Merge pull request #37 from LusineStar/fix/windows-firstlogon-drive-scan

fix(kvm): Windows 首启脚本盘符扫描的批处理语法错误，导致 RDP/入站端口全被丢弃

.github/workflows/build.yml

@@ -14,9 +14,15 @@ permissions:
   contents: write
 
 jobs:
-  linux-amd64:
-    name: Linux amd64
+  linux:
+    name: Linux ${{ matrix.goarch }}
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        goarch:
+          - amd64
+          - arm64
 
     steps:
       - name: Checkout
@@ -25,7 +31,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: "22.22.0"
           cache: npm
           cache-dependency-path: |
             frontend/package-lock.json
@@ -55,16 +61,21 @@ jobs:
           fi
 
       - name: Build CLICD
+        env:
+          CLICD_GOARCH: ${{ matrix.goarch }}
         run: bash build.sh
 
       - name: Package CLICD
+        env:
+          CLICD_GOARCH: ${{ matrix.goarch }}
         run: |
-          mkdir -p dist package/clicd-linux-amd64
-          cp build/clicd package/clicd-linux-amd64/clicd
-          cp build/install.sh package/clicd-linux-amd64/install.sh
-          chmod +x package/clicd-linux-amd64/clicd package/clicd-linux-amd64/install.sh
-          tar -C package -czf dist/clicd-linux-amd64.tar.gz clicd-linux-amd64
-          cp build/clicd dist/clicd-linux-amd64
+          asset_dir="clicd-linux-${CLICD_GOARCH}"
+          mkdir -p "dist" "package/${asset_dir}"
+          cp build/clicd "package/${asset_dir}/clicd"
+          cp build/install.sh "package/${asset_dir}/install.sh"
+          chmod +x "package/${asset_dir}/clicd" "package/${asset_dir}/install.sh"
+          tar -C package -czf "dist/${asset_dir}.tar.gz" "${asset_dir}"
+          cp build/clicd "dist/${asset_dir}"
 
       - name: Package Mofang module
         run: |
@@ -87,13 +98,34 @@ jobs:
       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with:
-          name: clicd-linux-amd64
+          name: clicd-linux-${{ matrix.goarch }}
           path: dist/*
 
-      - name: Publish GitHub Release
+  release:
+    name: Publish GitHub Release
+    needs: linux
+    runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: dist-artifacts
+
+      - name: Prepare release assets
+        run: |
+          mkdir -p dist
+          find dist-artifacts -maxdepth 2 -type f ! -name SHA256SUMS -print -exec cp -f {} dist/ \;
+          sha256sum dist/* > dist/SHA256SUMS
+
+      - name: Publish GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
         run: |
           gh release create "$GITHUB_REF_NAME" dist/* --generate-notes || \
           gh release upload "$GITHUB_REF_NAME" dist/* --clobber

.github/workflows/pages.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "22.22.0"
           cache: npm
           cache-dependency-path: docs/package-lock.json
 

.gitignore

@@ -13,6 +13,7 @@ backend/internal/server/web/*
 
 # Build artifacts
 /build/
+/dist/
 Mofang/*.zip
 *.exe
 *.dll
@@ -69,3 +70,6 @@ push-release.ps1
 deploy.ps1
 backend/clicd
 api.md
+deploy-arm.ps1
+deploy-dhcp.ps1
+deploy-pve-windows.ps1

Mofang/clicd.php

@@ -1,4 +1,4 @@
-<?php
+<?php
 
 use think\Db;
 

Mofang/handlers/webssh.php

@@ -1,4 +1,4 @@
-<?php
+<?php
 $ws = isset($_GET['ws']) ? (string)$_GET['ws'] : (isset($_GET['amp;ws']) ? (string)$_GET['amp;ws'] : '');
 $protocol = isset($_GET['protocol']) ? (string)$_GET['protocol'] : (isset($_GET['amp;protocol']) ? (string)$_GET['amp;protocol'] : '');
 $container = isset($_GET['container']) ? (string)$_GET['container'] : (isset($_GET['amp;container']) ? (string)$_GET['amp;container'] : '');

Mofang/templates/firewall.html

@@ -1,4 +1,4 @@
-<style>
+<style>
     .clicd-fw-panel {
         font-size: 14px;
         color: #1f2937

Mofang/templates/info.html

@@ -1,4 +1,4 @@
-<style>
+<style>
 .clicd-info{font-size:14px;color:#1f2937;background:#f6f8fb;padding:14px;border-radius:6px;max-width:100%;overflow:hidden}
 .clicd-info *{box-sizing:border-box}
 .clicd-head{display:grid;grid-template-columns:repeat(auto-fit,minmax(170px,1fr));gap:10px;margin-bottom:12px}

Mofang/templates/nat.html

@@ -1,4 +1,4 @@
-<style>
+<style>
 .clicd-nat-panel{font-size:14px;color:#1f2937}
 .clicd-nat-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(180px,1fr));gap:12px;margin-bottom:16px}
 .clicd-nat-card{border:1px solid #e5e7eb;border-radius:6px;padding:12px;background:#fff}

README.md

@@ -119,10 +119,4 @@ This open-source software is intended solely for educational purposes, specifica
 
 ## Star History
 
-<a href="https://www.star-history.com/?repos=MengMengCode%2FCLICD&type=date&legend=top-left">
- <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=MengMengCode/CLICD&type=date&theme=dark&legend=top-left" />
-   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=MengMengCode/CLICD&type=date&legend=top-left" />
-   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=MengMengCode/CLICD&type=date&legend=top-left" />
- </picture>
-</a>
+[![MengMengCode/CLICD Star History](http://mengmeng.meteor-history.com/api/embed/MengMengCode/CLICD.svg?sig=YT8i1bxihL6_GcFAa0CWRbQb35-B0XXyh-ZAxIsmV0U&theme=light&style=xkcd&color=dd4528&background=ffffff&textColor=000000&width=900&height=600&lineWidth=3&showTitle=true&showLegend=true&showDots=false&v=3)](https://meteor-history.com)

backend/go.mod

@@ -1,18 +1,16 @@
 module clicd
 
-go 1.24.0
-
-toolchain go1.24.5
+go 1.25.0
 
 require (
 	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/gorilla/websocket v1.5.3
-	golang.org/x/crypto v0.45.0
-	golang.org/x/term v0.37.0
+	golang.org/x/crypto v0.52.0
+	golang.org/x/term v0.43.0
 )
 
 require (
-	golang.org/x/sys v0.38.0
+	golang.org/x/sys v0.45.0
 	modernc.org/sqlite v1.29.10
 )
 

backend/go.sum

@@ -18,8 +18,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
-golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
-golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/exp v0.0.0-20231108232855-2478ac86f678 h1:mchzmB1XO2pMaKFRqk/+MV3mgGG96aqaPXaMifQU47w=
 golang.org/x/exp v0.0.0-20231108232855-2478ac86f678/go.mod h1:zk2irFbV9DP96SEBUUAy67IdHUaZuSnrz1n472HUCLE=
 golang.org/x/mod v0.19.0 h1:fEdghXQSo20giMthA7cd28ZC+jts4amQ3YMXiP5oMQ8=
@@ -27,10 +27,10 @@ golang.org/x/mod v0.19.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
-golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
-golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
+golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
 golang.org/x/tools v0.23.0 h1:SGsXPZ+2l4JsgaCKkx+FQ9YZ5XEtA1GZYuoDjenLjvg=
 golang.org/x/tools v0.23.0/go.mod h1:pnu6ufv6vQkll6szChhK3C3L/ruaIv5eBeztNG8wtsI=
 modernc.org/cc/v4 v4.24.4 h1:TFkx1s6dCkQpd6dKurBNmpo+G8Zl4Sq/ztJ+2+DEsh0=

backend/internal/api/access_policy.go

@@ -0,0 +1,94 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+
+	"clicd/internal/config"
+)
+
+type panelAccessPolicyResponse struct {
+	Enabled        bool     `json:"enabled"`
+	AllowedSources []string `json:"allowed_sources"`
+	TrustedProxies []string `json:"trusted_proxies"`
+	CurrentSource  string   `json:"current_source"`
+	DirectSource   string   `json:"direct_source"`
+	UsingForwarded bool     `json:"using_forwarded"`
+}
+
+func HandlePanelAccessPolicy(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodGet:
+		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: panelAccessPolicyStatus(r, config.AppConfig.PanelAccessPolicy)})
+	case http.MethodPut:
+		updatePanelAccessPolicy(w, r)
+	default:
+		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
+	}
+}
+
+func updatePanelAccessPolicy(w http.ResponseWriter, r *http.Request) {
+	var requested config.PanelAccessPolicy
+	if err := json.NewDecoder(r.Body).Decode(&requested); err != nil {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid request body"})
+		return
+	}
+	normalized, err := config.NormalizePanelAccessPolicy(requested)
+	if err != nil {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: err.Error()})
+		return
+	}
+	decision := evaluatePanelRequest(r, normalized)
+	if normalized.Enabled && !decision.Allowed {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{
+			Success: false,
+			Message: "The new access policy does not allow your current source address " + decision.CurrentSource,
+		})
+		return
+	}
+
+	previous := config.AppConfig.PanelAccessPolicy
+	config.AppConfig.PanelAccessPolicy = normalized
+	if err := config.SaveConfig(); err != nil {
+		config.AppConfig.PanelAccessPolicy = previous
+		jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "Failed to save panel access policy"})
+		return
+	}
+	detail := "enabled=" + strings.ToLower(strings.TrimSpace(boolText(normalized.Enabled))) +
+		",allowed=" + strings.Join(normalized.AllowedSources, ",") +
+		",trusted_proxies=" + strings.Join(normalized.TrustedProxies, ",")
+	auditRequest(r, "settings.panel_access", "Panel access policy", detail, true, "")
+	jsonResponse(w, http.StatusOK, APIResponse{
+		Success: true,
+		Message: "Panel access policy saved",
+		Data:    panelAccessPolicyStatus(r, normalized),
+	})
+}
+
+func panelAccessPolicyStatus(r *http.Request, policy config.PanelAccessPolicy) panelAccessPolicyResponse {
+	decision := evaluatePanelRequest(r, policy)
+	return panelAccessPolicyResponse{
+		Enabled:        policy.Enabled,
+		AllowedSources: append([]string(nil), policy.AllowedSources...),
+		TrustedProxies: append([]string(nil), policy.TrustedProxies...),
+		CurrentSource:  decision.CurrentSource,
+		DirectSource:   decision.DirectSource,
+		UsingForwarded: decision.UsedForwarded,
+	}
+}
+
+func evaluatePanelRequest(r *http.Request, policy config.PanelAccessPolicy) config.PanelAccessDecision {
+	return config.EvaluatePanelAccess(policy, r.RemoteAddr, config.ForwardedClientHeaders{
+		ForwardedFor:   r.Header.Get("X-Forwarded-For"),
+		RealIP:         r.Header.Get("X-Real-IP"),
+		CFConnectingIP: r.Header.Get("CF-Connecting-IP"),
+	})
+}
+
+func boolText(value bool) string {
+	if value {
+		return "true"
+	}
+	return "false"
+}

backend/internal/api/container_metrics.go

@@ -0,0 +1,242 @@
+package api
+
+import (
+	"encoding/json"
+	"fmt"
+	"math"
+	"strconv"
+	"sync"
+	"time"
+
+	"clicd/internal/config"
+)
+
+type ContainerMetricPoint struct {
+	TS        int64   `json:"ts"`
+	CPU       float64 `json:"cpu"`
+	Memory    float64 `json:"memory"`
+	Network   float64 `json:"network"`
+	NetworkRx float64 `json:"network_rx"`
+	NetworkTx float64 `json:"network_tx"`
+	DiskIO    float64 `json:"disk_io"`
+	DiskRead  float64 `json:"disk_read"`
+	DiskWrite float64 `json:"disk_write"`
+}
+
+var containerMetricSamplerOnce sync.Once
+var containerMetricMu sync.RWMutex
+var containerMetricHistory = map[string][]ContainerMetricPoint{}
+var containerMetricInFlight sync.Map
+
+const (
+	containerMetricSampleInterval = 30 * time.Second
+	containerMetricSampleTimeout  = 20 * time.Second
+	containerMetricConcurrency    = 4
+)
+
+func StartContainerMetricSampler() {
+	containerMetricSamplerOnce.Do(func() {
+		go func() {
+			sampleAllContainerMetrics()
+			ticker := time.NewTicker(containerMetricSampleInterval)
+			defer ticker.Stop()
+			for range ticker.C {
+				sampleAllContainerMetrics()
+			}
+		}()
+	})
+}
+
+func sampleAllContainerMetrics() {
+	containers, _ := listByRuntime()
+	sem := make(chan struct{}, containerMetricConcurrency)
+	var wg sync.WaitGroup
+
+	for _, c := range containers {
+		c := c
+		if c.Status != "running" {
+			continue
+		}
+		sem <- struct{}{}
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			defer func() { <-sem }()
+			sampleContainerMetricWithTimeout(c)
+		}()
+	}
+	wg.Wait()
+	pruneContainerMetricHistory()
+}
+
+func sampleContainerMetricWithTimeout(c config.Container) {
+	key := containerMetricKey(c)
+	if key == "" {
+		return
+	}
+	if _, loaded := containerMetricInFlight.LoadOrStore(key, struct{}{}); loaded {
+		return
+	}
+	done := make(chan struct{}, 1)
+	go func() {
+		defer containerMetricInFlight.Delete(key)
+		if usage, err := usageByRuntime(c.ID); err == nil {
+			appendContainerMetricPoint(c, usage)
+		}
+		done <- struct{}{}
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(containerMetricSampleTimeout):
+	}
+}
+
+func appendContainerMetricPoint(c config.Container, usage map[string]interface{}) {
+	key := containerMetricKey(c)
+	if key == "" {
+		return
+	}
+	memoryTotal := numberFromUsage(usage, "memory_total_bytes")
+	if memoryTotal <= 0 {
+		memoryTotal = float64(c.RAMMB) * 1024 * 1024
+	}
+	memoryPct := 0.0
+	if memoryTotal > 0 {
+		memoryPct = clampPercent(numberFromUsage(usage, "memory_usage_bytes") / memoryTotal * 100)
+	}
+	vcpu := c.VCPU
+	if vcpu <= 0 {
+		vcpu = 1
+	}
+	cpuPct := clampPercent(numberFromUsage(usage, "cpu_usage_pct") / vcpu)
+	networkRx := positiveNumberFromUsage(usage, "network_rx_bps")
+	networkTx := positiveNumberFromUsage(usage, "network_tx_bps")
+	diskRead := positiveNumberFromUsage(usage, "disk_read_bps")
+	diskWrite := positiveNumberFromUsage(usage, "disk_write_bps")
+	point := ContainerMetricPoint{
+		TS:        time.Now().UnixMilli(),
+		CPU:       cpuPct,
+		Memory:    memoryPct,
+		NetworkRx: networkRx,
+		NetworkTx: networkTx,
+		Network:   networkRx + networkTx,
+		DiskRead:  diskRead,
+		DiskWrite: diskWrite,
+		DiskIO:    diskRead + diskWrite,
+	}
+	cutoff := time.Now().Add(-hostMetricRetention).UnixMilli()
+
+	containerMetricMu.Lock()
+	defer containerMetricMu.Unlock()
+
+	history := containerMetricHistory[key]
+	keepFrom := 0
+	for keepFrom < len(history) && history[keepFrom].TS < cutoff {
+		keepFrom++
+	}
+	if keepFrom > 0 {
+		copy(history, history[keepFrom:])
+		history = history[:len(history)-keepFrom]
+	}
+	containerMetricHistory[key] = append(history, point)
+}
+
+func getContainerMetricHistory(c *config.Container) []ContainerMetricPoint {
+	if c == nil {
+		return nil
+	}
+	key := containerMetricKey(*c)
+	containerMetricMu.RLock()
+	defer containerMetricMu.RUnlock()
+
+	history := containerMetricHistory[key]
+	result := make([]ContainerMetricPoint, len(history))
+	copy(result, history)
+	return result
+}
+
+func pruneContainerMetricHistory() {
+	cutoff := time.Now().Add(-hostMetricRetention).UnixMilli()
+	valid := map[string]bool{}
+	if config.AppConfig != nil {
+		for _, c := range config.AppConfig.Containers {
+			valid[containerMetricKey(c)] = true
+		}
+	}
+
+	containerMetricMu.Lock()
+	defer containerMetricMu.Unlock()
+
+	for key, history := range containerMetricHistory {
+		if !valid[key] {
+			delete(containerMetricHistory, key)
+			continue
+		}
+		keepFrom := 0
+		for keepFrom < len(history) && history[keepFrom].TS < cutoff {
+			keepFrom++
+		}
+		if keepFrom > 0 {
+			copy(history, history[keepFrom:])
+			containerMetricHistory[key] = history[:len(history)-keepFrom]
+		}
+	}
+}
+
+func containerMetricKey(c config.Container) string {
+	if c.UUID != "" {
+		return "uuid:" + c.UUID
+	}
+	if c.ID > 0 {
+		return fmt.Sprintf("id:%d", c.ID)
+	}
+	if c.Name != "" {
+		return "name:" + c.Name
+	}
+	return ""
+}
+
+func numberFromUsage(usage map[string]interface{}, key string) float64 {
+	value, ok := usage[key]
+	if !ok || value == nil {
+		return 0
+	}
+	switch v := value.(type) {
+	case float64:
+		if math.IsNaN(v) || math.IsInf(v, 0) {
+			return 0
+		}
+		return v
+	case float32:
+		return float64(v)
+	case int:
+		return float64(v)
+	case int64:
+		return float64(v)
+	case int32:
+		return float64(v)
+	case uint:
+		return float64(v)
+	case uint64:
+		return float64(v)
+	case uint32:
+		return float64(v)
+	case json.Number:
+		n, _ := v.Float64()
+		return n
+	case string:
+		n, _ := strconv.ParseFloat(v, 64)
+		return n
+	default:
+		return 0
+	}
+}
+
+func positiveNumberFromUsage(usage map[string]interface{}, key string) float64 {
+	value := numberFromUsage(usage, key)
+	if value < 0 {
+		return 0
+	}
+	return value
+}

backend/internal/api/handlers.go

@@ -132,6 +132,11 @@ func HandleSingleContainer(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 		getUsage(w, r, id)
+	case action == "history" && r.Method == http.MethodGet:
+		if !requireScope(w, r, "container:read") {
+			return
+		}
+		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: getContainerMetricHistory(c)})
 	case action == "traffic" && r.Method == http.MethodGet:
 		if !requireScope(w, r, "container:read") {
 			return
@@ -167,6 +172,16 @@ func HandleSingleContainer(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 		assignIPv6(w, r, id)
+	case action == "public-ipv4" && r.Method == http.MethodPut:
+		if !requireScope(w, r, "container:network") {
+			return
+		}
+		updatePublicIPv4(w, r, id)
+	case action == "ipv6-addresses" && r.Method == http.MethodPut:
+		if !requireScope(w, r, "ipv6:assign") {
+			return
+		}
+		updateIPv6Addresses(w, r, id)
 	case action == "snapshots" || strings.HasPrefix(action, "snapshots/"):
 		handleContainerSnapshots(w, r, id, action)
 	case action == "port-mappings" && r.Method == http.MethodPost:
@@ -240,6 +255,12 @@ func createContainer(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Template is not enabled or downloaded"})
 		return
 	}
+	if ids, err := normalizeAllowedImageIDs(cfg.AllowedImageIDs); err != nil {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: err.Error()})
+		return
+	} else {
+		cfg.AllowedImageIDs = ids
+	}
 	if cfg.VCPU <= 0 {
 		cfg.VCPU = 1
 	}
@@ -253,11 +274,13 @@ func createContainer(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Port mapping count cannot be negative"})
 		return
 	}
-	if cfg.WantsNAT() && cfg.PortMappingCount < 2 {
-		cfg.PortMappingCount = 2
-	} else if !cfg.WantsNAT() {
-		cfg.PortMappingCount = 0
-		cfg.ExtraPorts = nil
+	if err := cfg.NormalizeCreateNATMappings(); err != nil {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: err.Error()})
+		return
+	}
+	if err := lxc.ValidateCreateNATPortAvailability(cfg); err != nil {
+		jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: err.Error()})
+		return
 	}
 	if cfg.PortMappingCount > 64 {
 		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Port mapping count cannot exceed 64"})
@@ -288,6 +311,10 @@ func createContainer(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: err.Error()})
 		return
 	}
+	if err := validateCreateStoragePool(&cfg); err != nil {
+		jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: err.Error()})
+		return
+	}
 	if err := validateCreateSSHAuth(cfg); err != nil {
 		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: err.Error()})
 		return
@@ -452,13 +479,12 @@ func updateResourceLimit(w http.ResponseWriter, r *http.Request, id int) {
 	config.NormalizeContainerResourceAliases(c)
 	config.SaveConfig()
 
-	// Re-apply resource limits to running container
-	if c.Status == "running" {
+	// Re-apply persisted/runtime limits. LXC also uses this path to migrate
+	// old managed config lines such as lxc.prlimit.nproc.
 	if err := applyLimitsByRuntime(c); err != nil {
 		jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: err.Error()})
 		return
 	}
-	}
 
 	msg := "Resource limits updated"
 	if c.IsKVM() && c.Status == "running" {
@@ -656,6 +682,18 @@ func HandleHostInfo(w http.ResponseWriter, r *http.Request) {
 	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: info})
 }
 
+// HandleHostHistory returns host resource samples collected by the server.
+func HandleHostHistory(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
+		return
+	}
+	if !requireScope(w, r, "host:read") {
+		return
+	}
+	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: getHostMetricHistory()})
+}
+
 func resetSSHPassword(w http.ResponseWriter, r *http.Request, id int) {
 	c := config.FindContainer(id)
 	if c != nil && lxc.IsExpired(*c) {

backend/internal/api/host.go

@@ -5,6 +5,8 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"io"
+	"math"
 	"net"
 	"net/http"
 	"os"
@@ -27,6 +29,7 @@ type HostInfo struct {
 	Network NetworkInfo      `json:"network"`
 	DiskIO  DiskIOInfo       `json:"disk_io"`
 	Load    LoadInfo         `json:"load"`
+	Runtime HostRuntimeProbe `json:"runtime"`
 }
 
 type HostProbeReport struct {
@@ -215,10 +218,34 @@ type DiskIOInfo struct {
 	WriteBps   float64 `json:"write_bps"`
 }
 
+type HostMetricPoint struct {
+	TS           int64   `json:"ts"`
+	CPU          float64 `json:"cpu"`
+	Memory       float64 `json:"memory"`
+	Network      float64 `json:"network"`
+	NetworkRx    float64 `json:"network_rx"`
+	NetworkTx    float64 `json:"network_tx"`
+	DiskIO       float64 `json:"disk_io"`
+	DiskRead     float64 `json:"disk_read"`
+	DiskWrite    float64 `json:"disk_write"`
+	DiskUsagePct float64 `json:"disk_usage_pct"`
+}
+
 var hostCPUMu sync.Mutex
 var lastHostCPU cpuTimes
 var hostIOMu sync.Mutex
 var lastHostIO hostIOSample
+var hostMetricSamplerOnce sync.Once
+var hostMetricMu sync.RWMutex
+var hostMetricHistory []HostMetricPoint
+var egressIPv4Mu sync.Mutex
+var cachedEgressIPv4 lxc.PublicIPInfo
+var cachedEgressIPv4At time.Time
+
+const (
+	hostMetricSampleInterval = 30 * time.Second
+	hostMetricRetention      = 7 * 24 * time.Hour
+)
 
 type cpuTimes struct {
 	Total uint64
@@ -234,6 +261,10 @@ type hostIOSample struct {
 }
 
 func getHostInfo() HostInfo {
+	return getHostInfoWithNetworkDetails(true)
+}
+
+func getHostInfoWithNetworkDetails(includeDetails bool) HostInfo {
 	info := HostInfo{
 		CPU: CpuInfo{Cores: runtime.NumCPU()},
 	}
@@ -241,11 +272,107 @@ func getHostInfo() HostInfo {
 	info.RAM = getMemoryInfo()
 	info.Disk = getDiskInfo()
 	info.CPU.Usage = getCPUUsage()
-	info.Network, info.DiskIO = getHostRates()
+	info.Network, info.DiskIO = getHostRates(includeDetails)
 	info.Load = getLoadInfo()
+	info.Runtime = detectRuntimeProbeQuick()
 	return info
 }
 
+func detectRuntimeProbeQuick() HostRuntimeProbe {
+	devKVM := fileExists("/dev/kvm")
+	nested, detail := detectNestedVirtualization()
+	lxcOK := commandExists("lxc-create")
+	kvmSupportedArch := runtime.GOARCH == "amd64" || runtime.GOARCH == "arm64"
+	kvmOK := kvmSupportedArch && devKVM && commandExists("virsh") && commandExists(kvmQEMUCheckKey())
+	probe := HostRuntimeProbe{
+		LXCAvailable:         lxcOK,
+		KVMAvailable:         kvmOK,
+		DevKVM:               devKVM,
+		NestedVirtualization: nested,
+		NestedDetail:         detail,
+		SupportMode:          "unsupported",
+	}
+	if probe.KVMAvailable {
+		probe.SupportMode = "kvm_lxc"
+	} else if probe.LXCAvailable {
+		probe.SupportMode = "lxc_only"
+	}
+	return probe
+}
+
+func StartHostMetricSampler() {
+	hostMetricSamplerOnce.Do(func() {
+		appendHostMetricPoint(getHostInfoWithNetworkDetails(false))
+		go func() {
+			ticker := time.NewTicker(hostMetricSampleInterval)
+			defer ticker.Stop()
+			for range ticker.C {
+				appendHostMetricPoint(getHostInfoWithNetworkDetails(false))
+			}
+		}()
+	})
+}
+
+func appendHostMetricPoint(info HostInfo) {
+	memoryPct := 0.0
+	if info.RAM.TotalMB > 0 {
+		memoryPct = clampPercent(float64(info.RAM.UsedMB) / float64(info.RAM.TotalMB) * 100)
+	}
+	diskUsagePct := 0.0
+	if info.Disk.TotalGB > 0 {
+		diskUsagePct = clampPercent(info.Disk.UsedGB / info.Disk.TotalGB * 100)
+	}
+	point := HostMetricPoint{
+		TS:           time.Now().UnixMilli(),
+		CPU:          clampPercent(info.CPU.Usage),
+		Memory:       memoryPct,
+		NetworkRx:    info.Network.RXBps,
+		NetworkTx:    info.Network.TXBps,
+		Network:      info.Network.RXBps + info.Network.TXBps,
+		DiskRead:     info.DiskIO.ReadBps,
+		DiskWrite:    info.DiskIO.WriteBps,
+		DiskIO:       info.DiskIO.ReadBps + info.DiskIO.WriteBps,
+		DiskUsagePct: diskUsagePct,
+	}
+	cutoff := time.Now().Add(-hostMetricRetention).UnixMilli()
+
+	hostMetricMu.Lock()
+	defer hostMetricMu.Unlock()
+
+	keepFrom := 0
+	for keepFrom < len(hostMetricHistory) && hostMetricHistory[keepFrom].TS < cutoff {
+		keepFrom++
+	}
+	if keepFrom > 0 {
+		copy(hostMetricHistory, hostMetricHistory[keepFrom:])
+		hostMetricHistory = hostMetricHistory[:len(hostMetricHistory)-keepFrom]
+	}
+	hostMetricHistory = append(hostMetricHistory, point)
+}
+
+func getHostMetricHistory() []HostMetricPoint {
+	hostMetricMu.RLock()
+	defer hostMetricMu.RUnlock()
+
+	result := make([]HostMetricPoint, len(hostMetricHistory))
+	copy(result, hostMetricHistory)
+	return result
+}
+
+func clampPercent(value float64) float64 {
+	if value < 0 || !isFiniteFloat(value) {
+		return 0
+	}
+	if value > 100 {
+		return 100
+	}
+	return value
+}
+
+func isFiniteFloat(value float64) bool {
+	return !math.IsNaN(value) && !math.IsInf(value, 0)
+}
+
 func getMemoryInfo() MemoryInfo {
 	f, err := os.Open("/proc/meminfo")
 	if err != nil {
@@ -391,13 +518,14 @@ func parseSizeGBf(s string) (float64, error) {
 	return val, err
 }
 
-func getHostRates() (NetworkInfo, DiskIOInfo) {
+func getHostRates(includeDetails bool) (NetworkInfo, DiskIOInfo) {
 	rx, tx := readHostNetworkBytes()
 	readBytes, writeBytes := readHostDiskBytes()
 	now := unixNano()
 
 	network := NetworkInfo{RXBytes: rx, TXBytes: tx}
-	publicIPv4 := lxc.DetectPublicIPv4()
+	if includeDetails {
+		publicIPv4 := detectDisplayPublicIPv4()
 		network.PublicIPv4 = publicIPv4.Address
 		network.PublicIPv4Interface = publicIPv4.Interface
 		network.PublicIPv4Addresses = lxc.DetectFreePublicIPv4Candidates(0)
@@ -406,6 +534,7 @@ func getHostRates() (NetworkInfo, DiskIOInfo) {
 			network.PublicIPv6 = network.IPv6Prefixes[0].Address
 			network.PublicIPv6Interface = network.IPv6Prefixes[0].Interface
 		}
+	}
 	diskIO := DiskIOInfo{ReadBytes: readBytes, WriteBytes: writeBytes}
 
 	hostIOMu.Lock()
@@ -437,23 +566,79 @@ func getHostRates() (NetworkInfo, DiskIOInfo) {
 }
 
 func readHostNetworkBytes() (uint64, uint64) {
-	entries, err := os.ReadDir("/sys/class/net")
-	if err != nil {
-		return 0, 0
+	ifaces := detectHostTrafficInterfaces()
+	if len(ifaces) == 0 {
+		ifaces = fallbackHostTrafficInterfaces()
 	}
 
 	var rx, tx uint64
-	for _, entry := range entries {
-		name := entry.Name()
-		if name == "lo" {
-			continue
-		}
+	for _, name := range ifaces {
 		rx += readUintFile("/sys/class/net/" + name + "/statistics/rx_bytes")
 		tx += readUintFile("/sys/class/net/" + name + "/statistics/tx_bytes")
 	}
 	return rx, tx
 }
 
+func detectHostTrafficInterfaces() []string {
+	seen := map[string]bool{}
+	result := make([]string, 0, 2)
+	add := func(name string) {
+		name = strings.TrimSpace(name)
+		if !isHostTrafficInterface(name) || seen[name] {
+			return
+		}
+		seen[name] = true
+		result = append(result, name)
+	}
+
+	if iface, _ := detectDefaultIPv4Route(); iface != "" {
+		add(iface)
+	}
+	if iface, _ := detectDefaultIPv6Route(); iface != "" {
+		add(iface)
+	}
+	if pub := lxc.DetectPublicIPv4(); pub.Interface != "" {
+		add(pub.Interface)
+	}
+	for _, prefix := range lxc.DetectHostPublicIPv6Prefixes() {
+		add(prefix.Interface)
+	}
+	return result
+}
+
+func fallbackHostTrafficInterfaces() []string {
+	entries, err := os.ReadDir("/sys/class/net")
+	if err != nil {
+		return nil
+	}
+
+	result := make([]string, 0)
+	for _, entry := range entries {
+		name := entry.Name()
+		if !isHostTrafficInterface(name) {
+			continue
+		}
+		state := strings.TrimSpace(readFirstExistingFile(filepath.Join("/sys/class/net", name, "operstate")))
+		if state == "down" {
+			continue
+		}
+		result = append(result, name)
+	}
+	sort.Strings(result)
+	return result
+}
+
+func isHostTrafficInterface(name string) bool {
+	name = strings.TrimSpace(name)
+	if name == "" || name == "lo" {
+		return false
+	}
+	if isContainerLikeInterfaceName(name) {
+		return false
+	}
+	return true
+}
+
 func readHostDiskBytes() (uint64, uint64) {
 	f, err := os.Open("/proc/diskstats")
 	if err != nil {
@@ -574,6 +759,8 @@ func trimOSReleaseValue(value string) string {
 
 func detectHostCPUProbe() HostCPUProbe {
 	probe := HostCPUProbe{Cores: runtime.NumCPU(), Threads: runtime.NumCPU(), Architecture: runtime.GOARCH}
+	armImplementer := ""
+	armPart := ""
 	if data, err := os.ReadFile("/proc/cpuinfo"); err == nil {
 		seenFlags := map[string]bool{}
 		for _, line := range strings.Split(string(data), "\n") {
@@ -582,19 +769,28 @@ func detectHostCPUProbe() HostCPUProbe {
 				continue
 			}
 			key := strings.TrimSpace(fields[0])
+			keyLower := strings.ToLower(key)
 			value := strings.TrimSpace(fields[1])
-			switch key {
-			case "model name", "Hardware", "Processor":
-				if probe.Model == "" {
+			switch keyLower {
+			case "model name", "hardware", "processor":
+				if probe.Model == "" && meaningfulCPUModel(value) {
 					probe.Model = value
 				}
 			case "cpu cores":
 				if cores, err := strconv.Atoi(value); err == nil && cores > probe.Cores {
 					probe.Cores = cores
 				}
-			case "flags", "Features":
+			case "cpu implementer":
+				if armImplementer == "" {
+					armImplementer = strings.ToLower(value)
+				}
+			case "cpu part":
+				if armPart == "" {
+					armPart = strings.ToLower(value)
+				}
+			case "flags", "features":
 				for _, flag := range strings.Fields(value) {
-					if flag == "vmx" || flag == "svm" {
+					if flag == "vmx" || flag == "svm" || flag == "virt" {
 						probe.Virtualization = true
 						probe.VirtualizationKey = flag
 					}
@@ -607,12 +803,132 @@ func detectHostCPUProbe() HostCPUProbe {
 		}
 		sort.Strings(probe.Flags)
 	}
+	enrichCPUProbeFromLscpu(&probe, &armImplementer, &armPart)
+	if probe.Model == "" {
+		probe.Model = armCPUModelName(armImplementer, armPart)
+	}
+	if probe.Model == "" && runtime.GOARCH == "arm64" {
+		probe.Model = "ARM64 CPU"
+	}
 	if probe.Model == "" {
 		probe.Model = "Unknown"
 	}
 	return probe
 }
 
+func meaningfulCPUModel(value string) bool {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return false
+	}
+	if _, err := strconv.Atoi(value); err == nil {
+		return false
+	}
+	lower := strings.ToLower(value)
+	return lower != "unknown" && lower != "not specified"
+}
+
+func enrichCPUProbeFromLscpu(probe *HostCPUProbe, armImplementer *string, armPart *string) {
+	out := runCommandOutput(2*time.Second, "lscpu")
+	if out == "" {
+		return
+	}
+	for _, line := range strings.Split(out, "\n") {
+		fields := strings.SplitN(line, ":", 2)
+		if len(fields) != 2 {
+			continue
+		}
+		key := strings.ToLower(strings.TrimSpace(fields[0]))
+		value := strings.TrimSpace(fields[1])
+		switch key {
+		case "model name":
+			if probe.Model == "" && meaningfulCPUModel(value) {
+				probe.Model = value
+			}
+		case "cpu(s)":
+			if threads, err := strconv.Atoi(value); err == nil && threads > probe.Threads {
+				probe.Threads = threads
+			}
+		case "core(s) per socket":
+			if cores, err := strconv.Atoi(value); err == nil && cores > 0 {
+				probe.Cores = cores
+			}
+		case "socket(s)":
+			if sockets, err := strconv.Atoi(value); err == nil && sockets > 1 && probe.Cores > 0 {
+				probe.Cores *= sockets
+			}
+		case "virtualization":
+			lower := strings.ToLower(value)
+			if value != "" && lower != "none" && lower != "n/a" {
+				probe.Virtualization = true
+				probe.VirtualizationKey = value
+			}
+		case "flags":
+			seen := map[string]bool{}
+			for _, flag := range probe.Flags {
+				seen[flag] = true
+			}
+			for _, flag := range strings.Fields(value) {
+				if flag == "vmx" || flag == "svm" || flag == "virt" {
+					probe.Virtualization = true
+					probe.VirtualizationKey = flag
+				}
+				if !seen[flag] {
+					probe.Flags = append(probe.Flags, flag)
+					seen[flag] = true
+				}
+			}
+			sort.Strings(probe.Flags)
+		case "cpu implementer":
+			if *armImplementer == "" {
+				*armImplementer = strings.ToLower(value)
+			}
+		case "cpu part":
+			if *armPart == "" {
+				*armPart = strings.ToLower(value)
+			}
+		}
+	}
+}
+
+func armCPUModelName(implementer, part string) string {
+	implementer = normalizeHexID(implementer)
+	part = normalizeHexID(part)
+	if implementer == "" || part == "" {
+		return ""
+	}
+	armParts := map[string]string{
+		"0x41:0xd03": "ARM Cortex-A53",
+		"0x41:0xd05": "ARM Cortex-A55",
+		"0x41:0xd07": "ARM Cortex-A57",
+		"0x41:0xd08": "ARM Cortex-A72",
+		"0x41:0xd09": "ARM Cortex-A73",
+		"0x41:0xd0a": "ARM Cortex-A75",
+		"0x41:0xd0b": "ARM Cortex-A76",
+		"0x41:0xd0c": "ARM Neoverse N1",
+		"0x41:0xd0d": "ARM Cortex-A77",
+		"0x41:0xd40": "ARM Neoverse V1",
+		"0x41:0xd41": "ARM Cortex-A78",
+		"0x41:0xd49": "ARM Neoverse N2",
+		"0x41:0xd4f": "ARM Neoverse V2",
+	}
+	if model := armParts[implementer+":"+part]; model != "" {
+		return model
+	}
+	return strings.ToUpper(strings.TrimPrefix(implementer, "0x")) + " ARM CPU part " + part
+}
+
+func normalizeHexID(value string) string {
+	value = strings.ToLower(strings.TrimSpace(value))
+	if value == "" {
+		return ""
+	}
+	if strings.HasPrefix(value, "0x") {
+		return value
+	}
+	return "0x" + value
+}
+
 func detectMemoryModules() []HostMemoryModule {
 	if !commandExists("dmidecode") {
 		return nil
@@ -724,7 +1040,7 @@ func isVirtualBlockDevice(name, model, vendor string) bool {
 	}
 	for _, token := range []string{
 		"qemu", "virtio", "virtual", "vmware", "vbox", "xen",
-		"amazon elastic block store", "google persistentdisk", "microsoft",
+		"amazon elastic block store", "google persistentdisk", "microsoft", "blockvolume",
 	} {
 		if strings.Contains(lower, token) {
 			return true
@@ -1153,9 +1469,126 @@ func detectAllPublicIPv4() []string {
 			result = append(result, value)
 		}
 	}
+	if egress := detectEgressPublicIPv4(); egress.Address != "" {
+		if !seen[egress.Address] {
+			seen[egress.Address] = true
+			result = append(result, egress.Address)
+		}
+	}
 	return result
 }
 
+func detectDisplayPublicIPv4() lxc.PublicIPInfo {
+	if pub := lxc.DetectPublicIPv4(); pub.Address != "" {
+		return pub
+	}
+	return detectEgressPublicIPv4()
+}
+
+func detectEgressPublicIPv4() lxc.PublicIPInfo {
+	egressIPv4Mu.Lock()
+	defer egressIPv4Mu.Unlock()
+
+	if cachedEgressIPv4.Address != "" && time.Since(cachedEgressIPv4At) < 5*time.Minute {
+		return cachedEgressIPv4
+	}
+
+	client := &http.Client{Timeout: 1200 * time.Millisecond}
+	for _, endpoint := range []string{
+		"https://api.ipify.org",
+		"https://ifconfig.me/ip",
+		"https://icanhazip.com",
+	} {
+		ctx, cancel := context.WithTimeout(context.Background(), 1200*time.Millisecond)
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+		if err != nil {
+			cancel()
+			continue
+		}
+		resp, err := client.Do(req)
+		if err != nil {
+			cancel()
+			continue
+		}
+		body, readErr := io.ReadAll(io.LimitReader(resp.Body, 128))
+		_ = resp.Body.Close()
+		cancel()
+		if readErr != nil || resp.StatusCode < 200 || resp.StatusCode >= 300 {
+			continue
+		}
+		address := strings.TrimSpace(string(body))
+		ip := net.ParseIP(address)
+		if !isPublicIPv4(ip) {
+			continue
+		}
+		iface, gateway := detectDefaultIPv4Route()
+		cachedEgressIPv4 = lxc.PublicIPInfo{
+			Address:    ip.String(),
+			Interface:  iface,
+			Prefix:     ip.String() + "/32",
+			PrefixLen:  32,
+			SubnetMask: "255.255.255.255",
+			Gateway:    gateway,
+			IsTunnel:   isTunnelLikeInterfaceName(iface),
+			Source:     "egress",
+		}
+		cachedEgressIPv4At = time.Now()
+		return cachedEgressIPv4
+	}
+
+	cachedEgressIPv4 = lxc.PublicIPInfo{}
+	cachedEgressIPv4At = time.Now()
+	return cachedEgressIPv4
+}
+
+func detectDefaultIPv4Route() (string, string) {
+	out := runCommandOutput(2*time.Second, "ip", "-4", "route", "show", "default")
+	for _, line := range strings.Split(out, "\n") {
+		fields := strings.Fields(line)
+		if len(fields) == 0 {
+			continue
+		}
+		iface := ""
+		gateway := ""
+		for i, field := range fields {
+			if field == "dev" && i+1 < len(fields) {
+				iface = fields[i+1]
+			}
+			if field == "via" && i+1 < len(fields) {
+				gateway = fields[i+1]
+			}
+		}
+		if iface != "" || gateway != "" {
+			return iface, gateway
+		}
+	}
+	return "", ""
+}
+
+func detectDefaultIPv6Route() (string, string) {
+	out := runCommandOutput(2*time.Second, "ip", "-6", "route", "show", "default")
+	for _, line := range strings.Split(out, "\n") {
+		fields := strings.Fields(line)
+		if len(fields) == 0 {
+			continue
+		}
+		iface := ""
+		gateway := ""
+		for i, field := range fields {
+			if field == "dev" && i+1 < len(fields) {
+				iface = fields[i+1]
+			}
+			if field == "via" && i+1 < len(fields) {
+				gateway = fields[i+1]
+			}
+		}
+		if iface != "" || gateway != "" {
+			return iface, gateway
+		}
+	}
+	return "", ""
+}
+
 func collectIPv4Addresses(nics []HostNICProbe) []HostIPProbe {
 	result := make([]HostIPProbe, 0)
 	for _, nic := range nics {
@@ -1301,6 +1734,16 @@ func isContainerLikeInterfaceName(iface string) bool {
 	return false
 }
 
