrorAction SilentlyContinue | Where-Object { $_.IPAddress -eq $ip } | Remove-NetIPAddress -Confirm:$false -ErrorAction SilentlyContinue",
@@ -1826,8 +1875,7 @@ func windowsIPv4PowerShell(ipv4s []string) string {
 	}
 	return strings.Join([]string{
 		"$clicdIPv4=@(" + strings.Join(quoted, ",") + ")",
-		"$iface=$null",
-		"for ($i=0; $i -lt 60 -and -not $iface; $i++) { $iface=Get-NetAdapter | Where-Object { $_.Status -eq 'Up' -and $_.HardwareInterface } | Sort-Object ifIndex | Select-Object -First 1; if (-not $iface) { Start-Sleep -Seconds 5 } }",
+		// Reuse $iface already found by the main script
 		"if ($iface) {",
 		"  foreach ($ip in $clicdIPv4) {",
 		"    Get-NetIPAddress -InterfaceIndex $iface.ifIndex -AddressFamily IPv4 -ErrorAction SilentlyContinue | Where-Object { $_.IPAddress -eq $ip } | Remove-NetIPAddress -Confirm:$false -ErrorAction SilentlyContinue",
@@ -2530,7 +2578,10 @@ if [ -n "$SSH_PUBLIC_KEY" ]; then
 	chown -R root:root /root/.ssh 2>/dev/null || true
 fi
 if command -v chpasswd >/dev/null 2>&1; then
-	printf 'root:%s\n' "$ROOT_PASSWORD" | chpasswd || true
+	printf 'root:%s\n' "$ROOT_PASSWORD" | chpasswd 2>/tmp/clicd-chpasswd.log && echo "root password set via chpasswd" || echo "WARNING: chpasswd failed: $(cat /tmp/clicd-chpasswd.log 2>/dev/null)"
+elif command -v openssl >/dev/null 2>&1 && command -v usermod >/dev/null 2>&1; then
+	HASH=$(echo "$ROOT_PASSWORD" | openssl passwd -6 -stdin 2>/dev/null)
+	[ -n "$HASH" ] && usermod -p "$HASH" root 2>/dev/null && echo "root password set via openssl/usermod" || echo "WARNING: openssl/usermod failed"
 fi
 ssh-keygen -A >/dev/null 2>&1 || true
 if command -v systemctl >/dev/null 2>&1; then

backend/internal/lxc/lxc.go

@@ -345,12 +345,7 @@ func (m *Manager) CreateContainer(cfg ContainerConfig) error {
 
 		// Setup default port mappings (SSH only)
 		portMappings = SetupDefaultPortMappings(sshPort)
-		defaultHostIP := defaultPortMappingHostIP(publicIPv4s)
-		if defaultHostIP != "" {
-			for i := range portMappings {
-				portMappings[i].HostIP = defaultHostIP
-			}
-		}
+		// NAT4 port mappings should bind to the host IP, not the container's independent public IPv4.
 		tempC := &config.Container{ID: id, PublicIPv4s: publicIPv4s, PortMappings: portMappings}
 
 		extraPorts := cfg.ExtraPorts
@@ -364,7 +359,7 @@ func (m *Manager) CreateContainer(cfg ContainerConfig) error {
 			pm, err := normalizePortMapping(tempC, -1, config.PortMapping{
 				ContainerPort: containerPort,
 				HostPort:      containerPort,
-				HostIP:        defaultHostIP,
+				HostIP:        "",
 				Protocol:      "tcp",
 				Description:   fmt.Sprintf("Port-%d", containerPort),
 			})

backend/internal/lxc/portmap.go

@@ -59,9 +59,9 @@ func (m *Manager) ApplyPortMappings(id int) error {
 		}
 	}
 
-	// When container has public IPv4 but no port mappings (independent IP mode),
-	// ensure inbound DNAT for standard service ports (SSH / RDP).
-	if len(c.PortMappings) == 0 && len(c.PublicIPv4s) > 0 {
+	// When container has public IPv4, apply full port passthrough DNAT so the
+	// container owns all ports on its public IP (no NAT management needed).
+	if len(c.PublicIPv4s) > 0 {
 		ensureIndependentIPv4Ingress(c, tag)
 	}
 