+func isTunnelLikeInterfaceName(iface string) bool {
+	lower := strings.ToLower(strings.TrimSpace(iface))
+	for _, prefix := range []string{"tun", "tap", "wg", "gre", "gretap", "sit", "ip6tnl", "he-", "zt", "tailscale"} {
+		if lower == prefix || strings.HasPrefix(lower, prefix) {
+			return true
+		}
+	}
+	return false
+}
+
 func collectIPv6Addresses(nics []HostNICProbe) []HostIPProbe {
 	result := make([]HostIPProbe, 0)
 	for _, nic := range nics {
@@ -1368,6 +1811,8 @@ func detectGPUVendor(value string) string {
 		return "NVIDIA"
 	case strings.Contains(lower, "amd") || strings.Contains(lower, "ati"):
 		return "AMD"
+	case strings.Contains(lower, "virtio") || strings.Contains(lower, "red hat") || strings.Contains(lower, "qemu"):
+		return "Virtio"
 	default:
 		return "Unknown"
 	}
@@ -1375,6 +1820,9 @@ func detectGPUVendor(value string) string {
 
 func detectGPUType(value string) string {
 	lower := strings.ToLower(value)
+	if strings.Contains(lower, "virtio") || strings.Contains(lower, "red hat") || strings.Contains(lower, "qemu") {
+		return "virtual"
+	}
 	if strings.Contains(lower, "intel") {
 		return "integrated"
 	}
@@ -1394,9 +1842,10 @@ func detectRuntimeProbe(env []HostEnvCheck) HostRuntimeProbe {
 	devKVM := fileExists("/dev/kvm")
 	nested, detail := detectNestedVirtualization()
 	lxcOK := envCheckOK(env, "lxc-create")
+	kvmSupportedArch := runtime.GOARCH == "amd64" || runtime.GOARCH == "arm64"
 	probe := HostRuntimeProbe{
 		LXCAvailable:         lxcOK,
-		KVMAvailable:         devKVM && envCheckOK(env, "virsh"),
+		KVMAvailable:         kvmSupportedArch && devKVM && envCheckOK(env, "virsh") && envCheckOK(env, kvmQEMUCheckKey()),
 		DevKVM:               devKVM,
 		NestedVirtualization: nested,
 		NestedDetail:         detail,
@@ -1446,6 +1895,7 @@ func detectSystemProbe() HostSystemProbe {
 }
 
 func detectHostEnvironment() []HostEnvCheck {
+	qemuCheck := commandCheck(kvmQEMUCheckKey(), "QEMU/KVM 虚拟机", false, kvmQEMUCommand(), "")
 	checks := []HostEnvCheck{
 		commandCheck("service-manager", "服务管理器 systemd/OpenRC", true, "systemctl", "systemd"),
 		commandCheck("lxc-create", "LXC 创建工具", true, "lxc-create", ""),
@@ -1454,7 +1904,7 @@ func detectHostEnvironment() []HostEnvCheck {
 		commandCheck("ip", "iproute2 网络工具", true, "ip", ""),
 		commandCheck("conntrack", "conntrack 安全扫描", false, "conntrack", ""),
 		commandCheck("virsh", "libvirt virsh", false, "virsh", ""),
-		commandCheck("qemu-system-x86_64", "QEMU/KVM 虚拟机", false, "qemu-system-x86_64", ""),
+		qemuCheck,
 		commandCheck("genisoimage", "KVM cloud-init ISO 工具", false, "genisoimage", "xorriso/mkisofs 可替代"),
 		commandCheck("xorriso", "ISO 备用工具", false, "xorriso", ""),
 		commandCheck("smartctl", "硬盘健康检测", false, "smartctl", ""),
@@ -1467,6 +1917,19 @@ func detectHostEnvironment() []HostEnvCheck {
 	return checks
 }
 
+func kvmQEMUCheckKey() string {
+	switch runtime.GOARCH {
+	case "arm64":
+		return "qemu-system-aarch64"
+	default:
+		return "qemu-system-x86_64"
+	}
+}
+
+func kvmQEMUCommand() string {
+	return kvmQEMUCheckKey()
+}
+
 func commandCheck(key, label string, required bool, cmd string, fallback string) HostEnvCheck {
 	ok := commandExists(cmd)
 	detail := "missing"

backend/internal/api/host_test.go

@@ -41,3 +41,37 @@ func TestCertbotVersionAtLeast54(t *testing.T) {
 		}
 	}
 }
+
+func TestARMCPUModelName(t *testing.T) {
+	if got := armCPUModelName("0x41", "0xd0c"); got != "ARM Neoverse N1" {
+		t.Fatalf("armCPUModelName() = %q, want ARM Neoverse N1", got)
+	}
+	if got := armCPUModelName("41", "d0c"); got != "ARM Neoverse N1" {
+		t.Fatalf("armCPUModelName() without hex prefix = %q, want ARM Neoverse N1", got)
+	}
+}
+
+func TestMeaningfulCPUModel(t *testing.T) {
+	if meaningfulCPUModel("0") {
+		t.Fatal("numeric ARM processor index should not be treated as a CPU model")
+	}
+	if !meaningfulCPUModel("Neoverse-N1") {
+		t.Fatal("expected Neoverse-N1 to be treated as a CPU model")
+	}
+}
+
+func TestHostTrafficInterfaceFilter(t *testing.T) {
+	accepted := []string{"eth0", "ens3", "enp0s6", "bond0", "wg0"}
+	for _, name := range accepted {
+		if !isHostTrafficInterface(name) {
+			t.Fatalf("expected %s to be accepted as a host traffic interface", name)
+		}
+	}
+
+	rejected := []string{"", "lo", "docker0", "br-3024b78640ee", "lxcbr0", "virbr0", "vethaaa9e44", "cni0"}
+	for _, name := range rejected {
+		if isHostTrafficInterface(name) {
+			t.Fatalf("expected %s to be rejected as an internal/container interface", name)
+		}
+	}
+}

backend/internal/api/images.go

@@ -2,18 +2,24 @@ package api
 
 import (
 	"context"
+	"crypto/rand"
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"net/http"
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
+	"runtime"
+	"strings"
 	"sync"
 	"time"
 
 	"clicd/internal/config"
 	"clicd/internal/kvm"
 	"clicd/internal/lxc"
+	"clicd/internal/safehttp"
 )
 
 // ImageInfo represents a template image with its download/enable status.
@@ -36,10 +42,19 @@ type ImageInfo struct {
 	SizeBytes       int64  `json:"size_bytes"`
 	ManualPath      string `json:"manual_path,omitempty"`
 	Desktop         string `json:"desktop,omitempty"`
+	Provisioner     string `json:"provisioner,omitempty"`
+	Custom          bool   `json:"custom,omitempty"`
+	SHA256          string `json:"sha256,omitempty"`
 }
 
+var customImageFieldPattern = regexp.MustCompile(`^[a-z0-9][a-z0-9._-]{0,63}$`)
+var sha256Pattern = regexp.MustCompile(`^[a-fA-F0-9]{64}$`)
+
 var imageDownloadsMu sync.Mutex
 var imageDownloads = map[string]*imageDownloadStatus{}
+var lxcImageCacheMu sync.Mutex
+var lxcImageDownloadMu sync.Mutex
+var lxcImageDownloadActive bool
 
 type imageDownloadStatus struct {
 	Downloading     bool
@@ -135,6 +150,22 @@ func isImageDownloadActive(id string) bool {
 	return st != nil && st.Downloading
 }
 
+func beginLXCImageDownload() bool {
+	lxcImageDownloadMu.Lock()
+	defer lxcImageDownloadMu.Unlock()
+	if lxcImageDownloadActive {
+		return false
+	}
+	lxcImageDownloadActive = true
+	return true
+}
+
+func endLXCImageDownload() {
+	lxcImageDownloadMu.Lock()
+	lxcImageDownloadActive = false
+	lxcImageDownloadMu.Unlock()
+}
+
 func lxcImageDownloadTempName(id string) string {
 	return fmt.Sprintf("clicd-img-dl-%s", id)
 }
@@ -156,46 +187,68 @@ func cleanupOldImageDownloadErrors() {
 	}
 }
 
-// isImageDownloaded checks if the LXC download cache exists for a template.
-func isImageDownloaded(distro, release, arch string) bool {
-	downloaded, _ := imageDownloadedInfo(distro, release, arch)
-	return downloaded
-}
-
 // imageDownloadedInfo returns whether the image is downloaded and its total size in bytes.
-func imageDownloadedInfo(distro, release, arch string) (bool, int64) {
-	cachePath := filepath.Join("/var/cache/lxc/download", distro, release, arch)
+func imageDownloadedInfo(templateID string) (bool, int64) {
+	cachePath, ok := officialLXCImageCachePath(templateID)
+	if !ok {
+		return false, 0
+	}
 	info, err := os.Stat(cachePath)
 	if err != nil || !info.IsDir() {
 		return false, 0
 	}
-	// Check directly for rootfs.tar.xz (some LXC versions store it here)
-	if fi, err := os.Stat(filepath.Join(cachePath, "rootfs.tar.xz")); err == nil {
-		return true, fi.Size()
-	}
-	if fi, err := os.Stat(filepath.Join(cachePath, "meta.tar.xz")); err == nil {
-		return true, fi.Size()
-	}
-	// Check one level deeper (LXC uses variant subdirectories like "default")
-	entries, err := os.ReadDir(cachePath)
-	if err != nil {
-		return false, 0
-	}
-	for _, entry := range entries {
-		if !entry.IsDir() {
-			continue
-		}
-		subPath := filepath.Join(cachePath, entry.Name())
-		if fi, err := os.Stat(filepath.Join(subPath, "rootfs.tar.xz")); err == nil {
-			return true, fi.Size()
-		}
-		if fi, err := os.Stat(filepath.Join(subPath, "meta.tar.xz")); err == nil {
-			return true, fi.Size()
+	for _, candidate := range []string{
+		filepath.Join(cachePath, "rootfs.tar.xz"),
+		filepath.Join(cachePath, "meta.tar.xz"),
+		filepath.Join(cachePath, "default", "rootfs.tar.xz"),
+		filepath.Join(cachePath, "default", "meta.tar.xz"),
+	} {
+		if fileInfo, err := os.Stat(candidate); err == nil && !fileInfo.IsDir() {
+			return true, fileInfo.Size()
 		}
 	}
 	return false, 0
 }
 
+func officialLXCImageCachePath(templateID string) (string, bool) {
+	arch := "amd64"
+	if runtime.GOARCH == "arm64" {
+		arch = "arm64"
+	}
+	base := "/var/cache/lxc/download"
+	switch templateID {
+	case "ubuntu-noble":
+		return filepath.Join(base, "ubuntu", "noble", arch), true
+	case "ubuntu-jammy":
+		return filepath.Join(base, "ubuntu", "jammy", arch), true
+	case "debian-trixie":
+		return filepath.Join(base, "debian", "trixie", arch), true
+	case "debian-bookworm":
+		return filepath.Join(base, "debian", "bookworm", arch), true
+	case "debian-bullseye":
+		return filepath.Join(base, "debian", "bullseye", arch), true
+	case "alpine-3.21":
+		return filepath.Join(base, "alpine", "3.21", arch), true
+	case "centos-9-stream":
+		return filepath.Join(base, "centos", "9-Stream", arch), true
+	case "archlinux-current":
+		return filepath.Join(base, "archlinux", "current", arch), true
+	case "fedora-44":
+		return filepath.Join(base, "fedora", "44", arch), true
+	case "rockylinux-10":
+		return filepath.Join(base, "rockylinux", "10", arch), true
+	default:
+		return "", false
+	}
+}
+
+func lxcTemplateDownloadedInfo(template lxc.Template) (bool, int64) {
+	if template.Custom {
+		return lxc.CustomImageDownloadedInfo(template.ID)
+	}
+	return imageDownloadedInfo(template.ID)
+}
+
 // getEnabledImageSet returns the set of enabled image IDs.
 // If none have been explicitly set, all templates are enabled by default.
 func getEnabledImageSet() map[string]bool {
@@ -227,12 +280,17 @@ func HandleImages(w http.ResponseWriter, r *http.Request) {
 
 	enabledSet := getEnabledImageSet()
 	cleanupOldImageDownloadErrors()
+	kvmAvailable := hostKVMAvailable()
 
 	templates := lxc.GetTemplates()
-	images := make([]ImageInfo, 0, len(templates)+len(kvm.GetImages()))
+	kvmImages := []kvm.Image{}
+	if kvmAvailable {
+		kvmImages = kvm.GetImages()
+	}
+	images := make([]ImageInfo, 0, len(templates))
 	for _, t := range templates {
 		dl := imageDownloadInfo(t.ID)
-		downloaded, size := imageDownloadedInfo(t.Distro, t.Release, t.Arch)
+		downloaded, size := lxcTemplateDownloadedInfo(t)
 		images = append(images, ImageInfo{
 			ID:              t.ID,
 			Name:            t.Name,
@@ -250,13 +308,15 @@ func HandleImages(w http.ResponseWriter, r *http.Request) {
 			Stage:           dl.Stage,
 			Error:           dl.Error,
 			SizeBytes:       size,
+			Custom:          t.Custom,
+			SHA256:          t.SHA256,
 		})
 	}
-	for _, t := range kvm.GetImages() {
+	for _, t := range kvmImages {
 		dl := imageDownloadInfo(t.ID)
 		downloaded, size := kvm.ImageDownloadedInfo(t.ID)
 		manualPath := ""
-		if t.Distro == "windows" {
+		if t.IsWindows() {
 			manualPath = kvm.ImagePath(t.ID)
 		}
 		images = append(images, ImageInfo{
@@ -278,12 +338,260 @@ func HandleImages(w http.ResponseWriter, r *http.Request) {
 			SizeBytes:       size,
 			ManualPath:      manualPath,
 			Desktop:         t.Desktop,
+			Provisioner:     t.Provisioner,
+			Custom:          t.Custom,
+			SHA256:          t.SHA256,
 		})
 	}
 
 	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: images})
 }
 
+// HandleCustomKVMImages creates or removes administrator-defined LXC/KVM image sources.
+func HandleCustomKVMImages(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodPost:
+		if !requireScope(w, r, "image:download") {
+			return
+		}
+		handleCustomKVMImageCreate(w, r)
+	case http.MethodDelete:
+		if !requireScope(w, r, "image:delete") {
+			return
+		}
+		handleCustomKVMImageDelete(w, r)
+	default:
+		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
+	}
+}
+
+func handleCustomKVMImageCreate(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		Type        string `json:"type"`
+		Name        string `json:"name"`
+		Description string `json:"description"`
+		Distro      string `json:"distro"`
+		Release     string `json:"release"`
+		Arch        string `json:"arch"`
+		URL         string `json:"url"`
+		Provisioner string `json:"provisioner"`
+		SHA256      string `json:"sha256"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid request body"})
+		return
+	}
+	req.Name = strings.TrimSpace(req.Name)
+	req.Type = strings.ToLower(strings.TrimSpace(req.Type))
+	if req.Type == "" {
+		req.Type = config.VirtualizationKVM
+	}
+	req.Description = strings.TrimSpace(req.Description)
+	req.Distro = strings.ToLower(strings.TrimSpace(req.Distro))
+	req.Release = strings.ToLower(strings.TrimSpace(req.Release))
+	req.Arch = strings.ToLower(strings.TrimSpace(req.Arch))
+	req.URL = strings.TrimSpace(req.URL)
+	req.Provisioner = strings.ToLower(strings.TrimSpace(req.Provisioner))
+	req.SHA256 = strings.ToLower(strings.TrimSpace(req.SHA256))
+
+	if req.Name == "" || len(req.Name) > 100 {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "name must be between 1 and 100 characters"})
+		return
+	}
+	if len(req.Description) > 500 {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "description must not exceed 500 characters"})
+		return
+	}
+	if req.Arch != runtime.GOARCH || (req.Arch != "amd64" && req.Arch != "arm64") {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "image architecture must match the host architecture"})
+		return
+	}
+	if req.Type == config.VirtualizationLXC {
+		if !customImageFieldPattern.MatchString(req.Distro) {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "distro contains unsupported characters"})
+			return
+		}
+		if !customImageFieldPattern.MatchString(req.Release) {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "release contains unsupported characters"})
+			return
+		}
+	} else if req.Type == config.VirtualizationKVM {
+		switch req.Provisioner {
+		case config.KVMProvisionerLinuxCloudInit:
+			if !customImageFieldPattern.MatchString(req.Distro) {
+				jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "distro contains unsupported characters"})
+				return
+			}
+			if !customImageFieldPattern.MatchString(req.Release) {
+				jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "release contains unsupported characters"})
+				return
+			}
+		case config.KVMProvisionerWindows10:
+			if req.Arch != "amd64" {
+				jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Windows unattended installation currently requires an amd64 host"})
+				return
+			}
+			req.Distro = "windows"
+			req.Release = "10"
+		case config.KVMProvisionerWindows11:
+			if req.Arch != "amd64" {
+				jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Windows unattended installation currently requires an amd64 host"})
+				return
+			}
+			req.Distro = "windows"
+			req.Release = "11"
+		default:
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "unsupported unattended installation template"})
+			return
+		}
+	} else {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "type must be lxc or kvm"})
+		return
+	}
+	if len(req.URL) > 4096 {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "url must not exceed 4096 characters"})
+		return
+	}
+	if _, err := safehttp.ValidateURL(req.URL); err != nil {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: err.Error()})
+		return
+	}
+	if req.SHA256 != "" && !sha256Pattern.MatchString(req.SHA256) {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "sha256 must contain exactly 64 hexadecimal characters"})
+		return
+	}
+	if req.Type == config.VirtualizationLXC {
+		for _, existing := range lxc.GetTemplates() {
+			if strings.EqualFold(existing.Name, req.Name) {
+				jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: "an image with this name already exists"})
+				return
+			}
+			if existing.Custom && existing.URL == req.URL {
+				jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: "this image URL is already registered"})
+				return
+			}
+		}
+	} else {
+		for _, existing := range kvm.GetImages() {
+			if strings.EqualFold(existing.Name, req.Name) {
+				jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: "an image with this name already exists"})
+				return
+			}
+			if existing.Custom && existing.URL == req.URL {
+				jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: "this image URL is already registered"})
+				return
+			}
+		}
+	}
+
+	random := make([]byte, 5)
+	if _, err := rand.Read(random); err != nil {
+		jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "failed to generate image ID"})
+		return
+	}
+	createdAt := time.Now().Format("2006-01-02 15:04:05")
+	if req.Type == config.VirtualizationLXC {
+		image := config.CustomLXCImage{
+			ID:          "custom-lxc-" + hex.EncodeToString(random),
+			Name:        req.Name,
+			Description: req.Description,
+			Distro:      req.Distro,
+			Release:     req.Release,
+			Arch:        req.Arch,
+			URL:         req.URL,
+			SHA256:      req.SHA256,
+			CreatedAt:   createdAt,
+		}
+		if err := config.AddCustomLXCImage(image); err != nil {
+			jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "failed to save custom image: " + err.Error()})
+			return
+		}
+		jsonResponse(w, http.StatusCreated, APIResponse{Success: true, Message: "Custom image added", Data: image})
+		return
+	}
+	image := config.CustomKVMImage{
+		ID: "custom-kvm-" + hex.EncodeToString(random), Name: req.Name, Description: req.Description,
+		Distro: req.Distro, Release: req.Release, Arch: req.Arch, URL: req.URL,
+		Provisioner: req.Provisioner, SHA256: req.SHA256, CreatedAt: createdAt,
+	}
+	if err := config.AddCustomKVMImage(image); err != nil {
+		jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "failed to save custom image: " + err.Error()})
+		return
+	}
+	jsonResponse(w, http.StatusCreated, APIResponse{Success: true, Message: "Custom image added", Data: image})
+}
+
+func handleCustomKVMImageDelete(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		ID string `json:"id"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil || strings.TrimSpace(req.ID) == "" {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "id required"})
+		return
+	}
+	req.ID = strings.TrimSpace(req.ID)
+	kvmImage := kvm.FindImage(req.ID)
+	lxcImage := lxc.FindTemplate(req.ID)
+	isCustomKVM := kvmImage != nil && kvmImage.Custom
+	isCustomLXC := lxcImage != nil && lxcImage.Custom
+	if !isCustomKVM && !isCustomLXC {
+		jsonResponse(w, http.StatusNotFound, APIResponse{Success: false, Message: "Custom image not found"})
+		return
+	}
+	if isImageDownloadActive(req.ID) {
+		jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: "Image is downloading; cancel it before removing the source"})
+		return
+	}
+	for i := range config.AppConfig.Containers {
+		if config.AppConfig.Containers[i].Template == req.ID {
+			jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: "This image is still used by a container"})
+			return
+		}
+	}
+	for i := range config.AppConfig.Tasks {
+		task := &config.AppConfig.Tasks[i]
+		if task.Status != "pending" && task.Status != "running" {
+			continue
+		}
+		var taskConfig struct {
+			TemplateID string `json:"template_id"`
+		}
+		_ = json.Unmarshal([]byte(task.Config), &taskConfig)
+		if task.TemplateID == req.ID || taskConfig.TemplateID == req.ID {
+			jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: "This image is still referenced by an active task"})
+			return
+		}
+	}
+	var deleteErr error
+	if isCustomLXC {
+		deleteErr = lxc.DeleteCustomImage(req.ID)
+	} else {
+		deleteErr = kvm.DeleteImage(req.ID)
+	}
+	if deleteErr != nil {
+		jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "Failed to delete image cache: " + deleteErr.Error()})
+		return
+	}
+	removeImageEnabled(req.ID)
+	var removed bool
+	var err error
+	if isCustomLXC {
+		removed, err = config.RemoveCustomLXCImage(req.ID)
+	} else {
+		removed, err = config.RemoveCustomKVMImage(req.ID)
+	}
+	if err != nil {
+		jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "Failed to remove custom image: " + err.Error()})
+		return
+	}
+	if !removed {
+		jsonResponse(w, http.StatusNotFound, APIResponse{Success: false, Message: "Custom image not found"})
+		return
+	}
+	clearImageDownload(req.ID)
+	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "Custom image removed"})
+}
+
 // HandleImageDownload starts a template image download in the background.
 func HandleImageDownload(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
@@ -301,7 +609,6 @@ func HandleImageDownload(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "template_id required"})
 		return
 	}
-
 	tmpl := lxc.FindTemplate(req.TemplateID)
 	if tmpl == nil {
 		image := kvm.FindImage(req.TemplateID)
@@ -309,6 +616,14 @@ func HandleImageDownload(w http.ResponseWriter, r *http.Request) {
 			jsonResponse(w, http.StatusNotFound, APIResponse{Success: false, Message: "Template not found"})
 			return
 		}
+		if !hostKVMAvailable() {
+			jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "KVM is not available on this host"})
+			return
+		}
+		if _, err := config.SelectStoragePoolForContent(config.StorageContentImages, "", 1024*1024*1024); err != nil {
+			jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: err.Error()})
+			return
+		}
 		if ok, _ := kvm.ImageDownloadedInfo(image.ID); ok {
 			ensureImageEnabled(image.ID)
 			clearImageDownload(image.ID)
@@ -349,22 +664,79 @@ func HandleImageDownload(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusAccepted, APIResponse{Success: true, Message: "Download started"})
 		return
 	}
+	if !beginLXCImageDownload() {
+		jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: "Another LXC image download is active"})
+		return
+	}
+	lxcDownloadHandedOff := false
+	defer func() {
+		if !lxcDownloadHandedOff {
+			endLXCImageDownload()
+		}
+	}()
+	imagePool, err := config.SelectStoragePoolForContent(
+		config.StorageContentImages,
+		"",
+		dirSizeBytes("/var/cache/lxc/download")+1024*1024*1024,
+	)
+	if err != nil {
+		jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: err.Error()})
+		return
+	}
+	if err := ensureLXCImageCachePool(*imagePool); err != nil {
+		jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: err.Error()})
+		return
+	}
 
 	// Already downloaded? Just enable if needed.
-	if isImageDownloaded(tmpl.Distro, tmpl.Release, tmpl.Arch) {
+	if downloaded, _ := lxcTemplateDownloadedInfo(*tmpl); downloaded {
 		ensureImageEnabled(tmpl.ID)
 		clearImageDownload(tmpl.ID)
 		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "Already downloaded"})
 		return
 	}
 
-	ctx, ok := startImageDownload(tmpl.ID, "lxc-create")
+	startStage := "lxc-create"
+	if tmpl.Custom {
+		startStage = "downloading"
+	}
+	ctx, ok := startImageDownload(tmpl.ID, startStage)
 	if !ok {
 		jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: "Already downloading"})
 		return
 	}
 
+	if tmpl.Custom {
 		go func(tmpl lxc.Template) {
+			defer endLXCImageDownload()
+			err := lxc.DownloadCustomImageWithProgress(ctx, tmpl, func(progress lxc.CustomImageDownloadProgress) {
+				updateImageDownload(tmpl.ID, func(status *imageDownloadStatus) {
+					status.Stage = progress.Stage
+					status.DownloadedBytes = progress.DownloadedBytes
+					status.TotalBytes = progress.TotalBytes
+					status.Progress = progress.Percent
+				})
+			})
+			if err != nil {
+				if ctx.Err() != nil {
+					_ = os.Remove(lxc.CustomImagePath(tmpl.ID) + ".tmp")
+					_ = os.Remove(lxc.CustomImagePath(tmpl.ID))
+					finishImageDownload(tmpl.ID, nil)
+					return
+				}
+				finishImageDownload(tmpl.ID, err)
+				return
+			}
+			ensureImageEnabled(tmpl.ID)
+			finishImageDownload(tmpl.ID, nil)
+		}(*tmpl)
+		lxcDownloadHandedOff = true
+		jsonResponse(w, http.StatusAccepted, APIResponse{Success: true, Message: "Download started"})
+		return
+	}
+
+	go func(tmpl lxc.Template) {
+		defer endLXCImageDownload()
 		// Download via lxc-create with a temp container, then destroy it.
 		tmpName := lxcImageDownloadTempName(tmpl.ID)
 		args := []string{"-n", tmpName, "-t", "download", "--",
@@ -376,7 +748,7 @@ func HandleImageDownload(w http.ResponseWriter, r *http.Request) {
 			st.Stage = "lxc-create"
 		})
 		cmd := exec.CommandContext(ctx, "lxc-create", args...)
-		output, err := cmd.CombinedOutput()
+		output, err := runLXCImageDownloadCommand(cmd, tmpl.ID)
 
 		// Clean up the temp container unconditionally.
 		cleanupLXCImageDownloadTemp(tmpl.ID)
@@ -393,10 +765,154 @@ func HandleImageDownload(w http.ResponseWriter, r *http.Request) {
 		ensureImageEnabled(tmpl.ID)
 		finishImageDownload(tmpl.ID, nil)
 	}(*tmpl)
+	lxcDownloadHandedOff = true
 
 	jsonResponse(w, http.StatusAccepted, APIResponse{Success: true, Message: "Download started"})
 }
 
+type lxcImageDownloadCommandResult struct {
+	output []byte
+	err    error
+}
+
+func runLXCImageDownloadCommand(cmd *exec.Cmd, templateID string) ([]byte, error) {
+	startedAt := time.Now()
+	done := make(chan lxcImageDownloadCommandResult, 1)
+	go func() {
+		output, err := cmd.CombinedOutput()
+		done <- lxcImageDownloadCommandResult{output: output, err: err}
+	}()
+
+	ticker := time.NewTicker(time.Second)
+	defer ticker.Stop()
+	var lastBytes int64
+	for {
+		select {
+		case result := <-done:
+			return result.output, result.err
+		case <-ticker.C:
+			downloadedBytes := newestLXCRootfsDownloadSize(startedAt)
+			if downloadedBytes <= 0 || downloadedBytes == lastBytes {
+				continue
+			}
+			lastBytes = downloadedBytes
+			updateImageDownload(templateID, func(st *imageDownloadStatus) {
+				st.Stage = "downloading"
+				st.DownloadedBytes = downloadedBytes
+			})
+		}
+	}
+}
+
+func newestLXCRootfsDownloadSize(startedAt time.Time) int64 {
+	matches, _ := filepath.Glob("/tmp/tmp.*/rootfs.tar.xz")
+	var newestTime time.Time
+	var newestSize int64
+	for _, match := range matches {
+		info, err := os.Stat(match)
+		if err != nil || info.IsDir() || info.ModTime().Before(startedAt.Add(-5*time.Second)) {
+			continue
+		}
+		if info.ModTime().After(newestTime) {
+			newestTime = info.ModTime()
+			newestSize = info.Size()
+		}
+	}
+	return newestSize
+}
+
+func ensureLXCImageCachePool(pool config.StoragePool) error {
+	lxcImageCacheMu.Lock()
+	defer lxcImageCacheMu.Unlock()
+
+	cachePath := "/var/cache/lxc/download"
+	targetPath := filepath.Join(pool.Path, "images", "lxc")
+	targetAbs, err := filepath.Abs(targetPath)
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(targetAbs, 0755); err != nil {
+		return fmt.Errorf("failed to create LXC image storage: %v", err)
+	}
+
+	info, err := os.Lstat(cachePath)
+	if os.IsNotExist(err) {
+		if err := os.MkdirAll(filepath.Dir(cachePath), 0755); err != nil {
+			return err
+		}
+		return os.Symlink(targetAbs, cachePath)
+	}
+	if err != nil {
+		return err
+	}
+
+	sourcePath := cachePath
+	linked := info.Mode()&os.ModeSymlink != 0
+	if linked {
+		sourcePath, err = filepath.EvalSymlinks(cachePath)
+		if err != nil {
+			return fmt.Errorf("failed to resolve LXC image cache: %v", err)
+		}
+	}
+	sourceAbs, err := filepath.Abs(sourcePath)
+	if err != nil {
+		return err
+	}
+	if sourceAbs == targetAbs {
+		return nil
+	}
+	if strings.HasPrefix(targetAbs, sourceAbs+string(os.PathSeparator)) || strings.HasPrefix(sourceAbs, targetAbs+string(os.PathSeparator)) {
+		return fmt.Errorf("LXC image cache source and target must not be nested")
+	}
+	if !info.IsDir() && !linked {
+		return fmt.Errorf("LXC image cache is not a directory: %s", cachePath)
+	}
+
+	if output, err := exec.Command("cp", "-a", sourceAbs+string(os.PathSeparator)+".", targetAbs+string(os.PathSeparator)).CombinedOutput(); err != nil {
+		return fmt.Errorf("failed to migrate LXC image cache: %v, output: %s", err, strings.TrimSpace(string(output)))
+	}
+
+	tempLink := fmt.Sprintf("%s.clicd-new-%d", cachePath, time.Now().UnixNano())
+	if err := os.Symlink(targetAbs, tempLink); err != nil {
+		return err
+	}
+	if linked {
+		if err := os.Rename(tempLink, cachePath); err != nil {
+			_ = os.Remove(tempLink)
+			return fmt.Errorf("failed to switch LXC image cache: %v", err)
+		}
+		if isManagedLXCImageCachePath(sourceAbs) {
+			_ = os.RemoveAll(sourceAbs)
+		}
+		return nil
+	}
+
+	backupPath := fmt.Sprintf("%s.clicd-backup-%d", cachePath, time.Now().UnixNano())
+	if err := os.Rename(cachePath, backupPath); err != nil {
+		_ = os.Remove(tempLink)
+		return fmt.Errorf("failed to prepare LXC image cache migration: %v", err)
+	}
+	if err := os.Rename(tempLink, cachePath); err != nil {
+		_ = os.Rename(backupPath, cachePath)
+		_ = os.Remove(tempLink)
+		return fmt.Errorf("failed to activate LXC image storage: %v", err)
+	}
+	if err := os.RemoveAll(backupPath); err != nil {
+		return fmt.Errorf("LXC image cache migrated but old cache cleanup failed: %v", err)
+	}
+	return nil
+}
+
+func isManagedLXCImageCachePath(path string) bool {
+	path = filepath.Clean(path)
+	for _, pool := range config.StoragePoolsForContent(config.StorageContentImages) {
+		if path == filepath.Clean(filepath.Join(pool.Path, "images", "lxc")) {
+			return true
+		}
+	}
+	return path == filepath.Clean("/var/lib/clicd/images/lxc")
+}
+
 // HandleImageCancel cancels an in-progress image download.
 func HandleImageCancel(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
@@ -432,8 +948,13 @@ func HandleImageCancel(w http.ResponseWriter, r *http.Request) {
 		os.Remove(kvm.ImagePath(image.ID))
 	}
 	if tmpl := lxc.FindTemplate(req.TemplateID); tmpl != nil {
+		if tmpl.Custom {
+			_ = os.Remove(lxc.CustomImagePath(tmpl.ID) + ".tmp")
+			_ = os.Remove(lxc.CustomImagePath(tmpl.ID))
+		} else {
 			go cleanupLXCImageDownloadTemp(tmpl.ID)
 		}
+	}
 	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "Cancel requested"})
 }
 
@@ -473,9 +994,22 @@ func HandleImageDelete(w http.ResponseWriter, r *http.Request) {
 		jsonResponse(w, http.StatusNotFound, APIResponse{Success: false, Message: "Template not found"})
 		return
 	}
+	if tmpl.Custom {
+		if err := lxc.DeleteCustomImage(tmpl.ID); err != nil {
+			jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "Failed to delete image cache: " + err.Error()})
+			return
+		}
+		removeImageEnabled(tmpl.ID)
+		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "Deleted"})
+		return
+	}
 
 	// Remove cache directory
-	cachePath := filepath.Join("/var/cache/lxc/download", tmpl.Distro, tmpl.Release, tmpl.Arch)
+	cachePath, ok := officialLXCImageCachePath(tmpl.ID)
+	if !ok {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Template cache path is not managed by CLICD"})
+		return
+	}
 	if err := os.RemoveAll(cachePath); err != nil {
 		jsonResponse(w, http.StatusInternalServerError, APIResponse{
 			Success: false,
@@ -531,11 +1065,36 @@ func HandleEnabledImages(w http.ResponseWriter, r *http.Request) {
 
 	runtime := runtimeFromRequest(r.URL.Query().Get("type"))
 	enabledSet := getEnabledImageSet()
+	var subUser *config.SubUser
+	var targetContainer *config.Container
+	currentImageIDs := map[string]bool{}
+	if isSubUserRequest(r) {
+		subUser = subUserFromRequest(r)
+		if identifier := r.URL.Query().Get("container"); identifier != "" {
+			targetContainer = containerByIdentifier(identifier)
+			if targetContainer == nil || !isContainerAllowedForRequest(r, identifier) {
+				jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Access denied to this container"})
+				return
+			}
+			currentImageIDs[targetContainer.Template] = true
+		} else {
+			for _, id := range subUserCurrentImageIDs(subUser) {
+				currentImageIDs[id] = true
+			}
+		}
+	}
 
 	result := make([]map[string]string, 0)
 	if runtime == config.VirtualizationKVM {
+		if !hostKVMAvailable() {
+			jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: result})
+			return
+		}
 		for _, t := range kvm.GetImages() {
-			if downloaded, _ := kvm.ImageDownloadedInfo(t.ID); enabledSet[t.ID] && downloaded {
+			if subUser != nil && !isImageAllowedForSubUser(subUser, targetContainer, t.ID) {
+				continue
+			}
+			if downloaded, _ := kvm.ImageDownloadedInfo(t.ID); downloaded && (enabledSet[t.ID] || currentImageIDs[t.ID]) {
 				result = append(result, map[string]string{
 					"id": t.ID, "name": t.Name, "distro": t.Distro, "release": t.Release, "arch": t.Arch,
 					"description": t.Description, "type": config.VirtualizationKVM, "desktop": t.Desktop,
@@ -544,7 +1103,10 @@ func HandleEnabledImages(w http.ResponseWriter, r *http.Request) {
 		}
 	} else {
 		for _, t := range lxc.GetTemplates() {
-			if enabledSet[t.ID] && isImageDownloaded(t.Distro, t.Release, t.Arch) {
+			if subUser != nil && !isImageAllowedForSubUser(subUser, targetContainer, t.ID) {
+				continue
+			}
+			if downloaded, _ := lxcTemplateDownloadedInfo(t); downloaded && (enabledSet[t.ID] || currentImageIDs[t.ID]) {
 				result = append(result, map[string]string{
 					"id": t.ID, "name": t.Name, "distro": t.Distro, "release": t.Release, "arch": t.Arch,
 					"variant": t.Variant, "description": t.Description, "type": config.VirtualizationLXC,
@@ -560,9 +1122,49 @@ func isTemplateEnabledAndDownloaded(templateID string) bool {
 	return isImageEnabledAndDownloaded(templateID, runtimeFromTemplateID(templateID))
 }
 
+func imageTemplateExists(templateID string) bool {
+	return lxc.FindTemplate(templateID) != nil || kvm.FindImage(templateID) != nil
+}
+
+func isImageDownloadedForRuntime(templateID string, runtime string) bool {
+	runtime = runtimeFromRequest(runtime)
+	if runtime == config.VirtualizationKVM {
+		if !hostKVMAvailable() {
+			return false
+		}
+		image := kvm.FindImage(templateID)
+		if image == nil {
+			return false
+		}
+		downloaded, _ := kvm.ImageDownloadedInfo(image.ID)
+		return downloaded
+	}
+	tmpl := lxc.FindTemplate(templateID)
+	if tmpl == nil {
+		return false
+	}
+	downloaded, _ := lxcTemplateDownloadedInfo(*tmpl)
+	return downloaded
+}
+
+func isTemplateAvailableForRequest(r *http.Request, c *config.Container, templateID string, runtime string) bool {
+	if isSubUserRequest(r) {
+		if !isTemplateAllowedForRequest(r, c, templateID) {
+			return false
+		}
+		if c != nil && c.Template == templateID {
+			return isImageDownloadedForRuntime(templateID, runtime)
+		}
+	}
+	return isImageEnabledAndDownloaded(templateID, runtime)
+}
+
 func isImageEnabledAndDownloaded(templateID string, runtime string) bool {
 	runtime = runtimeFromRequest(runtime)
 	if runtime == config.VirtualizationKVM {
+		if !hostKVMAvailable() {
+			return false
+		}
 		image := kvm.FindImage(templateID)
 		if image == nil {
 			return false
@@ -576,7 +1178,15 @@ func isImageEnabledAndDownloaded(templateID string, runtime string) bool {
 		return false
 	}
 	enabledSet := getEnabledImageSet()
-	return enabledSet[tmpl.ID] && isImageDownloaded(tmpl.Distro, tmpl.Release, tmpl.Arch)
+	downloaded, _ := lxcTemplateDownloadedInfo(*tmpl)
+	return enabledSet[tmpl.ID] && downloaded
+}
+
+func hostKVMAvailable() bool {
+	if runtime.GOARCH != "amd64" && runtime.GOARCH != "arm64" {
+		return false
+	}
+	return fileExists("/dev/kvm") && commandExists("virsh") && commandExists(kvmQEMUCheckKey())
 }
 
 func ensureImageEnabled(id string) {

backend/internal/api/images_custom_test.go

@@ -0,0 +1,133 @@
+package api
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func TestCustomKVMImageCreateRejectsInvalidSource(t *testing.T) {
+	payload := map[string]string{
+		"name":        "Invalid Source",
+		"distro":      "ubuntu",
+		"release":     "noble",
+		"arch":        runtime.GOARCH,
+		"url":         "file:///etc/passwd",
+		"provisioner": "linux-cloud-init",
+	}
+	body, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := httptest.NewRequest(http.MethodPost, "/api/images/custom", bytes.NewReader(body))
+	response := httptest.NewRecorder()
+
+	HandleCustomKVMImages(response, request)
+
+	if response.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want %d; body=%s", response.Code, http.StatusBadRequest, response.Body.String())
+	}
+}
+
+func TestCustomKVMImageCreateRejectsArchitectureMismatch(t *testing.T) {
+	otherArch := "arm64"
+	if runtime.GOARCH == otherArch {
+		otherArch = "amd64"
+	}
+	payload := map[string]string{
+		"name":        "Wrong Architecture",
+		"distro":      "ubuntu",
+		"release":     "noble",
+		"arch":        otherArch,
+		"url":         "https://example.test/image.qcow2",
+		"provisioner": "linux-cloud-init",
+	}
+	body, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := httptest.NewRequest(http.MethodPost, "/api/images/custom", bytes.NewReader(body))
+	response := httptest.NewRecorder()
+
+	HandleCustomKVMImages(response, request)
+
+	if response.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want %d; body=%s", response.Code, http.StatusBadRequest, response.Body.String())
+	}
+}
+
+func TestCustomLXCImageCreateRejectsInvalidSource(t *testing.T) {
+	payload := map[string]string{
+		"type":    "lxc",
+		"name":    "Invalid LXC Source",
+		"distro":  "alpine",
+		"release": "3.21",
+		"arch":    runtime.GOARCH,
+		"url":     "file:///tmp/rootfs.tar.xz",
+	}
+	body, err := json.Marshal(payload)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := httptest.NewRequest(http.MethodPost, "/api/images/custom", bytes.NewReader(body))
+	response := httptest.NewRecorder()
+
+	HandleCustomKVMImages(response, request)
+
+	if response.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want %d; body=%s", response.Code, http.StatusBadRequest, response.Body.String())
+	}
+}
+
+func TestCustomImageCreateRejectsPrivateNetworkSource(t *testing.T) {
+	for _, imageType := range []string{"lxc", "kvm"} {
+		t.Run(imageType, func(t *testing.T) {
+			payload := map[string]string{
+				"type":        imageType,
+				"name":        "Private Network Source",
+				"distro":      "ubuntu",
+				"release":     "noble",
+				"arch":        runtime.GOARCH,
+				"url":         "http://169.254.169.254/latest/meta-data",
+				"provisioner": "linux-cloud-init",
+			}
+			body, err := json.Marshal(payload)
+			if err != nil {
+				t.Fatal(err)
+			}
+			request := httptest.NewRequest(http.MethodPost, "/api/images/custom", bytes.NewReader(body))
+			response := httptest.NewRecorder()
+
+			HandleCustomKVMImages(response, request)
+
+			if response.Code != http.StatusBadRequest {
+				t.Fatalf("status = %d, want %d; body=%s", response.Code, http.StatusBadRequest, response.Body.String())
+			}
+		})
+	}
+}
+
+func TestOfficialLXCImageCachePathUsesAllowlist(t *testing.T) {
+	cachePath, ok := officialLXCImageCachePath("debian-trixie")
+	if !ok {
+		t.Fatal("known template cache path was rejected")
+	}
+	normalized := filepath.ToSlash(cachePath)
+	if !strings.Contains(normalized, "/debian/trixie/") {
+		t.Fatalf("cache path = %q, want Debian trixie path", cachePath)
+	}
+	for _, templateID := range []string{
+		"../../../etc",
+		"custom-lxc-attacker",
+		"debian-trixie/../../etc",
+	} {
+		if cachePath, ok := officialLXCImageCachePath(templateID); ok || cachePath != "" {
+			t.Fatalf("officialLXCImageCachePath(%q) = %q, %v; want rejection", templateID, cachePath, ok)
+		}
+	}
+}

backend/internal/api/ipv6.go

@@ -1,6 +1,9 @@
 package api
 
-import "net/http"
+import (
+	"encoding/json"
+	"net/http"
+)
 
 func HandleIPv6Status(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodGet {
@@ -22,3 +25,54 @@ func assignIPv6(w http.ResponseWriter, r *http.Request, id int) {
 	}
 	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "IPv6 assigned", Data: c})
 }
+
+type ipAssignmentRequest struct {
+	Mode      string   `json:"mode"`
+	Auto      *bool    `json:"auto,omitempty"`
+	Count     int      `json:"count,omitempty"`
+	Addresses []string `json:"addresses,omitempty"`
+}
+
+func (req ipAssignmentRequest) allocation() ([]string, int, bool) {
+	auto := req.Mode == "random" || req.Mode == "auto"
+	if req.Mode == "custom" {
+		auto = false
+	}
+	if req.Mode == "clear" || req.Mode == "none" {
+		return nil, 0, false
+	}
+	if req.Auto != nil {
+		auto = *req.Auto
+	}
+	return req.Addresses, req.Count, auto
+}
+
+func updatePublicIPv4(w http.ResponseWriter, r *http.Request, id int) {
+	var req ipAssignmentRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid request body"})
+		return
+	}
+	addresses, count, auto := req.allocation()
+	c, err := updatePublicIPv4ByRuntime(id, addresses, count, auto)
+	if err != nil {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: err.Error()})
+		return
+	}
+	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "Public IPv4 assignments updated", Data: c})
+}
+
+func updateIPv6Addresses(w http.ResponseWriter, r *http.Request, id int) {
+	var req ipAssignmentRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid request body"})
+		return
+	}
+	addresses, count, auto := req.allocation()
+	c, err := updateIPv6ByRuntime(id, addresses, count, auto)
+	if err != nil {
+		jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: err.Error()})
+		return
+	}
+	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "IPv6 assignments updated", Data: c})
+}

backend/internal/api/restore.go

@@ -0,0 +1,104 @@
+package api
+
+import (
+	"fmt"
+	"time"
+
+	"clicd/internal/config"
+	"clicd/internal/kvm"
+	"clicd/internal/lxc"
+)
+
+// CaptureRuntimeRestoreState records which managed workloads are actually
+// running before the CLICD service exits. On the next host boot, only those
+// workloads are started again.
+func CaptureRuntimeRestoreState() {
+	if config.AppConfig == nil {
+		return
+	}
+	lxcManager := lxc.NewManager()
+	kvmManager := kvm.NewManager()
+	changed := false
+
+	for i := range config.AppConfig.Containers {
+		c := &config.AppConfig.Containers[i]
+		status, err := runtimeStatus(*c, lxcManager, kvmManager)
+		if err != nil {
+			fmt.Printf("Warning: failed to capture runtime state for %s: %v\n", c.Name, err)
+			continue
+		}
+		restore := status == "running"
+		if c.RestoreOnHostBoot != restore {
+			c.RestoreOnHostBoot = restore
+			changed = true
+		}
+		if status != "" && c.Status != status {
+			c.Status = status
+			changed = true
+		}
+	}
+	if changed {
+		if err := config.SaveConfig(); err != nil {
+			fmt.Printf("Warning: failed to save host boot restore state: %v\n", err)
+		}
+	}
+}
+
+func StartHostBootRestore() {
+	go RestoreHostBootState()
+}
+
+func RestoreHostBootState() {
+	if config.AppConfig == nil {
+		return
+	}
+	time.Sleep(2 * time.Second)
+
+	lxcManager := lxc.NewManager()
+	kvmManager := kvm.NewManager()
+	containers := append([]config.Container(nil), config.AppConfig.Containers...)
+
+	for _, c := range containers {
+		if !c.RestoreOnHostBoot {
+			continue
+		}
+		if c.PolicyBlocked {
+			fmt.Printf("Skipping host boot restore for %s: policy blocked\n", c.Name)
+			continue
+		}
+		if lxc.IsExpired(c) {
+			fmt.Printf("Skipping host boot restore for %s: expired at %s\n", c.Name, c.ExpiresAt)
+			continue
+		}
+
+		status, err := runtimeStatus(c, lxcManager, kvmManager)
+		if err == nil && status == "running" {
+			config.UpdateContainerStatusAndRestore(c.ID, "running", true)
+			if !c.IsKVM() {
+				_ = lxcManager.ApplyPortMappings(c.ID)
+			} else {
+				_ = lxc.NewManager().ApplyPortMappings(c.ID)
+			}
+			continue
+		}
+
+		fmt.Printf("Restoring workload after host boot: %s (ID=%d)\n", c.Name, c.ID)
+		if c.IsKVM() {
+			if err := kvmManager.StartContainer(c.ID); err != nil {
+				fmt.Printf("Warning: failed to restore KVM %s: %v\n", c.Name, err)
+			}
+			continue
+		}
+		if err := lxcManager.StartContainer(c.ID); err != nil {
+			fmt.Printf("Warning: failed to restore LXC %s: %v\n", c.Name, err)
+		}
+	}
+	lxc.EnsureAllRunningPortMappings()
+}
+
+func runtimeStatus(c config.Container, lxcManager *lxc.Manager, kvmManager *kvm.Manager) (string, error) {
+	if c.IsKVM() {
+		return kvmManager.GetContainerStatus(c.VirshName())
+	}
+	return lxcManager.GetContainerStatus(c.LxcName())
+}

backend/internal/api/routing.go

@@ -22,6 +22,11 @@ type nat4PortRange struct {
 	End   int `json:"end"`
 }
 
+type nat4Networks struct {
+	LXC config.NATNetwork `json:"lxc"`
+	KVM config.NATNetwork `json:"kvm"`
+}
+
 type nat4Route struct {
 	ContainerID   int    `json:"container_id"`
 	ContainerName string `json:"container_name"`
@@ -46,6 +51,19 @@ type ipv4Route struct {
 	Gateway       string `json:"gateway,omitempty"`
 }
 
+type lanDHCPRoute struct {
+	ContainerID   int    `json:"container_id"`
+	ContainerName string `json:"container_name"`
+	LXCName       string `json:"lxc_name"`
+	Status        string `json:"status"`
+	Address       string `json:"address"`
+	Interface     string `json:"interface"`
+	PrefixLen     int    `json:"prefix_len,omitempty"`
+	Gateway       string `json:"gateway,omitempty"`
+	MACAddress    string `json:"mac_address,omitempty"`
+	Mode          string `json:"mode"`
+}
+
 type ipv6Route struct {
 	ContainerID   int    `json:"container_id"`
 	ContainerName string `json:"container_name"`
@@ -59,11 +77,15 @@ type ipv6Route struct {
 type routingResponse struct {
 	NAT4                routeCapacity        `json:"nat4"`
 	NAT4PortRange       nat4PortRange        `json:"nat4_port_range"`
+	NAT4NextPort        int                  `json:"nat4_next_port"`
+	NAT4Networks        nat4Networks         `json:"nat4_networks"`
 	IPv4                routeCapacity        `json:"ipv4"`
+	LANDHCP             routeCapacity        `json:"lan_dhcp"`
 	IPv6                routeCapacity        `json:"ipv6"`
 	HostPublicIPv4      lxc.PublicIPInfo     `json:"host_public_ipv4"`
 	PublicIPv4Addresses []lxc.PublicIPInfo   `json:"public_ipv4_addresses"`
 	IPv4Assignments     []ipv4Route          `json:"ipv4_assignments"`
+	LANDHCPAssignments  []lanDHCPRoute       `json:"lan_dhcp_assignments"`
 	NAT4Mappings        []nat4Route          `json:"nat4_mappings"`
 	IPv6Assignments     []ipv6Route          `json:"ipv6_assignments"`
 	IPv6Prefixes        []lxc.IPv6PrefixInfo `json:"ipv6_prefixes"`
@@ -125,6 +147,7 @@ func handleRoutingGet(w http.ResponseWriter, r *http.Request) {
 	nat4Mappings := make([]nat4Route, 0)
 	usedPorts := map[int]bool{}
 	ipv4Assignments := make([]ipv4Route, 0)
+	lanDHCPAssignments := make([]lanDHCPRoute, 0)
 	ipv6Assignments := make([]ipv6Route, 0)
 
 	nat4StartPort, nat4EndPort := config.NATPortRange()
@@ -164,6 +187,20 @@ func handleRoutingGet(w http.ResponseWriter, r *http.Request) {
 			})
 		}
 		c.NormalizeNetworkAssignments()
+		if c.UsesLANIPv4() {
+			lanDHCPAssignments = append(lanDHCPAssignments, lanDHCPRoute{
+				ContainerID:   c.ID,
+				ContainerName: c.Name,
+				LXCName:       c.LxcName(),
+				Status:        c.Status,
+				Address:       c.IP,
+				Interface:     c.LANInterface,
+				PrefixLen:     c.LANIPv4PrefixLen,
+				Gateway:       c.LANIPv4Gateway,
+				MACAddress:    c.MACAddress,
+				Mode:          c.LANIPv4Mode,
+			})
+		}
 		for _, ip := range c.IPv6Addresses {
 			if ip.Address == "" {
 				continue
@@ -191,6 +228,12 @@ func handleRoutingGet(w http.ResponseWriter, r *http.Request) {
 	sort.SliceStable(ipv4Assignments, func(i, j int) bool {
 		return ipv4Assignments[i].Address < ipv4Assignments[j].Address
 	})
+	sort.SliceStable(lanDHCPAssignments, func(i, j int) bool {
+		if lanDHCPAssignments[i].Interface == lanDHCPAssignments[j].Interface {
+			return lanDHCPAssignments[i].ContainerName < lanDHCPAssignments[j].ContainerName
+		}
+		return lanDHCPAssignments[i].Interface < lanDHCPAssignments[j].Interface
+	})
 	sort.SliceStable(ipv6Assignments, func(i, j int) bool {
 		return ipv6Assignments[i].Address < ipv6Assignments[j].Address
 	})
@@ -201,6 +244,7 @@ func handleRoutingGet(w http.ResponseWriter, r *http.Request) {
 	if nat4Remaining < 0 {
 		nat4Remaining = 0
 	}
+	nat4NextPort, _ := config.PreviewSSHPortExcluding(nil)
 
 	prefixes := lxc.DetectPublicIPv6Prefixes()
 	hostPublicIPv4 := lxc.DetectPublicIPv4()
@@ -226,11 +270,21 @@ func handleRoutingGet(w http.ResponseWriter, r *http.Request) {
 				Start: nat4StartPort,
 				End:   nat4EndPort,
 			},
+			NAT4NextPort: nat4NextPort,
+			NAT4Networks: nat4Networks{
+				LXC: config.LXCNATNetwork(),
+				KVM: config.KVMNATNetwork(),
+			},
 			IPv4: routeCapacity{
 				Used:      ipv4Used,
 				Remaining: strconv.Itoa(ipv4Remaining),
 				Total:     strconv.Itoa(ipv4Total),
 			},
+			LANDHCP: routeCapacity{
+				Used:      len(lanDHCPAssignments),
+				Remaining: "DHCP",
+				Total:     "DHCP",
+			},
 			IPv6: routeCapacity{
 				Used:      len(ipv6Assignments),
 				Remaining: ipv6Remaining,
@@ -239,6 +293,7 @@ func handleRoutingGet(w http.ResponseWriter, r *http.Request) {
 			HostPublicIPv4:      hostPublicIPv4,
 			PublicIPv4Addresses: publicIPv4s,
 			IPv4Assignments:     ipv4Assignments,
+			LANDHCPAssignments:  lanDHCPAssignments,
 			NAT4Mappings:        nat4Mappings,
 			IPv6Assignments:     ipv6Assignments,
 			IPv6Prefixes:        prefixes,

backend/internal/api/routing_test.go

@@ -1,6 +1,7 @@
 package api
 
 import (
+	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -24,3 +25,44 @@ func TestHandleRoutingGetAllowsRoutingWriteScope(t *testing.T) {
 		t.Fatal("routing:write scope should be able to receive the routing response after updates")
 	}
 }
+
+func TestHandleRoutingGetReturnsConfiguredNextNATPort(t *testing.T) {
+	previous := config.AppConfig
+	t.Cleanup(func() { config.AppConfig = previous })
+	config.AppConfig = &config.ClicdConfig{
+		NATPortStart: 30000,
+		NATPortEnd:   35000,
+		NextSSHPort:  30000,
+		Containers: []config.Container{{
+			PortMappings: []config.PortMapping{{HostPort: 30000}},
+		}},
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/routing", nil)
+	req = withAuthContext(req, AuthContext{
+		Type:   authTypeAPIKey,
+		Scopes: []string{"routing:read"},
+	})
+	rec := httptest.NewRecorder()
+	handleRoutingGet(rec, req)
+
+	var response struct {
+		Success bool `json:"success"`
+		Data    struct {
+			NAT4PortRange nat4PortRange `json:"nat4_port_range"`
+			NAT4NextPort  int           `json:"nat4_next_port"`
+		} `json:"data"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &response); err != nil {
+		t.Fatal(err)
+	}
+	if !response.Success {
+		t.Fatalf("routing response was unsuccessful: %s", rec.Body.String())
+	}
+	if response.Data.NAT4PortRange.Start != 30000 || response.Data.NAT4PortRange.End != 35000 {
+		t.Fatalf("NAT range = %+v", response.Data.NAT4PortRange)
+	}
+	if response.Data.NAT4NextPort != 30001 {
+		t.Fatalf("next NAT port = %d, want 30001", response.Data.NAT4NextPort)
+	}
+}

backend/internal/api/runtime.go

@@ -20,7 +20,7 @@ func runtimeFromRequest(value string) string {
 }
 
 func hasRequestedNetwork(cfg lxc.ContainerConfig) bool {
-	return cfg.WantsNAT() || cfg.AssignIPv4 || len(cfg.PublicIPv4s) > 0 || cfg.AssignIPv6 || len(cfg.IPv6Addresses) > 0
+	return cfg.WantsNAT() || cfg.WantsLANIPv4() || cfg.AssignIPv4 || len(cfg.PublicIPv4s) > 0 || cfg.AssignIPv6 || len(cfg.IPv6Addresses) > 0
 }
 
 func runtimeFromTemplateID(templateID string) string {
@@ -115,6 +115,22 @@ func assignIPv6ByRuntime(id int) (*config.Container, error) {
 	return lxcManager.AssignIPv6(id)
 }
 
+func updatePublicIPv4ByRuntime(id int, requested []string, count int, auto bool) (*config.Container, error) {
+	c := config.FindContainer(id)
+	if c != nil && c.IsKVM() {
+		return kvmManager.UpdatePublicIPv4Assignments(id, requested, count, auto)
+	}
+	return lxcManager.UpdatePublicIPv4Assignments(id, requested, count, auto)
+}
+
+func updateIPv6ByRuntime(id int, requested []string, count int, auto bool) (*config.Container, error) {
+	c := config.FindContainer(id)
+	if c != nil && c.IsKVM() {
+		return kvmManager.UpdateIPv6Assignments(id, requested, count, auto)
+	}
+	return lxcManager.UpdateIPv6Assignments(id, requested, count, auto)
+}
+
 func usageByRuntime(id int) (map[string]interface{}, error) {
 	c := config.FindContainer(id)
 	if c != nil && c.IsKVM() {
@@ -131,12 +147,12 @@ func trafficByRuntime(id int) map[string]interface{} {
 	return lxcManager.GetTrafficInfo(id)
 }
 
-func createSnapshotByRuntime(id int, createdBy string, scheduled bool, rotateLimit int) (config.Snapshot, error) {
+func createSnapshotByRuntime(id int, createdBy string, scheduled bool, rotateLimit int, storagePoolID ...string) (config.Snapshot, error) {
 	c := config.FindContainer(id)
 	if c != nil && c.IsKVM() {
-		return kvmManager.CreateSnapshot(id, createdBy, scheduled, rotateLimit)
+		return kvmManager.CreateSnapshot(id, createdBy, scheduled, rotateLimit, storagePoolID...)
 	}
-	return lxcManager.CreateSnapshot(id, createdBy, scheduled, rotateLimit)
+	return lxcManager.CreateSnapshot(id, createdBy, scheduled, rotateLimit, storagePoolID...)
 }
 
 func deleteSnapshotByRuntime(snapshotID string) error {

backend/internal/api/settings.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"time"
 
@@ -48,6 +49,38 @@ func HandleLanguage(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+// HandleTaskQueueSettings returns or updates the global task concurrency limit.
+func HandleTaskQueueSettings(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodGet:
+		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: globalQueue.Settings()})
+	case http.MethodPut, http.MethodPost:
+		var req struct {
+			Concurrency int `json:"concurrency"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid request body"})
+			return
+		}
+		if req.Concurrency < 1 || req.Concurrency > config.MaxTaskConcurrency {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "任务并发数必须在 1 到 16 之间"})
+			return
+		}
+		previous := config.AppConfig.TaskConcurrency
+		config.AppConfig.TaskConcurrency = req.Concurrency
+		if err := config.SaveConfig(); err != nil {
+			config.AppConfig.TaskConcurrency = previous
+			jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "保存任务队列设置失败"})
+			return
+		}
+		globalQueue.SetConcurrency(req.Concurrency)
+		auditRequest(r, "settings.task_queue", "task_concurrency", fmt.Sprintf("concurrency=%d", req.Concurrency), true, "")
+		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "任务队列设置已保存", Data: globalQueue.Settings()})
+	default:
+		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
+	}
+}
+
 // RecordLoginLog adds a login attempt to the log (persisted to config)
 func RecordLoginLog(username, ip, userAgent string, success bool) {
 	config.AddLoginLog(username, ip, userAgent, success)

backend/internal/api/snapshots.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"encoding/json"
+	"io"
 	"net/http"
 	"sort"
 	"strconv"
@@ -88,6 +89,20 @@ func listContainerSnapshots(w http.ResponseWriter, r *http.Request, containerID
 
 func createContainerSnapshot(w http.ResponseWriter, r *http.Request, containerID int) {
 	user := requestUser(r)
+	var req struct {
+		StoragePoolID string `json:"storage_pool_id"`
+	}
+	if r.Body != nil {
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil && err != io.EOF {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid request body"})
+			return
+		}
+	}
+	req.StoragePoolID = strings.TrimSpace(req.StoragePoolID)
+	if _, err := config.SelectStoragePoolForContent(config.StorageContentSnapshots, req.StoragePoolID, 0); err != nil {
+		jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: err.Error()})
+		return
+	}
 	if isSubUserRequest(r) {
 		c := config.FindContainer(containerID)
 		limit := config.ContainerSnapshotLimit(c)
@@ -96,7 +111,7 @@ func createContainerSnapshot(w http.ResponseWriter, r *http.Request, containerID
 			return
 		}
 	}
-	snapshot, err := createSnapshotByRuntime(containerID, user, false, 0)
+	snapshot, err := createSnapshotByRuntime(containerID, user, false, 0, req.StoragePoolID)
 	if err != nil {
 		jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: err.Error()})
 		return
@@ -159,6 +174,12 @@ func updateSnapshotSchedule(w http.ResponseWriter, r *http.Request, containerID
 	if req.Time == "" {
 		req.Time = "03:00"
 	}
+	if req.Enabled {
+		if _, err := config.SelectStoragePoolForContent(config.StorageContentSnapshots, "", 0); err != nil {
+			jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: err.Error()})
+			return
+		}
+	}
 	user := requestUser(r)
 	c, err := setSnapshotScheduleByRuntime(containerID, req.Enabled, req.IntervalHours, req.Time, user)
 	if err != nil {

backend/internal/api/storage.go

@@ -0,0 +1,498 @@
+package api
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"os/exec"
+	pathpkg "path"
+	"path/filepath"
+	"strings"
+
+	"clicd/internal/config"
+)
+
+type storageInfoResponse struct {
+	Pools        []storagePoolInfo `json:"pools"`
+	Disks        []storageDiskInfo `json:"disks"`
+	ContentTypes []string          `json:"content_types"`
+}
+
+type storagePoolInfo struct {
+	config.StoragePool
+	Available      bool                  `json:"available"`
+	Exists         bool                  `json:"exists"`
+	SizeBytes      int64                 `json:"size_bytes"`
+	UsedBytes      int64                 `json:"used_bytes"`
+	FreeBytes      int64                 `json:"free_bytes"`
+	ClicdUsedBytes int64                 `json:"clicd_used_bytes"`
+	ContentUsage   []storageContentUsage `json:"content_usage"`
+	Error          string                `json:"error,omitempty"`
+}
+
+type storageContentUsage struct {
+	ContentType string `json:"content_type"`
+	SizeBytes   int64  `json:"size_bytes"`
+}
+
+type storageDiskInfo struct {
+	Name           string                `json:"name"`
+	Path           string                `json:"path"`
+	Type           string                `json:"type"`
+	FSType         string                `json:"fstype"`
+	MountPoint     string                `json:"mount_point"`
+	Model          string                `json:"model"`
+	SizeBytes      int64                 `json:"size_bytes"`
+	UsedBytes      int64                 `json:"used_bytes"`
+	FreeBytes      int64                 `json:"free_bytes"`
+	StoragePoolID  string                `json:"storage_pool_id,omitempty"`
+	StoragePath    string                `json:"storage_path,omitempty"`
+	ClicdUsedBytes int64                 `json:"clicd_used_bytes"`
+	ContentUsage   []storageContentUsage `json:"content_usage"`
+}
+
+func HandleStorage(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodGet:
+		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: buildStorageInfo()})
+	case http.MethodPut:
+		var req struct {
+			Pools []config.StoragePool `json:"pools"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid request body"})
+			return
+		}
+		pools, err := normalizeStoragePoolsRequest(req.Pools)
+		if err != nil {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: err.Error()})
+			return
+		}
+		for _, pool := range pools {
+			if err := os.MkdirAll(pool.Path, 0755); err != nil {
+				jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: fmt.Sprintf("Failed to create %s: %v", pool.Path, err)})
+				return
+			}
+		}
+		config.AppConfig.StoragePools = pools
+		if err := config.SaveConfig(); err != nil {
+			jsonResponse(w, http.StatusInternalServerError, APIResponse{Success: false, Message: "Failed to save storage pools"})
+			return
+		}
+		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: buildStorageInfo()})
+	default:
+		jsonResponse(w, http.StatusMethodNotAllowed, APIResponse{Success: false, Message: "Method not allowed"})
+	}
+}
+
+func buildStorageInfo() storageInfoResponse {
+	disks := detectStorageDisks()
+	pools := make([]storagePoolInfo, 0, len(config.AppConfig.StoragePools))
+	for _, pool := range config.AppConfig.StoragePools {
+		info := storagePoolInfo{StoragePool: pool}
+		if filepath.Clean(pool.MountPoint) == string(os.PathSeparator) {
+			_ = os.MkdirAll(pool.Path, 0755)
+		}
+		if st, err := os.Stat(pool.Path); err == nil && st.IsDir() {
+			info.Exists = true
+		} else if err != nil {
+			info.Error = err.Error()
+		}
+		detectedMountPoint := bestMountPointForPath(pool.Path, disks)
+		if info.MountPoint == "" {
+			info.MountPoint = detectedMountPoint
+		}
+		if detectedMountPoint != "" && filepath.Clean(info.MountPoint) == filepath.Clean(detectedMountPoint) {
+			info.Available = info.Exists
+			info.SizeBytes, info.UsedBytes, info.FreeBytes = dfPath(pool.Path)
+			info.ContentUsage, info.ClicdUsedBytes = contentUsageForPool(pool.Path)
+		} else if info.Error == "" {
+			info.Error = "storage disk is not mounted"
+		}
+		pools = append(pools, info)
+	}
+	for i := range disks {
+		for _, pool := range pools {
+			if pool.MountPoint != disks[i].MountPoint {
+				continue
+			}
+			disks[i].ClicdUsedBytes += pool.ClicdUsedBytes
+			disks[i].ContentUsage = mergeContentUsage(disks[i].ContentUsage, pool.ContentUsage)
+			if disks[i].StoragePoolID == "" {
+				disks[i].StoragePoolID = pool.ID
+				disks[i].StoragePath = pool.Path
+			}
+		}
+	}
+	return storageInfoResponse{
+		Pools: pools,
+		Disks: disks,
+		ContentTypes: []string{
+			config.StorageContentLXC,
+			config.StorageContentKVM,
+			config.StorageContentImages,
+			config.StorageContentSnapshots,
+			config.StorageContentBackups,
+		},
+	}
+}
+
+func normalizeStoragePoolsRequest(items []config.StoragePool) ([]config.StoragePool, error) {
+	return normalizeStoragePoolsRequestWithDisks(items, detectStorageDisks())
+}
+
+func normalizeStoragePoolsRequestWithDisks(items []config.StoragePool, disks []storageDiskInfo) ([]config.StoragePool, error) {
+	if len(items) == 0 {
+		return nil, fmt.Errorf("at least one mounted storage disk configuration must be retained")
+	}
+	result := make([]config.StoragePool, 0, len(items))
+	seen := map[string]bool{}
+	defaultSeen := map[string]bool{}
+	for _, item := range items {
+		disk, managedPath, err := storageDiskForPoolRequest(item, disks)
+		if err != nil {
+			return nil, err
+		}
+		id, name := storagePoolIdentity(disk)
+		if seen[id] {
+			return nil, fmt.Errorf("duplicate storage disk: %s", disk.MountPoint)
+		}
+		seen[id] = true
+
+		contentTypes := normalizeStorageContentTypes(item.ContentTypes)
+		defaultContents := normalizeStorageContentTypes(item.DefaultContents)
+		allowed := map[string]bool{}
+		for _, content := range contentTypes {
+			allowed[content] = true
+		}
+		defaults := make([]string, 0, len(defaultContents))
+		for _, content := range defaultContents {
+			if !allowed[content] {
+				continue
+			}
+			if defaultSeen[content] {
+				return nil, fmt.Errorf("only one default storage disk is allowed for %s", content)
+			}
+			defaultSeen[content] = true
+			defaults = append(defaults, content)
+		}
+		result = append(result, config.StoragePool{
+			ID:              id,
+			Name:            name,
+			Path:            managedPath,
+			MountPoint:      disk.MountPoint,
+			ContentTypes:    contentTypes,
+			DefaultContents: defaults,
+			Enabled:         item.Enabled,
+		})
+	}
+	return result, nil
+}
+
+func storageDiskForPoolRequest(item config.StoragePool, disks []storageDiskInfo) (storageDiskInfo, string, error) {
+	requestedMount := filepath.Clean(strings.TrimSpace(item.MountPoint))
+	if requestedMount == "." {
+		requestedMount = ""
+	}
+	requestedPath := filepath.Clean(strings.TrimSpace(item.Path))
+	if requestedPath == "." {
+		requestedPath = ""
+	}
+	for _, disk := range disks {
+		mountPoint := filepath.Clean(disk.MountPoint)
+		managedPath := managedStoragePath(mountPoint)
+		mountMatches := requestedMount != "" && requestedMount == mountPoint
+		pathMatches := requestedPath != "" && requestedPath == managedPath
+		if !mountMatches && !pathMatches {
+			continue
+		}
+		if requestedMount != "" && !mountMatches {
+			return storageDiskInfo{}, "", fmt.Errorf("storage disk mount point has changed; refresh and try again")
+		}
+		if requestedPath != "" && !pathMatches {
+			return storageDiskInfo{}, "", fmt.Errorf("custom storage paths are not allowed; refresh and try again")
+		}
+		return disk, managedPath, nil
+	}
+	return storageDiskInfo{}, "", fmt.Errorf("storage disk is not mounted or is no longer available")
+}
+
+func storagePoolIdentity(disk storageDiskInfo) (string, string) {
+	mountPoint := filepath.Clean(disk.MountPoint)
+	if mountPoint == string(os.PathSeparator) {
+		return "disk-root", "system (/)"
+	}
+	baseName := filepath.Base(mountPoint)
+	if baseName == "" || baseName == "." || baseName == string(os.PathSeparator) {
+		baseName = strings.TrimSpace(disk.Name)
+	}
+	if baseName == "" {
+		baseName = "storage"
+	}
+	devicePath := strings.TrimSpace(disk.Path)
+	if devicePath == "" {
+		devicePath = strings.TrimSpace(disk.Name)
+	}
+	return "disk-" + storageID(baseName), fmt.Sprintf("%s (%s)", baseName, devicePath)
+}
+
+func managedStoragePath(mountPoint string) string {
+	if filepath.Clean(mountPoint) == string(os.PathSeparator) {
+		return filepath.Join(string(os.PathSeparator), "var", "lib", "clicd")
+	}
+	return filepath.Join(filepath.Clean(mountPoint), "clicd")
+}
+
+func normalizeStorageContentTypes(values []string) []string {
+	seen := map[string]bool{}
+	result := []string{}
+	for _, value := range values {
+		var next string
+		switch strings.ToLower(strings.TrimSpace(value)) {
+		case config.StorageContentLXC:
+			next = config.StorageContentLXC
+		case config.StorageContentKVM:
+			next = config.StorageContentKVM
+		case config.StorageContentImages:
+			next = config.StorageContentImages
+		case config.StorageContentSnapshots:
+			next = config.StorageContentSnapshots
+		case config.StorageContentBackups:
+			next = config.StorageContentBackups
+		default:
+			continue
+		}
+		if seen[next] {
+			continue
+		}
+		seen[next] = true
+		result = append(result, next)
+	}
+	return result
+}
+
+func storageID(name string) string {
+	id := strings.ToLower(strings.TrimSpace(name))
+	id = strings.NewReplacer(" ", "-", "_", "-", ".", "-", "/", "-").Replace(id)
+	id = strings.Trim(id, "-")
+	if id == "" {
+		return "storage"
+	}
+	return id
+}
+
+func detectStorageDisks() []storageDiskInfo {
+	type lsblkDevice struct {
+		Name       string        `json:"name"`
+		Path       string        `json:"path"`
+		Type       string        `json:"type"`
+		FSType     string        `json:"fstype"`
+		MountPoint string        `json:"mountpoint"`
+		Model      string        `json:"model"`
+		Size       int64         `json:"size"`
+		ReadOnly   bool          `json:"ro"`
+		Children   []lsblkDevice `json:"children"`
+	}
+	var payload struct {
+		BlockDevices []lsblkDevice `json:"blockdevices"`
+	}
+	out, err := exec.Command("lsblk", "-J", "-b", "-o", "NAME,PATH,SIZE,TYPE,FSTYPE,MOUNTPOINT,MODEL,RO").Output()
+	if err != nil {
+		return nil
+	}
+	if err := json.Unmarshal(out, &payload); err != nil {
+		return nil
+	}
+	result := []storageDiskInfo{}
+	var walk func(lsblkDevice)
+	walk = func(dev lsblkDevice) {
+		info := storageDiskInfo{
+			Name:       dev.Name,
+			Path:       dev.Path,
+			Type:       dev.Type,
+			FSType:     dev.FSType,
+			MountPoint: dev.MountPoint,
+			Model:      strings.TrimSpace(dev.Model),
+			SizeBytes:  dev.Size,
+		}
+		if isUsableStorageMount(dev.Type, dev.FSType, dev.Path, dev.MountPoint, dev.ReadOnly) && !mountIsReadOnly(dev.MountPoint) {
+			info.SizeBytes, info.UsedBytes, info.FreeBytes = dfPath(dev.MountPoint)
+			result = append(result, info)
+		}
+		for _, child := range dev.Children {
+			walk(child)
+		}
+	}
+	for _, dev := range payload.BlockDevices {
+		walk(dev)
+	}
+	return result
+}
+
+func isUsableStorageMount(deviceType, fsType, devicePath, mountPoint string, readOnly bool) bool {
+	if readOnly || strings.TrimSpace(mountPoint) == "" || !strings.HasPrefix(mountPoint, "/") {
+		return false
+	}
+
+	deviceType = strings.ToLower(strings.TrimSpace(deviceType))
+	devicePath = strings.ToLower(strings.TrimSpace(devicePath))
+	if deviceType == "loop" || deviceType == "rom" || deviceType == "zram" || strings.HasPrefix(devicePath, "/dev/loop") {
+		return false
+	}
+
+	fsType = strings.ToLower(strings.TrimSpace(fsType))
+	unsupportedFileSystems := map[string]bool{
+		"":           true,
+		"squashfs":   true,
+		"iso9660":    true,
+		"udf":        true,
+		"swap":       true,
+		"tmpfs":      true,
+		"devtmpfs":   true,
+		"overlay":    true,
+		"proc":       true,
+		"sysfs":      true,
+		"cgroup":     true,
+		"cgroup2":    true,
+		"efivarfs":   true,
+		"securityfs": true,
+	}
+	if unsupportedFileSystems[fsType] {
+		return false
+	}
+
+	mountPoint = pathpkg.Clean(mountPoint)
+	for _, reserved := range []string{"/snap", "/boot"} {
+		if mountPoint == reserved || strings.HasPrefix(mountPoint, reserved+"/") {
+			return false
+		}
+	}
+	return true
+}
+
+func mountIsReadOnly(mountPoint string) bool {
+	out, err := exec.Command("findmnt", "-n", "-o", "OPTIONS", "--target", mountPoint).Output()
+	if err != nil {
+		return false
+	}
+	for _, option := range strings.Split(strings.TrimSpace(string(out)), ",") {
+		if strings.TrimSpace(option) == "ro" {
+			return true
+		}
+	}
+	return false
+}
+
+func contentUsageForPool(poolPath string) ([]storageContentUsage, int64) {
+	mapping := map[string]string{
+		config.StorageContentLXC:       "lxc",
+		config.StorageContentKVM:       "kvm",
+		config.StorageContentImages:    "images",
+		config.StorageContentSnapshots: "snapshots",
+		config.StorageContentBackups:   "backups",
+	}
+	result := make([]storageContentUsage, 0, len(mapping))
+	var total int64
+	for _, content := range []string{
+		config.StorageContentLXC,
+		config.StorageContentKVM,
+		config.StorageContentImages,
+		config.StorageContentSnapshots,
+		config.StorageContentBackups,
+	} {
+		size := dirSizeBytes(filepath.Join(poolPath, mapping[content]))
+		result = append(result, storageContentUsage{ContentType: content, SizeBytes: size})
+		total += size
+	}
+	return result, total
+}
+
+func mergeContentUsage(current []storageContentUsage, next []storageContentUsage) []storageContentUsage {
+	sizes := map[string]int64{}
+	order := []string{}
+	for _, item := range append(current, next...) {
+		if _, ok := sizes[item.ContentType]; !ok {
+			order = append(order, item.ContentType)
+		}
+		sizes[item.ContentType] += item.SizeBytes
+	}
+	result := make([]storageContentUsage, 0, len(order))
+	for _, content := range order {
+		result = append(result, storageContentUsage{ContentType: content, SizeBytes: sizes[content]})
+	}
+	return result
+}
+
+func dirSizeBytes(path string) int64 {
+	if resolved, err := filepath.EvalSymlinks(path); err == nil {
+		path = resolved
+	}
+	// Count allocated blocks on this filesystem only. LXC rootfs directories can
+	// contain active mounts such as proc/sys; traversing them is slow and reports
+	// enormous virtual sizes that are not actually occupied by CLICD data.
+	out, err := exec.Command("du", "-skx", path).Output()
+	if err == nil {
+		fields := strings.Fields(string(out))
+		if len(fields) > 0 {
+			var sizeKB int64
+			if _, scanErr := fmt.Sscanf(fields[0], "%d", &sizeKB); scanErr == nil && sizeKB <= (1<<63-1)/1024 {
+				return sizeKB * 1024
+			}
+		}
+	}
+	var size int64
+	_ = filepath.WalkDir(path, func(_ string, d os.DirEntry, err error) error {
+		if err != nil || d.IsDir() {
+			return nil
+		}
+		if info, statErr := d.Info(); statErr == nil {
+			size += info.Size()
+		}
+		return nil
+	})
+	return size
+}
+
+func dfPath(path string) (size int64, used int64, free int64) {
+	out, err := exec.Command("df", "-B1", "-P", path).Output()
+	if err != nil {
+		return 0, 0, 0
+	}
+	lines := strings.Split(strings.TrimSpace(string(out)), "\n")
+	if len(lines) < 2 {
+		return 0, 0, 0
+	}
+	fields := strings.Fields(lines[len(lines)-1])
+	if len(fields) < 6 {
+		return 0, 0, 0
+	}
+	fmt.Sscanf(fields[1], "%d", &size)
+	fmt.Sscanf(fields[2], "%d", &used)
+	fmt.Sscanf(fields[3], "%d", &free)
+	return size, used, free
+}
+
+func bestMountPointForPath(path string, disks []storageDiskInfo) string {
+	path = strings.ReplaceAll(path, "\\", "/")
+	path = pathpkg.Clean(path)
+	best := ""
+	for _, disk := range disks {
+		mp := pathpkg.Clean(strings.ReplaceAll(disk.MountPoint, "\\", "/"))
+		if disk.MountPoint == "" || mp == "." {
+			continue
+		}
+		matches := path == mp
+		if mp == "/" {
+			matches = pathpkg.IsAbs(path)
+		} else if strings.HasPrefix(path, mp+"/") {
+			matches = true
+		}
+		if matches {
+			if len(mp) > len(best) {
+				best = mp
+			}
+		}
+	}
+	return best
+}

backend/internal/api/storage_test.go

@@ -0,0 +1,121 @@
+package api
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"clicd/internal/config"
+)
+
+func TestIsUsableStorageMount(t *testing.T) {
+	tests := []struct {
+		name       string
+		deviceType string
+		fsType     string
+		devicePath string
+		mountPoint string
+		readOnly   bool
+		wantUsable bool
+	}{
+		{name: "root partition", deviceType: "part", fsType: "ext4", devicePath: "/dev/sda2", mountPoint: "/", wantUsable: true},
+		{name: "mounted data disk", deviceType: "disk", fsType: "xfs", devicePath: "/dev/sdb", mountPoint: "/data", wantUsable: true},
+		{name: "snap loop", deviceType: "loop", fsType: "squashfs", devicePath: "/dev/loop0", mountPoint: "/snap/core20/2105", readOnly: true},
+		{name: "loop without ro flag", deviceType: "loop", fsType: "ext4", devicePath: "/dev/loop7", mountPoint: "/mnt/loop"},
+		{name: "read only disk", deviceType: "part", fsType: "ext4", devicePath: "/dev/sdc1", mountPoint: "/archive", readOnly: true},
+		{name: "optical image", deviceType: "rom", fsType: "iso9660", devicePath: "/dev/sr0", mountPoint: "/media/cdrom"},
+		{name: "efi partition", deviceType: "part", fsType: "vfat", devicePath: "/dev/sda1", mountPoint: "/boot/efi"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := isUsableStorageMount(tt.deviceType, tt.fsType, tt.devicePath, tt.mountPoint, tt.readOnly)
+			if got != tt.wantUsable {
+				t.Fatalf("isUsableStorageMount() = %v, want %v", got, tt.wantUsable)
+			}
+		})
+	}
+}
+
+func TestBestMountPointForPath(t *testing.T) {
+	disks := []storageDiskInfo{
+		{Path: "/dev/sda2", MountPoint: "/"},
+		{Path: "/dev/sdb1", MountPoint: "/mnt/clicd-data"},
+	}
+	tests := []struct {
+		path string
+		want string
+	}{
+		{path: "/var/lib/clicd", want: "/"},
+		{path: "/mnt/clicd-data/clicd", want: "/mnt/clicd-data"},
+		{path: "/mnt/clicd-data", want: "/mnt/clicd-data"},
+	}
+	for _, tt := range tests {
+		if got := bestMountPointForPath(tt.path, disks); got != tt.want {
+			t.Fatalf("bestMountPointForPath(%q) = %q, want %q", tt.path, got, tt.want)
+		}
+	}
+}
+
+func TestNormalizeStoragePoolsUsesServerManagedPath(t *testing.T) {
+	disks := []storageDiskInfo{
+		{Path: "/dev/sda2", MountPoint: "/"},
+		{Path: "/dev/sdb1", MountPoint: "/mnt/data"},
+	}
+	items := []config.StoragePool{{
+		ID:              "disk-data",
+		Name:            "data",
+		Path:            "/mnt/data/clicd",
+		MountPoint:      "/mnt/data",
+		ContentTypes:    []string{config.StorageContentLXC},
+		DefaultContents: []string{config.StorageContentLXC},
+		Enabled:         true,
+	}}
+	pools, err := normalizeStoragePoolsRequestWithDisks(items, disks)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wantPath := filepath.Join(filepath.Clean("/mnt/data"), "clicd")
+	if len(pools) != 1 || pools[0].ID != "disk-data" || pools[0].Name != "data (/dev/sdb1)" || pools[0].Path != wantPath || pools[0].MountPoint != "/mnt/data" {
+		t.Fatalf("unexpected normalized pools: %#v", pools)
+	}
+}
+
+func TestNormalizeStoragePoolsRejectsUncontrolledPath(t *testing.T) {
+	disks := []storageDiskInfo{{Path: "/dev/sdb1", MountPoint: "/mnt/data"}}
+	for _, path := range []string{"/etc", "/mnt/data/clicd/../../etc", "/mnt/data/other"} {
+		_, err := normalizeStoragePoolsRequestWithDisks([]config.StoragePool{{
+			ID:         "disk-data",
+			Name:       "data",
+			Path:       path,
+			MountPoint: "/mnt/data",
+			Enabled:    true,
+		}}, disks)
+		if err == nil {
+			t.Fatalf("path %q was accepted", path)
+		}
+	}
+}
+
+func TestDirSizeBytesUsesAllocatedBlocks(t *testing.T) {
+	if runtime.GOOS != "linux" {
+		t.Skip("allocated-block behavior is provided by the Linux du command")
+	}
+	dir := t.TempDir()
+	file, err := os.Create(filepath.Join(dir, "sparse.img"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := file.Truncate(1 << 30); err != nil {
+		file.Close()
+		t.Fatal(err)
+	}
+	if err := file.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	if got := dirSizeBytes(dir); got >= 128<<20 {
+		t.Fatalf("dirSizeBytes() = %d, expected allocated size instead of 1 GiB apparent size", got)
+	}
+}

backend/internal/api/subuser.go

@@ -27,6 +27,9 @@ type subUserResponse struct {
 	Password             string   `json:"password,omitempty"`
 	ContainerNames       []string `json:"container_names"`
 	ContainerUUIDs       []string `json:"container_uuids,omitempty"`
+	AllowedImageIDs      []string `json:"allowed_image_ids,omitempty"`
+	ImageLimitConfigured bool     `json:"image_limit_configured,omitempty"`
+	CurrentImageIDs      []string `json:"current_image_ids,omitempty"`
 	AccessCode           string   `json:"access_code"`
 	CreatedAt            string   `json:"created_at"`
 }
@@ -38,6 +41,9 @@ func newSubUserResponse(su config.SubUser, password string) subUserResponse {
 		Password:             password,
 		ContainerNames:       su.ContainerNames,
 		ContainerUUIDs:       su.ContainerUUIDs,
+		AllowedImageIDs:      effectiveSubUserAllowedImageIDs(&su),
+		ImageLimitConfigured: su.ImageLimitConfigured,
+		CurrentImageIDs:      subUserCurrentImageIDs(&su),
 		AccessCode:           su.AccessCode,
 		CreatedAt:            su.CreatedAt,
 	}
@@ -94,6 +100,10 @@ func HandleSubUserCreate(w http.ResponseWriter, r *http.Request) {
 				}
 				su.ContainerNames = appendUniqueString(su.ContainerNames, containerName)
 				su.ContainerUUIDs = appendUniqueString(su.ContainerUUIDs, c.UUID)
+				if !su.ImageLimitConfigured && len(su.AllowedImageIDs) == 0 {
+					su.AllowedImageIDs = effectiveContainerAllowedImageIDs(c)
+					su.ImageLimitConfigured = true
+				}
 				config.SaveConfig()
 				jsonResponse(w, http.StatusOK, APIResponse{
 					Success: true,
@@ -120,6 +130,8 @@ func HandleSubUserCreate(w http.ResponseWriter, r *http.Request) {
 		PassHash:             string(hash),
 		ContainerNames:       []string{containerName},
 		ContainerUUIDs:       []string{c.UUID},
+		AllowedImageIDs:      effectiveContainerAllowedImageIDs(c),
+		ImageLimitConfigured: true,
 		AccessCode:           accessCode,
 		CreatedAt:            time.Now().Format("2006-01-02 15:04:05"),
 	}
@@ -306,6 +318,155 @@ func requestAllowedContainers(r *http.Request) (subUserAccess, bool) {
 	return subUserAllowedContainers(r)
 }
 