@@ -75,40 +75,30 @@ func ensureIndependentIPv4Ingress(c *config.Container, tag string) {
 		return
 	}
 
-	type svcPort struct {
-		port     int
-		protocol string
-		desc     string
-	}
-	servicePorts := []svcPort{{port: 22, protocol: "tcp", desc: "SSH"}}
-	if strings.Contains(strings.ToLower(c.Template), "windows") {
-		servicePorts = []svcPort{{port: 3389, protocol: "tcp", desc: "RDP"}}
-	}
-
 	for _, assignment := range c.PublicIPv4s {
 		hostIP := strings.TrimSpace(assignment.Address)
 		if hostIP == "" {
 			continue
 		}
-		for _, svc := range servicePorts {
+		// Full port passthrough: DNAT all TCP+UDP traffic on this public IP to the container.
+		for _, proto := range []string{"tcp", "udp"} {
 			args := []string{
 				"-t", "nat",
 				"-I", "PREROUTING", "1",
 				"-d", hostIP,
-				"-p", svc.protocol,
-				"--dport", fmt.Sprintf("%d", svc.port),
+				"-p", proto,
 				"-j", "DNAT",
-				"--to-destination", fmt.Sprintf("%s:%d", c.IP, svc.port),
-				"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-%s-%d", tag, natRuleIPTag(hostIP), svc.port),
+				"--to-destination", c.IP,
+				"-m", "comment", "--comment", fmt.Sprintf("clicd-%s-%s-all-%s", tag, natRuleIPTag(hostIP), proto),
 			}
 			cmd := exec.Command("iptables", args...)
 			output, err := cmd.CombinedOutput()
 			if err != nil {
-				fmt.Printf("Warning: failed to apply %s ingress %s:%d->%s:%d: %v, output: %s\n",
-					svc.desc, hostIP, svc.port, c.IP, svc.port, err, string(output))
+				fmt.Printf("Warning: failed to apply %s passthrough %s->%s: %v, output: %s\n",
+					proto, hostIP, c.IP, err, string(output))
 				continue
 			}
-			fmt.Printf("%s ingress: %s:%d -> %s:%d\n", svc.desc, hostIP, svc.port, c.IP, svc.port)
+			fmt.Printf("IPv4 passthrough (%s): %s -> %s (all ports)\n", proto, hostIP, c.IP)
 		}
 	}
 }

backend/internal/server/web/.gitkeep

@@ -0,0 +1 @@
+ 

backend/internal/version/version.go

@@ -1,7 +1,7 @@
 package version
 
 var (
-	Version = "1.1.14"
+	Version = "1.1.16"
 	Repo    = "MengMengCode/CLICD"
 )
 

frontend/index.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>CLICD - LXC Container Manager</title>
+    <title>CLICD - Container Manager</title>
     <script>
       (function() {
         var theme = localStorage.getItem('clicd_theme');

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clicd-frontend",
   "private": true,
-  "version": "1.1.14",
+  "version": "1.1.16",
   "type": "module",
   "scripts": {
     "dev": "vite",