+func subUserFromRequest(r *http.Request) *config.SubUser {
+	username := ""
+	if ctx, ok := authContextFromRequest(r); ok && ctx.Type == authTypeSubUser {
+		username = ctx.Username
+	}
+	if username == "" {
+		if claims, ok := claimsFromRequest(r); ok {
+			username, _ = claims["sub_user"].(string)
+		}
+	}
+	if username == "" {
+		return nil
+	}
+	for i := range config.AppConfig.SubUsers {
+		if config.AppConfig.SubUsers[i].Username == username {
+			return &config.AppConfig.SubUsers[i]
+		}
+	}
+	return nil
+}
+
+func normalizeAllowedImageIDs(ids []string) ([]string, error) {
+	seen := map[string]bool{}
+	result := make([]string, 0, len(ids))
+	for _, id := range ids {
+		id = strings.TrimSpace(id)
+		if id == "" || seen[id] {
+			continue
+		}
+		if !imageTemplateExists(id) {
+			return nil, fmt.Errorf("unknown image template: %s", id)
+		}
+		seen[id] = true
+		result = append(result, id)
+	}
+	return result, nil
+}
+
+func isTemplateAllowedForRequest(r *http.Request, c *config.Container, templateID string) bool {
+	if !isSubUserRequest(r) {
+		return true
+	}
+	return isImageAllowedForSubUser(subUserFromRequest(r), c, templateID)
+}
+
+func isImageAllowedForSubUser(su *config.SubUser, c *config.Container, templateID string) bool {
+	if su == nil || strings.TrimSpace(templateID) == "" {
+		return false
+	}
+	for _, id := range effectiveSubUserAllowedImageIDs(su) {
+		if id == templateID {
+			return true
+		}
+	}
+	return false
+}
+
+func effectiveContainerAllowedImageIDs(c *config.Container) []string {
+	if c == nil {
+		return nil
+	}
+	if c.ImageLimitConfigured || len(c.AllowedImageIDs) > 0 {
+		return cleanImageIDList(c.AllowedImageIDs)
+	}
+	if c.Template != "" {
+		return []string{c.Template}
+	}
+	return nil
+}
+
+func effectiveSubUserAllowedImageIDs(su *config.SubUser) []string {
+	if su == nil {
+		return nil
+	}
+	if su.ImageLimitConfigured || len(su.AllowedImageIDs) > 0 {
+		return cleanImageIDList(su.AllowedImageIDs)
+	}
+	result := []string{}
+	seen := map[string]bool{}
+	for _, c := range subUserAssignedContainers(su) {
+		for _, id := range effectiveContainerAllowedImageIDs(c) {
+			if id != "" && !seen[id] {
+				seen[id] = true
+				result = append(result, id)
+			}
+		}
+	}
+	return result
+}
+
+func cleanImageIDList(ids []string) []string {
+	result := make([]string, 0, len(ids))
+	seen := map[string]bool{}
+	for _, id := range ids {
+		id = strings.TrimSpace(id)
+		if id == "" || seen[id] {
+			continue
+		}
+		seen[id] = true
+		result = append(result, id)
+	}
+	return result
+}
+
+func subUserCurrentImageIDs(su *config.SubUser) []string {
+	seen := map[string]bool{}
+	result := []string{}
+	for _, c := range subUserAssignedContainers(su) {
+		if c.Template != "" && !seen[c.Template] {
+			seen[c.Template] = true
+			result = append(result, c.Template)
+		}
+	}
+	return result
+}
+
+func subUserAssignedContainers(su *config.SubUser) []*config.Container {
+	if su == nil {
+		return nil
+	}
+	result := []*config.Container{}
+	seen := map[string]bool{}
+	for _, uuid := range su.ContainerUUIDs {
+		if c := config.FindContainerByUUID(uuid); c != nil {
+			key := c.UUID
+			if key == "" {
+				key = c.Name
+			}
+			if !seen[key] {
+				seen[key] = true
+				result = append(result, c)
+			}
+		}
+	}
+	for _, name := range su.ContainerNames {
+		if c := config.FindContainerByName(name); c != nil {
+			key := c.UUID
+			if key == "" {
+				key = c.Name
+			}
+			if !seen[key] {
+				seen[key] = true
+				result = append(result, c)
+			}
+		}
+	}
+	return result
+}
+
 func isAccessRestrictedRequest(r *http.Request) bool {
 	_, restricted := requestAllowedContainers(r)
 	return restricted
@@ -485,7 +646,7 @@ func isSubUserBlockedAction(action string, method string) bool {
 		return method != http.MethodGet
 	}
 	switch action {
-	case "usage", "traffic":
+	case "usage", "traffic", "history":
 		return method != http.MethodGet
 	default:
 		return true
@@ -504,7 +665,7 @@ func isSubUserContainerActionAllowed(action string, method string) bool {
 		return method == http.MethodGet
 	}
 	switch {
-	case action == "usage" || action == "traffic" || action == "random-port":
+	case action == "usage" || action == "traffic" || action == "history" || action == "random-port":
 		return method == http.MethodGet
 	case action == "snapshots":
 		return method == http.MethodGet || method == http.MethodPost
@@ -584,6 +745,9 @@ type SubUserListItem struct {
 	Username             string   `json:"username"`
 	ContainerNames       []string `json:"container_names"`
 	ContainerUUIDs       []string `json:"container_uuids"`
+	AllowedImageIDs      []string `json:"allowed_image_ids"`
+	ImageLimitConfigured bool     `json:"image_limit_configured"`
+	CurrentImageIDs      []string `json:"current_image_ids"`
 	ContainerName        string   `json:"container_name"`
 	ContainerUUID        string   `json:"container_uuid"`
 	AccessCode           string   `json:"access_code"`
@@ -611,6 +775,9 @@ func HandleSubUserList(w http.ResponseWriter, r *http.Request) {
 			Username:             su.Username,
 			ContainerNames:       su.ContainerNames,
 			ContainerUUIDs:       su.ContainerUUIDs,
+			AllowedImageIDs:      effectiveSubUserAllowedImageIDs(&su),
+			ImageLimitConfigured: su.ImageLimitConfigured,
+			CurrentImageIDs:      subUserCurrentImageIDs(&su),
 			AccessCode:           su.AccessCode,
 			Password:             su.Password,
 			CreatedAt:            su.CreatedAt,
@@ -711,6 +878,28 @@ func HandleSubUserAction(w http.ResponseWriter, r *http.Request) {
 		logs := filterSubUserLoginLogs(target.Username)
 		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: logs})
 
+	case action == "images" && r.Method == http.MethodPut:
+		if !requireScope(w, r, "subuser:update") {
+			return
+		}
+		var req struct {
+			AllowedImageIDs []string `json:"allowed_image_ids"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: "Invalid request body"})
+			return
+		}
+		ids, err := normalizeAllowedImageIDs(req.AllowedImageIDs)
+		if err != nil {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: err.Error()})
+			return
+		}
+		target.AllowedImageIDs = ids
+		target.ImageLimitConfigured = true
+		target.TokenVersion++
+		config.SaveConfig()
+		jsonResponse(w, http.StatusOK, APIResponse{Success: true, Data: newSubUserResponse(*target, target.Password)})
+
 	default:
 		jsonResponse(w, http.StatusNotFound, APIResponse{Success: false, Message: "Action not found"})
 	}

backend/internal/api/taskqueue.go

@@ -30,6 +30,8 @@ type Task struct {
 	ContainerName string              `json:"container_name"`
 	Status        string              `json:"status"`
 	Error         string              `json:"error,omitempty"`
+	Stage         string              `json:"stage,omitempty"`
+	StageDetail   string              `json:"stage_detail,omitempty"`
 	CreatedAt     string              `json:"created_at"`
 	TemplateID    string              `json:"template_id,omitempty"`
 	Config        lxc.ContainerConfig `json:"config,omitempty"`
@@ -37,6 +39,7 @@ type Task struct {
 	User          string              `json:"user,omitempty"` // who created this task
 	IP            string              `json:"ip,omitempty"`
 	UserAgent     string              `json:"user_agent,omitempty"`
+	activeKey     string
 }
 
 type TaskQueue struct {
@@ -47,20 +50,63 @@ type TaskQueue struct {
 	nextID         int
 	createCond     *sync.Cond
 	opCond         *sync.Cond
+	maxConcurrency int
+	activeTasks    int
+	activeTargets  map[string]bool
 	stop           chan struct{}
 }
 
+type TaskQueueSettings struct {
+	Concurrency int `json:"concurrency"`
+	Active      int `json:"active"`
+	Pending     int `json:"pending"`
+}
+
 var globalQueue *TaskQueue
 
 func init() {
-	globalQueue = &TaskQueue{
+	globalQueue = newTaskQueue(config.DefaultTaskConcurrency)
+	go globalQueue.createDispatcher()
+	go globalQueue.opDispatcher()
+}
+
+func newTaskQueue(concurrency int) *TaskQueue {
+	q := &TaskQueue{
 		tasks:          make(map[string]*Task),
+		maxConcurrency: config.NormalizeTaskConcurrency(concurrency),
+		activeTargets:  make(map[string]bool),
 		stop:           make(chan struct{}),
 	}
-	globalQueue.createCond = sync.NewCond(&globalQueue.mu)
-	globalQueue.opCond = sync.NewCond(&globalQueue.mu)
-	go globalQueue.createWorker()
-	go globalQueue.opWorker()
+	q.createCond = sync.NewCond(&q.mu)
+	q.opCond = sync.NewCond(&q.mu)
+	return q
+}
+
+func ConfigureTaskQueue(concurrency int) {
+	globalQueue.SetConcurrency(concurrency)
+}
+
+func (q *TaskQueue) SetConcurrency(concurrency int) {
+	q.mu.Lock()
+	q.maxConcurrency = config.NormalizeTaskConcurrency(concurrency)
+	q.createCond.Broadcast()
+	q.opCond.Broadcast()
+	q.mu.Unlock()
+}
+
+func (q *TaskQueue) Settings() TaskQueueSettings {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	return TaskQueueSettings{
+		Concurrency: q.maxConcurrency,
+		Active:      q.activeTasks,
+		Pending:     len(q.createQueue) + len(q.opQueue),
+	}
+}
+
+func (q *TaskQueue) signalDispatchers() {
+	q.createCond.Broadcast()
+	q.opCond.Broadcast()
 }
 
 func (q *TaskQueue) enqueueTask(task *Task) {
@@ -90,6 +136,8 @@ func (q *TaskQueue) EnqueueWithAudit(containerID int, containerName string, task
 		ContainerID:   containerID,
 		ContainerName: containerName,
 		Status:        "pending",
+		Stage:         "queued",
+		StageDetail:   "排队等待",
 		CreatedAt:     time.Now().Format("2006-01-02 15:04:05"),
 		TemplateID:    templateID,
 		User:          user,
@@ -172,6 +220,8 @@ func (q *TaskQueue) enqueueBatchCreateList(configs []lxc.ContainerConfig, user s
 			ContainerID:   0,
 			ContainerName: cfgCopy.Name,
 			Status:        "pending",
+			Stage:         "queued",
+			StageDetail:   "排队等待",
 			CreatedAt:     time.Now().Format("2006-01-02 15:04:05"),
 			Config:        cfgCopy,
 			User:          user,
@@ -202,6 +252,8 @@ func (q *TaskQueue) enqueueSingleWithAudit(containerID int, containerName string
 		ContainerID:   containerID,
 		ContainerName: containerName,
 		Status:        "pending",
+		Stage:         "queued",
+		StageDetail:   "排队等待",
 		CreatedAt:     time.Now().Format("2006-01-02 15:04:05"),
 		TemplateID:    templateID,
 		User:          user,
@@ -262,103 +314,184 @@ func (q *TaskQueue) CancelPendingSecurityStops() int {
 	return cancelled
 }
 
-// createWorker handles TaskCreate: lxc-create, resource setup, start, and SSH init.
-// If a restored task already has a same-name container in config, it resumes
-// initialization instead of creating another ct-{id}.
-func (q *TaskQueue) createWorker() {
+// The two dispatchers keep long-running creates from blocking power operations,
+// while sharing one global concurrency budget.
+func (q *TaskQueue) createDispatcher() {
 	for {
-		q.mu.Lock()
-		for len(q.createQueue) == 0 {
-			q.createCond.Wait()
+		task := q.takeNextTask(true)
+		go q.runCreateTask(task)
 	}
-		task := q.createQueue[0]
-		q.createQueue = q.createQueue[1:]
-		task.Status = "running"
-		q.mu.Unlock()
+}
 
+func (q *TaskQueue) opDispatcher() {
+	for {
+		task := q.takeNextTask(false)
+		go q.runOperationTask(task)
+	}
+}
+
+func (q *TaskQueue) takeNextTask(create bool) *Task {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	cond := q.opCond
+	if create {
+		cond = q.createCond
+	}
+	for {
+		queue := q.opQueue
+		if create {
+			queue = q.createQueue
+		}
+		if q.activeTasks < q.maxConcurrency {
+			if index := runnableTaskIndex(queue, q.activeTargets); index >= 0 {
+				task := queue[index]
+				queue = append(queue[:index], queue[index+1:]...)
+				if create {
+					q.createQueue = queue
+				} else {
+					q.opQueue = queue
+				}
+				task.Status = "running"
+				task.Error = ""
+				task.Stage = "preparing"
+				task.StageDetail = "准备初始化环境"
+				task.activeKey = taskConcurrencyKey(task)
+				q.activeTargets[task.activeKey] = true
+				q.activeTasks++
+				q.persistTasks()
+				return task
+			}
+		}
+		cond.Wait()
+	}
+}
+
+func runnableTaskIndex(queue []*Task, activeTargets map[string]bool) int {
+	for index, task := range queue {
+		if !activeTargets[taskConcurrencyKey(task)] {
+			return index
+		}
+	}
+	return -1
+}
+
+func taskConcurrencyKey(task *Task) string {
+	if task == nil {
+		return "task:nil"
+	}
+	name := strings.TrimSpace(task.ContainerName)
+	if name == "" {
+		name = strings.TrimSpace(task.Config.Name)
+	}
+	if name != "" {
+		return "name:" + strings.ToLower(name)
+	}
+	if task.ContainerID > 0 {
+		return fmt.Sprintf("id:%d", task.ContainerID)
+	}
+	return "task:" + task.ID
+}
+
+func (q *TaskQueue) finishTask(task *Task, status string, taskErr error) {
+	q.mu.Lock()
+	task.Status = status
+	if taskErr != nil {
+		task.Error = taskErr.Error()
+		if task.Type == TaskCreate {
+			task.Stage = "failed"
+			task.StageDetail = "初始化失败"
+		}
+	} else {
+		task.Error = ""
+		if task.Type == TaskCreate {
+			task.Stage = "completed"
+			task.StageDetail = "初始化完成"
+		}
+	}
+	if task.activeKey != "" {
+		delete(q.activeTargets, task.activeKey)
+		task.activeKey = ""
+	}
+	if q.activeTasks > 0 {
+		q.activeTasks--
+	}
+	q.persistTasks()
+	q.signalDispatchers()
+	q.mu.Unlock()
+}
+
+func (q *TaskQueue) updateTaskStage(task *Task, stage, detail string) {
+	q.mu.Lock()
+	task.Stage = stage
+	task.StageDetail = detail
+	q.mu.Unlock()
+}
+
+// runCreateTask handles lxc-create, resource setup, start, and SSH init. A
+// restored task resumes initialization when the same-name container exists.
+func (q *TaskQueue) runCreateTask(task *Task) {
+	q.mu.Lock()
 	createdByTask := false
 	if task.Config.Name == "" {
 		task.Config.Name = task.ContainerName
 	}
 	task.Config.NormalizeResourceAliases()
-		if task.Config.Name == "" {
-			task.Status = "failed"
-			task.Error = "container name is required"
-			config.AddAuditLog(string(task.Type), task.ContainerName, "failed: "+task.Error, "admin")
-			q.mu.Lock()
-			q.persistTasks()
+	cfg := task.Config
 	q.mu.Unlock()
-			continue
+	cfg.Progress = func(stage, detail string) {
+		q.updateTaskStage(task, stage, detail)
 	}
-		c := config.FindContainerByName(task.Config.Name)
+	if cfg.Name == "" {
+		err := fmt.Errorf("container name is required")
+		config.AddAuditLog(string(task.Type), task.ContainerName, "failed: "+err.Error(), "admin")
+		q.finishTask(task, "failed", err)
+		return
+	}
+	c := config.FindContainerByName(cfg.Name)
 	if c == nil {
-			// 1) Download image + apply limits (lxc-create)
-			err := createByRuntime(task.Config)
-			if err != nil {
-				task.Status = "failed"
-				task.Error = err.Error()
-				config.AddAuditLog(string(task.Type), task.Config.Name, "失败: "+err.Error(), "admin")
-				q.mu.Lock()
-				q.persistTasks()
-				q.mu.Unlock()
-				continue
+		if err := createByRuntime(cfg); err != nil {
+			config.AddAuditLog(string(task.Type), cfg.Name, "失败: "+err.Error(), "admin")
+			q.finishTask(task, "failed", err)
+			return
 		}
 		createdByTask = true
-
-			// 2) Find created container by name
-			c = config.FindContainerByName(task.Config.Name)
+		c = config.FindContainerByName(cfg.Name)
 		if c == nil {
-				task.Status = "failed"
-				task.Error = "created but not found in config"
-				config.AddAuditLog(string(task.Type), task.Config.Name, "失败: "+task.Error, "admin")
-				q.mu.Lock()
-				q.persistTasks()
-				q.mu.Unlock()
-				continue
+			err := fmt.Errorf("created but not found in config")
+			config.AddAuditLog(string(task.Type), task.Config.Name, "失败: "+err.Error(), "admin")
+			q.finishTask(task, "failed", err)
+			return
 		}
+	} else {
+		lxc.ReleaseQueuedCreateNATPorts(cfg.Name)
 	}
 
+	q.mu.Lock()
 	task.ContainerID = c.ID
 	task.ContainerName = c.Name
-
-		// 3) Start + initialize SSH/network in the same worker.
-		//    If init fails, destroy the container so no dead entry remains.
-		startErr := startByRuntime(c.ID)
-		if startErr != nil {
+	q.mu.Unlock()
+	startDetail := "启动容器并等待网络就绪"
+	if strings.EqualFold(cfg.Virtualization, config.VirtualizationKVM) {
+		startDetail = "启动虚拟机并等待网络就绪"
+	}
+	q.updateTaskStage(task, "starting", startDetail)
+	if err := startByRuntime(c.ID); err != nil {
 		if createdByTask {
 			_ = destroyByRuntime(c.ID)
 		}
-			task.Status = "failed"
-			task.Error = startErr.Error()
-			config.AddAuditLog(string(task.Type), task.ContainerName, "初始化失败: "+startErr.Error(), "admin")
-		} else {
-			task.Status = "done"
+		config.AddAuditLog(string(task.Type), task.ContainerName, "初始化失败: "+err.Error(), "admin")
+		q.finishTask(task, "failed", err)
+		return
+	}
 	config.AddAuditLog(string(task.Type), task.ContainerName, "成功", "admin")
-		}
-
-		q.mu.Lock()
-		q.persistTasks()
-		q.mu.Unlock()
-	}
+	q.finishTask(task, "done", nil)
 }
 
-// opWorker handles all non-create tasks (start, stop, restart, delete, reinstall)
-// including the follow-up initialization after a create succeeds.
-func (q *TaskQueue) opWorker() {
-	for {
+func (q *TaskQueue) runOperationTask(task *Task) {
 	q.mu.Lock()
-		for len(q.opQueue) == 0 {
-			q.opCond.Wait()
-		}
-		task := q.opQueue[0]
-		q.opQueue = q.opQueue[1:]
-		task.Status = "running"
+	err := resolveTaskContainer(task)
 	q.mu.Unlock()
-
-		var err error
 	skipped := false
-		err = resolveTaskContainer(task)
-		// Block operations on expired or traffic-exceeded containers (except stop/delete)
 	if err == nil && (task.Type == TaskStart || task.Type == TaskRestart || task.Type == TaskReinstall) {
 		c := config.FindContainer(task.ContainerID)
 		if c != nil {
@@ -372,8 +505,7 @@ func (q *TaskQueue) opWorker() {
 	if err == nil && isSecurityStopTask(task) && !config.AppConfig.SecurityAutoShutdown {
 		skipped = true
 	}
-		if err == nil {
-			if !skipped {
+	if err == nil && !skipped {
 		switch task.Type {
 		case TaskStart:
 			err = startByRuntime(task.ContainerID)
@@ -384,7 +516,7 @@ func (q *TaskQueue) opWorker() {
 		case TaskDelete:
 			err = destroyByRuntime(task.ContainerID)
 			if err == nil {
-						time.Sleep(1 * time.Second)
+				time.Sleep(time.Second)
 				if config.FindContainer(task.ContainerID) != nil {
 					err = fmt.Errorf("container still exists after delete: %d", task.ContainerID)
 				}
@@ -397,22 +529,22 @@ func (q *TaskQueue) opWorker() {
 			}
 		}
 	}
-		}
 
-		q.mu.Lock()
 	auditUser := task.User
 	if auditUser == "" {
 		auditUser = "admin"
 	}
 	if err != nil {
-			task.Status = "failed"
-			task.Error = err.Error()
 		config.AddAuditLogFull(string(task.Type), task.ContainerName, "失败: "+err.Error(), auditUser, task.IP, task.UserAgent, false, err.Error())
-		} else if skipped {
-			task.Status = "done"
+		q.finishTask(task, "failed", err)
+		return
+	}
+	if skipped {
 		config.AddAuditLogFull(string(task.Type), task.ContainerName, "跳过: 安全告警自动关机已关闭", auditUser, task.IP, task.UserAgent, true, "")
-		} else {
-			task.Status = "done"
+		q.finishTask(task, "done", nil)
+		return
+	}
+
 	config.AddAuditLogFull(string(task.Type), task.ContainerName, "成功", auditUser, task.IP, task.UserAgent, true, "")
 	switch task.Type {
 	case TaskStart:
@@ -426,10 +558,7 @@ func (q *TaskQueue) opWorker() {
 	case TaskReinstall:
 		clearPolicyBlockAfterAdminRecovery(task)
 	}
-		}
-		q.persistTasks()
-		q.mu.Unlock()
-	}
+	q.finishTask(task, "done", nil)
 }
 
 func isSecurityStopTask(task *Task) bool {
@@ -503,7 +632,8 @@ func (q *TaskQueue) GetTasks() []*Task {
 	result := make([]*Task, 0, len(q.tasks))
 	// Collect all task IDs, sort by creation time (extracted from ID number)
 	for _, t := range q.tasks {
-		result = append(result, t)
+		copyTask := *t
+		result = append(result, &copyTask)
 	}
 	// Stable sort by ID number (task-N where N is sequential)
 	for i := 0; i < len(result); i++ {
@@ -560,7 +690,11 @@ func HandleSingleTaskAction(w http.ResponseWriter, r *http.Request, id int, acti
 		if c := config.FindContainer(id); c != nil {
 			runtime = c.Runtime()
 		}
-		if !isImageEnabledAndDownloaded(templateID, runtime) {
+		if !isTemplateAllowedForRequest(r, c, templateID) {
+			jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Template is not allowed for this user"})
+			return
+		}
+		if !isTemplateAvailableForRequest(r, c, templateID, runtime) {
 			jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Template is not enabled or downloaded"})
 			return
 		}
@@ -618,6 +752,7 @@ func HandleBatchCreate(w http.ResponseWriter, r *http.Request) {
 
 	activeCreateNames := globalQueue.ActiveCreateNames()
 	requestNames := make(map[string]bool)
+	requestNATPorts := make(map[string]string)
 	for i := range req.Containers {
 		name := strings.TrimSpace(req.Containers[i].Name)
 		req.Containers[i].Name = name
@@ -646,25 +781,57 @@ func HandleBatchCreate(w http.ResponseWriter, r *http.Request) {
 		}
 		req.Containers[i].NormalizeResourceAliases()
 		req.Containers[i].Virtualization = runtimeFromRequest(req.Containers[i].Virtualization)
+		if req.Containers[i].WantsLANIPv4() && req.Containers[i].Virtualization != config.VirtualizationLXC {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: name + ": LAN IPv4 is only supported for LXC containers"})
+			return
+		}
 		if req.Containers[i].RAMMB < 128 {
 			req.Containers[i].RAMMB = 512
 		}
 		if req.Containers[i].DiskGB < 1 {
 			req.Containers[i].DiskGB = 5
 		}
+		if err := validateCreateStoragePool(&req.Containers[i]); err != nil {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: name + ": " + err.Error()})
+			return
+		}
 		if !isImageEnabledAndDownloaded(req.Containers[i].TemplateID, req.Containers[i].Virtualization) {
 			jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: name + ": template is not enabled or downloaded"})
 			return
 		}
+		if ids, err := normalizeAllowedImageIDs(req.Containers[i].AllowedImageIDs); err != nil {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: name + ": " + err.Error()})
+			return
+		} else {
+			req.Containers[i].AllowedImageIDs = ids
+		}
 		if req.Containers[i].PortMappingCount < 0 {
 			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: name + ": port mapping count cannot be negative"})
 			return
 		}
-		if req.Containers[i].WantsNAT() && req.Containers[i].PortMappingCount < 2 {
-			req.Containers[i].PortMappingCount = 2
-		} else if !req.Containers[i].WantsNAT() {
-			req.Containers[i].PortMappingCount = 0
-			req.Containers[i].ExtraPorts = nil
+		if err := req.Containers[i].NormalizeCreateNATMappings(); err != nil {
+			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: name + ": " + err.Error()})
+			return
+		}
+		if err := lxc.ValidateCreateNATPortAvailability(req.Containers[i]); err != nil {
+			jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: name + ": " + err.Error()})
+			return
+		}
+		if req.Containers[i].ManagementPort > 0 {
+			key := fmt.Sprintf("%d/tcp", req.Containers[i].ManagementPort)
+			if owner := requestNATPorts[key]; owner != "" {
+				jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: fmt.Sprintf("%s: NAT management port %s is also requested by %s", name, key, owner)})
+				return
+			}
+			requestNATPorts[key] = name
+		}
+		for _, mapping := range req.Containers[i].NATPortMappings {
+			key := fmt.Sprintf("%d/%s", mapping.HostPort, mapping.Protocol)
+			if owner := requestNATPorts[key]; owner != "" {
+				jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: fmt.Sprintf("%s: NAT host port %s is also requested by %s", name, key, owner)})
+				return
+			}
+			requestNATPorts[key] = name
 		}
 		if req.Containers[i].PortMappingCount > 64 {
 			jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: name + ": port mapping count cannot exceed 64"})
@@ -701,7 +868,12 @@ func HandleBatchCreate(w http.ResponseWriter, r *http.Request) {
 		}
 		requestNames[name] = true
 	}
-	ids := globalQueue.EnqueueBatchCreateWithAudit(req.Containers, requestActor(r), clientIP(r), r.UserAgent())
+	planned, err := lxc.ReserveBatchCreateNATPorts(req.Containers)
+	if err != nil {
+		jsonResponse(w, http.StatusConflict, APIResponse{Success: false, Message: err.Error()})
+		return
+	}
+	ids := globalQueue.EnqueueBatchCreateWithAudit(planned, requestActor(r), clientIP(r), r.UserAgent())
 	jsonResponse(w, http.StatusAccepted, APIResponse{Success: true, Data: ids})
 }
 
@@ -777,6 +949,10 @@ func HandleBatchAction(w http.ResponseWriter, r *http.Request) {
 			jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Access denied to one or more containers"})
 			return
 		}
+		if taskType == TaskReinstall && !isTemplateAllowedForRequest(r, c, req.TemplateID) {
+			jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: c.Name + ": template is not allowed for this user"})
+			return
+		}
 		if taskConfig != nil {
 			if err := validateReinstallSSHAuth(c, req.TemplateID, *taskConfig); err != nil {
 				jsonResponse(w, http.StatusBadRequest, APIResponse{Success: false, Message: c.Name + ": " + err.Error()})
@@ -819,7 +995,8 @@ func HandleTaskDelete(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	globalQueue.mu.Lock()
-	if task := globalQueue.tasks[taskID]; task != nil && !isTaskAllowedForRequest(r, task) {
+	task := globalQueue.tasks[taskID]
+	if task != nil && !isTaskAllowedForRequest(r, task) {
 		globalQueue.mu.Unlock()
 		jsonResponse(w, http.StatusForbidden, APIResponse{Success: false, Message: "Access denied to this task"})
 		return
@@ -842,6 +1019,9 @@ func HandleTaskDelete(w http.ResponseWriter, r *http.Request) {
 	globalQueue.opQueue = newOp
 	globalQueue.persistTasks()
 	globalQueue.mu.Unlock()
+	if task != nil && task.Type == TaskCreate {
+		lxc.ReleaseQueuedCreateNATPorts(task.Config.Name)
+	}
 	jsonResponse(w, http.StatusOK, APIResponse{Success: true, Message: "Task deleted"})
 }
 
@@ -861,6 +1041,8 @@ func HandleTasks(w http.ResponseWriter, r *http.Request) {
 
 // RestoreTasks restores task queue from config
 func RestoreTasks() {
+	globalQueue.mu.Lock()
+	defer globalQueue.mu.Unlock()
 	for _, st := range config.AppConfig.Tasks {
 		if st.Type == string(TaskStop) && st.User == "system:security" && !config.AppConfig.SecurityAutoShutdown {
 			continue
@@ -890,6 +1072,8 @@ func RestoreTasks() {
 			ContainerName: containerName,
 			Status:        st.Status,
 			Error:         st.Error,
+			Stage:         "queued",
+			StageDetail:   "排队等待",
 			CreatedAt:     st.CreatedAt,
 			TemplateID:    st.TemplateID,
 			Config:        cfg,
@@ -919,3 +1103,17 @@ func parseIDNum(id string) int {
 	}
 	return num
 }
+
+func validateCreateStoragePool(cfg *lxc.ContainerConfig) error {
+	required := config.StorageContentLXC
+	if cfg.Virtualization == config.VirtualizationKVM {
+		required = config.StorageContentKVM
+	}
+	requiredBytes := int64(cfg.DiskGB) * 1024 * 1024 * 1024
+	pool, err := config.SelectStoragePoolForContent(required, cfg.StoragePoolID, requiredBytes)
+	if err != nil {
+		return err
+	}
+	cfg.StoragePoolID = pool.ID
+	return nil
+}

backend/internal/api/taskqueue_test.go

@@ -0,0 +1,56 @@
+package api
+
+import (
+	"testing"
+
+	"clicd/internal/config"
+	"clicd/internal/lxc"
+)
+
+func TestRunnableTaskIndexSkipsActiveContainer(t *testing.T) {
+	queue := []*Task{
+		{ID: "task-1", Type: TaskStop, ContainerID: 1, ContainerName: "alpha"},
+		{ID: "task-2", Type: TaskStart, ContainerID: 1, ContainerName: "alpha"},
+		{ID: "task-3", Type: TaskStart, ContainerID: 2, ContainerName: "beta"},
+	}
+	active := map[string]bool{taskConcurrencyKey(queue[0]): true}
+
+	if got := runnableTaskIndex(queue[1:], active); got != 1 {
+		t.Fatalf("runnableTaskIndex() = %d, want 1 for the other container", got)
+	}
+}
+
+func TestTaskConcurrencyKeyUsesContainerName(t *testing.T) {
+	create := &Task{ID: "task-1", Type: TaskCreate, Config: lxcConfigWithName("Example")}
+	operation := &Task{ID: "task-2", Type: TaskDelete, ContainerID: 9, ContainerName: "example"}
+	if taskConcurrencyKey(create) != taskConcurrencyKey(operation) {
+		t.Fatalf("same container received different concurrency keys: %q and %q", taskConcurrencyKey(create), taskConcurrencyKey(operation))
+	}
+}
+
+func TestTaskQueueSetConcurrencyNormalizesAndReports(t *testing.T) {
+	q := newTaskQueue(config.DefaultTaskConcurrency)
+	q.SetConcurrency(config.MaxTaskConcurrency + 10)
+	if got := q.Settings().Concurrency; got != config.MaxTaskConcurrency {
+		t.Fatalf("concurrency = %d, want %d", got, config.MaxTaskConcurrency)
+	}
+	q.SetConcurrency(0)
+	if got := q.Settings().Concurrency; got != config.DefaultTaskConcurrency {
+		t.Fatalf("concurrency = %d, want default %d", got, config.DefaultTaskConcurrency)
+	}
+}
+
+func TestTaskQueueUpdateTaskStage(t *testing.T) {
+	q := newTaskQueue(config.DefaultTaskConcurrency)
+	task := &Task{ID: "task-1", Type: TaskCreate, Status: "running"}
+
+	q.updateTaskStage(task, "rootfs", "下载模板并创建基础文件系统")
+
+	if task.Stage != "rootfs" || task.StageDetail != "下载模板并创建基础文件系统" {
+		t.Fatalf("unexpected task stage: %q %q", task.Stage, task.StageDetail)
+	}
+}
+
+func lxcConfigWithName(name string) lxc.ContainerConfig {
+	return lxc.ContainerConfig{Name: name}
+}

backend/internal/cli/access_policy.go

@@ -0,0 +1,86 @@
+package cli
+
+import (
+	"flag"
+	"fmt"
+	"strings"
+
+	"clicd/internal/config"
+)
+
+// RunAccessPolicyCommand manages the panel source policy without requiring the
+// interactive menu. It is intended to remain usable over SSH as a recovery path.
+func RunAccessPolicyCommand(args []string) error {
+	action := "show"
+	if len(args) > 0 {
+		action = strings.ToLower(strings.TrimSpace(args[0]))
+		args = args[1:]
+	}
+
+	switch action {
+	case "show":
+		printPanelAccessPolicy(config.AppConfig.PanelAccessPolicy)
+		return nil
+	case "disable", "off":
+		next := config.AppConfig.PanelAccessPolicy
+		next.Enabled = false
+		if err := savePanelAccessPolicy(next); err != nil {
+			return err
+		}
+		fmt.Println("Panel access allowlist disabled.")
+		return reloadPanelAfterAccessPolicyCommand()
+	case "set", "enable":
+		flags := flag.NewFlagSet("clicd access-policy set", flag.ContinueOnError)
+		flags.SetOutput(new(strings.Builder))
+		var allowed string
+		var trusted string
+		flags.StringVar(&allowed, "allow", "", "comma-separated allowed IP/CIDR values")
+		flags.StringVar(&trusted, "trusted-proxy", "", "comma-separated trusted proxy IP/CIDR values")
+		if err := flags.Parse(args); err != nil {
+			return fmt.Errorf("invalid access-policy arguments: %w", err)
+		}
+		next := config.PanelAccessPolicy{
+			Enabled:        true,
+			AllowedSources: splitPanelAccessEntries(allowed),
+			TrustedProxies: splitPanelAccessEntries(trusted),
+		}
+		if err := savePanelAccessPolicy(next); err != nil {
+			return err
+		}
+		fmt.Println("Panel access allowlist saved.")
+		printPanelAccessPolicy(config.AppConfig.PanelAccessPolicy)
+		return reloadPanelAfterAccessPolicyCommand()
+	default:
+		return fmt.Errorf("unknown access-policy action %q; use show, set, or disable", action)
+	}
+}
+
+func savePanelAccessPolicy(policy config.PanelAccessPolicy) error {
+	normalized, err := config.NormalizePanelAccessPolicy(policy)
+	if err != nil {
+		return err
+	}
+	previous := config.AppConfig.PanelAccessPolicy
+	config.AppConfig.PanelAccessPolicy = normalized
+	if err := config.SaveConfig(); err != nil {
+		config.AppConfig.PanelAccessPolicy = previous
+		return fmt.Errorf("save panel access policy: %w", err)
+	}
+	return nil
+}
+
+func reloadPanelAfterAccessPolicyCommand() error {
+	if !isWebPanelRunning() {
+		return nil
+	}
+	if err := restartService("clicd"); err != nil {
+		return fmt.Errorf("policy was saved but clicd service restart failed: %w", err)
+	}
+	return nil
+}
+
+func printPanelAccessPolicy(policy config.PanelAccessPolicy) {
+	fmt.Printf("Enabled: %t\n", policy.Enabled)
+	fmt.Printf("Allowed sources: %s\n", strings.Join(policy.AllowedSources, ", "))
+	fmt.Printf("Trusted proxies: %s\n", strings.Join(policy.TrustedProxies, ", "))
+}

backend/internal/cli/cli.go

@@ -9,6 +9,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"runtime"
 	"sort"
 	"strconv"
 	"strings"
@@ -53,6 +54,7 @@ var cliTranslations = map[string]string{
 	"导入现有 LXC 容器":       "Import existing LXC containers",
 	"检查并升级 CLICD":       "Check and upgrade CLICD",
 	"卸载 CLICD":          "Uninstall CLICD",
+	"面板访问白名单":           "Panel access allowlist",
 	"系统信息":              "System info",
 	"退出":                "Exit",
 	"获取容器列表失败":          "Failed to get container list",
@@ -127,7 +129,9 @@ var cliTranslations = map[string]string{
 	"GitHub Release 没有 tag_name，无法判断最新版本。": "GitHub Release has no tag_name, so the latest version cannot be determined.",
 	"最新版本":            "Latest version",
 	"发布页面":            "Release page",
-	"最新 Release 没有找到 clicd-linux-amd64.tar.gz，无法自动升级。": "The latest release does not contain clicd-linux-amd64.tar.gz, so automatic upgrade is unavailable.",
+	"当前架构不支持自动升级":     "Automatic upgrade is not supported on the current architecture",
+	"最新 Release 没有找到": "The latest release does not contain",
+	"无法自动升级。":         "automatic upgrade is unavailable.",
 	"当前已经是最新版本。":      "The current version is already the latest.",
 	"是否仍然重新安装最新版本？输入 reinstall 继续":          "Reinstall the latest version anyway? Type reinstall to continue",
 	"输入 upgrade 开始升级":                       "Type upgrade to start upgrade",
@@ -172,6 +176,22 @@ var cliTranslations = map[string]string{
 	"LXC 版本":            "LXC version",
 	"暂无可用容器":            "No available containers",
 	"忽略无效端口":            "Ignoring invalid port",
+	"面板访问来源策略":          "Panel access source policy",
+	"当前状态":              "Current status",
+	"已启用":               "enabled",
+	"已关闭":               "disabled",
+	"允许来源":              "Allowed sources",
+	"可信代理":              "Trusted proxies",
+	"启用或修改白名单":          "Enable or update allowlist",
+	"关闭白名单限制":           "Disable allowlist",
+	"取消":                "Cancel",
+	"允许的 IP/CIDR，多个用逗号分隔":      "Allowed IP/CIDR values, comma-separated",
+	"可信代理 IP/CIDR，多个用逗号分隔，可留空": "Trusted proxy IP/CIDR values, comma-separated; optional",
+	"白名单配置无效":                  "Invalid allowlist configuration",
+	"保存访问来源策略失败":               "Failed to save access source policy",
+	"面板访问白名单已保存。":              "Panel access allowlist saved.",
+	"面板访问白名单已关闭。":              "Panel access allowlist disabled.",
+	"至少填写一个允许的 IP 或网段。":        "Enter at least one allowed IP address or network.",
 	"？": "? ",
 	"。": ". ",
 	"，": ", ",
@@ -190,7 +210,7 @@ func Run() {
 		refreshCLILanguage()
 		clearScreen()
 		printMenu()
-		cliPrint("\n请选择操作 [1-12,l,0/q]: ")
+		cliPrint("\n请选择操作 [1-13,l,0/q]: ")
 		input, _ := reader.ReadString('\n')
 		input = strings.TrimSpace(input)
 
@@ -243,6 +263,10 @@ func Run() {
 			clearScreen()
 			cliUninstall(reader)
 			return
+		case "13":
+			clearScreen()
+			cliConfigurePanelAccess(reader)
+			waitEnter(reader)
 		case "0":
 			clearScreen()
 			cliShowInfo()
@@ -290,11 +314,80 @@ func printMenu() {
 	cliPrintln("  10. 导入现有 LXC 容器")
 	cliPrintln("  11. 检查并升级 CLICD")
 	cliPrintln("  12. 卸载 CLICD")
+	cliPrintln("  13. 面板访问白名单")
 	cliPrintln("  0. 系统信息")
 	cliPrintln("  l. 切换语言")
 	cliPrintln("  q. 退出")
 }
 
+func cliConfigurePanelAccess(reader *bufio.Reader) {
+	cliPrintf("\n--- %s ---\n", cliT("面板访问来源策略"))
+	policy := config.AppConfig.PanelAccessPolicy
+	status := cliT("已关闭")
+	if policy.Enabled {
+		status = cliT("已启用")
+	}
+	cliPrintf("%s: %s\n", cliT("当前状态"), status)
+	cliPrintf("%s: %s\n", cliT("允许来源"), strings.Join(policy.AllowedSources, ", "))
+	cliPrintf("%s: %s\n", cliT("可信代理"), strings.Join(policy.TrustedProxies, ", "))
+	cliPrintf("\n  1. %s\n", cliT("启用或修改白名单"))
+	cliPrintf("  2. %s\n", cliT("关闭白名单限制"))
+	cliPrintf("  0. %s\n", cliT("取消"))
+
+	choice := promptString(reader, "请选择操作", "0")
+	next := policy
+	switch strings.TrimSpace(choice) {
+	case "1":
+		allowed := promptString(reader, "允许的 IP/CIDR，多个用逗号分隔", strings.Join(policy.AllowedSources, ","))
+		allowedSources := splitPanelAccessEntries(allowed)
+		if len(allowedSources) == 0 {
+			cliPrintln("至少填写一个允许的 IP 或网段。")
+			return
+		}
+		trusted := promptString(reader, "可信代理 IP/CIDR，多个用逗号分隔，可留空", strings.Join(policy.TrustedProxies, ","))
+		next = config.PanelAccessPolicy{
+			Enabled:        true,
+			AllowedSources: allowedSources,
+			TrustedProxies: splitPanelAccessEntries(trusted),
+		}
+	case "2":
+		next.Enabled = false
+	case "0", "":
+		cliPrintln("已取消")
+		return
+	default:
+		cliPrintln("无效选择")
+		return
+	}
+
+	normalized, err := config.NormalizePanelAccessPolicy(next)
+	if err != nil {
+		cliPrintf("%s: %v\n", cliT("白名单配置无效"), err)
+		return
+	}
+	previous := config.AppConfig.PanelAccessPolicy
+	config.AppConfig.PanelAccessPolicy = normalized
+	if err := config.SaveConfig(); err != nil {
+		config.AppConfig.PanelAccessPolicy = previous
+		cliPrintf("%s: %v\n", cliT("保存访问来源策略失败"), err)
+		return
+	}
+	if normalized.Enabled {
+		cliPrintln("面板访问白名单已保存。")
+	} else {
+		cliPrintln("面板访问白名单已关闭。")
+	}
+	if isWebPanelRunning() {
+		restartWebPanelForConfigChange()
+	}
+}
+
+func splitPanelAccessEntries(value string) []string {
+	return strings.FieldsFunc(value, func(r rune) bool {
+		return r == ',' || r == ';' || r == '\n' || r == '\r' || r == '\t' || r == ' '
+	})
+}
+
 func cliSwitchLanguage(reader *bufio.Reader) {
 	cliPrintf("\n--- %s ---\n", cliT("切换语言"))
 	cliPrintf("%s: %s\n", cliT("当前语言"), cliLanguageLabel(config.NormalizeLanguage(config.AppConfig.Language)))
@@ -557,11 +650,16 @@ func cliUpgradeSystem(reader *bufio.Reader) {
 	if repo == "" {
 		repo = version.Repo
 	}
+	assetName, err := releaseArchiveAssetName(runtime.GOARCH)
+	if err != nil {
+		cliPrintf("当前架构不支持自动升级: %s\n", runtime.GOARCH)
+		return
+	}
 	current := version.Current()
 	cliPrintf("当前版本: %s\n", current)
 	cliPrintf("检查仓库: https://github.com/%s\n", repo)
 
-	release, err := fetchLatestRelease(repo)
+	release, err := fetchLatestRelease(repo, assetName)
 	if err != nil {
 		cliPrintf("检查 GitHub 最新版本失败: %v\n", err)
 		return
@@ -576,9 +674,9 @@ func cliUpgradeSystem(reader *bufio.Reader) {
 		cliPrintf("发布页面: %s\n", release.HTMLURL)
 	}
 
-	assetURL := findReleaseAsset(release, "clicd-linux-amd64.tar.gz")
+	assetURL := findReleaseAsset(release, assetName)
 	if assetURL == "" {
-		cliPrintln("最新 Release 没有找到 clicd-linux-amd64.tar.gz，无法自动升级。")
+		cliPrintf("最新 Release 没有找到 %s，无法自动升级。\n", assetName)
 		return
 	}
 
@@ -597,7 +695,7 @@ func cliUpgradeSystem(reader *bufio.Reader) {
 		}
 	}
 
-	if err := upgradeFromReleaseAsset(assetURL, latest); err != nil {
+	if err := upgradeFromReleaseAsset(assetURL, latest, assetName); err != nil {
 		cliPrintf("升级失败: %v\n", err)
 		return
 	}
@@ -605,7 +703,7 @@ func cliUpgradeSystem(reader *bufio.Reader) {
 	cliPrintln("原有数据已保留，Web 服务已重启。")
 }
 
-func fetchLatestRelease(repo string) (*githubRelease, error) {
+func fetchLatestRelease(repo, assetName string) (*githubRelease, error) {
 	url := fmt.Sprintf("https://api.github.com/repos/%s/releases/latest", repo)
 	req, err := http.NewRequest(http.MethodGet, url, nil)
 	if err != nil {
@@ -617,7 +715,7 @@ func fetchLatestRelease(repo string) (*githubRelease, error) {
 	client := &http.Client{Timeout: 20 * time.Second}
 	resp, err := client.Do(req)
 	if err != nil {
-		if fallback, fallbackErr := fetchLatestReleaseFallback(repo); fallbackErr == nil {
+		if fallback, fallbackErr := fetchLatestReleaseFallback(repo, assetName); fallbackErr == nil {
 			return fallback, nil
 		}
 		return nil, err
@@ -627,7 +725,7 @@ func fetchLatestRelease(repo string) (*githubRelease, error) {
 	if resp.StatusCode != http.StatusOK {
 		body, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
 		apiErr := fmt.Errorf("GitHub API 返回 %s: %s", resp.Status, strings.TrimSpace(string(body)))
-		if fallback, fallbackErr := fetchLatestReleaseFallback(repo); fallbackErr == nil {
+		if fallback, fallbackErr := fetchLatestReleaseFallback(repo, assetName); fallbackErr == nil {
 			if resp.StatusCode == http.StatusForbidden || resp.StatusCode == http.StatusTooManyRequests {
 				cliPrintln("GitHub API 被限流，已切换到备用检查方式。")
 			} else {
@@ -645,7 +743,7 @@ func fetchLatestRelease(repo string) (*githubRelease, error) {
 	return &release, nil
 }
 
-func fetchLatestReleaseFallback(repo string) (*githubRelease, error) {
+func fetchLatestReleaseFallback(repo, assetName string) (*githubRelease, error) {
 	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("https://github.com/%s/releases/latest", repo), nil)
 	if err != nil {
 		return nil, err
@@ -667,7 +765,6 @@ func fetchLatestReleaseFallback(repo string) (*githubRelease, error) {
 		return nil, fmt.Errorf("无法从 GitHub releases/latest 跳转结果解析最新版本")
 	}
 
-	const assetName = "clicd-linux-amd64.tar.gz"
 	return &githubRelease{
 		TagName: tag,
 		Name:    tag,
@@ -708,6 +805,15 @@ func setGitHubRequestHeaders(req *http.Request) {
 	}
 }
 
+func releaseArchiveAssetName(goarch string) (string, error) {
+	switch goarch {
+	case "amd64", "arm64":
+		return fmt.Sprintf("clicd-linux-%s.tar.gz", goarch), nil
+	default:
+		return "", fmt.Errorf("unsupported architecture: %s", goarch)
+	}
+}
+
 func findReleaseAsset(release *githubRelease, name string) string {
 	for _, asset := range release.Assets {
 		if asset.Name == name && asset.BrowserDownloadURL != "" {
@@ -717,14 +823,14 @@ func findReleaseAsset(release *githubRelease, name string) string {
 	return ""
 }
 
-func upgradeFromReleaseAsset(assetURL, latest string) error {
+func upgradeFromReleaseAsset(assetURL, latest, assetName string) error {
 	tmpDir, err := os.MkdirTemp("", "clicd-upgrade-*")
 	if err != nil {
 		return err
 	}
 	defer os.RemoveAll(tmpDir)
 
-	archivePath := filepath.Join(tmpDir, "clicd-linux-amd64.tar.gz")
+	archivePath := filepath.Join(tmpDir, assetName)
 	cliPrintln("正在下载升级包...")
 	if err := downloadFile(assetURL, archivePath); err != nil {
 		return err
@@ -1228,8 +1334,8 @@ func removeCLICDNATRules() {
 				break
 			}
 		}
-		deleteNATRule("POSTROUTING", "-s", "10.0.3.0/24", "-o", "eth+", "-j", "MASQUERADE")
-		deleteNATRule("POSTROUTING", "-s", "192.168.122.0/24", "-o", "eth+", "-j", "MASQUERADE")
+		deleteNATRule("POSTROUTING", "-s", config.LXCNATNetwork().Subnet, "-o", "eth+", "-j", "MASQUERADE")
+		deleteNATRule("POSTROUTING", "-s", config.KVMNATNetwork().Subnet, "-o", "eth+", "-j", "MASQUERADE")
 	}
 }
 

backend/internal/cli/cli_test.go

@@ -19,6 +19,26 @@ func TestSafeReleaseBackupComponent(t *testing.T) {
 	}
 }
 
+func TestReleaseArchiveAssetName(t *testing.T) {
+	tests := map[string]string{
+		"amd64": "clicd-linux-amd64.tar.gz",
+		"arm64": "clicd-linux-arm64.tar.gz",
+	}
+	for goarch, want := range tests {
+		got, err := releaseArchiveAssetName(goarch)
+		if err != nil {
+			t.Fatalf("releaseArchiveAssetName(%q) error = %v", goarch, err)
+		}
+		if got != want {
+			t.Fatalf("releaseArchiveAssetName(%q) = %q, want %q", goarch, got, want)
+		}
+	}
+
+	if _, err := releaseArchiveAssetName("386"); err == nil {
+		t.Fatal("releaseArchiveAssetName(386) error = nil, want unsupported architecture")
+	}
+}
+
 func TestCopyFileToBackupRejectsUnsafeFileName(t *testing.T) {
 	unsafeNames := []string{
 		"../clicd",

backend/internal/config/config.go

@@ -5,9 +5,12 @@ import (
 	"encoding/hex"
 	"fmt"
 	"os"
+	"os/exec"
 	"path/filepath"
+	"sort"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"golang.org/x/crypto/bcrypt"
@@ -109,6 +112,8 @@ type Container struct {
 	LXCName                       string                 `json:"lxc_name,omitempty"`
 	KVMName                       string                 `json:"kvm_name,omitempty"`
 	DiskImage                     string                 `json:"disk_image,omitempty"`
+	StoragePoolID                 string                 `json:"storage_pool_id,omitempty"`
+	StoragePath                   string                 `json:"storage_path,omitempty"`
 	MACAddress                    string                 `json:"mac_address,omitempty"`
 	Template                      string                 `json:"template"`
 	VCPU                          float64                `json:"vcpu"`
@@ -128,7 +133,13 @@ type Container struct {
 	IOReadMBps                    int                    `json:"io_read_mbps"`
 	IOWriteMBps                   int                    `json:"io_write_mbps"`
 	Status                        string                 `json:"status"`
+	RestoreOnHostBoot             bool                   `json:"restore_on_host_boot,omitempty"`
 	IP                            string                 `json:"ip"`
+	LANIPv4Mode                   string                 `json:"lan_ipv4_mode,omitempty"`
+	LANInterface                  string                 `json:"lan_interface,omitempty"`
+	LANIPv4Address                string                 `json:"lan_ipv4_address,omitempty"`
+	LANIPv4PrefixLen              int                    `json:"lan_ipv4_prefix_len,omitempty"`
+	LANIPv4Gateway                string                 `json:"lan_ipv4_gateway,omitempty"`
 	PublicIPv4s                   []PublicIPv4Assignment `json:"public_ipv4s,omitempty"`
 	IPv6                          string                 `json:"ipv6"`
 	IPv6PrefixLen                 int                    `json:"ipv6_prefix_len"`
@@ -143,6 +154,8 @@ type Container struct {
 	FirewallEnabled               bool                   `json:"firewall_enabled"`
 	FirewallDefaultAction         string                 `json:"firewall_default_action"`
 	FirewallRules                 []FirewallRule         `json:"firewall_rules"`
+	AllowedImageIDs               []string               `json:"allowed_image_ids,omitempty"`
+	ImageLimitConfigured          bool                   `json:"image_limit_configured,omitempty"`
 	SnapshotLimit                 int                    `json:"snapshot_limit"`
 	CreatedAt                     string                 `json:"created_at"`
 	ExpiresAt                     string                 `json:"expires_at"`
@@ -160,6 +173,9 @@ type Container struct {
 const (
 	VirtualizationLXC = "lxc"
 	VirtualizationKVM = "kvm"
+
+	LANIPv4ModeDHCP   = "dhcp"
+	LANIPv4ModeStatic = "static"
 )
 
 func NormalizeVirtualization(value string) string {
@@ -179,8 +195,373 @@ func (c *Container) IsKVM() bool {
 	return c.Runtime() == VirtualizationKVM
 }
 
+func (c *Container) UsesLANDHCP() bool {
+	return strings.EqualFold(strings.TrimSpace(c.LANIPv4Mode), LANIPv4ModeDHCP)
+}
+
+func (c *Container) UsesLANStaticIPv4() bool {
+	return strings.EqualFold(strings.TrimSpace(c.LANIPv4Mode), LANIPv4ModeStatic)
+}
+
+func (c *Container) UsesLANIPv4() bool {
+	return c.UsesLANDHCP() || c.UsesLANStaticIPv4()
+}
+
+func normalizeStoragePools() bool {
+	if AppConfig == nil {
+		return false
+	}
+	changed := false
+	result := make([]StoragePool, 0, len(AppConfig.StoragePools))
+	seen := map[string]bool{}
+	defaultSeen := map[string]bool{}
+	for _, pool := range AppConfig.StoragePools {
+		pool.ID = strings.TrimSpace(pool.ID)
+		pool.Name = strings.TrimSpace(pool.Name)
+		pool.Path = filepath.Clean(strings.TrimSpace(pool.Path))
+		pool.MountPoint = filepath.Clean(strings.TrimSpace(pool.MountPoint))
+		if pool.MountPoint == "." {
+			pool.MountPoint = ""
+		}
+		if pool.MountPoint != "" {
+			managedPath := managedStoragePoolPath(pool.MountPoint)
+			if pool.Path != managedPath {
+				pool.Path = managedPath
+				changed = true
+			}
+		}
+		if pool.ID == "" {
+			pool.ID = storagePoolIDFromName(pool.Name, pool.Path)
+			changed = true
+		}
+		if pool.Name == "" {
+			pool.Name = pool.ID
+			changed = true
+		}
+		if pool.Path == "." || !filepath.IsAbs(pool.Path) || seen[pool.ID] {
+			changed = true
+			continue
+		}
+		seen[pool.ID] = true
+		pool.ContentTypes = normalizeStorageContentTypes(pool.ContentTypes)
+		pool.DefaultContents = normalizeStorageContentTypes(pool.DefaultContents)
+		allowed := map[string]bool{}
+		for _, content := range pool.ContentTypes {
+			allowed[content] = true
+		}
+		defaults := make([]string, 0, len(pool.DefaultContents))
+		for _, content := range pool.DefaultContents {
+			if !allowed[content] || defaultSeen[content] {
+				changed = true
+				continue
+			}
+			defaultSeen[content] = true
+			defaults = append(defaults, content)
+		}
+		pool.DefaultContents = defaults
+		if pool.ContentTypes == nil {
+			pool.ContentTypes = []string{}
+		}
+		result = append(result, pool)
+	}
+	if len(result) != len(AppConfig.StoragePools) {
+		changed = true
+	}
+	AppConfig.StoragePools = result
+	return changed
+}
+
+func managedStoragePoolPath(mountPoint string) string {
+	mountPoint = filepath.Clean(strings.TrimSpace(mountPoint))
+	if mountPoint == string(os.PathSeparator) {
+		return filepath.Join(string(os.PathSeparator), "var", "lib", "clicd")
+	}
+	return filepath.Join(mountPoint, "clicd")
+}
+
+func storagePoolIDFromName(name, path string) string {
+	base := strings.ToLower(strings.TrimSpace(name))
+	if base == "" {
+		base = filepath.Base(filepath.Clean(path))
+	}
+	replacer := strings.NewReplacer(" ", "-", "_", "-", ".", "-", "/", "-")
+	base = replacer.Replace(base)
+	base = strings.Trim(base, "-")
+	if base == "" {
+		base = "storage"
+	}
+	return base
+}
+
+func normalizeStorageContentTypes(values []string) []string {
+	if len(values) == 0 {
+		return nil
+	}
+	valid := map[string]bool{
+		StorageContentLXC:       true,
+		StorageContentKVM:       true,
+		StorageContentImages:    true,
+		StorageContentSnapshots: true,
+		StorageContentBackups:   true,
+	}
+	seen := map[string]bool{}
+	result := []string{}
+	for _, value := range values {
+		next := strings.ToLower(strings.TrimSpace(value))
+		if !valid[next] || seen[next] {
+			continue
+		}
+		seen[next] = true
+		result = append(result, next)
+	}
+	return result
+}
+
+func StoragePoolsForContent(content string) []StoragePool {
+	if AppConfig == nil {
+		return nil
+	}
+	content = strings.ToLower(strings.TrimSpace(content))
+	result := []StoragePool{}
+	for _, pool := range AppConfig.StoragePools {
+		if !pool.Enabled || !storagePoolAllows(pool, content) {
+			continue
+		}
+		result = append(result, pool)
+	}
+	return result
+}
+
+func StoragePoolByID(id string) *StoragePool {
+	if AppConfig == nil {
+		return nil
+	}
+	id = strings.TrimSpace(id)
+	for i := range AppConfig.StoragePools {
+		if AppConfig.StoragePools[i].ID == id {
+			return &AppConfig.StoragePools[i]
+		}
+	}
+	return nil
+}
+
+func StoragePoolAllowsContent(pool StoragePool, content string) bool {
+	return storagePoolAllows(pool, strings.ToLower(strings.TrimSpace(content)))
+}
+
+func StoragePathForContent(content, fallback string) string {
+	if pool := DefaultStoragePoolForContent(content); pool != nil {
+		return pool.Path
+	}
+	return fallback
+}
+
+// PreferredStoragePoolForContent returns the configured default without doing
+// filesystem probes. Use SelectStoragePoolForContent for new writes.
+func PreferredStoragePoolForContent(content string) *StoragePool {
+	if AppConfig == nil {
+		return nil
+	}
+	content = strings.ToLower(strings.TrimSpace(content))
+	for i := range AppConfig.StoragePools {
+		pool := &AppConfig.StoragePools[i]
+		if !pool.Enabled || !storagePoolAllows(*pool, content) {
+			continue
+		}
+		for _, item := range pool.DefaultContents {
+			if item == content {
+				return pool
+			}
+		}
+	}
+	for i := range AppConfig.StoragePools {
+		pool := &AppConfig.StoragePools[i]
+		if pool.Enabled && storagePoolAllows(*pool, content) {
+			return pool
+		}
+	}
+	return nil
+}
+
+func DefaultStoragePoolForContent(content string) *StoragePool {
+	pool, _ := SelectStoragePoolForContent(content, "", 0)
+	return pool
+}
+
+const storagePoolFreeReserveBytes int64 = 256 * 1024 * 1024
+
+type storagePoolCandidate struct {
+	pool      *StoragePool
+	freeBytes int64
+	isDefault bool
+}
+
+// SelectStoragePoolForContent picks a writable mounted pool. The requested or
+// configured default pool is preferred while it has enough space; remaining
+// pools are tried by available space from largest to smallest.
+func SelectStoragePoolForContent(content, requestedPoolID string, requiredBytes int64) (*StoragePool, error) {
+	if AppConfig == nil {
+		return nil, fmt.Errorf("storage configuration is not loaded")
+	}
+	content = strings.ToLower(strings.TrimSpace(content))
+	requestedPoolID = strings.TrimSpace(requestedPoolID)
+	if requiredBytes < 0 {
+		requiredBytes = 0
+	}
+	requiredFree := requiredBytes + storagePoolFreeReserveBytes
+	candidates := make([]storagePoolCandidate, 0, len(AppConfig.StoragePools))
+	configured := 0
+	for i := range AppConfig.StoragePools {
+		pool := &AppConfig.StoragePools[i]
+		if !pool.Enabled || !storagePoolAllows(*pool, content) {
+			continue
+		}
+		configured++
+		freeBytes, available := probeStoragePoolFreeBytes(*pool)
+		if !available {
+			continue
+		}
+		candidate := storagePoolCandidate{pool: pool, freeBytes: freeBytes}
+		for _, item := range pool.DefaultContents {
+			if item == content {
+				candidate.isDefault = true
+				break
+			}
+		}
+		candidates = append(candidates, candidate)
+	}
+	if configured == 0 {
+		return nil, fmt.Errorf("no storage disk is enabled for %s", storageContentLabel(content))
+	}
+	if len(candidates) == 0 {
+		return nil, fmt.Errorf("all storage disks enabled for %s are unavailable or unmounted", storageContentLabel(content))
+	}
+
+	sort.SliceStable(candidates, func(i, j int) bool {
+		return candidates[i].freeBytes > candidates[j].freeBytes
+	})
+	preferred := func(match func(storagePoolCandidate) bool) *StoragePool {
+		for _, candidate := range candidates {
+			if match(candidate) && candidate.freeBytes >= requiredFree {
+				return candidate.pool
+			}
+		}
+		return nil
+	}
+	if requestedPoolID != "" {
+		if pool := preferred(func(candidate storagePoolCandidate) bool { return candidate.pool.ID == requestedPoolID }); pool != nil {
+			return pool, nil
+		}
+	}
+	if pool := preferred(func(candidate storagePoolCandidate) bool { return candidate.isDefault }); pool != nil {
+		return pool, nil
+	}
+	if pool := preferred(func(storagePoolCandidate) bool { return true }); pool != nil {
+		return pool, nil
+	}
+	return nil, fmt.Errorf("storage disks enabled for %s do not have enough free space", storageContentLabel(content))
+}
+
+var probeStoragePoolFreeBytes = storagePoolFreeBytes
+
+func storagePoolFreeBytes(pool StoragePool) (int64, bool) {
+	if strings.TrimSpace(pool.Path) == "" {
+		return 0, false
+	}
+	if _, err := os.Stat(pool.Path); err != nil {
+		if !os.IsNotExist(err) || filepath.Clean(pool.MountPoint) != string(os.PathSeparator) {
+			return 0, false
+		}
+		if err := os.MkdirAll(pool.Path, 0755); err != nil {
+			return 0, false
+		}
+	}
+	if mountPoint := strings.TrimSpace(pool.MountPoint); mountPoint != "" {
+		out, err := exec.Command("findmnt", "-n", "-o", "TARGET", "--target", pool.Path).Output()
+		if err != nil || filepath.Clean(strings.TrimSpace(string(out))) != filepath.Clean(mountPoint) {
+			return 0, false
+		}
+	}
+	out, err := exec.Command("df", "-B1", "-P", pool.Path).Output()
+	if err != nil {
+		return 0, false
+	}
+	lines := strings.Split(strings.TrimSpace(string(out)), "\n")
+	if len(lines) < 2 {
+		return 0, false
+	}
+	fields := strings.Fields(lines[len(lines)-1])
+	if len(fields) < 4 {
+		return 0, false
+	}
+	freeBytes, err := strconv.ParseInt(fields[3], 10, 64)
+	return freeBytes, err == nil
+}
+
+func storageContentLabel(content string) string {
+	switch content {
+	case StorageContentLXC:
+		return "LXC containers"
+	case StorageContentKVM:
+		return "KVM disks"
+	case StorageContentImages:
+		return "image cache"
+	case StorageContentSnapshots:
+		return "snapshots"
+	case StorageContentBackups:
+		return "backups"
+	default:
+		return content
+	}
+}
+
+func storagePoolAllows(pool StoragePool, content string) bool {
+	for _, item := range pool.ContentTypes {
+		if item == content {
+			return true
+		}
+	}
+	return false
+}
+
 func (c *Container) NormalizeNetworkAssignments() bool {
 	changed := false
+	lanMode := strings.ToLower(strings.TrimSpace(c.LANIPv4Mode))
+	if lanMode != "" && lanMode != LANIPv4ModeDHCP && lanMode != LANIPv4ModeStatic {
+		lanMode = ""
+	}
+	if c.LANIPv4Mode != lanMode {
+		c.LANIPv4Mode = lanMode
+		changed = true
+	}
+	lanInterface := strings.TrimSpace(c.LANInterface)
+	if c.LANInterface != lanInterface {
+		c.LANInterface = lanInterface
+		changed = true
+	}
+	lanAddress := strings.TrimSpace(c.LANIPv4Address)
+	if c.LANIPv4Address != lanAddress {
+		c.LANIPv4Address = lanAddress
+		changed = true
+	}
+	lanGateway := strings.TrimSpace(c.LANIPv4Gateway)
+	if c.LANIPv4Gateway != lanGateway {
+		c.LANIPv4Gateway = lanGateway
+		changed = true
+	}
+	if c.LANIPv4Mode == LANIPv4ModeDHCP {
+		if c.LANIPv4Address != "" {
+			c.LANIPv4Address = ""
+			changed = true
+		}
+	} else if c.LANIPv4Mode != LANIPv4ModeStatic {
+		if c.LANIPv4Address != "" || c.LANIPv4PrefixLen != 0 || c.LANIPv4Gateway != "" {
+			c.LANIPv4Address = ""
+			c.LANIPv4PrefixLen = 0
+			c.LANIPv4Gateway = ""
+			changed = true
+		}
+	}
 	seenIPv4 := map[string]bool{}
 	filteredIPv4 := make([]PublicIPv4Assignment, 0, len(c.PublicIPv4s))
 	for _, item := range c.PublicIPv4s {
@@ -202,7 +583,7 @@ func (c *Container) NormalizeNetworkAssignments() bool {
 	c.PublicIPv4s = filteredIPv4
 
 	seenIPv6 := map[string]bool{}
-	filteredIPv6 := make([]IPv6Assignment, 0, len(c.IPv6Addresses)+1)
+	filteredIPv6 := make([]IPv6Assignment, 0, len(c.IPv6Addresses))
 	for _, item := range c.IPv6Addresses {
 		item.Address = strings.TrimSpace(item.Address)
 		item.Interface = strings.TrimSpace(item.Interface)
@@ -325,6 +706,8 @@ type SubUser struct {
 	PassHash             string   `json:"pass_hash"`
 	ContainerNames       []string `json:"container_names"`
 	ContainerUUIDs       []string `json:"container_uuids,omitempty"`
+	AllowedImageIDs      []string `json:"allowed_image_ids,omitempty"`
+	ImageLimitConfigured bool     `json:"image_limit_configured,omitempty"`
 	Token                string   `json:"-"`
 	AccessCode           string   `json:"access_code"`
 	CreatedAt            string   `json:"created_at"`
@@ -361,6 +744,43 @@ type SSLConfig struct {
 	LastError    string `json:"last_error,omitempty"`
 }
 
+const (
+	StorageContentLXC       = "lxc"
+	StorageContentKVM       = "kvm"
+	StorageContentImages    = "images"
+	StorageContentSnapshots = "snapshots"
+	StorageContentBackups   = "backups"
+)
+
+type StoragePool struct {
+	ID              string   `json:"id"`
+	Name            string   `json:"name"`
+	Path            string   `json:"path"`
+	MountPoint      string   `json:"mount_point,omitempty"`
+	ContentTypes    []string `json:"content_types"`
+	DefaultContents []string `json:"default_contents,omitempty"`
+	Enabled         bool     `json:"enabled"`
+}
+
+func defaultPrimaryStoragePool() StoragePool {
+	contents := []string{
+		StorageContentLXC,
+		StorageContentKVM,
+		StorageContentImages,
+		StorageContentSnapshots,
+		StorageContentBackups,
+	}
+	return StoragePool{
+		ID:              "disk-root",
+		Name:            "system (/)",
+		Path:            "/var/lib/clicd",
+		MountPoint:      "/",
+		ContentTypes:    append([]string(nil), contents...),
+		DefaultContents: append([]string(nil), contents...),
+		Enabled:         true,
+	}
+}
+
 // ClicdConfig is the main configuration structure
 type ClicdConfig struct {
 	AdminUser            string                 `json:"admin_user"`
@@ -374,6 +794,8 @@ type ClicdConfig struct {
 	NextSSHPort          int                    `json:"next_ssh_port"`
 	NATPortStart         int                    `json:"nat_port_start"`
 	NATPortEnd           int                    `json:"nat_port_end"`
+	LXCNATSubnet         string                 `json:"lxc_nat_subnet"`
+	KVMNATSubnet         string                 `json:"kvm_nat_subnet"`
 	SetupComplete        bool                   `json:"setup_complete"`
 	SubUsers             []SubUser              `json:"sub_users"`
 	ApiKeys              []ApiKeyConfig         `json:"api_keys"`
@@ -381,21 +803,65 @@ type ClicdConfig struct {
 	Tasks                []SavedTask            `json:"tasks"`
 	LoginLogs            []SavedLoginLog        `json:"login_logs"`
 	EnabledImages        []string               `json:"enabled_images"`
+	CustomKVMImages      []CustomKVMImage       `json:"custom_kvm_images"`
+	CustomLXCImages      []CustomLXCImage       `json:"custom_lxc_images"`
 	Snapshots            []Snapshot             `json:"snapshots"`
 	PublicIPv4Pool       []PublicIPv4Assignment `json:"public_ipv4_pool"`
 	PublicIPv6Prefixes   []PublicIPv6Prefix     `json:"public_ipv6_prefixes"`
 	WebSSHAllowedOrigins []string               `json:"webssh_allowed_origins"`
+	PanelAccessPolicy    PanelAccessPolicy      `json:"panel_access_policy"`
 	SecurityAutoShutdown bool                   `json:"security_auto_shutdown"`
+	TaskConcurrency      int                    `json:"task_concurrency"`
 	Language             string                 `json:"language"`
 	SSL                  SSLConfig              `json:"ssl"`
 	SSLCertificates      map[string]SSLConfig   `json:"ssl_certificates"`
+	StoragePools         []StoragePool          `json:"storage_pools"`
+}
+
+const (
+	KVMProvisionerLinuxCloudInit = "linux-cloud-init"
+	KVMProvisionerWindows10      = "windows-10"
+	KVMProvisionerWindows11      = "windows-11"
+)
+
+// CustomKVMImage is an administrator-defined KVM image source.
+type CustomKVMImage struct {
+	ID          string `json:"id"`
+	Name        string `json:"name"`
+	Description string `json:"description"`
+	Distro      string `json:"distro"`
+	Release     string `json:"release"`
+	Arch        string `json:"arch"`
+	URL         string `json:"url"`
+	Provisioner string `json:"provisioner"`
+	SHA256      string `json:"sha256,omitempty"`
+	CreatedAt   string `json:"created_at"`
+}
+
+// CustomLXCImage is an administrator-defined LXC rootfs archive source.
+type CustomLXCImage struct {
+	ID          string `json:"id"`
+	Name        string `json:"name"`
+	Description string `json:"description"`
+	Distro      string `json:"distro"`
+	Release     string `json:"release"`
+	Arch        string `json:"arch"`
+	URL         string `json:"url"`
+	SHA256      string `json:"sha256,omitempty"`
+	CreatedAt   string `json:"created_at"`
 }
 
 var configPath string
 var AppConfig *ClicdConfig
+var allocationMu sync.Mutex
 
 const DefaultSnapshotLimit = 3
 
+const (
+	DefaultTaskConcurrency = 2
+	MaxTaskConcurrency     = 16
+)
+
 const (
 	DefaultNATPortStart = 20000
 	DefaultNATPortEnd   = 65535
@@ -518,6 +984,8 @@ func InitConfig() (*ClicdConfig, error) {
 		NextSSHPort:          22000,
 		NATPortStart:         DefaultNATPortStart,
 		NATPortEnd:           DefaultNATPortEnd,
+		LXCNATSubnet:         configuredSubnetValue("", "CLICD_LXC_SUBNET", DefaultLXCNATSubnet),
+		KVMNATSubnet:         configuredSubnetValue("", "CLICD_KVM_SUBNET", DefaultKVMNATSubnet),
 		SetupComplete:        false,
 		SubUsers:             []SubUser{},
 		AuditLogs:            []AuditLog{},
@@ -527,6 +995,12 @@ func InitConfig() (*ClicdConfig, error) {
 		PublicIPv4Pool:       []PublicIPv4Assignment{},
 		PublicIPv6Prefixes:   []PublicIPv6Prefix{},
 		WebSSHAllowedOrigins: []string{},
+		PanelAccessPolicy: PanelAccessPolicy{
+			AllowedSources: []string{},
+			TrustedProxies: []string{},
+		},
+		TaskConcurrency: DefaultTaskConcurrency,
+		StoragePools:    []StoragePool{defaultPrimaryStoragePool()},
 	}
 
 	if err := SaveConfig(); err != nil {
@@ -564,10 +1038,17 @@ func normalizeConfigDefaults(dataDir string) bool {
 	if normalizeNATPortRangeDefaults() {
 		changed = true
 	}
+	if normalizeNATNetworkDefaults() {
+		changed = true
+	}
 	if AppConfig.NextContainerID == 0 {
 		AppConfig.NextContainerID = 1
 		changed = true
 	}
+	if normalized := NormalizeTaskConcurrency(AppConfig.TaskConcurrency); AppConfig.TaskConcurrency != normalized {
+		AppConfig.TaskConcurrency = normalized
+		changed = true
+	}
 	if AppConfig.DataDir == "" {
 		AppConfig.DataDir = dataDir
 		changed = true
@@ -595,6 +1076,25 @@ func normalizeConfigDefaults(dataDir string) bool {
 		AppConfig.WebSSHAllowedOrigins = normalized
 		changed = true
 	}
+	if normalized, err := NormalizePanelAccessPolicy(AppConfig.PanelAccessPolicy); err == nil {
+		if !panelAccessPoliciesEqual(AppConfig.PanelAccessPolicy, normalized) {
+			AppConfig.PanelAccessPolicy = normalized
+			changed = true
+		}
+	} else {
+		AppConfig.PanelAccessPolicy = PanelAccessPolicy{
+			AllowedSources: []string{},
+			TrustedProxies: []string{},
+		}
+		changed = true
+	}
+	if len(AppConfig.StoragePools) == 0 {
+		AppConfig.StoragePools = []StoragePool{defaultPrimaryStoragePool()}
+		changed = true
+	}
+	if normalizeStoragePools() {
+		changed = true
+	}
 	if AppConfig.SubUsers == nil {
 		AppConfig.SubUsers = make([]SubUser, 0)
 		changed = true
@@ -626,6 +1126,14 @@ func normalizeConfigDefaults(dataDir string) bool {
 		AppConfig.EnabledImages = make([]string, 0)
 		changed = true
 	}
+	if AppConfig.CustomKVMImages == nil {
+		AppConfig.CustomKVMImages = make([]CustomKVMImage, 0)
+		changed = true
+	}
+	if AppConfig.CustomLXCImages == nil {
+		AppConfig.CustomLXCImages = make([]CustomLXCImage, 0)
+		changed = true
+	}
 	if AppConfig.Language == "" {
 		AppConfig.Language = "zh"
 		changed = true
@@ -640,6 +1148,16 @@ func normalizeConfigDefaults(dataDir string) bool {
 	return changed
 }
 
+func NormalizeTaskConcurrency(value int) int {
+	if value <= 0 {
+		return DefaultTaskConcurrency
+	}
+	if value > MaxTaskConcurrency {
+		return MaxTaskConcurrency
+	}
+	return value
+}
+
 func NormalizeLanguage(language string) string {
 	switch strings.ToLower(strings.TrimSpace(language)) {
 	case "en", "en-us", "en_us", "english":
@@ -984,8 +1502,108 @@ func SaveConfig() error {
 	return saveConfigToDB()
 }
 
+func ListCustomKVMImages() []CustomKVMImage {
+	allocationMu.Lock()
+	defer allocationMu.Unlock()
+	if AppConfig == nil {
+		return nil
+	}
+	return append([]CustomKVMImage(nil), AppConfig.CustomKVMImages...)
+}
+
+func AddCustomKVMImage(image CustomKVMImage) error {
+	allocationMu.Lock()
+	defer allocationMu.Unlock()
+	for _, existing := range AppConfig.CustomKVMImages {
+		if existing.ID == image.ID {
+			return fmt.Errorf("custom KVM image %q already exists", image.ID)
+		}
+	}
+	AppConfig.CustomKVMImages = append(AppConfig.CustomKVMImages, image)
+	if err := SaveConfig(); err != nil {
+		AppConfig.CustomKVMImages = AppConfig.CustomKVMImages[:len(AppConfig.CustomKVMImages)-1]
+		return err
+	}
+	return nil
+}
+
+func RemoveCustomKVMImage(id string) (bool, error) {
+	allocationMu.Lock()
+	defer allocationMu.Unlock()
+	filtered := make([]CustomKVMImage, 0, len(AppConfig.CustomKVMImages))
+	found := false
+	for _, image := range AppConfig.CustomKVMImages {
+		if image.ID == id {
+			found = true
+			continue
+		}
+		filtered = append(filtered, image)
+	}
+	if !found {
+		return false, nil
+	}
+	previous := AppConfig.CustomKVMImages
+	AppConfig.CustomKVMImages = filtered
+	if err := SaveConfig(); err != nil {
+		AppConfig.CustomKVMImages = previous
+		return false, err
+	}
+	return true, nil
+}
+
+func ListCustomLXCImages() []CustomLXCImage {
+	allocationMu.Lock()
+	defer allocationMu.Unlock()
+	if AppConfig == nil {
+		return nil
+	}
+	return append([]CustomLXCImage(nil), AppConfig.CustomLXCImages...)
+}
+
+func AddCustomLXCImage(image CustomLXCImage) error {
+	allocationMu.Lock()
+	defer allocationMu.Unlock()
+	for _, existing := range AppConfig.CustomLXCImages {
+		if existing.ID == image.ID {
+			return fmt.Errorf("custom LXC image %q already exists", image.ID)
+		}
+	}
+	AppConfig.CustomLXCImages = append(AppConfig.CustomLXCImages, image)
+	if err := SaveConfig(); err != nil {
+		AppConfig.CustomLXCImages = AppConfig.CustomLXCImages[:len(AppConfig.CustomLXCImages)-1]
+		return err
+	}
+	return nil
+}
+
+func RemoveCustomLXCImage(id string) (bool, error) {
+	allocationMu.Lock()
+	defer allocationMu.Unlock()
+	filtered := make([]CustomLXCImage, 0, len(AppConfig.CustomLXCImages))
+	found := false
+	for _, image := range AppConfig.CustomLXCImages {
+		if image.ID == id {
+			found = true
+			continue
+		}
+		filtered = append(filtered, image)
+	}
+	if !found {
+		return false, nil
+	}
+	previous := AppConfig.CustomLXCImages
+	AppConfig.CustomLXCImages = filtered
+	if err := SaveConfig(); err != nil {
+		AppConfig.CustomLXCImages = previous
+		return false, err
+	}
+	return true, nil
+}
+
 // AddContainer adds a container to the config
 func AddContainer(c Container) {
+	allocationMu.Lock()
+	defer allocationMu.Unlock()
 	if c.UUID == "" {
 		c.UUID = NewContainerUUID()
 	}
@@ -997,6 +1615,8 @@ func AddContainer(c Container) {
 
 // AllocateContainerID allocates a new container ID
 func AllocateContainerID() int {
+	allocationMu.Lock()
+	defer allocationMu.Unlock()
 	id := AppConfig.NextContainerID
 	AppConfig.NextContainerID++
 	SaveConfig()
@@ -1158,6 +1778,23 @@ func UpdateContainerStatus(id int, status string) {
 	}
 }
 
+func UpdateContainerStatusAndRestore(id int, status string, restoreOnHostBoot bool) {
+	c := FindContainer(id)
+	if c != nil {
+		c.Status = status
+		c.RestoreOnHostBoot = restoreOnHostBoot
+		SaveConfig()
+	}
+}
+
+func SetContainerRestoreOnHostBoot(id int, restore bool) {
+	c := FindContainer(id)
+	if c != nil {
+		c.RestoreOnHostBoot = restore
+		SaveConfig()
+	}
+}
+
 func SetContainerPolicyBlock(id int, blocked bool, reason string) {
 	c := FindContainer(id)
 	if c == nil {
@@ -1256,7 +1893,42 @@ func normalizeNATPortRangeDefaults() bool {
 