frontend/src/components/CreateContainerModal.tsx

@@ -321,7 +321,12 @@ export default function CreateContainerModal({ isOpen, onClose, onSuccess, exist
                 type="checkbox"
                 checked={!!form.assign_ipv4}
                 disabled={!ipv4Available}
-                onChange={(event) => setForm({ ...form, assign_ipv4: event.target.checked, public_ipv4s: event.target.checked ? form.public_ipv4s : [] })}
+                onChange={(event) => setForm({
+                  ...form,
+                  assign_ipv4: event.target.checked,
+                  public_ipv4s: event.target.checked ? form.public_ipv4s : [],
+                  ...(event.target.checked ? { assign_nat: false, port_mapping_count: 0, extra_ports: [] } : {}),
+                })}
                 className="mt-1"
               />
               <span className="min-w-0">
@@ -429,6 +434,7 @@ export default function CreateContainerModal({ isOpen, onClose, onSuccess, exist
                       assign_nat: checked,
                       port_mapping_count: checked ? Math.max(2, form.port_mapping_count || 2) : 0,
                       extra_ports: [],
+                      ...(checked ? { assign_ipv4: false, public_ipv4s: [], ipv4_count: 0 } : {}),
                     })
                   }}
                   className="mt-1"
@@ -680,9 +686,10 @@ function validateResourceInputs(form: CreateContainerRequest, maxVCPU: number, m
 
 function normalizeCreateForm(form: CreateContainerRequest): CreateContainerRequest {
   const normalized = applyTemplateDefaults(form)
-  const wantsNAT = normalized.assign_nat !== false
   const wantsIPv4 = !!normalized.assign_ipv4
   const wantsIPv6 = !!normalized.assign_ipv6
+  // IPv4 and NAT are mutually exclusive
+  const wantsNAT = wantsIPv4 ? false : normalized.assign_nat !== false
   const linuxTemplate = !isWindowsTemplate(normalized.template_id)
   const sshAuthMode = linuxTemplate ? (normalized.ssh_auth_mode || 'auto_password') : 'auto_password'
   return {

frontend/src/pages/ContainerDetail.tsx

@@ -753,6 +753,7 @@ export default function ContainerDetail() {
   }
 
   const isRunning = container.status === 'running'
+  const isInitializing = container.status === 'initializing'
   const isKVM = (container.virtualization || 'lxc') === 'kvm'
   const isWindows = container.template?.includes('windows')
   const reinstallLinuxTemplate = !isWindowsTemplate(selectedTemplate)
@@ -772,23 +773,26 @@ export default function ContainerDetail() {
   const maxRAMMB = hostInfo?.ram.total_mb ? Number(hostInfo.ram.total_mb) : undefined
   const hasIndependentIPv4 = assignedIPv4List.length > 0
   const hasIndependentIPv6 = ipv6List.length > 0
-  const hasIndependentIP = hasIndependentIPv4 || hasIndependentIPv6
   const defaultConnPort = isWindows ? 3389 : 22
 
   let publicEndpoint = '-'
   let sshCommand = ''
 