 // AllocateSSHPort allocates a new SSH port, skipping ports already used by any container
 func AllocateSSHPort() (int, error) {
+	return AllocateSSHPortExcluding(nil)
+}
+
+// AllocateSSHPortExcluding allocates a management port while reserving
+// user-requested NAT host ports for the container being created.
+func AllocateSSHPortExcluding(excluded []int) (int, error) {
+	allocationMu.Lock()
+	defer allocationMu.Unlock()
+	candidate, err := previewSSHPortExcluding(excluded)
+	if err != nil {
+		return 0, err
+	}
+	start, end := NATPortRange()
+	AppConfig.NextSSHPort = candidate + 1
+	if AppConfig.NextSSHPort > end {
+		AppConfig.NextSSHPort = start
+	}
+	SaveConfig()
+	return candidate, nil
+}
+
+// PreviewSSHPortExcluding returns the management port that the allocator would
+// choose without advancing or persisting the allocation cursor.
+func PreviewSSHPortExcluding(excluded []int) (int, error) {
+	allocationMu.Lock()
+	defer allocationMu.Unlock()
+	return previewSSHPortExcluding(excluded)
+}
+
+func previewSSHPortExcluding(excluded []int) (int, error) {
 	used := collectAllHostPorts()
+	for _, port := range excluded {
+		if port > 0 {
+			used[port] = true
+		}
+	}
 	start, end := NATPortRange()
 	port := AppConfig.NextSSHPort
 	if port < start || port > end {
@@ -1268,11 +1940,6 @@ func AllocateSSHPort() (int, error) {
 		if used[candidate] {
 			continue
 		}
-		AppConfig.NextSSHPort = candidate + 1
-		if AppConfig.NextSSHPort > end {
-			AppConfig.NextSSHPort = start
-		}
-		SaveConfig()
 		return candidate, nil
 	}
 	return 0, fmt.Errorf("no free NAT4 host port in configured range %d-%d", start, end)

backend/internal/config/nat_network.go

@@ -0,0 +1,144 @@
+package config
+
+import (
+	"encoding/binary"
+	"fmt"
+	"net/netip"
+	"os"
+	"strings"
+)
+
+const (
+	DefaultLXCNATSubnet = "10.0.3.0/24"
+	DefaultKVMNATSubnet = "192.168.122.0/24"
+)
+
+type NATNetwork struct {
+	Subnet     string `json:"subnet"`
+	Gateway    string `json:"gateway"`
+	Netmask    string `json:"netmask"`
+	DHCPStart  string `json:"dhcp_start"`
+	DHCPEnd    string `json:"dhcp_end"`
+	DHCPMax    int    `json:"dhcp_max"`
+	PrefixBits int    `json:"prefix_bits"`
+}
+
+func ParseNATNetwork(raw string) (NATNetwork, error) {
+	prefix, err := netip.ParsePrefix(strings.TrimSpace(raw))
+	if err != nil || !prefix.Addr().Is4() {
+		return NATNetwork{}, fmt.Errorf("NAT subnet must be a valid IPv4 CIDR")
+	}
+	prefix = prefix.Masked()
+	if prefix.Bits() < 16 || prefix.Bits() > 28 {
+		return NATNetwork{}, fmt.Errorf("NAT subnet prefix must be between /16 and /28")
+	}
+	if !isRFC1918Prefix(prefix) {
+		return NATNetwork{}, fmt.Errorf("NAT subnet must use an RFC1918 private IPv4 range")
+	}
+
+	network := ipv4Uint32(prefix.Addr())
+	hostBits := 32 - prefix.Bits()
+	broadcast := network | uint32((uint64(1)<<hostBits)-1)
+	gateway := uint32IPv4(network + 1)
+	dhcpStart := uint32IPv4(network + 2)
+	dhcpEnd := uint32IPv4(broadcast - 1)
+	return NATNetwork{
+		Subnet:     prefix.String(),
+		Gateway:    gateway.String(),
+		Netmask:    netmaskString(prefix.Bits()),
+		DHCPStart:  dhcpStart.String(),
+		DHCPEnd:    dhcpEnd.String(),
+		DHCPMax:    int(broadcast - network - 2),
+		PrefixBits: prefix.Bits(),
+	}, nil
+}
+
+func LXCNATNetwork() NATNetwork {
+	return configuredNATNetwork(false)
+}
+
+func KVMNATNetwork() NATNetwork {
+	return configuredNATNetwork(true)
+}
+
+func normalizeNATNetworkDefaults() bool {
+	changed := false
+	lxcSubnet := configuredSubnetValue(AppConfig.LXCNATSubnet, "CLICD_LXC_SUBNET", DefaultLXCNATSubnet)
+	kvmSubnet := configuredSubnetValue(AppConfig.KVMNATSubnet, "CLICD_KVM_SUBNET", DefaultKVMNATSubnet)
+	if AppConfig.LXCNATSubnet != lxcSubnet {
+		AppConfig.LXCNATSubnet = lxcSubnet
+		changed = true
+	}
+	if AppConfig.KVMNATSubnet != kvmSubnet {
+		AppConfig.KVMNATSubnet = kvmSubnet
+		changed = true
+	}
+	return changed
+}
+
+func configuredNATNetwork(kvm bool) NATNetwork {
+	raw := DefaultLXCNATSubnet
+	if kvm {
+		raw = DefaultKVMNATSubnet
+	}
+	if AppConfig != nil {
+		if kvm && AppConfig.KVMNATSubnet != "" {
+			raw = AppConfig.KVMNATSubnet
+		}
+		if !kvm && AppConfig.LXCNATSubnet != "" {
+			raw = AppConfig.LXCNATSubnet
+		}
+	}
+	network, err := ParseNATNetwork(raw)
+	if err == nil {
+		return network
+	}
+	network, _ = ParseNATNetwork(map[bool]string{false: DefaultLXCNATSubnet, true: DefaultKVMNATSubnet}[kvm])
+	return network
+}
+
+func configuredSubnetValue(current, envName, fallback string) string {
+	raw := strings.TrimSpace(current)
+	if envValue := strings.TrimSpace(os.Getenv(envName)); envValue != "" {
+		raw = envValue
+	}
+	if network, err := ParseNATNetwork(raw); err == nil {
+		return network.Subnet
+	}
+	network, _ := ParseNATNetwork(fallback)
+	return network.Subnet
+}
+
+func isRFC1918Prefix(prefix netip.Prefix) bool {
+	privateRanges := []netip.Prefix{
+		netip.MustParsePrefix("10.0.0.0/8"),
+		netip.MustParsePrefix("172.16.0.0/12"),
+		netip.MustParsePrefix("192.168.0.0/16"),
+	}
+	for _, privateRange := range privateRanges {
+		if privateRange.Contains(prefix.Addr()) {
+			last := uint32IPv4(ipv4Uint32(prefix.Addr()) | uint32((uint64(1)<<(32-prefix.Bits()))-1))
+			return privateRange.Contains(last)
+		}
+	}
+	return false
+}
+
+func ipv4Uint32(addr netip.Addr) uint32 {
+	bytes := addr.As4()
+	return binary.BigEndian.Uint32(bytes[:])
+}
+
+func uint32IPv4(value uint32) netip.Addr {
+	var bytes [4]byte
+	binary.BigEndian.PutUint32(bytes[:], value)
+	return netip.AddrFrom4(bytes)
+}
+
+func netmaskString(bits int) string {
+	mask := uint32(0)
+	if bits > 0 {
+		mask = ^uint32(0) << (32 - bits)
+	}
+	return uint32IPv4(mask).String()
+}

backend/internal/config/nat_network_test.go

@@ -0,0 +1,56 @@
+package config
+
+import "testing"
+
+func TestParseNATNetwork(t *testing.T) {
+	network, err := ParseNATNetwork("172.28.40.0/24")
+	if err != nil {
+		t.Fatalf("ParseNATNetwork returned error: %v", err)
+	}
+	if network.Subnet != "172.28.40.0/24" ||
+		network.Gateway != "172.28.40.1" ||
+		network.Netmask != "255.255.255.0" ||
+		network.DHCPStart != "172.28.40.2" ||
+		network.DHCPEnd != "172.28.40.254" ||
+		network.DHCPMax != 253 {
+		t.Fatalf("unexpected network values: %+v", network)
+	}
+}
+
+func TestParseNATNetworkMasksHostBits(t *testing.T) {
+	network, err := ParseNATNetwork("10.44.8.99/20")
+	if err != nil {
+		t.Fatalf("ParseNATNetwork returned error: %v", err)
+	}
+	if network.Subnet != "10.44.0.0/20" || network.Gateway != "10.44.0.1" || network.DHCPEnd != "10.44.15.254" {
+		t.Fatalf("unexpected masked network values: %+v", network)
+	}
+}
+
+func TestParseNATNetworkRejectsUnsafeRanges(t *testing.T) {
+	for _, raw := range []string{
+		"203.0.113.0/24",
+		"10.0.0.0/15",
+		"10.0.0.0/29",
+		"not-a-subnet",
+	} {
+		if _, err := ParseNATNetwork(raw); err == nil {
+			t.Fatalf("ParseNATNetwork(%q) unexpectedly succeeded", raw)
+		}
+	}
+}
+
+func TestNormalizeNATNetworkDefaultsUsesEnvironment(t *testing.T) {
+	t.Setenv("CLICD_LXC_SUBNET", "172.30.8.0/24")
+	t.Setenv("CLICD_KVM_SUBNET", "10.230.0.0/20")
+	previous := AppConfig
+	AppConfig = &ClicdConfig{}
+	t.Cleanup(func() { AppConfig = previous })
+
+	if !normalizeNATNetworkDefaults() {
+		t.Fatal("expected defaults to change")
+	}
+	if AppConfig.LXCNATSubnet != "172.30.8.0/24" || AppConfig.KVMNATSubnet != "10.230.0.0/20" {
+		t.Fatalf("unexpected configured subnets: LXC=%s KVM=%s", AppConfig.LXCNATSubnet, AppConfig.KVMNATSubnet)
+	}
+}

backend/internal/config/nat_test.go

@@ -44,3 +44,45 @@ func TestAllocateSSHPortErrorsWhenConfiguredRangeIsFull(t *testing.T) {
 		t.Fatalf("expected exhausted NAT range error, got port %d", port)
 	}
 }
+
+func TestAllocateSSHPortExcludingRequestedMappings(t *testing.T) {
+	previous := AppConfig
+	t.Cleanup(func() { AppConfig = previous })
+	AppConfig = &ClicdConfig{
+		NATPortStart: 32000,
+		NATPortEnd:   32002,
+		NextSSHPort:  32000,
+	}
+
+	port, err := AllocateSSHPortExcluding([]int{32000, 32001})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if port != 32002 {
+		t.Fatalf("allocated port = %d, want 32002", port)
+	}
+}
+
+func TestPreviewSSHPortUsesRangeWithoutAdvancingCursor(t *testing.T) {
+	previous := AppConfig
+	t.Cleanup(func() { AppConfig = previous })
+	AppConfig = &ClicdConfig{
+		NATPortStart: 30000,
+		NATPortEnd:   35000,
+		NextSSHPort:  30000,
+		Containers: []Container{{
+			PortMappings: []PortMapping{{HostPort: 30000}},
+		}},
+	}
+
+	port, err := PreviewSSHPortExcluding([]int{30001})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if port != 30002 {
+		t.Fatalf("preview port = %d, want 30002", port)
+	}
+	if AppConfig.NextSSHPort != 30000 {
+		t.Fatalf("preview advanced cursor to %d", AppConfig.NextSSHPort)
+	}
+}

backend/internal/config/panel_access.go

@@ -0,0 +1,198 @@
+package config
+
+import (
+	"fmt"
+	"net"
+	"net/netip"
+	"strings"
+)
+
+// PanelAccessPolicy limits access to the complete web panel and API surface.
+type PanelAccessPolicy struct {
+	Enabled        bool     `json:"enabled"`
+	AllowedSources []string `json:"allowed_sources"`
+	TrustedProxies []string `json:"trusted_proxies"`
+}
+
+// ForwardedClientHeaders contains proxy-provided client address headers.
+type ForwardedClientHeaders struct {
+	ForwardedFor   string
+	RealIP         string
+	CFConnectingIP string
+}
+
+// PanelAccessDecision describes the address used by the access policy.
+type PanelAccessDecision struct {
+	Allowed       bool
+	DirectSource  string
+	CurrentSource string
+	UsedForwarded bool
+}
+
+func NormalizePanelAccessPolicy(policy PanelAccessPolicy) (PanelAccessPolicy, error) {
+	allowed, err := normalizeIPRanges(policy.AllowedSources, "allowed source")
+	if err != nil {
+		return PanelAccessPolicy{}, err
+	}
+	trusted, err := normalizeIPRanges(policy.TrustedProxies, "trusted proxy")
+	if err != nil {
+		return PanelAccessPolicy{}, err
+	}
+	if policy.Enabled && len(allowed) == 0 {
+		return PanelAccessPolicy{}, fmt.Errorf("at least one allowed IP address or CIDR is required")
+	}
+	return PanelAccessPolicy{
+		Enabled:        policy.Enabled,
+		AllowedSources: allowed,
+		TrustedProxies: trusted,
+	}, nil
+}
+
+func normalizeIPRanges(values []string, label string) ([]string, error) {
+	result := make([]string, 0, len(values))
+	seen := make(map[string]struct{}, len(values))
+	for _, raw := range values {
+		value := strings.TrimSpace(raw)
+		if value == "" {
+			continue
+		}
+		normalized, err := normalizeIPRange(value)
+		if err != nil {
+			return nil, fmt.Errorf("invalid %s %q: %w", label, value, err)
+		}
+		if _, exists := seen[normalized]; exists {
+			continue
+		}
+		seen[normalized] = struct{}{}
+		result = append(result, normalized)
+	}
+	return result, nil
+}
+
+func normalizeIPRange(value string) (string, error) {
+	if strings.Contains(value, "/") {
+		prefix, err := netip.ParsePrefix(value)
+		if err != nil {
+			return "", err
+		}
+		if prefix.Addr().Zone() != "" {
+			return "", fmt.Errorf("IPv6 zones are not supported")
+		}
+		return prefix.Masked().String(), nil
+	}
+	addr, err := netip.ParseAddr(value)
+	if err != nil {
+		return "", err
+	}
+	if addr.Zone() != "" {
+		return "", fmt.Errorf("IPv6 zones are not supported")
+	}
+	return addr.Unmap().String(), nil
+}
+
+func panelAccessPoliciesEqual(a, b PanelAccessPolicy) bool {
+	return a.Enabled == b.Enabled &&
+		stringSlicesEqual(a.AllowedSources, b.AllowedSources) &&
+		stringSlicesEqual(a.TrustedProxies, b.TrustedProxies)
+}
+
+func stringSlicesEqual(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}
+
+// EvaluatePanelAccess resolves the effective client address and applies policy.
+// Forwarded headers are only considered when the TCP peer is trusted.
+func EvaluatePanelAccess(policy PanelAccessPolicy, remoteAddr string, headers ForwardedClientHeaders) PanelAccessDecision {
+	direct, ok := parseRemoteIP(remoteAddr)
+	decision := PanelAccessDecision{}
+	if ok {
+		decision.DirectSource = direct.String()
+		decision.CurrentSource = direct.String()
+	}
+	if !policy.Enabled {
+		decision.Allowed = true
+		return decision
+	}
+	if !ok {
+		return decision
+	}
+
+	current := direct
+	if ipInRanges(direct, policy.TrustedProxies) {
+		if forwarded, forwardedOK := resolveForwardedIP(direct, policy.TrustedProxies, headers); forwardedOK {
+			current = forwarded
+			decision.CurrentSource = forwarded.String()
+			decision.UsedForwarded = true
+		}
+	}
+
+	// A direct local connection remains an emergency recovery path. When a
+	// trusted local reverse proxy forwards a client address, that client is
+	// still checked normally.
+	if current.IsLoopback() && !decision.UsedForwarded {
+		decision.Allowed = true
+		return decision
+	}
+	decision.Allowed = ipInRanges(current, policy.AllowedSources)
+	return decision
+}
+
+func parseRemoteIP(value string) (netip.Addr, bool) {
+	value = strings.TrimSpace(value)
+	if host, _, err := net.SplitHostPort(value); err == nil {
+		value = host
+	}
+	value = strings.TrimPrefix(strings.TrimSuffix(value, "]"), "[")
+	addr, err := netip.ParseAddr(value)
+	if err != nil {
+		return netip.Addr{}, false
+	}
+	return addr.Unmap(), true
+}
+
+func resolveForwardedIP(direct netip.Addr, trusted []string, headers ForwardedClientHeaders) (netip.Addr, bool) {
+	for _, raw := range []string{headers.CFConnectingIP, headers.RealIP} {
+		if addr, ok := parseRemoteIP(strings.TrimSpace(strings.Split(raw, ",")[0])); ok {
+			return addr, true
+		}
+	}
+
+	parts := strings.Split(headers.ForwardedFor, ",")
+	current := direct
+	found := false
+	for i := len(parts) - 1; i >= 0 && ipInRanges(current, trusted); i-- {
+		addr, ok := parseRemoteIP(strings.TrimSpace(parts[i]))
+		if !ok {
+			continue
+		}
+		current = addr
+		found = true
+	}
+	return current, found
+}
+
+func ipInRanges(addr netip.Addr, ranges []string) bool {
+	addr = addr.Unmap()
+	for _, raw := range ranges {
+		if strings.Contains(raw, "/") {
+			prefix, err := netip.ParsePrefix(raw)
+			if err == nil && prefix.Contains(addr) {
+				return true
+			}
+			continue
+		}
+		candidate, err := netip.ParseAddr(raw)
+		if err == nil && candidate.Unmap() == addr {
+			return true
+		}
+	}
+	return false
+}

backend/internal/config/panel_access_test.go

@@ -0,0 +1,146 @@
+package config
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestNormalizePanelAccessPolicy(t *testing.T) {
+	policy, err := NormalizePanelAccessPolicy(PanelAccessPolicy{
+		Enabled:        true,
+		AllowedSources: []string{" 192.0.2.8 ", "10.20.30.44/24", "192.0.2.8", "2001:db8::1"},
+		TrustedProxies: []string{"127.0.0.1", "2001:db8:1::/64"},
+	})
+	if err != nil {
+		t.Fatalf("NormalizePanelAccessPolicy() error = %v", err)
+	}
+	if want := []string{"192.0.2.8", "10.20.30.0/24", "2001:db8::1"}; !reflect.DeepEqual(policy.AllowedSources, want) {
+		t.Fatalf("AllowedSources = %#v, want %#v", policy.AllowedSources, want)
+	}
+	if want := []string{"127.0.0.1", "2001:db8:1::/64"}; !reflect.DeepEqual(policy.TrustedProxies, want) {
+		t.Fatalf("TrustedProxies = %#v, want %#v", policy.TrustedProxies, want)
+	}
+}
+
+func TestNormalizePanelAccessPolicyRejectsEmptyEnabledPolicy(t *testing.T) {
+	if _, err := NormalizePanelAccessPolicy(PanelAccessPolicy{Enabled: true}); err == nil {
+		t.Fatal("expected enabled empty policy to fail")
+	}
+}
+
+func TestEvaluatePanelAccess(t *testing.T) {
+	base := PanelAccessPolicy{
+		Enabled:        true,
+		AllowedSources: []string{"192.0.2.0/24", "2001:db8::/32"},
+		TrustedProxies: []string{"10.0.0.1", "127.0.0.1"},
+	}
+	tests := []struct {
+		name          string
+		policy        PanelAccessPolicy
+		remote        string
+		headers       ForwardedClientHeaders
+		allowed       bool
+		current       string
+		usedForwarded bool
+	}{
+		{
+			name:    "disabled",
+			policy:  PanelAccessPolicy{},
+			remote:  "198.51.100.9:44321",
+			allowed: true,
+			current: "198.51.100.9",
+		},
+		{
+			name:    "direct CIDR match",
+			policy:  base,
+			remote:  "192.0.2.25:44321",
+			allowed: true,
+			current: "192.0.2.25",
+		},
+		{
+			name:    "direct denied",
+			policy:  base,
+			remote:  "198.51.100.9:44321",
+			allowed: false,
+			current: "198.51.100.9",
+		},
+		{
+			name:   "spoofed forwarding header ignored",
+			policy: base,
+			remote: "198.51.100.9:44321",
+			headers: ForwardedClientHeaders{
+				ForwardedFor: "192.0.2.10",
+			},
+			allowed: false,
+			current: "198.51.100.9",
+		},
+		{
+			name:   "trusted proxy forwards allowed source",
+			policy: base,
+			remote: "10.0.0.1:44321",
+			headers: ForwardedClientHeaders{
+				ForwardedFor: "192.0.2.10",
+			},
+			allowed:       true,
+			current:       "192.0.2.10",
+			usedForwarded: true,
+		},
+		{
+			name:   "trusted proxy forwards denied source",
+			policy: base,
+			remote: "10.0.0.1:44321",
+			headers: ForwardedClientHeaders{
+				RealIP: "198.51.100.20",
+			},
+			allowed:       false,
+			current:       "198.51.100.20",
+			usedForwarded: true,
+		},
+		{
+			name:          "direct loopback recovery",
+			policy:        base,
+			remote:        "127.0.0.1:44321",
+			allowed:       true,
+			current:       "127.0.0.1",
+			usedForwarded: false,
+		},
+		{
+			name:   "trusted loopback proxy is enforced",
+			policy: base,
+			remote: "127.0.0.1:44321",
+			headers: ForwardedClientHeaders{
+				ForwardedFor: "198.51.100.20",
+			},
+			allowed:       false,
+			current:       "198.51.100.20",
+			usedForwarded: true,
+		},
+		{
+			name:    "IPv6 source",
+			policy:  base,
+			remote:  "[2001:db8::88]:44321",
+			allowed: true,
+			current: "2001:db8::88",
+		},
+		{
+			name:   "trusted proxy chain",
+			policy: base,
+			remote: "10.0.0.1:44321",
+			headers: ForwardedClientHeaders{
+				ForwardedFor: "192.0.2.70, 10.0.0.1",
+			},
+			allowed:       true,
+			current:       "192.0.2.70",
+			usedForwarded: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := EvaluatePanelAccess(tt.policy, tt.remote, tt.headers)
+			if got.Allowed != tt.allowed || got.CurrentSource != tt.current || got.UsedForwarded != tt.usedForwarded {
+				t.Fatalf("EvaluatePanelAccess() = %#v", got)
+			}
+		})
+	}
+}

backend/internal/config/storage_test.go

@@ -0,0 +1,114 @@
+package config
+
+import (
+	"path/filepath"
+	"testing"
+)
+
+func TestNormalizeStoragePoolsReplacesPersistedCustomPath(t *testing.T) {
+	previousConfig := AppConfig
+	t.Cleanup(func() { AppConfig = previousConfig })
+	mountPoint := filepath.Join(t.TempDir(), "data")
+
+	AppConfig = &ClicdConfig{StoragePools: []StoragePool{{
+		ID:         "data",
+		Name:       "data",
+		Path:       filepath.Join(t.TempDir(), "uncontrolled"),
+		MountPoint: mountPoint,
+		Enabled:    true,
+	}}}
+	if !normalizeStoragePools() {
+		t.Fatal("expected custom path normalization to report a change")
+	}
+	want := managedStoragePoolPath(mountPoint)
+	if got := AppConfig.StoragePools[0].Path; got != want {
+		t.Fatalf("normalized path = %q, want %q", got, want)
+	}
+}
+
+func TestSelectStoragePoolForContent(t *testing.T) {
+	previousConfig := AppConfig
+	previousProbe := probeStoragePoolFreeBytes
+	t.Cleanup(func() {
+		AppConfig = previousConfig
+		probeStoragePoolFreeBytes = previousProbe
+	})
+
+	AppConfig = &ClicdConfig{StoragePools: []StoragePool{
+		{
+			ID:              "primary",
+			Path:            "/primary",
+			ContentTypes:    []string{StorageContentLXC},
+			DefaultContents: []string{StorageContentLXC},
+			Enabled:         true,
+		},
+		{
+			ID:           "large",
+			Path:         "/large",
+			ContentTypes: []string{StorageContentLXC},
+			Enabled:      true,
+		},
+		{
+			ID:           "small",
+			Path:         "/small",
+			ContentTypes: []string{StorageContentLXC},
+			Enabled:      true,
+		},
+	}}
+
+	free := map[string]int64{
+		"primary": 20 * 1024 * 1024 * 1024,
+		"large":   50 * 1024 * 1024 * 1024,
+		"small":   10 * 1024 * 1024 * 1024,
+	}
+	probeStoragePoolFreeBytes = func(pool StoragePool) (int64, bool) {
+		value, ok := free[pool.ID]
+		return value, ok
+	}
+
+	pool, err := SelectStoragePoolForContent(StorageContentLXC, "", 5*1024*1024*1024)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if pool.ID != "primary" {
+		t.Fatalf("selected %q, want configured default primary", pool.ID)
+	}
+
+	free["primary"] = 128 * 1024 * 1024
+	pool, err = SelectStoragePoolForContent(StorageContentLXC, "", 5*1024*1024*1024)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if pool.ID != "large" {
+		t.Fatalf("selected %q, want largest fallback pool", pool.ID)
+	}
+
+	pool, err = SelectStoragePoolForContent(StorageContentLXC, "small", 5*1024*1024*1024)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if pool.ID != "small" {
+		t.Fatalf("selected %q, want requested pool", pool.ID)
+	}
+}
+
+func TestSelectStoragePoolRequiresEnabledContent(t *testing.T) {
+	previousConfig := AppConfig
+	previousProbe := probeStoragePoolFreeBytes
+	t.Cleanup(func() {
+		AppConfig = previousConfig
+		probeStoragePoolFreeBytes = previousProbe
+	})
+
+	AppConfig = &ClicdConfig{StoragePools: []StoragePool{{
+		ID:           "primary",
+		Path:         "/primary",
+		ContentTypes: []string{StorageContentLXC},
+		Enabled:      true,
+	}}}
+	probeStoragePoolFreeBytes = func(StoragePool) (int64, bool) { return 100 * 1024 * 1024 * 1024, true }
+
+	if _, err := SelectStoragePoolForContent(StorageContentSnapshots, "", 0); err == nil {
+		t.Fatal("expected snapshots selection to fail when no pool enables snapshots")
+	}
+}

backend/internal/config/store_sqlite.go

@@ -23,6 +23,7 @@ type savedTaskConfig struct {
 	Name                 string        `json:"name"`
 	Virtualization       string        `json:"virtualization,omitempty"`
 	TemplateID           string        `json:"template_id"`
+	StoragePoolID        string        `json:"storage_pool_id,omitempty"`
 	VCPU                 float64       `json:"vcpu"`
 	CPUPercent           int           `json:"cpu_percent"`
 	RAMMB                int           `json:"ram_mb"`
@@ -38,9 +39,18 @@ type savedTaskConfig struct {
 	IOReadMBps           int           `json:"io_read_mbps"`
 	IOWriteMBps          int           `json:"io_write_mbps"`
 	ExtraPorts           []int         `json:"extra_ports"`
+	NATPortMappings      []PortMapping `json:"nat_port_mappings,omitempty"`
+	ManagementPort       int           `json:"management_port,omitempty"`
 	PortMappingCount     int           `json:"port_mapping_count"`
 	AssignNAT            *bool         `json:"assign_nat,omitempty"`
+	LANIPv4Mode          string        `json:"lan_ipv4_mode,omitempty"`
+	LANInterface         string        `json:"lan_interface,omitempty"`
+	LANIPv4Address       string        `json:"lan_ipv4_address,omitempty"`
+	LANIPv4PrefixLen     int           `json:"lan_ipv4_prefix_len,omitempty"`
+	LANIPv4Gateway       string        `json:"lan_ipv4_gateway,omitempty"`
 	SnapshotLimit        int           `json:"snapshot_limit"`
+	AllowedImageIDs      []string      `json:"allowed_image_ids,omitempty"`
+	ImageLimitConfigured bool          `json:"image_limit_configured,omitempty"`
 	AssignIPv4           bool          `json:"assign_ipv4"`
 	IPv4Count            int           `json:"ipv4_count,omitempty"`
 	PublicIPv4s          []string      `json:"public_ipv4s,omitempty"`
@@ -183,6 +193,8 @@ func ensureSchema() error {
 			lxc_name TEXT,
 			kvm_name TEXT,
 			disk_image TEXT,
+			storage_pool_id TEXT,
+			storage_path TEXT,
 			mac_address TEXT,
 			template TEXT,
 			vcpu REAL,
@@ -202,7 +214,13 @@ func ensureSchema() error {
 			io_read_mbps INTEGER NOT NULL DEFAULT 0,
 			io_write_mbps INTEGER NOT NULL DEFAULT 0,
 			status TEXT,
+			restore_on_host_boot INTEGER NOT NULL DEFAULT 0,
 			ip TEXT,
+			lan_ipv4_mode TEXT,
+			lan_interface TEXT,
+			lan_ipv4_address TEXT,
+			lan_ipv4_prefix_len INTEGER,
+			lan_ipv4_gateway TEXT,
 			ipv6 TEXT,
 			ipv6_prefix_len INTEGER,
 			ipv6_interface TEXT,
@@ -222,7 +240,9 @@ func ensureSchema() error {
 			snapshot_schedule_created_by TEXT,
 			policy_blocked INTEGER,
 			policy_blocked_reason TEXT,
-			policy_blocked_at TEXT
+			policy_blocked_at TEXT,
+			allowed_image_ids TEXT,
+			image_limit_configured INTEGER NOT NULL DEFAULT 0
 		)`,
 		`CREATE TABLE IF NOT EXISTS port_mappings (
 			container_id INTEGER NOT NULL,
@@ -258,7 +278,9 @@ func ensureSchema() error {
 			pass_hash TEXT,
 			access_code TEXT,
 			created_at TEXT,
-			token_version INTEGER
+			token_version INTEGER,
+			allowed_image_ids TEXT,
+			image_limit_configured INTEGER NOT NULL DEFAULT 0
 		)`,
 		`CREATE TABLE IF NOT EXISTS sub_user_container_names (
 			sub_user_id TEXT NOT NULL,
@@ -336,8 +358,14 @@ func ensureSchema() error {
 			cfg_io_speed_mbps INTEGER,
 			cfg_io_read_mbps INTEGER NOT NULL DEFAULT 0,
 			cfg_io_write_mbps INTEGER NOT NULL DEFAULT 0,
+			cfg_management_port INTEGER NOT NULL DEFAULT 0,
 			cfg_port_mapping_count INTEGER,
 			cfg_assign_nat INTEGER,
+			cfg_lan_ipv4_mode TEXT,
+			cfg_lan_interface TEXT,
+			cfg_lan_ipv4_address TEXT,
+			cfg_lan_ipv4_prefix_len INTEGER,
+			cfg_lan_ipv4_gateway TEXT,
 			cfg_snapshot_limit INTEGER,
 			cfg_assign_ipv4 INTEGER,
 			cfg_ipv4_count INTEGER,
@@ -348,6 +376,8 @@ func ensureSchema() error {
 			cfg_ssh_auth_mode TEXT,
 			cfg_ssh_password TEXT,
 			cfg_ssh_public_key TEXT,
+			cfg_allowed_image_ids TEXT,
+			cfg_image_limit_configured INTEGER NOT NULL DEFAULT 0,
 			cfg_expires_at TEXT
 		)`,
 		`CREATE TABLE IF NOT EXISTS task_extra_ports (
@@ -356,6 +386,15 @@ func ensureSchema() error {
 			port INTEGER NOT NULL,
 			PRIMARY KEY (task_id, position)
 		)`,
+		`CREATE TABLE IF NOT EXISTS task_nat_port_mappings (
+			task_id TEXT NOT NULL,
+			position INTEGER NOT NULL,
+			host_port INTEGER NOT NULL,
+			container_port INTEGER NOT NULL,
+			protocol TEXT,
+			description TEXT,
+			PRIMARY KEY (task_id, position)
+		)`,
 		`CREATE TABLE IF NOT EXISTS login_logs (
 			id INTEGER PRIMARY KEY AUTOINCREMENT,
 			time TEXT,
@@ -406,18 +445,28 @@ func ensureSchemaMigrations() error {
 		{"tasks", "cfg_network_up_mbps", "INTEGER NOT NULL DEFAULT 0"},
 		{"tasks", "cfg_io_read_mbps", "INTEGER NOT NULL DEFAULT 0"},
 		{"tasks", "cfg_io_write_mbps", "INTEGER NOT NULL DEFAULT 0"},
+		{"tasks", "cfg_management_port", "INTEGER NOT NULL DEFAULT 0"},
 		{"tasks", "cfg_assign_ipv4", "INTEGER"},
 		{"tasks", "cfg_ipv4_count", "INTEGER"},
 		{"tasks", "cfg_public_ipv4s", "TEXT"},
 		{"tasks", "cfg_assign_nat", "INTEGER"},
+		{"tasks", "cfg_lan_ipv4_mode", "TEXT"},
+		{"tasks", "cfg_lan_interface", "TEXT"},
+		{"tasks", "cfg_lan_ipv4_address", "TEXT NOT NULL DEFAULT ''"},
+		{"tasks", "cfg_lan_ipv4_prefix_len", "INTEGER NOT NULL DEFAULT 0"},
+		{"tasks", "cfg_lan_ipv4_gateway", "TEXT NOT NULL DEFAULT ''"},
 		{"tasks", "cfg_ipv6_count", "INTEGER"},
 		{"tasks", "cfg_ipv6_addresses", "TEXT"},
 		{"tasks", "cfg_ssh_auth_mode", "TEXT"},
 		{"tasks", "cfg_ssh_password", "TEXT"},
 		{"tasks", "cfg_ssh_public_key", "TEXT"},
+		{"tasks", "cfg_allowed_image_ids", "TEXT"},
+		{"tasks", "cfg_image_limit_configured", "INTEGER NOT NULL DEFAULT 0"},
 		{"port_mappings", "host_ip", "TEXT"},
 		{"container_public_ipv4s", "prefix_len", "INTEGER"},
 		{"container_public_ipv4s", "gateway", "TEXT"},
+		{"sub_users", "allowed_image_ids", "TEXT"},
+		{"sub_users", "image_limit_configured", "INTEGER NOT NULL DEFAULT 0"},
 		{"containers", "network_down_mbps", "INTEGER NOT NULL DEFAULT 0"},
 		{"containers", "network_up_mbps", "INTEGER NOT NULL DEFAULT 0"},
 		{"containers", "io_read_mbps", "INTEGER NOT NULL DEFAULT 0"},
@@ -425,6 +474,16 @@ func ensureSchemaMigrations() error {
 		{"containers", "firewall_enabled", "INTEGER NOT NULL DEFAULT 0"},
 		{"containers", "firewall_default_action", "TEXT NOT NULL DEFAULT 'DROP'"},
 		{"containers", "firewall_rules", "TEXT"},
+		{"containers", "allowed_image_ids", "TEXT"},
+		{"containers", "image_limit_configured", "INTEGER NOT NULL DEFAULT 0"},
+		{"containers", "restore_on_host_boot", "INTEGER NOT NULL DEFAULT 0"},
+		{"containers", "storage_pool_id", "TEXT"},
+		{"containers", "storage_path", "TEXT"},
+		{"containers", "lan_ipv4_mode", "TEXT"},
+		{"containers", "lan_interface", "TEXT"},
+		{"containers", "lan_ipv4_address", "TEXT NOT NULL DEFAULT ''"},
+		{"containers", "lan_ipv4_prefix_len", "INTEGER NOT NULL DEFAULT 0"},
+		{"containers", "lan_ipv4_gateway", "TEXT NOT NULL DEFAULT ''"},
 	} {
 		wasAdded, err := ensureColumn(column.table, column.name, column.def)
 		if err != nil {
@@ -466,6 +525,27 @@ func ensureSchemaMigrations() error {
 			return err
 		}
 	}
+	if _, err := db.Exec(`UPDATE containers
+		SET lan_ipv4_mode = COALESCE(lan_ipv4_mode, ''),
+		    lan_interface = COALESCE(lan_interface, ''),
+		    lan_ipv4_address = COALESCE(lan_ipv4_address, ''),
+		    lan_ipv4_prefix_len = COALESCE(lan_ipv4_prefix_len, 0),
+		    lan_ipv4_gateway = COALESCE(lan_ipv4_gateway, '')`); err != nil {
+		return err
+	}
+	if _, err := db.Exec(`UPDATE containers
+		SET storage_pool_id = COALESCE(storage_pool_id, ''),
+		    storage_path = COALESCE(storage_path, '')`); err != nil {
+		return err
+	}
+	if _, err := db.Exec(`UPDATE tasks
+		SET cfg_lan_ipv4_mode = COALESCE(cfg_lan_ipv4_mode, ''),
+		    cfg_lan_interface = COALESCE(cfg_lan_interface, ''),
+		    cfg_lan_ipv4_address = COALESCE(cfg_lan_ipv4_address, ''),
+		    cfg_lan_ipv4_prefix_len = COALESCE(cfg_lan_ipv4_prefix_len, 0),
+		    cfg_lan_ipv4_gateway = COALESCE(cfg_lan_ipv4_gateway, '')`); err != nil {
+		return err
+	}
 	return nil
 }
 
@@ -526,8 +606,11 @@ func loadConfigFromDB() (*ClicdConfig, bool, error) {
 		NextSSHPort:          atoi(meta["next_ssh_port"]),
 		NATPortStart:         atoi(meta["nat_port_start"]),
 		NATPortEnd:           atoi(meta["nat_port_end"]),
+		LXCNATSubnet:         meta["lxc_nat_subnet"],
+		KVMNATSubnet:         meta["kvm_nat_subnet"],
 		SetupComplete:        atob(meta["setup_complete"]),
 		SecurityAutoShutdown: atob(meta["security_auto_shutdown"]),
+		TaskConcurrency:      atoi(meta["task_concurrency"]),
 		Language:             meta["language"],
 	}
 	if raw := strings.TrimSpace(meta["ssl"]); raw != "" {
@@ -545,6 +628,18 @@ func loadConfigFromDB() (*ClicdConfig, bool, error) {
 	if raw := strings.TrimSpace(meta["webssh_allowed_origins"]); raw != "" {
 		_ = json.Unmarshal([]byte(raw), &cfg.WebSSHAllowedOrigins)
 	}
+	if raw := strings.TrimSpace(meta["panel_access_policy"]); raw != "" {
+		_ = json.Unmarshal([]byte(raw), &cfg.PanelAccessPolicy)
+	}
+	if raw := strings.TrimSpace(meta["storage_pools"]); raw != "" {
+		_ = json.Unmarshal([]byte(raw), &cfg.StoragePools)
+	}
+	if raw := strings.TrimSpace(meta["custom_kvm_images"]); raw != "" {
+		_ = json.Unmarshal([]byte(raw), &cfg.CustomKVMImages)
+	}
+	if raw := strings.TrimSpace(meta["custom_lxc_images"]); raw != "" {
+		_ = json.Unmarshal([]byte(raw), &cfg.CustomLXCImages)
+	}
 
 	if cfg.Containers, err = loadContainers(); err != nil {
 		return nil, false, err
@@ -597,6 +692,7 @@ func saveConfigToDB() error {
 		"api_keys",
 		"audit_logs",
 		"task_extra_ports",
+		"task_nat_port_mappings",
 		"tasks",
 		"login_logs",
 		"enabled_images",
@@ -644,6 +740,10 @@ func saveMeta(tx *sql.Tx) error {
 	publicIPv4PoolJSON, _ := json.Marshal(AppConfig.PublicIPv4Pool)
 	publicIPv6PrefixesJSON, _ := json.Marshal(AppConfig.PublicIPv6Prefixes)
 	webSSHAllowedOriginsJSON, _ := json.Marshal(AppConfig.WebSSHAllowedOrigins)
+	panelAccessPolicyJSON, _ := json.Marshal(AppConfig.PanelAccessPolicy)
+	storagePoolsJSON, _ := json.Marshal(AppConfig.StoragePools)
+	customKVMImagesJSON, _ := json.Marshal(AppConfig.CustomKVMImages)
+	customLXCImagesJSON, _ := json.Marshal(AppConfig.CustomLXCImages)
 	values := map[string]string{
 		"admin_user":             AppConfig.AdminUser,
 		"admin_pass_hash":        AppConfig.AdminPassHash,
@@ -655,14 +755,21 @@ func saveMeta(tx *sql.Tx) error {
 		"next_ssh_port":          strconv.Itoa(AppConfig.NextSSHPort),
 		"nat_port_start":         strconv.Itoa(AppConfig.NATPortStart),
 		"nat_port_end":           strconv.Itoa(AppConfig.NATPortEnd),
+		"lxc_nat_subnet":         AppConfig.LXCNATSubnet,
+		"kvm_nat_subnet":         AppConfig.KVMNATSubnet,
 		"setup_complete":         btoa(AppConfig.SetupComplete),
 		"security_auto_shutdown": btoa(AppConfig.SecurityAutoShutdown),
+		"task_concurrency":       strconv.Itoa(AppConfig.TaskConcurrency),
 		"language":               NormalizeLanguage(AppConfig.Language),
 		"ssl":                    string(sslJSON),
 		"ssl_certificates":       string(sslCertificatesJSON),
 		"public_ipv4_pool":       string(publicIPv4PoolJSON),
 		"public_ipv6_prefixes":   string(publicIPv6PrefixesJSON),
 		"webssh_allowed_origins": string(webSSHAllowedOriginsJSON),
+		"panel_access_policy":    string(panelAccessPolicyJSON),
+		"storage_pools":          string(storagePoolsJSON),
+		"custom_kvm_images":      string(customKVMImagesJSON),
+		"custom_lxc_images":      string(customLXCImagesJSON),
 		"schema_version":         "1",
 		"updated_at":             time.Now().Format("2006-01-02 15:04:05"),
 	}
@@ -677,30 +784,33 @@ func saveMeta(tx *sql.Tx) error {
 func saveContainers(tx *sql.Tx) error {
 	for _, c := range AppConfig.Containers {
 		NormalizeContainerResourceAliases(&c)
+		allowedImageIDs := encodeStringSlice(c.AllowedImageIDs)
 		if _, err := tx.Exec(`INSERT INTO containers (
-			id, uuid, name, virtualization, lxc_name, kvm_name, disk_image, mac_address, template,
+			id, uuid, name, virtualization, lxc_name, kvm_name, disk_image, storage_pool_id, storage_path, mac_address, template,
 			vcpu, ram_mb, disk_gb, network_bw_mbps, network_down_mbps, network_up_mbps,
 			monthly_traffic_gb, traffic_mode, traffic_in_gb,
 			traffic_out_gb, traffic_used_rx, traffic_used_tx, traffic_reset_date,
 			io_speed_mbps, io_read_mbps, io_write_mbps,
-			status, ip, ipv6, ipv6_prefix_len, ipv6_interface, vnc_port, ssh_port, ssh_password,
+			status, restore_on_host_boot, ip, lan_ipv4_mode, lan_interface, lan_ipv4_address, lan_ipv4_prefix_len, lan_ipv4_gateway,
+			ipv6, ipv6_prefix_len, ipv6_interface, vnc_port, ssh_port, ssh_password,
 			ssh_host_key, port_mapping_limit, snapshot_limit, created_at, expires_at,
 			snapshot_schedule_enabled, snapshot_schedule_interval_hours, snapshot_schedule_time,
 			snapshot_schedule_last_run, snapshot_schedule_next_run, snapshot_schedule_created_by,
 			policy_blocked, policy_blocked_reason, policy_blocked_at,
-			firewall_enabled, firewall_default_action, firewall_rules
-		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-			c.ID, c.UUID, c.Name, c.Virtualization, c.LXCName, c.KVMName, c.DiskImage, c.MACAddress, c.Template,
+			firewall_enabled, firewall_default_action, firewall_rules, allowed_image_ids, image_limit_configured
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+			c.ID, c.UUID, c.Name, c.Virtualization, c.LXCName, c.KVMName, c.DiskImage, c.StoragePoolID, c.StoragePath, c.MACAddress, c.Template,
 			c.VCPU, c.RAMMB, c.DiskGB, c.NetworkBWMbps, c.NetworkDownMbps, c.NetworkUpMbps,
 			c.MonthlyTrafficGB, c.TrafficMode, c.TrafficInGB,
 			c.TrafficOutGB, c.TrafficUsedRX, c.TrafficUsedTX, c.TrafficResetDate,
 			c.IOSpeedMBps, c.IOReadMBps, c.IOWriteMBps,
-			c.Status, c.IP, c.IPv6, c.IPv6PrefixLen, c.IPv6Interface, c.VNCPort, c.SSHPort, c.SSHPassword,
+			c.Status, boolInt(c.RestoreOnHostBoot), c.IP, c.LANIPv4Mode, c.LANInterface, c.LANIPv4Address, c.LANIPv4PrefixLen, c.LANIPv4Gateway,
+			c.IPv6, c.IPv6PrefixLen, c.IPv6Interface, c.VNCPort, c.SSHPort, c.SSHPassword,
 			c.SSHHostKey, c.PortMappingLimit, c.SnapshotLimit, c.CreatedAt, c.ExpiresAt,
 			boolInt(c.SnapshotScheduleEnabled), c.SnapshotScheduleIntervalHours, c.SnapshotScheduleTime,
 			c.SnapshotScheduleLastRun, c.SnapshotScheduleNextRun, c.SnapshotScheduleCreatedBy,
 			boolInt(c.PolicyBlocked), c.PolicyBlockedReason, c.PolicyBlockedAt,
-			boolInt(c.FirewallEnabled), normalizeFirewallDefaultAction(c.FirewallDefaultAction), marshalFirewallRules(c.FirewallRules),
+			boolInt(c.FirewallEnabled), normalizeFirewallDefaultAction(c.FirewallDefaultAction), marshalFirewallRules(c.FirewallRules), allowedImageIDs, boolInt(c.ImageLimitConfigured),
 		); err != nil {
 			return err
 		}
@@ -728,8 +838,9 @@ func saveContainers(tx *sql.Tx) error {
 
 func saveSubUsers(tx *sql.Tx) error {
 	for _, su := range AppConfig.SubUsers {
-		if _, err := tx.Exec(`INSERT INTO sub_users(id, username, password, pass_hash, access_code, created_at, token_version)
-			VALUES (?, ?, ?, ?, ?, ?, ?)`, su.ID, su.Username, su.Password, su.PassHash, su.AccessCode, su.CreatedAt, su.TokenVersion); err != nil {
+		allowedImageIDs := encodeStringSlice(su.AllowedImageIDs)
+		if _, err := tx.Exec(`INSERT INTO sub_users(id, username, password, pass_hash, access_code, created_at, token_version, allowed_image_ids, image_limit_configured)
+			VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, su.ID, su.Username, su.Password, su.PassHash, su.AccessCode, su.CreatedAt, su.TokenVersion, allowedImageIDs, boolInt(su.ImageLimitConfigured)); err != nil {
 			return err
 		}
 		for i, name := range su.ContainerNames {
@@ -838,19 +949,21 @@ func saveTasksDB(tx *sql.Tx) error {
 			cfg_network_bw_mbps, cfg_network_down_mbps, cfg_network_up_mbps,
 			cfg_monthly_traffic_gb, cfg_traffic_mode, cfg_traffic_in_gb,
 			cfg_traffic_out_gb, cfg_io_speed_mbps, cfg_io_read_mbps, cfg_io_write_mbps,
-			cfg_port_mapping_count, cfg_assign_nat, cfg_snapshot_limit,
+			cfg_management_port, cfg_port_mapping_count, cfg_assign_nat, cfg_lan_ipv4_mode, cfg_lan_interface,
+			cfg_lan_ipv4_address, cfg_lan_ipv4_prefix_len, cfg_lan_ipv4_gateway, cfg_snapshot_limit,
 			cfg_assign_ipv4, cfg_ipv4_count, cfg_public_ipv4s, cfg_assign_ipv6, cfg_ipv6_count, cfg_ipv6_addresses,
-			cfg_ssh_auth_mode, cfg_ssh_password, cfg_ssh_public_key, cfg_expires_at
-		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+			cfg_ssh_auth_mode, cfg_ssh_password, cfg_ssh_public_key, cfg_allowed_image_ids, cfg_image_limit_configured, cfg_expires_at
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 			task.ID, task.Type, task.ContainerID, task.ContainerName, task.Status, task.Error, task.CreatedAt, task.TemplateID, task.User, task.IP, task.UserAgent,
 			cfg.Name, cfg.Virtualization, cfg.TemplateID, cfg.VCPU, cfg.CPUPercent, cfg.RAMMB, cfg.DiskGB,
 			cfg.NetworkBWMbps, cfg.NetworkDownMbps, cfg.NetworkUpMbps,
 			cfg.MonthlyTrafficGB, cfg.TrafficMode, cfg.TrafficInGB,
 			cfg.TrafficOutGB, cfg.IOSpeedMBps, cfg.IOReadMBps, cfg.IOWriteMBps,
-			cfg.PortMappingCount, boolPtrInt(cfg.AssignNAT), cfg.SnapshotLimit,
+			cfg.ManagementPort, cfg.PortMappingCount, boolPtrInt(cfg.AssignNAT), cfg.LANIPv4Mode, cfg.LANInterface,
+			cfg.LANIPv4Address, cfg.LANIPv4PrefixLen, cfg.LANIPv4Gateway, cfg.SnapshotLimit,
 			boolInt(cfg.AssignIPv4), cfg.IPv4Count, encodeStringSlice(cfg.PublicIPv4s),
 			boolInt(cfg.AssignIPv6), cfg.IPv6Count, encodeStringSlice(cfg.IPv6Addresses),
-			cfg.SSHAuthMode, cfg.SSHPassword, cfg.SSHPublicKey, cfg.ExpiresAt,
+			cfg.SSHAuthMode, cfg.SSHPassword, cfg.SSHPublicKey, encodeStringSlice(cfg.AllowedImageIDs), boolInt(cfg.ImageLimitConfigured), cfg.ExpiresAt,
 		); err != nil {
 			return err
 		}
@@ -859,6 +972,14 @@ func saveTasksDB(tx *sql.Tx) error {
 				return err
 			}
 		}
+		for i, mapping := range cfg.NATPortMappings {
+			if _, err := tx.Exec(`INSERT INTO task_nat_port_mappings(task_id, position, host_port, container_port, protocol, description)
+				VALUES (?, ?, ?, ?, ?, ?)`,
+				task.ID, i, mapping.HostPort, mapping.ContainerPort, mapping.Protocol, mapping.Description,
+			); err != nil {
+				return err
+			}
+		}
 	}
 	return nil
 }
@@ -894,17 +1015,18 @@ func saveSnapshots(tx *sql.Tx) error {
 
 func loadContainers() ([]Container, error) {
 	rows, err := db.Query(`SELECT
-		id, uuid, name, virtualization, lxc_name, kvm_name, disk_image, mac_address, template,
+		id, uuid, name, virtualization, lxc_name, kvm_name, disk_image, storage_pool_id, storage_path, mac_address, template,
 		vcpu, ram_mb, disk_gb, network_bw_mbps, network_down_mbps, network_up_mbps,
 		monthly_traffic_gb, traffic_mode, traffic_in_gb,
 		traffic_out_gb, traffic_used_rx, traffic_used_tx, traffic_reset_date,
 		io_speed_mbps, io_read_mbps, io_write_mbps,
-		status, ip, ipv6, ipv6_prefix_len, ipv6_interface, vnc_port, ssh_port, ssh_password,
+		status, restore_on_host_boot, ip, lan_ipv4_mode, lan_interface, lan_ipv4_address, lan_ipv4_prefix_len, lan_ipv4_gateway,
+		ipv6, ipv6_prefix_len, ipv6_interface, vnc_port, ssh_port, ssh_password,
 		ssh_host_key, port_mapping_limit, snapshot_limit, created_at, expires_at,
 		snapshot_schedule_enabled, snapshot_schedule_interval_hours, snapshot_schedule_time,
 		snapshot_schedule_last_run, snapshot_schedule_next_run, snapshot_schedule_created_by,
 		policy_blocked, policy_blocked_reason, policy_blocked_at,
-		firewall_enabled, firewall_default_action, firewall_rules
+		firewall_enabled, firewall_default_action, firewall_rules, allowed_image_ids, image_limit_configured
 		FROM containers ORDER BY id`)
 	if err != nil {
 		return nil, err
@@ -914,31 +1036,48 @@ func loadContainers() ([]Container, error) {
 	result := []Container{}
 	for rows.Next() {
 		var c Container
-		var scheduleEnabled, policyBlocked, firewallEnabled int
+		var scheduleEnabled, policyBlocked, firewallEnabled, imageLimitConfigured, restoreOnHostBoot int
 		var firewallDefaultAction string
-		var firewallRulesJSON sql.NullString
+		var firewallRulesJSON, allowedImageIDs sql.NullString
+		var storagePoolID, storagePath sql.NullString
+		var lanIPv4Mode, lanInterface sql.NullString
+		var lanIPv4Address, lanIPv4Gateway sql.NullString
+		var lanIPv4PrefixLen sql.NullInt64
 		if err := rows.Scan(
-			&c.ID, &c.UUID, &c.Name, &c.Virtualization, &c.LXCName, &c.KVMName, &c.DiskImage, &c.MACAddress, &c.Template,
+			&c.ID, &c.UUID, &c.Name, &c.Virtualization, &c.LXCName, &c.KVMName, &c.DiskImage, &storagePoolID, &storagePath, &c.MACAddress, &c.Template,
 			&c.VCPU, &c.RAMMB, &c.DiskGB, &c.NetworkBWMbps, &c.NetworkDownMbps, &c.NetworkUpMbps,
 			&c.MonthlyTrafficGB, &c.TrafficMode, &c.TrafficInGB,
 			&c.TrafficOutGB, &c.TrafficUsedRX, &c.TrafficUsedTX, &c.TrafficResetDate,
 			&c.IOSpeedMBps, &c.IOReadMBps, &c.IOWriteMBps,
-			&c.Status, &c.IP, &c.IPv6, &c.IPv6PrefixLen, &c.IPv6Interface, &c.VNCPort, &c.SSHPort, &c.SSHPassword,
+			&c.Status, &restoreOnHostBoot, &c.IP, &lanIPv4Mode, &lanInterface, &lanIPv4Address, &lanIPv4PrefixLen, &lanIPv4Gateway,
+			&c.IPv6, &c.IPv6PrefixLen, &c.IPv6Interface, &c.VNCPort, &c.SSHPort, &c.SSHPassword,
 			&c.SSHHostKey, &c.PortMappingLimit, &c.SnapshotLimit, &c.CreatedAt, &c.ExpiresAt,
 			&scheduleEnabled, &c.SnapshotScheduleIntervalHours, &c.SnapshotScheduleTime,
 			&c.SnapshotScheduleLastRun, &c.SnapshotScheduleNextRun, &c.SnapshotScheduleCreatedBy,
 			&policyBlocked, &c.PolicyBlockedReason, &c.PolicyBlockedAt,
-			&firewallEnabled, &firewallDefaultAction, &firewallRulesJSON,
+			&firewallEnabled, &firewallDefaultAction, &firewallRulesJSON, &allowedImageIDs, &imageLimitConfigured,
 		); err != nil {
 			return nil, err
 		}
+		c.StoragePoolID = storagePoolID.String
+		c.StoragePath = storagePath.String
+		c.LANIPv4Mode = lanIPv4Mode.String
+		c.LANInterface = lanInterface.String
+		c.LANIPv4Address = lanIPv4Address.String
+		if lanIPv4PrefixLen.Valid {
+			c.LANIPv4PrefixLen = int(lanIPv4PrefixLen.Int64)
+		}
+		c.LANIPv4Gateway = lanIPv4Gateway.String
 		c.SnapshotScheduleEnabled = scheduleEnabled != 0
+		c.RestoreOnHostBoot = restoreOnHostBoot != 0
 		c.PolicyBlocked = policyBlocked != 0
 		c.FirewallEnabled = firewallEnabled != 0
 		c.FirewallDefaultAction = normalizeFirewallDefaultAction(firewallDefaultAction)
+		c.ImageLimitConfigured = imageLimitConfigured != 0
 		if firewallRulesJSON.Valid && strings.TrimSpace(firewallRulesJSON.String) != "" {
 			_ = json.Unmarshal([]byte(firewallRulesJSON.String), &c.FirewallRules)
 		}
+		c.AllowedImageIDs = decodeStringSlice(allowedImageIDs.String)
 		NormalizeContainerResourceAliases(&c)
 		result = append(result, c)
 	}
@@ -1034,7 +1173,7 @@ func loadContainerIPv6Addresses(containerID int) ([]IPv6Assignment, error) {
 }
 
 func loadSubUsers() ([]SubUser, error) {
-	rows, err := db.Query(`SELECT id, username, password, pass_hash, access_code, created_at, token_version FROM sub_users ORDER BY created_at, id`)
+	rows, err := db.Query(`SELECT id, username, password, pass_hash, access_code, created_at, token_version, allowed_image_ids, image_limit_configured FROM sub_users ORDER BY created_at, id`)
 	if err != nil {
 		return nil, err
 	}
@@ -1042,9 +1181,13 @@ func loadSubUsers() ([]SubUser, error) {
 	result := []SubUser{}
 	for rows.Next() {
 		var su SubUser
-		if err := rows.Scan(&su.ID, &su.Username, &su.Password, &su.PassHash, &su.AccessCode, &su.CreatedAt, &su.TokenVersion); err != nil {
+		var allowedImageIDs sql.NullString
+		var imageLimitConfigured int
+		if err := rows.Scan(&su.ID, &su.Username, &su.Password, &su.PassHash, &su.AccessCode, &su.CreatedAt, &su.TokenVersion, &allowedImageIDs, &imageLimitConfigured); err != nil {
 			return nil, err
 		}
+		su.AllowedImageIDs = decodeStringSlice(allowedImageIDs.String)
+		su.ImageLimitConfigured = imageLimitConfigured != 0
 		result = append(result, su)
 	}
 	if err := rows.Err(); err != nil {
@@ -1136,9 +1279,10 @@ func loadTasks() ([]SavedTask, error) {
 		cfg_network_bw_mbps, cfg_network_down_mbps, cfg_network_up_mbps,
 		cfg_monthly_traffic_gb, cfg_traffic_mode, cfg_traffic_in_gb,
 		cfg_traffic_out_gb, cfg_io_speed_mbps, cfg_io_read_mbps, cfg_io_write_mbps,
-		cfg_port_mapping_count, cfg_assign_nat, cfg_snapshot_limit,
+		cfg_management_port, cfg_port_mapping_count, cfg_assign_nat, cfg_lan_ipv4_mode, cfg_lan_interface,
+		cfg_lan_ipv4_address, cfg_lan_ipv4_prefix_len, cfg_lan_ipv4_gateway, cfg_snapshot_limit,
 		cfg_assign_ipv4, cfg_ipv4_count, cfg_public_ipv4s, cfg_assign_ipv6, cfg_ipv6_count, cfg_ipv6_addresses,
-		cfg_ssh_auth_mode, cfg_ssh_password, cfg_ssh_public_key, cfg_expires_at
+		cfg_ssh_auth_mode, cfg_ssh_password, cfg_ssh_public_key, cfg_allowed_image_ids, cfg_image_limit_configured, cfg_expires_at
 		FROM tasks ORDER BY created_at, id`)
 	if err != nil {
 		return nil, err
@@ -1149,19 +1293,20 @@ func loadTasks() ([]SavedTask, error) {
 	for rows.Next() {
 		var t SavedTask
 		var cfg savedTaskConfig
-		var assignIPv4, assignIPv6 int
+		var assignIPv4, assignIPv6, imageLimitConfigured int
 		var ip, userAgent, publicIPv4s, ipv6Addresses sql.NullString
-		var sshAuthMode, sshPassword, sshPublicKey sql.NullString
-		var assignNAT, ipv4Count, ipv6Count sql.NullInt64
+		var lanIPv4Mode, lanInterface, lanIPv4Address, lanIPv4Gateway, sshAuthMode, sshPassword, sshPublicKey, allowedImageIDs sql.NullString
+		var assignNAT, lanIPv4PrefixLen, ipv4Count, ipv6Count sql.NullInt64
 		if err := rows.Scan(
 			&t.ID, &t.Type, &t.ContainerID, &t.ContainerName, &t.Status, &t.Error, &t.CreatedAt, &t.TemplateID, &t.User, &ip, &userAgent,
 			&cfg.Name, &cfg.Virtualization, &cfg.TemplateID, &cfg.VCPU, &cfg.CPUPercent, &cfg.RAMMB, &cfg.DiskGB,
 			&cfg.NetworkBWMbps, &cfg.NetworkDownMbps, &cfg.NetworkUpMbps,
 			&cfg.MonthlyTrafficGB, &cfg.TrafficMode, &cfg.TrafficInGB,
 			&cfg.TrafficOutGB, &cfg.IOSpeedMBps, &cfg.IOReadMBps, &cfg.IOWriteMBps,
-			&cfg.PortMappingCount, &assignNAT, &cfg.SnapshotLimit,
+			&cfg.ManagementPort, &cfg.PortMappingCount, &assignNAT, &lanIPv4Mode, &lanInterface,
+			&lanIPv4Address, &lanIPv4PrefixLen, &lanIPv4Gateway, &cfg.SnapshotLimit,
 			&assignIPv4, &ipv4Count, &publicIPv4s, &assignIPv6, &ipv6Count, &ipv6Addresses,
-			&sshAuthMode, &sshPassword, &sshPublicKey, &cfg.ExpiresAt,
+			&sshAuthMode, &sshPassword, &sshPublicKey, &allowedImageIDs, &imageLimitConfigured, &cfg.ExpiresAt,
 		); err != nil {
 			return nil, err
 		}
@@ -1171,6 +1316,13 @@ func loadTasks() ([]SavedTask, error) {
 			value := assignNAT.Int64 != 0
 			cfg.AssignNAT = &value
 		}
+		cfg.LANIPv4Mode = lanIPv4Mode.String
+		cfg.LANInterface = lanInterface.String
+		cfg.LANIPv4Address = lanIPv4Address.String
+		if lanIPv4PrefixLen.Valid {
+			cfg.LANIPv4PrefixLen = int(lanIPv4PrefixLen.Int64)
+		}
+		cfg.LANIPv4Gateway = lanIPv4Gateway.String
 		cfg.AssignIPv4 = assignIPv4 != 0
 		if ipv4Count.Valid {
 			cfg.IPv4Count = int(ipv4Count.Int64)
@@ -1184,6 +1336,8 @@ func loadTasks() ([]SavedTask, error) {
 		cfg.SSHAuthMode = sshAuthMode.String
 		cfg.SSHPassword = sshPassword.String
 		cfg.SSHPublicKey = sshPublicKey.String
+		cfg.AllowedImageIDs = decodeStringSlice(allowedImageIDs.String)
+		cfg.ImageLimitConfigured = imageLimitConfigured != 0
 		normalizeSavedTaskConfigLimits(&cfg)
 		result = append(result, t)
 		configs = append(configs, cfg)
@@ -1199,6 +1353,10 @@ func loadTasks() ([]SavedTask, error) {
 		if err != nil {
 			return nil, err
 		}
+		configs[i].NATPortMappings, err = loadTaskNATPortMappings(result[i].ID)
+		if err != nil {
+			return nil, err
+		}
 		result[i].Config = encodeSavedTaskConfig(configs[i])
 	}
 	return result, nil
@@ -1221,6 +1379,24 @@ func loadTaskExtraPorts(taskID string) ([]int, error) {
 	return result, rows.Err()
 }
 
+func loadTaskNATPortMappings(taskID string) ([]PortMapping, error) {
+	rows, err := db.Query(`SELECT host_port, container_port, protocol, description
+		FROM task_nat_port_mappings WHERE task_id = ? ORDER BY position`, taskID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := []PortMapping{}
+	for rows.Next() {
+		var mapping PortMapping
+		if err := rows.Scan(&mapping.HostPort, &mapping.ContainerPort, &mapping.Protocol, &mapping.Description); err != nil {
+			return nil, err
+		}
+		result = append(result, mapping)
+	}
+	return result, rows.Err()
+}
+
 func loadLoginLogs() ([]SavedLoginLog, error) {
 	rows, err := db.Query(`SELECT time, username, ip, user_agent, success FROM login_logs ORDER BY id`)
 	if err != nil {

backend/internal/config/store_sqlite_test.go

@@ -63,9 +63,37 @@ func TestSQLiteConfigMigratesLegacyJSONAndPersists(t *testing.T) {
 			ContainerName: "ct2",
 			Status:        "pending",
 			CreatedAt:     "2026-06-07 17:29:02",
-			Config:        `{"name":"ct2","template_id":"debian-12","vcpu":1,"ram_mb":512,"disk_gb":5,"extra_ports":[80,443],"assign_ipv6":true}`,
+			Config:        `{"name":"ct2","template_id":"debian-12","vcpu":1,"ram_mb":512,"disk_gb":5,"extra_ports":[80,443],"nat_port_mappings":[{"host_port":30080,"container_port":80,"protocol":"tcp","description":"HTTP"}],"management_port":30022,"assign_ipv6":true}`,
 		}},
 		EnabledImages: []string{"debian-12"},
+		CustomKVMImages: []CustomKVMImage{{
+			ID:          "custom-kvm-test",
+			Name:        "Test Cloud Image",
+			Description: "third-party image",
+			Distro:      "ubuntu",
+			Release:     "noble",
+			Arch:        "amd64",
+			URL:         "https://images.example.test/ubuntu.qcow2",
+			Provisioner: KVMProvisionerLinuxCloudInit,
+			SHA256:      strings.Repeat("a", 64),
+			CreatedAt:   "2026-07-26 10:00:00",
+		}},
+		CustomLXCImages: []CustomLXCImage{{
+			ID:          "custom-lxc-test",
+			Name:        "Test Rootfs",
+			Description: "third-party LXC image",
+			Distro:      "alpine",
+			Release:     "3.21",
+			Arch:        "amd64",
+			URL:         "https://images.example.test/alpine-rootfs.tar.xz",
+			SHA256:      strings.Repeat("b", 64),
+			CreatedAt:   "2026-07-26 10:00:00",
+		}},
+		PanelAccessPolicy: PanelAccessPolicy{
+			Enabled:        true,
+			AllowedSources: []string{"192.0.2.0/24"},
+			TrustedProxies: []string{"127.0.0.1"},
+		},
 		Snapshots: []Snapshot{{
 			ID:            "snap-1",
 			ContainerID:   1,
@@ -93,11 +121,30 @@ func TestSQLiteConfigMigratesLegacyJSONAndPersists(t *testing.T) {
 	if len(cfg.Tasks) != 1 || !strings.Contains(cfg.Tasks[0].Config, `"extra_ports":[80,443]`) {
 		t.Fatalf("task config was not restored from sqlite columns: %+v", cfg.Tasks)
 	}
+	if !strings.Contains(cfg.Tasks[0].Config, `"nat_port_mappings":[{"host_port":30080,"container_port":80`) {
+		t.Fatalf("task NAT mappings were not restored from sqlite: %+v", cfg.Tasks)
+	}
+	if !strings.Contains(cfg.Tasks[0].Config, `"management_port":30022`) {
+		t.Fatalf("task management port was not restored from sqlite: %+v", cfg.Tasks)
+	}
+	if cfg.TaskConcurrency != DefaultTaskConcurrency {
+		t.Fatalf("legacy task concurrency = %d, want default %d", cfg.TaskConcurrency, DefaultTaskConcurrency)
+	}
+	if !cfg.PanelAccessPolicy.Enabled || len(cfg.PanelAccessPolicy.AllowedSources) != 1 {
+		t.Fatalf("legacy panel access policy was not migrated: %+v", cfg.PanelAccessPolicy)
+	}
+	if len(cfg.CustomKVMImages) != 1 || cfg.CustomKVMImages[0].ID != "custom-kvm-test" {
+		t.Fatalf("legacy custom KVM images were not migrated: %+v", cfg.CustomKVMImages)
+	}
+	if len(cfg.CustomLXCImages) != 1 || cfg.CustomLXCImages[0].ID != "custom-lxc-test" {
+		t.Fatalf("legacy custom LXC images were not migrated: %+v", cfg.CustomLXCImages)
+	}
 	if _, err := os.Stat(filepath.Join(dir, "config.db")); err != nil {
 		t.Fatalf("sqlite database was not created: %v", err)
 	}
 
 	cfg.Containers[0].Status = "stopped"
+	cfg.TaskConcurrency = 6
 	if err := SaveConfig(); err != nil {
 		t.Fatal(err)
 	}
@@ -111,6 +158,18 @@ func TestSQLiteConfigMigratesLegacyJSONAndPersists(t *testing.T) {
 	if got := cfg.Containers[0].Status; got != "stopped" {
 		t.Fatalf("expected sqlite value to win after migration, got %q", got)
 	}
+	if got := cfg.TaskConcurrency; got != 6 {
+		t.Fatalf("persisted task concurrency = %d, want 6", got)
+	}
+	if !cfg.PanelAccessPolicy.Enabled || cfg.PanelAccessPolicy.AllowedSources[0] != "192.0.2.0/24" {
+		t.Fatalf("persisted panel access policy = %+v", cfg.PanelAccessPolicy)
+	}
+	if len(cfg.CustomKVMImages) != 1 || cfg.CustomKVMImages[0].SHA256 != strings.Repeat("a", 64) {
+		t.Fatalf("persisted custom KVM images = %+v", cfg.CustomKVMImages)
+	}
+	if len(cfg.CustomLXCImages) != 1 || cfg.CustomLXCImages[0].SHA256 != strings.Repeat("b", 64) {
+		t.Fatalf("persisted custom LXC images = %+v", cfg.CustomLXCImages)
+	}
 }
 
 func resetConfigStoreForTest(t *testing.T) {

backend/internal/kvm/kvm.go

@@ -20,6 +20,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"regexp"
+	"runtime"
 	"sort"
 	"strconv"
 	"strings"
@@ -28,6 +29,7 @@ import (
 
 	"clicd/internal/config"
 	"clicd/internal/lxc"
+	"clicd/internal/safehttp"
 
 	"golang.org/x/crypto/ssh"
 )
@@ -94,6 +96,9 @@ var (
 )
 
 func BaseDir() string {
+	if pool := config.PreferredStoragePoolForContent(config.StorageContentKVM); pool != nil {
+		return filepath.Join(pool.Path, "kvm")
+	}
 	return "/var/lib/clicd/kvm"
 }
 
@@ -101,11 +106,30 @@ func NewManager() *Manager {
 	return &Manager{BasePath: BaseDir()}
 }
 
+func NewManagerForStoragePool(poolID string) *Manager {
+	if pool := config.StoragePoolByID(poolID); pool != nil && pool.Enabled {
+		for _, content := range pool.ContentTypes {
+			if content == config.StorageContentKVM {
+				return &Manager{BasePath: filepath.Join(pool.Path, "kvm")}
+			}
+		}
+	}
+	return NewManager()
+}
+
 func (m *Manager) instancesDir() string {
 	return filepath.Join(m.BasePath, "instances")
 }
 
 func (m *Manager) instanceDir(name string) string {
+	if config.AppConfig != nil {
+		for i := range config.AppConfig.Containers {
+			c := &config.AppConfig.Containers[i]
+			if c.IsKVM() && c.VirshName() == name && strings.TrimSpace(c.DiskImage) != "" {
+				return filepath.Dir(c.DiskImage)
+			}
+		}
+	}
 	return filepath.Join(m.instancesDir(), name)
 }
 
@@ -134,10 +158,19 @@ func DownloadImage(image Image) error {
 }
 
 func DownloadImageWithProgress(ctx context.Context, image Image, progress DownloadProgressFunc) error {
-	if err := os.MkdirAll(CacheDir(), 0755); err != nil {
+	pool, err := config.SelectStoragePoolForContent(config.StorageContentImages, "", 1024*1024*1024)
+	if err != nil {
 		return err
 	}
-	target := ImagePath(image.ID)
+	cacheDir := filepath.Join(pool.Path, "images", "kvm")
+	if err := os.MkdirAll(cacheDir, 0755); err != nil {
+		return err
+	}
+	ext := ".qcow2"
+	if image.IsWindows() {
+		ext = ".iso"
+	}
+	target := filepath.Join(cacheDir, image.ID+ext)
 	if ok, _ := ImageDownloadedInfo(image.ID); ok {
 		return nil
 	}
@@ -152,7 +185,7 @@ func DownloadImageWithProgress(ctx context.Context, image Image, progress Downlo
 	}
 	tmp := target + ".tmp"
 	_ = os.Remove(tmp)
-	if image.Distro == "windows" {
+	if image.IsWindows() {
 		if err := downloadFileWithValidator(ctx, image.URL, tmp, validateWindowsISOResponse(target), progress); err != nil {
 			_ = os.Remove(tmp)
 			return err
@@ -165,7 +198,13 @@ func DownloadImageWithProgress(ctx context.Context, image Image, progress Downlo
 		_ = os.Remove(tmp)
 		return err
 	}
-	if image.Distro == "windows" {
+	if image.SHA256 != "" {
+		if err := verifyFileSHA256(tmp, image.SHA256); err != nil {
+			_ = os.Remove(tmp)
+			return err
+		}
+	}
+	if image.IsWindows() {
 		if err := validateWindowsISO(tmp, target); err != nil {
 			_ = os.Remove(tmp)
 			return err
@@ -189,6 +228,23 @@ func DownloadImageWithProgress(ctx context.Context, image Image, progress Downlo
 	return nil
 }
 
+func verifyFileSHA256(path, expected string) error {
+	file, err := os.Open(path)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	hash := sha256.New()
+	if _, err := io.Copy(hash, file); err != nil {
+		return err
+	}
+	actual := hex.EncodeToString(hash.Sum(nil))
+	if !strings.EqualFold(actual, strings.TrimSpace(expected)) {
+		return fmt.Errorf("SHA-256 mismatch: expected %s, got %s", expected, actual)
+	}
+	return nil
+}
+
 func DeleteImage(id string) error {
 	return os.RemoveAll(ImagePath(id))
 }
@@ -200,26 +256,8 @@ func downloadFile(ctx context.Context, url, target string, progress DownloadProg
 }
 
 func downloadFileWithValidator(ctx context.Context, url, target string, validate downloadResponseValidator, progress DownloadProgressFunc) error {
-	client := http.Client{
-		Timeout: 30 * time.Minute,
-		CheckRedirect: func(req *http.Request, via []*http.Request) error {
-			if len(via) >= 10 {
-				return fmt.Errorf("too many redirects")
-			}
-			// Copy User-Agent on redirect
-			if ua := via[0].Header.Get("User-Agent"); ua != "" {
-				req.Header.Set("User-Agent", ua)
-			}
-			return nil
-		},
-	}
-	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
-	if err != nil {
-		return err
-	}
-	// Windows UA needed for Microsoft download servers
-	req.Header.Set("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36")
-	resp, err := client.Do(req)
+	const userAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
+	resp, err := safehttp.Get(ctx, url, userAgent, 30*time.Minute)
 	if err != nil {
 		return err
 	}
@@ -347,6 +385,7 @@ func normalizeQCOW2(ctx context.Context, src, target string) error {
 
 func (m *Manager) CreateContainer(cfg lxc.ContainerConfig) error {
 	cfg.NormalizeResourceAliases()
+	cfg.ReportProgress("preparing", "检查 KVM 镜像与创建参数")
 	image := FindImage(cfg.TemplateID)
 	if image == nil {
 		return fmt.Errorf("KVM image not found: %s", cfg.TemplateID)
@@ -366,19 +405,45 @@ func (m *Manager) CreateContainer(cfg lxc.ContainerConfig) error {
 	if cfg.VCPU < 1 || cfg.VCPU != float64(int(cfg.VCPU)) {
 		return fmt.Errorf("KVM vCPU must be a whole number and at least 1")
 	}
-	if cfg.WantsNAT() && cfg.PortMappingCount < 2 {
-		cfg.PortMappingCount = 2
-	} else if !cfg.WantsNAT() {
-		cfg.PortMappingCount = 0
-		cfg.ExtraPorts = nil
+	if IsWindowsImage(image.ID) && cfg.DiskGB < 30 {
+		cfg.DiskGB = 30
+	} else if image.Desktop != "" && cfg.DiskGB < 20 {
+		cfg.DiskGB = 20
+	}
+	cfg.ReportProgress("storage", "选择虚拟机存储磁盘")
+	pool, err := config.SelectStoragePoolForContent(
+		config.StorageContentKVM,
+		cfg.StoragePoolID,
+		int64(cfg.DiskGB)*1024*1024*1024,
+	)
+	if err != nil {
+		return err
+	}
+	cfg.StoragePoolID = pool.ID
+	m = NewManagerForStoragePool(pool.ID)
+	if err := cfg.NormalizeCreateNATMappings(); err != nil {
+		return err
 	}
 	if cfg.SnapshotLimit <= 0 {
 		cfg.SnapshotLimit = config.DefaultSnapshotLimit
 	}
+	if !cfg.ImageLimitConfigured && len(cfg.AllowedImageIDs) == 0 && cfg.TemplateID != "" {
+		cfg.AllowedImageIDs = []string{cfg.TemplateID}
+		cfg.ImageLimitConfigured = true
+	}
+	managementPort := 0
+	releaseNATReservation := func() {}
+	if cfg.WantsNAT() {
+		managementPort, releaseNATReservation, err = lxc.ReserveCreateNATPorts(cfg)
+		if err != nil {
+			return err
+		}
+		defer releaseNATReservation()
+	}
 
 	id := config.AllocateContainerID()
 	vmName := fmt.Sprintf("vm-%d", id)
-	c, err := m.defineContainer(id, vmName, cfg, true)
+	c, err := m.defineContainer(id, vmName, cfg, true, managementPort)
 	if err != nil {
 		_ = m.cleanupVM(vmName)
 		return err
@@ -387,7 +452,7 @@ func (m *Manager) CreateContainer(cfg lxc.ContainerConfig) error {
 	return nil
 }
 
-func (m *Manager) defineContainer(id int, vmName string, cfg lxc.ContainerConfig, allocatePorts bool) (*config.Container, error) {
+func (m *Manager) defineContainer(id int, vmName string, cfg lxc.ContainerConfig, allocatePorts bool, managementPort int) (*config.Container, error) {
 	image := FindImage(cfg.TemplateID)
 	if image == nil {
 		return nil, fmt.Errorf("KVM image not found: %s", cfg.TemplateID)
@@ -419,6 +484,7 @@ func (m *Manager) defineContainer(id int, vmName string, cfg lxc.ContainerConfig
 		sshPublicKey = sshAccess.PublicKey
 		sshAuthMode = sshAccess.Mode
 	}
+	cfg.ReportProgress("addresses", "分配 IPv4 与 IPv6 地址")
 	publicIPv4s, err := lxc.AllocatePublicIPv4Assignments(id, cfg.PublicIPv4s, cfg.IPv4Count, cfg.AssignIPv4)
 	if err != nil {
 		return nil, err
@@ -440,12 +506,17 @@ func (m *Manager) defineContainer(id int, vmName string, cfg lxc.ContainerConfig
 	var xml string
 	winAdminPassword := ""
 	if IsWindowsImage(image.ID) {
-		if cfg.RAMMB < 2048 {
-			cfg.RAMMB = 2048
+		minVCPU, minRAMMB, minDiskGB := windowsMinimumResources(image.ID)
+		if cfg.VCPU < minVCPU {
+			cfg.VCPU = minVCPU
 		}
-		if cfg.DiskGB < 30 {
-			cfg.DiskGB = 30
+		if cfg.RAMMB < minRAMMB {
+			cfg.RAMMB = minRAMMB
 		}
+		if cfg.DiskGB < minDiskGB {
+			cfg.DiskGB = minDiskGB
+		}
+		cfg.ReportProgress("disk", "创建 Windows 虚拟磁盘")
 		if err := createEmptyDisk(diskPath, cfg.DiskGB); err != nil {
 			return nil, err
 		}
@@ -454,7 +525,8 @@ func (m *Manager) defineContainer(id int, vmName string, cfg lxc.ContainerConfig
 		}
 		winAdminPassword = generateWindowsPassword()
 		unattendPath := filepath.Join(m.instanceDir(vmName), "unattend.iso")
-		if err := createWindowsUnattendISO(unattendPath, cfg.Name, winAdminPassword, mac, ipv6List, ipv4List); err != nil {
+		cfg.ReportProgress("cloud_init", "生成 Windows 自动应答配置")
+		if err := createWindowsUnattendISO(unattendPath, cfg.Name, winAdminPassword, mac, ipv6List, ipv4List, IsWindows11Image(image.ID)); err != nil {
 			return nil, err
 		}
 		xml = windowsDomainXML(vmName, int(cfg.VCPU), cfg.RAMMB, diskPath, ImagePath(image.ID), unattendPath, mac, cfg.IOReadMBps, cfg.IOWriteMBps, cfg.NetworkDownMbps, cfg.NetworkUpMbps)
@@ -467,9 +539,11 @@ func (m *Manager) defineContainer(id int, vmName string, cfg lxc.ContainerConfig
 				cfg.DiskGB = 20
 			}
 		}
+		cfg.ReportProgress("disk", "创建 KVM 系统磁盘")
 		if err := createOverlayDisk(ImagePath(image.ID), diskPath, cfg.DiskGB); err != nil {
 			return nil, err
 		}
+		cfg.ReportProgress("cloud_init", "生成 cloud-init 初始化配置")
 		if err := createSeedISO(seedPath, vmName, cfg.Name, sshPassword, sshPublicKey, mac, ipv6List, ipv4List, *image, sshAuthMode); err != nil {
 			return nil, err
 		}
@@ -479,6 +553,7 @@ func (m *Manager) defineContainer(id int, vmName string, cfg lxc.ContainerConfig
 	if err := os.WriteFile(xmlPath, []byte(xml), 0644); err != nil {
 		return nil, err
 	}
+	cfg.ReportProgress("define", "注册 KVM 虚拟机")
 	cmd := exec.Command("virsh", "define", xmlPath)
 	if output, err := cmd.CombinedOutput(); err != nil {
 		return nil, fmt.Errorf("virsh define failed: %v, output: %s", err, string(output))
@@ -487,9 +562,10 @@ func (m *Manager) defineContainer(id int, vmName string, cfg lxc.ContainerConfig
 	sshPort := 0
 	portMappings := []config.PortMapping{}
 	if allocatePorts && cfg.WantsNAT() {
-		sshPort, err = config.AllocateSSHPort()
-		if err != nil {
-			return nil, err
+		cfg.ReportProgress("nat", "分配并配置 NAT 端口")
+		sshPort = managementPort
+		if sshPort <= 0 {
+			return nil, fmt.Errorf("NAT management port was not reserved")
 		}
 		if IsWindowsImage(image.ID) {
 			// Windows: RDP (3389) instead of SSH (22)
@@ -509,23 +585,10 @@ func (m *Manager) defineContainer(id int, vmName string, cfg lxc.ContainerConfig
 			}
 		}
 		tempC := &config.Container{ID: id, PublicIPv4s: publicIPv4s, PortMappings: portMappings}
-		extraPorts := cfg.ExtraPorts
-		if len(extraPorts) == 0 && cfg.PortMappingCount > 1 {
-			extraPorts = allocateDefaultEqualPorts(tempC, cfg.PortMappingCount-1)
+		portMappings, err = lxc.SetupCreatePortMappings(tempC, cfg)
+		if err != nil {
+			return nil, err
 		}
-		for _, port := range extraPorts {
-			if port <= 0 {
-				continue
-			}
-			tempC.PortMappings = append(tempC.PortMappings, config.PortMapping{
-				ContainerPort: port,
-				HostPort:      port,
-				HostIP:        defaultHostIP,
-				Protocol:      "tcp",
-				Description:   fmt.Sprintf("Port-%d", port),
-			})
-		}
-		portMappings = tempC.PortMappings
 	}
 
 	now := time.Now().Format("2006-01-02 15:04:05")
@@ -533,6 +596,12 @@ func (m *Manager) defineContainer(id int, vmName string, cfg lxc.ContainerConfig
 	if trafficMode == "" {
 		trafficMode = "total"
 	}
+	storagePoolID := cfg.StoragePoolID
+	if storagePoolID == "" {
+		if pool := config.DefaultStoragePoolForContent(config.StorageContentKVM); pool != nil {
+			storagePoolID = pool.ID
+		}
+	}
 	container := &config.Container{
 		ID:               id,
 		UUID:             config.NewContainerUUID(),
@@ -540,6 +609,8 @@ func (m *Manager) defineContainer(id int, vmName string, cfg lxc.ContainerConfig
 		Virtualization:   config.VirtualizationKVM,
 		KVMName:          vmName,
 		DiskImage:        diskPath,
+		StoragePoolID:    storagePoolID,
+		StoragePath:      m.instanceDir(vmName),
 		MACAddress:       mac,
 		Template:         cfg.TemplateID,
 		VCPU:             cfg.VCPU,
@@ -568,11 +639,14 @@ func (m *Manager) defineContainer(id int, vmName string, cfg lxc.ContainerConfig
 		}(),
 		PortMappings:         portMappings,
 		PortMappingLimit:     cfg.PortMappingCount,
+		AllowedImageIDs:      append([]string(nil), cfg.AllowedImageIDs...),
+		ImageLimitConfigured: cfg.ImageLimitConfigured,
 		SnapshotLimit:        config.NormalizeSnapshotLimit(cfg.SnapshotLimit),
 		CreatedAt:            now,
 		ExpiresAt:            cfg.ExpiresAt,
 	}
 	container.NormalizeNetworkAssignments()
+	cfg.ReportProgress("metadata", "保存虚拟机配置")
 	return container, nil
 }
 
@@ -642,7 +716,7 @@ func (m *Manager) StartContainer(id int) error {
 	if !isWindows && c.IP != "" {
 		m.waitForCloudInitReady(name, c.IP, c.SSHPassword)
 	}
-	config.UpdateContainerStatus(id, "running")
+	config.UpdateContainerStatusAndRestore(id, "running", true)
 	if c.IPv6 != "" || len(c.IPv6Addresses) > 0 {
 		if err := m.applyIPv6Runtime(c); err != nil {
 			return err
@@ -721,13 +795,13 @@ func (m *Manager) StopContainer(id int) error {
 	name := c.VirshName()
 	status, _ := m.GetContainerStatus(name)
 	if status != "running" {
-		config.UpdateContainerStatus(id, "stopped")
+		config.UpdateContainerStatusAndRestore(id, "stopped", false)
 		return nil
 	}
 	exec.Command("virsh", "shutdown", name).Run()
 	for i := 0; i < 20; i++ {
 		if status, _ := m.GetContainerStatus(name); status != "running" {
-			config.UpdateContainerStatus(id, "stopped")
+			config.UpdateContainerStatusAndRestore(id, "stopped", false)
 			return nil
 		}
 		time.Sleep(1 * time.Second)
@@ -736,7 +810,7 @@ func (m *Manager) StopContainer(id int) error {
 	if output, err := cmd.CombinedOutput(); err != nil {
 		return fmt.Errorf("virsh destroy failed: %v, output: %s", err, string(output))
 	}
-	config.UpdateContainerStatus(id, "stopped")
+	config.UpdateContainerStatusAndRestore(id, "stopped", false)
 	return nil
 }
 
@@ -815,7 +889,7 @@ func (m *Manager) ReinstallContainer(id int, templateID string, authConfig ...lx
 		}
 		cfg.SSHPassword = sshAccess.Password
 	}
-	next, err := m.defineContainer(id, name, cfg, false)
+	next, err := m.defineContainer(id, name, cfg, false, 0)
 	if err != nil {
 		return err
 	}
@@ -947,7 +1021,7 @@ func (m *Manager) ensureDomainDefinition(c *config.Container) error {
 	return nil
 }
 
-func (m *Manager) CreateSnapshot(id int, createdBy string, scheduled bool, rotateLimit int) (config.Snapshot, error) {
+func (m *Manager) CreateSnapshot(id int, createdBy string, scheduled bool, rotateLimit int, storagePoolID ...string) (config.Snapshot, error) {
 	kvmSnapshotMu.Lock()
 	defer kvmSnapshotMu.Unlock()
 