-  if (container.ssh_port > 0) {
+  if (hasIndependentIPv4) {
+    // Direct connection via independent IPv4 — all ports forwarded
+    publicEndpoint = `${assignedIPv4List[0]}:${defaultConnPort}`
+    if (!isWindows) {
+      sshCommand = `ssh root@${assignedIPv4List[0]}`
+    }
+  } else if (hasIndependentIPv6) {
+    publicEndpoint = `[${ipv6List[0]}]:${defaultConnPort}`
+    if (!isWindows) {
+      sshCommand = `ssh root@[${ipv6List[0]}]`
+    }
+  } else if (container.ssh_port > 0) {
     // NAT port mapping mode
     publicEndpoint = `${publicHost}:${container.ssh_port}`
     sshCommand = `ssh -p ${container.ssh_port} root@${publicHost}`
-  } else if (hasIndependentIP) {
-    // Direct connection via independent IPv4 or IPv6
-    const connIP = hasIndependentIPv4 ? assignedIPv4List[0] : `[${ipv6List[0]}]`
-    publicEndpoint = `${connIP}:${defaultConnPort}`
-    if (!isWindows) {
-      sshCommand = `ssh root@${connIP}`
-    }
   }
   const editingSSH = draft.index !== null && !!container.port_mappings?.[draft.index] && (
     container.port_mappings[draft.index].description === 'SSH' || container.port_mappings[draft.index].container_port === 22 ||
@@ -872,13 +876,17 @@ export default function ContainerDetail() {
             <div>
               <div className="flex items-center gap-2 flex-wrap">
                 <h1 className="text-xl font-bold text-black">{container.name}</h1>
-                <StatusBadge running={isRunning} />
+                <StatusBadge running={isRunning} initializing={isInitializing} />
               </div>
               <div className="flex items-center gap-2 flex-wrap mt-2">
                 <InfoTag color="blue">系统 {container.template}</InfoTag>
                 <InfoTag color="slate">类型 {(container.virtualization || 'lxc').toUpperCase()}</InfoTag>
                 <InfoTag color="emerald">内网 {container.ip || '-'}</InfoTag>
-                <InfoTag color="amber">IPv4 NAT {hasNATQuota ? `${mappingCount} 条` : '未分配'}</InfoTag>
+                {hasIndependentIPv4 ? (
+                  <InfoTag color="amber">独立 IPv4 {assignedIPv4List[0]}</InfoTag>
+                ) : (
+                  <InfoTag color="amber">IPv4 NAT {hasNATQuota ? `${mappingCount} 条` : '未分配'}</InfoTag>
+                )}
                 <InfoTag color="violet">{isWindows ? 'RDP' : 'SSH'} {publicEndpoint}</InfoTag>
                 {isPolicyBlocked && <InfoTag color="red">策略封禁</InfoTag>}
               </div>
@@ -921,12 +929,14 @@ export default function ContainerDetail() {
                 管理链接
               </ActionButton>
             )}
-            <>
-              <ActionButton disabled={isSubUserPolicyBlocked} onClick={() => setShowNat(true)}>
-                <Settings className="w-3.5 h-3.5" />
-                IPv4 NAT 管理
-              </ActionButton>
-            </>
+            {!hasIndependentIPv4 && (
+              <>
+                <ActionButton disabled={isSubUserPolicyBlocked} onClick={() => setShowNat(true)}>
+                  <Settings className="w-3.5 h-3.5" />
+                  IPv4 NAT 管理
+                </ActionButton>
+              </>
+            )}
             <ActionButton onClick={() => setShowSnapshots(true)} disabled={!!taskStatus || !!snapshotBusy || isSubUserPolicyBlocked}>
               <Camera className="w-3.5 h-3.5" />
               快照
@@ -1436,7 +1446,7 @@ export default function ContainerDetail() {
         </Modal>
       )}
 
-      {showNat && (
+      {showNat && !hasIndependentIPv4 && (
         <Modal title="IPv4 NAT 端口管理" onClose={() => { setShowNat(false); setDraft(emptyDraft); setShowMappingEditor(false) }} wide extra={
           !isSubUser && canAddMapping && (
             <button onClick={openAddMapping} className="inline-flex items-center gap-1.5 px-3 py-1.5 bg-black text-white rounded-md text-xs hover:bg-gray-800">
@@ -1670,7 +1680,15 @@ function RangeSwitch({ value, onChange }: { value: StatsRangeKey; onChange: (val
   )
 }
 
-function StatusBadge({ running }: { running: boolean }) {
+function StatusBadge({ running, initializing }: { running: boolean; initializing?: boolean }) {
+  if (initializing) {
+    return (
+      <span className="inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-[11px] font-medium whitespace-nowrap bg-amber-50 text-amber-700">
+        <span className="w-1.5 h-1.5 rounded-full flex-shrink-0 bg-amber-500 animate-pulse"></span>
+        正在初始化
+      </span>
+    )
+  }
   return (
     <span className={`inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-[11px] font-medium whitespace-nowrap ${running ? 'bg-emerald-100 text-emerald-700' : 'bg-rose-100 text-rose-700'}`}>
       <span className={`w-1.5 h-1.5 rounded-full flex-shrink-0 ${running ? 'bg-emerald-500' : 'bg-rose-500'}`}></span>

frontend/src/pages/Containers.tsx

@@ -390,6 +390,7 @@ export default function Containers() {
               <tbody className="divide-y divide-gray-100">
                 {pageContainers.map((container) => {
                   const isRunning = container.status === 'running'
+                  const isInitializing = container.status === 'initializing'
                   const task = (container.id > 0 ? taskStatusMap[container.id] : taskNameMap[container.name]) || container.createTask
                   const isPlaceholder = !!container.isPlaceholder
                   const isPolicyBlocked = !!container.policy_blocked
@@ -437,7 +438,7 @@ export default function Containers() {
                         </button>
                       </td>
                       <td className="px-2.5 py-2 align-top">
-                        <StatusBadge running={isRunning} task={task} placeholder={isPlaceholder} policyBlocked={isPolicyBlocked} />
+                        <StatusBadge running={isRunning} initializing={isInitializing} task={task} placeholder={isPlaceholder} policyBlocked={isPolicyBlocked} />
                       </td>
                       <td className="px-2.5 py-2 align-top text-xs text-gray-600 whitespace-nowrap">
                         <span className="inline-flex items-center gap-1">
@@ -483,7 +484,7 @@ export default function Containers() {
                                 try {
                                   const { default: api } = await import('../services/api')
                                   await api.delete(`/tasks/${task.id}`)
-                                  fetchData()
+                                  await Promise.all([fetchData(), fetchTasks()])
                                 } catch { /* ignore */ }
                               }}
                               className="inline-flex items-center gap-1 px-2 py-1 rounded-md border border-red-200 text-[11px] text-red-600 hover:bg-red-50 transition-colors whitespace-nowrap"
@@ -581,7 +582,7 @@ type DisplayContainer = Container & {
   createTask?: Task
 }
 
-function StatusBadge({ running, task, placeholder, policyBlocked }: { running: boolean; task?: Task; placeholder?: boolean; policyBlocked?: boolean }) {
+function StatusBadge({ running, initializing, task, placeholder, policyBlocked }: { running: boolean; initializing?: boolean; task?: Task; placeholder?: boolean; policyBlocked?: boolean }) {
   const baseClass = "inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-[11px] font-medium whitespace-nowrap"
   if (policyBlocked) {
     return (
@@ -640,6 +641,15 @@ function StatusBadge({ running, task, placeholder, policyBlocked }: { running: b
     )
   }
 
+  if (initializing) {
+    return (
+      <span className={`${baseClass} bg-amber-50 text-amber-700`}>
+        <span className="w-1.5 h-1.5 rounded-full bg-amber-500 animate-pulse"></span>
+        正在初始化
+      </span>
+    )
+  }
+
   return (
     <span className={`${baseClass} ${running ? 'bg-green-50 text-green-700' : 'bg-red-50 text-red-600'}`}>
       <span className={`w-1.5 h-1.5 rounded-full flex-shrink-0 ${running ? 'bg-green-500' : 'bg-red-500'}`}></span>

frontend/src/pages/Login.tsx

@@ -66,7 +66,7 @@ export default function Login() {
                 <AppIcon className="w-10 h-10" />
               </div>
               <h1 className="text-2xl font-bold text-gray-950">CLICD</h1>
-              <p className="text-gray-500 mt-1 text-sm">{isAccessCodeLogin ? '容器管理登录' : 'LXC Container Manager'}</p>
+              <p className="text-gray-500 mt-1 text-sm">{isAccessCodeLogin ? '容器管理登录' : 'Container Manager'}</p>
             </div>
 
             <form onSubmit={handleSubmit} className="space-y-5">
@@ -128,7 +128,7 @@ export default function Login() {
           </form>
         </div>
 
-        <p className="text-center text-xs text-gray-400 mt-6">CLICD v1.1.14</p>
+        <p className="text-center text-xs text-gray-400 mt-6">CLICD v1.1.16</p>
       </div>
     </div>
   )

frontend/src/pages/Routing.tsx

@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useMemo, useState, type ReactNode } from 'react'
+import { useCallback, useEffect, useMemo, useRef, useState, type ReactNode } from 'react'
 import { Globe2, Network, Pencil, Plus, RefreshCw, Router, Save, Search, Server, Trash2, X } from 'lucide-react'
 import { useNavigate } from 'react-router-dom'
 import { useLanguage, type Language } from '../contexts/LanguageContext'
@@ -23,7 +23,8 @@ export default function Routing() {
   const [ipv4EditMode, setIPv4EditMode] = useState<'pool' | 'address'>('pool')
   const [editingIPv4Address, setEditingIPv4Address] = useState('')
   const [savingIPv4, setSavingIPv4] = useState(false)
-  const [ipv4Draft, setIPv4Draft] = useState<PublicIPv4Info[]>([])
+  const [ipv4Draft, setIPv4Draft] = useState<(PublicIPv4Info & { _id: number })[]>([])
+  const nextDraftId = useRef(0)
   const [nat4Page, setNat4Page] = useState(1)
   const [ipv6Page, setIPv6Page] = useState(1)
   const [nat4Search, setNat4Search] = useState('')
@@ -54,7 +55,7 @@ export default function Routing() {
 
   useEffect(() => {
     if (!editingIPv4) {
-      setIPv4Draft(publicIPv4s.map((ip) => ({ ...ip })))
+      setIPv4Draft(publicIPv4s.map((ip) => ({ ...ip, _id: nextDraftId.current++ })))
     }
   }, [editingIPv4, publicIPv4s])
 
@@ -65,14 +66,14 @@ export default function Routing() {
   }, [ipv4Assignments])
 
   const startEditIPv4 = () => {
-    setIPv4Draft(publicIPv4s.map((ip) => ({ ...ip })))
+    setIPv4Draft(publicIPv4s.map((ip) => ({ ...ip, _id: nextDraftId.current++ })))
     setIPv4EditMode('pool')
     setEditingIPv4Address('')
     setEditingIPv4(true)
   }
 
   const startEditIPv4Address = (ip: PublicIPv4Info) => {
-    setIPv4Draft([{ ...ip }])
+    setIPv4Draft([{ ...ip, _id: nextDraftId.current++ }])
     setIPv4EditMode('address')
     setEditingIPv4Address(ip.address)
     setEditingIPv4(true)
@@ -82,13 +83,14 @@ export default function Routing() {
     setEditingIPv4(false)
     setIPv4EditMode('pool')
     setEditingIPv4Address('')
-    setIPv4Draft(publicIPv4s.map((ip) => ({ ...ip })))
+    setIPv4Draft([])
   }
 
   const addIPv4Row = () => {
     setIPv4Draft((items) => [
       ...items,
       {
+        _id: nextDraftId.current++,
         address: '',
         interface: defaultIPv4Interface,
         prefix: '',
@@ -108,7 +110,7 @@ export default function Routing() {
     setSavingIPv4(true)
     try {
       const draftItems = ipv4Draft
-        .map((item) => ({
+        .map(({ _id, ...item }) => ({
           ...item,
           address: (item.address || '').trim(),
           interface: (item.interface || defaultIPv4Interface).trim(),
@@ -285,7 +287,7 @@ export default function Routing() {
                 </thead>
                 <tbody className="divide-y divide-gray-100">
                   {ipv4Draft.map((item, index) => (
-                    <tr key={`${item.address}-${index}`}>
+                    <tr key={item._id}>
                       <td className="px-3 py-2"><input value={item.address || ''} onChange={(e) => updateIPv4Draft(index, { address: e.target.value })} placeholder={text.ipv4CIDR} className={smallInputClass} /></td>
                       <td className="px-3 py-2"><input value={item.gateway || ''} onChange={(e) => updateIPv4Draft(index, { gateway: e.target.value })} placeholder={defaultIPv4Gateway || text.gateway} className={smallInputClass} /></td>
                       <td className="px-3 py-2"><input value={item.interface || ''} onChange={(e) => updateIPv4Draft(index, { interface: e.target.value })} placeholder={defaultIPv4Interface} className={smallInputClass} /></td>