@@ -973,17 +1047,26 @@ func (m *Manager) CreateSnapshot(id int, createdBy string, scheduled bool, rotat
 
 	name := c.VirshName()
 	instanceDir := m.instanceDir(name)
-	if err := safePathUnder(instanceDir, m.instancesDir()); err != nil {
+	if err := safePathUnder(instanceDir, filepath.Dir(instanceDir)); err != nil {
 		return config.Snapshot{}, err
 	}
 	if _, err := os.Stat(instanceDir); err != nil {
 		return config.Snapshot{}, fmt.Errorf("VM storage not found: %v", err)
 	}
+	pool, err := config.SelectStoragePoolForContent(
+		config.StorageContentSnapshots,
+		firstString(storagePoolID),
+		dirSizeBytes(instanceDir),
+	)
+	if err != nil {
+		return config.Snapshot{}, err
+	}
 
 	now := time.Now()
 	snapshotID := fmt.Sprintf("snap-%d-%s", id, now.Format("20060102150405-000000000"))
-	snapshotDir := filepath.Join(snapshotBaseDir(), "kvm", strconv.Itoa(id), snapshotID)
-	if err := safePathUnder(snapshotDir, snapshotBaseDir()); err != nil {
+	baseDir := filepath.Join(pool.Path, "snapshots")
+	snapshotDir := filepath.Join(baseDir, "kvm", strconv.Itoa(id), snapshotID)
+	if err := safePathUnder(snapshotDir, baseDir); err != nil {
 		return config.Snapshot{}, err
 	}
 	if err := os.MkdirAll(snapshotDir, 0700); err != nil {
@@ -1036,7 +1119,7 @@ func (m *Manager) DeleteSnapshot(id string) error {
 
 func (m *Manager) deleteSnapshotLocked(snapshot config.Snapshot) error {
 	if snapshot.Path != "" {
-		if err := safePathUnder(snapshot.Path, snapshotBaseDir()); err != nil {
+		if err := safeSnapshotPath(snapshot.Path); err != nil {
 			return err
 		}
 		if err := os.RemoveAll(snapshot.Path); err != nil {
@@ -1058,7 +1141,7 @@ func (m *Manager) RestoreSnapshot(id string) error {
 	if snapshot.Path == "" {
 		return fmt.Errorf("snapshot path is empty")
 	}
-	if err := safePathUnder(snapshot.Path, snapshotBaseDir()); err != nil {
+	if err := safeSnapshotPath(snapshot.Path); err != nil {
 		return err
 	}
 	if _, err := os.Stat(snapshot.Path); err != nil {
@@ -1074,7 +1157,8 @@ func (m *Manager) RestoreSnapshot(id string) error {
 	}
 	name := c.VirshName()
 	instanceDir := m.instanceDir(name)
-	if err := safePathUnder(instanceDir, m.instancesDir()); err != nil {
+	instanceParent := filepath.Dir(instanceDir)
+	if err := safePathUnder(instanceDir, instanceParent); err != nil {
 		return err
 	}
 
@@ -1082,8 +1166,8 @@ func (m *Manager) RestoreSnapshot(id string) error {
 	if err != nil {
 		return err
 	}
-	backupDir := filepath.Join(m.instancesDir(), fmt.Sprintf(".%s-restore-backup-%d", name, time.Now().UnixNano()))
-	if err := safePathUnder(backupDir, m.instancesDir()); err != nil {
+	backupDir := filepath.Join(instanceParent, fmt.Sprintf(".%s-restore-backup-%d", name, time.Now().UnixNano()))
+	if err := safePathUnder(backupDir, instanceParent); err != nil {
 		return err
 	}
 	if err := os.Rename(instanceDir, backupDir); err != nil && !os.IsNotExist(err) {
@@ -1103,6 +1187,7 @@ func (m *Manager) RestoreSnapshot(id string) error {
 		return fmt.Errorf("virsh define failed after restore: %v, output: %s", err, string(output))
 	}
 	c.DiskImage = filepath.Join(instanceDir, "disk.qcow2")
+	c.StoragePath = instanceDir
 	c.Status = "stopped"
 	c.IP = ""
 	config.SaveConfig()
@@ -1237,7 +1322,33 @@ func nextSnapshotRun(from time.Time, intervalHours int, scheduleTime string) tim
 }
 
 func snapshotBaseDir() string {
-	return filepath.Join(config.AppConfig.DataDir, "snapshots")
+	return snapshotBaseDirForPool("")
+}
+
+func snapshotBaseDirForPool(poolID string) string {
+	if pool, err := config.SelectStoragePoolForContent(config.StorageContentSnapshots, poolID, 0); err == nil {
+		return filepath.Join(pool.Path, "snapshots")
+	}
+	return ""
+}
+
+func safeSnapshotPath(path string) error {
+	if err := safePathUnder(path, filepath.Join(config.AppConfig.DataDir, "snapshots")); err == nil {
+		return nil
+	}
+	for _, pool := range config.StoragePoolsForContent(config.StorageContentSnapshots) {
+		if err := safePathUnder(path, filepath.Join(pool.Path, "snapshots")); err == nil {
+			return nil
+		}
+	}
+	return fmt.Errorf("unsafe snapshot path: %s", path)
+}
+
+func firstString(values []string) string {
+	if len(values) == 0 {
+		return ""
+	}
+	return strings.TrimSpace(values[0])
 }
 
 func copyTree(src string, dst string) error {
@@ -1538,7 +1649,13 @@ func (m *Manager) validateHost(skipCloudInit bool) error {
 			return err
 		}
 	}
+	if err := requireCommand(kvmEmulatorCommand()); err != nil {
+		return err
+	}
 	if skipCloudInit {
+		if runtime.GOARCH != "amd64" {
+			return fmt.Errorf("Windows KVM is currently supported only on x86_64/amd64 hosts")
+		}
 		if err := requireAnyCommand("genisoimage", "mkisofs", "xorriso"); err != nil {
 			return fmt.Errorf("%w (needed to generate Windows unattended setup ISO)", err)
 		}
@@ -1572,33 +1689,68 @@ func requireAnyCommand(names ...string) error {
 	return fmt.Errorf("one of %s is required for KVM support", strings.Join(names, ", "))
 }
 
+func kvmLibvirtArch() string {
+	switch runtime.GOARCH {
+	case "arm64":
+		return "aarch64"
+	default:
+		return "x86_64"
+	}
+}
+
+func kvmMachineType() string {
+	switch runtime.GOARCH {
+	case "arm64":
+		return "virt"
+	default:
+		return "pc"
+	}
+}
+
+func kvmEmulatorCommand() string {
+	switch runtime.GOARCH {
+	case "arm64":
+		return "qemu-system-aarch64"
+	default:
+		return "qemu-system-x86_64"
+	}
+}
+
+func kvmEmulatorPath() string {
+	if path, err := exec.LookPath(kvmEmulatorCommand()); err == nil {
+		return path
+	}
+	return "/usr/bin/" + kvmEmulatorCommand()
+}
+
 func ensureDefaultNetwork() error {
 	// Ensure libvirtd is running
 	if err := exec.Command("systemctl", "start", "libvirtd").Run(); err != nil {
 		// Non-systemd systems may use a different init, try virsh connect
-		if exec.Command("virsh", "connect").Run() != nil {
+		if virshCLocaleCommand("connect").Run() != nil {
 			return fmt.Errorf("libvirtd is not running and could not be started")
 		}
 	}
 	// Ensure default network is defined
-	if exec.Command("virsh", "net-info", "default").Run() != nil {
+	if virshCLocaleCommand("net-info", "default").Run() != nil {
 		// Default network may not be defined; try to define it
-		netXML := `<network>
+		network := config.KVMNATNetwork()
+		netXML := fmt.Sprintf(`<network>
   <name>default</name>
   <bridge name='virbr0'/>
   <forward mode='nat'/>
-  <ip address='192.168.122.1' netmask='255.255.255.0'>
+  <ip address='%s' netmask='%s'>
     <dhcp>
-      <range start='192.168.122.2' end='192.168.122.254'/>
+      <range start='%s' end='%s'/>
     </dhcp>
   </ip>
-</network>`
+</network>`, network.Gateway, network.Netmask, network.DHCPStart, network.DHCPEnd)
 		tmpFile := filepath.Join(os.TempDir(), "clicd-default-net.xml")
 		if err := os.WriteFile(tmpFile, []byte(netXML), 0644); err != nil {
 			return fmt.Errorf("failed to write default network XML: %v", err)
 		}
 		defer os.Remove(tmpFile)
-		if out, err := exec.Command("virsh", "net-define", tmpFile).CombinedOutput(); err != nil {
+		if out, err := virshCLocaleCommand("net-define", tmpFile).CombinedOutput(); err != nil {
 			return fmt.Errorf("failed to define libvirt default network: %v, output: %s", err, string(out))
 		}
 		if err := os.MkdirAll(filepath.Dir(libvirtDefaultNetworkMarker), 0755); err == nil {
@@ -1606,19 +1758,27 @@ func ensureDefaultNetwork() error {
 		}
 	}
 	// Start and autostart the default network
-	if out, err := exec.Command("virsh", "net-info", "default").Output(); err == nil {
+	if out, err := virshCLocaleCommand("net-info", "default").Output(); err == nil {
 		if !libvirtNetworkActive(string(out)) {
-			if startOut, startErr := exec.Command("virsh", "net-start", "default").CombinedOutput(); startErr != nil {
+			if startOut, startErr := virshCLocaleCommand("net-start", "default").CombinedOutput(); startErr != nil {
+				if verifyOut, verifyErr := virshCLocaleCommand("net-info", "default").Output(); verifyErr != nil || !libvirtNetworkActive(string(verifyOut)) {
 					return fmt.Errorf("failed to start libvirt default network: %v, output: %s", startErr, string(startOut))
 				}
 			}
 		}
-	if out, err := exec.Command("virsh", "net-autostart", "default").CombinedOutput(); err != nil {
+	}
+	if out, err := virshCLocaleCommand("net-autostart", "default").CombinedOutput(); err != nil {
 		return fmt.Errorf("failed to set autostart for libvirt default network: %v, output: %s", err, string(out))
 	}
 	return nil
 }
 
+func virshCLocaleCommand(args ...string) *exec.Cmd {
+	cmd := exec.Command("virsh", args...)
+	cmd.Env = append(os.Environ(), "LC_ALL=C", "LC_MESSAGES=C", "LANG=C", "LANGUAGE=C")
+	return cmd
+}
+
 func libvirtNetworkActive(info string) bool {
 	for _, line := range strings.Split(info, "\n") {
 		key, value, ok := strings.Cut(line, ":")
@@ -1683,7 +1843,7 @@ func createEmptyDisk(target string, diskGB int) error {
 	return nil
 }
 
-func createWindowsUnattendISO(target, hostname, adminPassword, mac string, ipv6s []string, ipv4s []string) error {
+func createWindowsUnattendISO(target, hostname, adminPassword, mac string, ipv6s []string, ipv4s []string, windows11 bool) error {
 	tool := firstAvailableCommand("genisoimage", "mkisofs", "xorriso")
 	if tool == "" {
 		return fmt.Errorf("one of genisoimage, mkisofs, xorriso is required for Windows unattended setup")
@@ -1703,7 +1863,7 @@ func createWindowsUnattendISO(target, hostname, adminPassword, mac string, ipv6s
 			return err
 		}
 	}
-	if err := os.WriteFile(answerPath, []byte(windowsAutounattendXML(hostname, adminPassword)), 0600); err != nil {
+	if err := os.WriteFile(answerPath, []byte(windowsAutounattendXML(hostname, adminPassword, windows11)), 0600); err != nil {
 		return err
 	}
 	if err := os.WriteFile(filepath.Join(setupScriptsDir, "SetupComplete.cmd"), []byte(windowsSetupCompleteCMD()), 0600); err != nil {
@@ -1741,12 +1901,21 @@ func firstAvailableCommand(names ...string) string {
 	return ""
 }
 
-func windowsAutounattendXML(hostname, adminPassword string) string {
+func windowsAutounattendXML(hostname, adminPassword string, windows11 bool) string {
 	if strings.TrimSpace(hostname) == "" {
 		hostname = "clicd-win"
 	}
 	hostname = sanitizeWindowsComputerName(hostname)
-	setupCommand := `cmd.exe /c if exist C:\CLICD\FirstLogon.ps1 (powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\CLICD\FirstLogon.ps1) else (for %%d in (D E F G H I J K L M N O P Q R S T U V W X Y Z) do @if exist %%d:\FirstLogon.ps1 powershell.exe -NoProfile -ExecutionPolicy Bypass -File %%d:\FirstLogon.ps1)`
+	setupCommand := `cmd.exe /c if exist C:\CLICD\FirstLogon.ps1 (powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\CLICD\FirstLogon.ps1) else (for %d in (D E F G H I J K L M N O P Q R S T U V W X Y Z) do @if exist %d:\FirstLogon.ps1 powershell.exe -NoProfile -ExecutionPolicy Bypass -File %d:\FirstLogon.ps1)`
+	compatibilityCommands := ""
+	if windows11 {
+		compatibilityCommands = `
+      <RunSynchronous>
+        <RunSynchronousCommand wcm:action="add"><Order>1</Order><Description>Allow virtual TPM compatibility</Description><Path>reg.exe add HKLM\SYSTEM\Setup\LabConfig /v BypassTPMCheck /t REG_DWORD /d 1 /f</Path></RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add"><Order>2</Order><Description>Allow virtual Secure Boot compatibility</Description><Path>reg.exe add HKLM\SYSTEM\Setup\LabConfig /v BypassSecureBootCheck /t REG_DWORD /d 1 /f</Path></RunSynchronousCommand>
+        <RunSynchronousCommand wcm:action="add"><Order>3</Order><Description>Allow virtual CPU compatibility</Description><Path>reg.exe add HKLM\SYSTEM\Setup\LabConfig /v BypassCPUCheck /t REG_DWORD /d 1 /f</Path></RunSynchronousCommand>
+      </RunSynchronous>`
+	}
 	return fmt.Sprintf(`<?xml version="1.0" encoding="utf-8"?>
 <unattend xmlns="urn:schemas-microsoft-com:unattend">
   <settings pass="windowsPE">
@@ -1775,7 +1944,7 @@ func windowsAutounattendXML(hostname, adminPassword string) string {
         <AcceptEula>true</AcceptEula>
         <FullName>CLICD</FullName>
         <Organization>CLICD</Organization>
-      </UserData>
+      </UserData>%s
     </component>
   </settings>
   <settings pass="specialize">
@@ -1796,7 +1965,14 @@ func windowsAutounattendXML(hostname, adminPassword string) string {
     </component>
   </settings>
 </unattend>
-`, xmlEscape(hostname), xmlEscape(adminPassword), xmlEscape(adminPassword), xmlEscape(setupCommand))
+`, compatibilityCommands, xmlEscape(hostname), xmlEscape(adminPassword), xmlEscape(adminPassword), xmlEscape(setupCommand))
+}
+
+func windowsMinimumResources(imageID string) (float64, int, int) {
+	if IsWindows11Image(imageID) {
+		return 2, 4096, 64
+	}
+	return 1, 2048, 30
 }
 
 func sanitizeWindowsComputerName(name string) string {
@@ -2030,7 +2206,7 @@ runcmd:
 	// Build static address block (IPv4 + IPv6)
 	ipv4s = normalizeKVMIPv4List(ipv4s)
 	addressBlock := ""
-	addressLines := make([]string, 0, len(ipv4s)+len(ipv6s))
+	addressLines := make([]string, 0, len(ipv4s))
 	for _, ipv4 := range ipv4s {
 		addressLines = append(addressLines, fmt.Sprintf("        - %s/32", ipv4))
 	}
@@ -2186,6 +2362,26 @@ func domainXML(name string, vcpu int, ramMB int, diskPath, seedPath, mac string,
 		video = "<video><model type='qxl' ram='65536' vram='65536' heads='1' primary='yes'/></video>"
 		input = "\n\t    <input type='tablet' bus='usb'/>"
 	}
+	osAttrs := ""
+	features := "<features><acpi/><apic/></features>"
+	if runtime.GOARCH == "arm64" {
+		osAttrs = " firmware='efi'"
+		features = "<features><acpi/><gic version='3'/></features>"
+	}
+	seedDisk := fmt.Sprintf(`<disk type='file' device='cdrom'>
+      <driver name='qemu' type='raw'/>
+      <source file='%s'/>
+      <target dev='hdb' bus='ide'/>
+      <readonly/>
+    </disk>`, xmlEscape(seedPath))
+	if runtime.GOARCH == "arm64" {
+		seedDisk = fmt.Sprintf(`<disk type='file' device='disk'>
+      <driver name='qemu' type='raw'/>
+      <source file='%s'/>
+      <target dev='vdb' bus='virtio'/>
+      <readonly/>
+    </disk>`, xmlEscape(seedPath))
+	}
 	return fmt.Sprintf(`<domain type='kvm'>
   <name>%s</name>
   %s
@@ -2193,29 +2389,24 @@ func domainXML(name string, vcpu int, ramMB int, diskPath, seedPath, mac string,
   <currentMemory unit='MiB'>%d</currentMemory>
   <vcpu placement='static' current='%d'>%d</vcpu>
   <cputune><shares>2048</shares></cputune>
-  <os>
-    <type arch='x86_64' machine='pc'>hvm</type>
+  <os%s>
+    <type arch='%s' machine='%s'>hvm</type>
     <boot dev='hd'/>
   </os>
-  <features><acpi/><apic/></features>
+  %s
   <cpu mode='host-passthrough' check='none'/>
   <clock offset='utc'/>
   <on_poweroff>destroy</on_poweroff>
   <on_reboot>restart</on_reboot>
   <on_crash>restart</on_crash>
   <devices>
-    <emulator>/usr/bin/qemu-system-x86_64</emulator>
+    <emulator>%s</emulator>
     <disk type='file' device='disk'>
       <driver name='qemu' type='qcow2' cache='none'/>
       <source file='%s'/>
       <target dev='vda' bus='virtio'/>%s
     </disk>
-    <disk type='file' device='cdrom'>
-      <driver name='qemu' type='raw'/>
-      <source file='%s'/>
-      <target dev='hdb' bus='ide'/>
-      <readonly/>
-    </disk>
+    %s
     <interface type='network'>
       <mac address='%s'/>
       <source network='default'/>
@@ -2232,7 +2423,7 @@ func domainXML(name string, vcpu int, ramMB int, diskPath, seedPath, mac string,
     <graphics type='vnc' port='-1' autoport='yes' listen='127.0.0.1'/>%s
     %s
   </devices>
-</domain>`, xmlEscape(name), domainUUIDXML(name), ramMB, ramMB, vcpu, vcpu, xmlEscape(diskPath), iotune, xmlEscape(seedPath), xmlEscape(mac), bandwidth, input, video)
+</domain>`, xmlEscape(name), domainUUIDXML(name), ramMB, ramMB, vcpu, vcpu, osAttrs, kvmLibvirtArch(), kvmMachineType(), features, xmlEscape(kvmEmulatorPath()), xmlEscape(diskPath), iotune, seedDisk, xmlEscape(mac), bandwidth, input, video)
 }
 
 func windowsDomainXML(name string, vcpu int, ramMB int, diskPath, winISOPath, unattendISOPath, mac string, ioReadMBps int, ioWriteMBps int, networkDownMbps int, networkUpMbps int) string {
@@ -3301,6 +3492,109 @@ func (m *Manager) AssignIPv6(id int) (*config.Container, error) {
 	return c, nil
 }
 
+func (m *Manager) UpdatePublicIPv4Assignments(id int, requested []string, count int, auto bool) (*config.Container, error) {
+	c := config.FindContainer(id)
+	if c == nil {
+		return nil, fmt.Errorf("container not found: %d", id)
+	}
+	if !c.IsKVM() {
+		return nil, fmt.Errorf("container is not a KVM VM: %d", id)
+	}
+
+	assignments := []config.PublicIPv4Assignment{}
+	if auto || len(requested) > 0 {
+		allocated, err := lxc.AllocatePublicIPv4Assignments(id, requested, count, auto)
+		if err != nil {
+			return nil, err
+		}
+		assignments = allocated
+	}
+
+	c.PublicIPv4s = assignments
+	reconcileKVMPortMappingHostIPs(c)
+	c.NormalizeNetworkAssignments()
+	config.SaveConfig()
+
+	lxcManager := lxc.NewManager()
+	_ = lxcManager.CleanPortMappings(id)
+	lxc.EnsureAssignedPublicIPv4s(c.PublicIPv4s)
+	if c.Status == "running" && c.IP != "" {
+		if err := lxcManager.ApplyPortMappings(id); err != nil {
+			return nil, err
+		}
+	}
+	return c, nil
+}
+
+func reconcileKVMPortMappingHostIPs(c *config.Container) {
+	if c == nil {
+		return
+	}
+	assigned := map[string]bool{}
+	for _, item := range c.PublicIPv4s {
+		if addr := strings.TrimSpace(item.Address); addr != "" {
+			assigned[addr] = true
+		}
+	}
+	replacement := ""
+	if len(assigned) == 1 {
+		for addr := range assigned {
+			replacement = addr
+		}
+	}
+	for i := range c.PortMappings {
+		hostIP := strings.TrimSpace(c.PortMappings[i].HostIP)
+		if hostIP == "" || assigned[hostIP] {
+			continue
+		}
+		c.PortMappings[i].HostIP = replacement
+	}
+}
+
+func (m *Manager) UpdateIPv6Assignments(id int, requested []string, count int, auto bool) (*config.Container, error) {
+	c := config.FindContainer(id)
+	if c == nil {
+		return nil, fmt.Errorf("container not found: %d", id)
+	}
+	if !c.IsKVM() {
+		return nil, fmt.Errorf("container is not a KVM VM: %d", id)
+	}
+
+	old := *c
+	old.IPv6Addresses = append([]config.IPv6Assignment(nil), c.IPv6Addresses...)
+	removeKVMIPv6Runtime(&old)
+
+	assignments := []config.IPv6Assignment{}
+	if auto || len(requested) > 0 {
+		allocated, err := m.allocateIPv6AssignmentsForContainer(id, requested, count, auto)
+		if err != nil {
+			if old.IPv6 != "" || len(old.IPv6Addresses) > 0 {
+				_ = m.applyIPv6Runtime(&old)
+			}
+			return nil, err
+		}
+		assignments = allocated
+	}
+
+	c.IPv6 = ""
+	c.IPv6PrefixLen = 0
+	c.IPv6Interface = ""
+	c.IPv6Addresses = assignments
+	c.NormalizeNetworkAssignments()
+	config.SaveConfig()
+
+	if len(c.IPv6Addresses) > 0 {
+		if err := m.applyIPv6Runtime(c); err != nil {
+			return nil, err
+		}
+	} else if c.Status == "running" {
+		if err := lxc.ApplyFirewallRules(c.ID); err != nil {
+			fmt.Printf("Warning: failed to re-apply firewall rules after KVM IPv6 removal for %s: %v\n", c.Name, err)
+		}
+	}
+	return c, nil
+}
+
 func (m *Manager) applyIPv6Runtime(c *config.Container) error {
 	if c == nil || (c.IPv6 == "" && len(c.IPv6Addresses) == 0) {
 		return nil
@@ -3895,35 +4189,6 @@ func sshHostKeyFingerprint(key ssh.PublicKey) string {
 	return hex.EncodeToString(sum[:])
 }
 
-func allocateDefaultEqualPorts(c *config.Container, count int) []int {
-	if count <= 0 {
-		return nil
-	}
-	used := map[int]bool{}
-	// Mark current container's ports
-	for _, pm := range c.PortMappings {
-		used[pm.HostPort] = true
-		used[pm.ContainerPort] = true
-	}
-	// Also mark all other containers' host ports (LXC + KVM)
-	for _, oc := range config.AppConfig.Containers {
-		if oc.ID == c.ID {
-			continue
-		}
-		for _, pm := range oc.PortMappings {
-			used[pm.HostPort] = true
-		}
-	}
-	ports := make([]int, 0, count)
-	start, end := config.NATPortRange()
-	for next := start; next <= end && len(ports) < count; next++ {
-		if !used[next] {
-			ports = append(ports, next)
-		}
-	}
-	return ports
-}
-
 func runStdin(command string, stdin []byte, args ...string) error {
 	cmd := exec.Command(command, args...)
 	cmd.Stdin = bytes.NewReader(stdin)

backend/internal/kvm/kvm_test.go

@@ -3,7 +3,14 @@ package kvm
 import (
 	"crypto/ed25519"
 	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/xml"
+	"os"
+	"path/filepath"
 	"reflect"
+	"runtime"
+	"strings"
 	"testing"
 
 	"clicd/internal/config"
@@ -11,6 +18,84 @@ import (
 	"golang.org/x/crypto/ssh"
 )
 
+func TestImagePathUsesAllowlistedImageID(t *testing.T) {
+	for _, id := range []string{"", ".", "..", "../../etc/passwd", `..\\..\\windows`, "/absolute", "unknown-image"} {
+		if got := filepath.Base(ImagePath(id)); got != "__invalid_image_id__.qcow2" {
+			t.Fatalf("ImagePath(%q) basename = %q", id, got)
+		}
+	}
+	validID := GetImages()[0].ID
+	if got := filepath.Base(ImagePath(validID)); got != validID+".qcow2" {
+		t.Fatalf("ImagePath(%q) basename = %q", validID, got)
+	}
+}
+
+func TestWindows11ImageDefinition(t *testing.T) {
+	image := FindImage("kvm-windows-11")
+	if image == nil {
+		t.Fatal("Windows 11 image is missing from the amd64 image list")
+	}
+	if image.Distro != "windows" || image.Release != "11" || image.Arch != "amd64" {
+		t.Fatalf("Windows 11 image metadata = %+v", image)
+	}
+	if !strings.Contains(image.URL, "microsoft.com/fwlink/") {
+		t.Fatalf("Windows 11 image does not use an official Microsoft URL: %s", image.URL)
+	}
+	if got := filepath.Base(ImagePath(image.ID)); got != "kvm-windows-11.iso" {
+		t.Fatalf("Windows 11 image basename = %q", got)
+	}
+}
+
+func TestWindows11UnattendAddsCompatibilityChecksOnlyForWindows11(t *testing.T) {
+	windows11 := windowsAutounattendXML("win11-test", "Password123!", true)
+	windows10 := windowsAutounattendXML("win10-test", "Password123!", false)
+
+	for _, key := range []string{"BypassTPMCheck", "BypassSecureBootCheck", "BypassCPUCheck"} {
+		if !strings.Contains(windows11, key) {
+			t.Fatalf("Windows 11 unattend is missing %s", key)
+		}
+		if strings.Contains(windows10, key) {
+			t.Fatalf("Windows 10 unattend unexpectedly contains %s", key)
+		}
+	}
+	var document struct {
+		XMLName xml.Name
+	}
+	if err := xml.Unmarshal([]byte(windows11), &document); err != nil {
+		t.Fatalf("Windows 11 unattend XML is invalid: %v", err)
+	}
+}
+
+func TestWindowsMinimumResources(t *testing.T) {
+	if cpu, ram, disk := windowsMinimumResources("kvm-windows-11"); cpu != 2 || ram != 4096 || disk != 64 {
+		t.Fatalf("Windows 11 minimums = %v vCPU, %d MB, %d GB", cpu, ram, disk)
+	}
+	if cpu, ram, disk := windowsMinimumResources("kvm-windows-10"); cpu != 1 || ram != 2048 || disk != 30 {
+		t.Fatalf("Windows 10 minimums = %v vCPU, %d MB, %d GB", cpu, ram, disk)
+	}
+}
+
+func TestLibvirtNetworkActiveParsesCLocaleOutput(t *testing.T) {
+	tests := []struct {
+		name string
+		info string
+		want bool
+	}{
+		{name: "active", info: "Name: default\nActive: yes\n", want: true},
+		{name: "spacing and case", info: "  Active  :  YES  \r\n", want: true},
+		{name: "inactive", info: "Name: default\nActive: no\n", want: false},
+		{name: "missing field", info: "Name: default\nAutostart: yes\n", want: false},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := libvirtNetworkActive(tc.info); got != tc.want {
+				t.Fatalf("libvirtNetworkActive(%q) = %v, want %v", tc.info, got, tc.want)
+			}
+		})
+	}
+}
+
 func TestChpasswdStdinPreservesShellMetacharacters(t *testing.T) {
 	password := `pa'";$(touch /tmp/pwned); echo #\\word`
 	got, err := chpasswdStdin("root", password)
@@ -81,6 +166,77 @@ func TestVerifyKVMHostKeyCapturesAndRejectsMismatch(t *testing.T) {
 	}
 }
 
+func TestGetImagesIncludesHostArchitectureCustomImage(t *testing.T) {
+	previous := config.AppConfig
+	t.Cleanup(func() { config.AppConfig = previous })
+	config.AppConfig = &config.ClicdConfig{
+		CustomKVMImages: []config.CustomKVMImage{
+			{
+				ID:          "custom-kvm-linux",
+				Name:        "Custom Linux",
+				Distro:      "ubuntu",
+				Release:     "noble",
+				Arch:        runtime.GOARCH,
+				URL:         "https://example.test/linux.qcow2",
+				Provisioner: config.KVMProvisionerLinuxCloudInit,
+			},
+			{
+				ID:          "custom-kvm-other-arch",
+				Name:        "Other Architecture",
+				Distro:      "ubuntu",
+				Release:     "noble",
+				Arch:        "not-" + runtime.GOARCH,
+				URL:         "https://example.test/other.qcow2",
+				Provisioner: config.KVMProvisionerLinuxCloudInit,
+			},
+		},
+	}
+
+	image := FindImage("custom-kvm-linux")
+	if image == nil || !image.Custom || image.Provisioner != config.KVMProvisionerLinuxCloudInit {
+		t.Fatalf("custom image was not exposed correctly: %+v", image)
+	}
+	if FindImage("custom-kvm-other-arch") != nil {
+		t.Fatal("custom image for another architecture was exposed")
+	}
+}
+
+func TestCustomWindowsProvisionerControlsImageType(t *testing.T) {
+	previous := config.AppConfig
+	t.Cleanup(func() { config.AppConfig = previous })
+	config.AppConfig = &config.ClicdConfig{CustomKVMImages: []config.CustomKVMImage{{
+		ID:          "custom-kvm-windows",
+		Name:        "Custom Windows",
+		Distro:      "windows",
+		Release:     "11",
+		Arch:        runtime.GOARCH,
+		URL:         "https://example.test/windows.iso",
+		Provisioner: config.KVMProvisionerWindows11,
+	}}}
+
+	if !IsWindowsImage("custom-kvm-windows") || !IsWindows11Image("custom-kvm-windows") {
+		t.Fatal("custom Windows 11 provisioner was not recognized")
+	}
+	if ext := filepath.Ext(ImagePath("custom-kvm-windows")); ext != ".iso" {
+		t.Fatalf("custom Windows image extension = %q, want .iso", ext)
+	}
+}
+
+func TestVerifyFileSHA256(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "image")
+	content := []byte("clicd custom image")
+	if err := os.WriteFile(path, content, 0600); err != nil {
+		t.Fatal(err)
+	}
+	sum := sha256.Sum256(content)
+	if err := verifyFileSHA256(path, hex.EncodeToString(sum[:])); err != nil {
+		t.Fatalf("valid checksum failed: %v", err)
+	}
+	if err := verifyFileSHA256(path, strings.Repeat("0", 64)); err == nil {
+		t.Fatal("invalid checksum unexpectedly passed")
+	}
+}
+
 func testSSHPublicKey(t *testing.T) ssh.PublicKey {
 	t.Helper()
 	_, privateKey, err := ed25519.GenerateKey(rand.Reader)

backend/internal/kvm/templates.go

@@ -1,7 +1,11 @@
 package kvm
 
 import (
+	"os"
 	"path/filepath"
+	"runtime"
+
+	"clicd/internal/config"
 )
 
 type Image struct {
@@ -13,9 +17,40 @@ type Image struct {
 	Description string `json:"description"`
 	URL         string `json:"url"`
 	Desktop     string `json:"desktop,omitempty"`
+	Provisioner string `json:"provisioner,omitempty"`
+	SHA256      string `json:"sha256,omitempty"`
+	Custom      bool   `json:"custom,omitempty"`
 }
 
 func GetImages() []Image {
+	var images []Image
+	switch runtime.GOARCH {
+	case "arm64":
+		images = arm64Images()
+	default:
+		images = amd64Images()
+	}
+	for _, custom := range config.ListCustomKVMImages() {
+		if custom.Arch != runtime.GOARCH {
+			continue
+		}
+		images = append(images, Image{
+			ID:          custom.ID,
+			Name:        custom.Name,
+			Distro:      custom.Distro,
+			Release:     custom.Release,
+			Arch:        custom.Arch,
+			Description: custom.Description,
+			URL:         custom.URL,
+			Provisioner: custom.Provisioner,
+			SHA256:      custom.SHA256,
+			Custom:      true,
+		})
+	}
+	return images
+}
+
+func amd64Images() []Image {
 	return []Image{
 		{
 			ID: "kvm-ubuntu-noble", Name: "Ubuntu 24.04 KVM",
@@ -36,12 +71,25 @@ func GetImages() []Image {
 			Description: "Ubuntu 22.04 LTS cloud image for KVM",
 			URL:         "https://cloud-images.ubuntu.com/jammy/current/jammy-server-cloudimg-amd64.img",
 		},
+		{
+			ID: "kvm-debian-trixie", Name: "Debian 13 KVM",
+			Distro: "debian", Release: "trixie", Arch: "amd64",
+			Description: "Debian 13 generic cloud image for KVM",
+			URL:         "https://cloud.debian.org/images/cloud/trixie/latest/debian-13-genericcloud-amd64.qcow2",
+		},
 		{
 			ID: "kvm-debian-bookworm", Name: "Debian 12 KVM",
 			Distro: "debian", Release: "bookworm", Arch: "amd64",
 			Description: "Debian 12 generic cloud image for KVM",
 			URL:         "https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2",
 		},
+		{
+			ID: "kvm-debian-trixie-xfce", Name: "Debian 13 XFCE KVM",
+			Distro: "debian", Release: "trixie", Arch: "amd64",
+			Description: "Debian 13 generic cloud image with XFCE desktop provisioned via cloud-init",
+			URL:         "https://cloud.debian.org/images/cloud/trixie/latest/debian-13-genericcloud-amd64.qcow2",
+			Desktop:     "xfce",
+		},
 		{
 			ID: "kvm-debian-bookworm-xfce", Name: "Debian 12 XFCE KVM",
 			Distro: "debian", Release: "bookworm", Arch: "amd64",
@@ -85,6 +133,12 @@ func GetImages() []Image {
 			Description: "Rocky Linux 9 GenericCloud image for KVM",
 			URL:         "https://dl.rockylinux.org/pub/rocky/9/images/x86_64/Rocky-9-GenericCloud-Base.latest.x86_64.qcow2",
 		},
+		{
+			ID: "kvm-windows-11", Name: "Windows 11 KVM",
+			Distro: "windows", Release: "11", Arch: "amd64",
+			Description: "Windows 11 Enterprise LTSC 2024 Evaluation",
+			URL:         "https://go.microsoft.com/fwlink/?clcid=0x409&country=us&culture=en-us&linkid=2289029",
+		},
 		{
 			ID: "kvm-windows-10", Name: "Windows 10 KVM",
 			Distro: "windows", Release: "10", Arch: "amd64",
@@ -94,6 +148,59 @@ func GetImages() []Image {
 	}
 }
 
+func arm64Images() []Image {
+	return []Image{
+		{
+			ID: "kvm-ubuntu-noble", Name: "Ubuntu 24.04 KVM",
+			Distro: "ubuntu", Release: "noble", Arch: "arm64",
+			Description: "Ubuntu 24.04 LTS cloud image for ARM64 KVM",
+			URL:         "https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-arm64.img",
+		},
+		{
+			ID: "kvm-ubuntu-jammy", Name: "Ubuntu 22.04 KVM",
+			Distro: "ubuntu", Release: "jammy", Arch: "arm64",
+			Description: "Ubuntu 22.04 LTS cloud image for ARM64 KVM",
+			URL:         "https://cloud-images.ubuntu.com/jammy/current/jammy-server-cloudimg-arm64.img",
+		},
+		{
+			ID: "kvm-debian-trixie", Name: "Debian 13 KVM",
+			Distro: "debian", Release: "trixie", Arch: "arm64",
+			Description: "Debian 13 generic cloud image for ARM64 KVM",
+			URL:         "https://cloud.debian.org/images/cloud/trixie/latest/debian-13-genericcloud-arm64.qcow2",
+		},
+		{
+			ID: "kvm-debian-bookworm", Name: "Debian 12 KVM",
+			Distro: "debian", Release: "bookworm", Arch: "arm64",
+			Description: "Debian 12 generic cloud image for ARM64 KVM",
+			URL:         "https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-arm64.qcow2",
+		},
+		{
+			ID: "kvm-debian-bullseye", Name: "Debian 11 KVM",
+			Distro: "debian", Release: "bullseye", Arch: "arm64",
+			Description: "Debian 11 generic cloud image for ARM64 KVM",
+			URL:         "https://cloud.debian.org/images/cloud/bullseye/latest/debian-11-genericcloud-arm64.qcow2",
+		},
+		{
+			ID: "kvm-centos-9-stream", Name: "CentOS Stream 9 KVM",
+			Distro: "centos", Release: "9-stream", Arch: "arm64",
+			Description: "CentOS Stream 9 GenericCloud image for ARM64 KVM",
+			URL:         "https://cloud.centos.org/centos/9-stream/aarch64/images/CentOS-Stream-GenericCloud-9-latest.aarch64.qcow2",
+		},
+		{
+			ID: "kvm-fedora-44", Name: "Fedora 44 KVM",
+			Distro: "fedora", Release: "44", Arch: "arm64",
+			Description: "Fedora 44 GenericCloud image for ARM64 KVM",
+			URL:         "https://download.fedoraproject.org/pub/fedora/linux/releases/44/Cloud/aarch64/images/Fedora-Cloud-Base-Generic-44-1.7.aarch64.qcow2",
+		},
+		{
+			ID: "kvm-rockylinux-9", Name: "Rocky Linux 9 KVM",
+			Distro: "rockylinux", Release: "9", Arch: "arm64",
+			Description: "Rocky Linux 9 GenericCloud image for ARM64 KVM",
+			URL:         "https://dl.rockylinux.org/pub/rocky/9/images/aarch64/Rocky-9-GenericCloud-Base.latest.aarch64.qcow2",
+		},
+	}
+}
+
 func FindImage(id string) *Image {
 	for _, image := range GetImages() {
 		if image.ID == id {
@@ -104,22 +211,56 @@ func FindImage(id string) *Image {
 }
 
 func CacheDir() string {
+	if pool := config.PreferredStoragePoolForContent(config.StorageContentImages); pool != nil {
+		return filepath.Join(pool.Path, "images", "kvm")
+	}
 	return filepath.Join(BaseDir(), "images")
 }
 
 func ImagePath(id string) string {
 	img := FindImage(id)
 	ext := ".qcow2"
-	if img != nil && img.Distro == "windows" {
+	safeID := "__invalid_image_id__"
+	if img != nil {
+		safeID = img.ID
+	}
+	if img != nil && img.IsWindows() {
 		ext = ".iso"
 	}
-	return filepath.Join(CacheDir(), id+ext)
+	fileName := safeID + ext
+	for _, pool := range config.StoragePoolsForContent(config.StorageContentImages) {
+		candidate := filepath.Join(pool.Path, "images", "kvm", fileName)
+		if info, err := os.Stat(candidate); err == nil && !info.IsDir() {
+			return candidate
+		}
+	}
+	legacy := filepath.Join("/var/lib/clicd/kvm/images", fileName)
+	if info, err := os.Stat(legacy); err == nil && !info.IsDir() {
+		return legacy
+	}
+	return filepath.Join(CacheDir(), fileName)
 }
 
-// IsWindowsImage returns true if the image distro is "windows".
+func (image Image) IsWindows() bool {
+	return image.Provisioner == config.KVMProvisionerWindows10 ||
+		image.Provisioner == config.KVMProvisionerWindows11 ||
+		(image.Provisioner == "" && image.Distro == "windows")
+}
+
+func (image Image) IsWindows11() bool {
+	return image.Provisioner == config.KVMProvisionerWindows11 ||
+		(image.Provisioner == "" && image.Distro == "windows" && image.Release == "11")
+}
+
+// IsWindowsImage returns true if the image uses Windows unattended installation.
 func IsWindowsImage(id string) bool {
 	img := FindImage(id)
-	return img != nil && img.Distro == "windows"
+	return img != nil && img.IsWindows()
+}
+
+func IsWindows11Image(id string) bool {
+	img := FindImage(id)
+	return img != nil && img.IsWindows11()
 }
 
 func virtioWinISOPath() string {

backend/internal/lxc/custom_images.go

@@ -0,0 +1,297 @@
+package lxc
+
+import (
+	"bufio"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"clicd/internal/safehttp"
+)
+
+type CustomImageDownloadProgress struct {
+	Stage           string
+	DownloadedBytes int64
+	TotalBytes      int64
+	Percent         int
+}
+
+type CustomImageDownloadProgressFunc func(CustomImageDownloadProgress)
+
+func CustomImagePath(id string) string {
+	template := FindTemplate(id)
+	if template == nil || !template.Custom {
+		return filepath.Join("/var/cache/lxc/download/custom", "__invalid_image_id__", "rootfs.tar")
+	}
+	return filepath.Join("/var/cache/lxc/download/custom", template.ID, "rootfs.tar")
+}
+
+func CustomImageDownloadedInfo(id string) (bool, int64) {
+	info, err := os.Stat(CustomImagePath(id))
+	if err != nil || info.IsDir() {
+		return false, 0
+	}
+	return true, info.Size()
+}
+
+func DeleteCustomImage(id string) error {
+	template := FindTemplate(id)
+	if template == nil || !template.Custom {
+		return fmt.Errorf("custom LXC image not found")
+	}
+	return os.RemoveAll(filepath.Dir(CustomImagePath(id)))
+}
+
+func DownloadCustomImageWithProgress(ctx context.Context, template Template, progress CustomImageDownloadProgressFunc) error {
+	if !template.Custom {
+		return fmt.Errorf("template is not a custom LXC image")
+	}
+	target := CustomImagePath(template.ID)
+	if ok, _ := CustomImageDownloadedInfo(template.ID); ok {
+		return nil
+	}
+	if err := os.MkdirAll(filepath.Dir(target), 0755); err != nil {
+		return err
+	}
+	tmp := target + ".tmp"
+	_ = os.Remove(tmp)
+	if err := downloadCustomRootfs(ctx, template.URL, tmp, progress); err != nil {
+		_ = os.Remove(tmp)
+		return err
+	}
+	if err := ctx.Err(); err != nil {
+		_ = os.Remove(tmp)
+		return err
+	}
+	if template.SHA256 != "" {
+		if err := verifyCustomRootfsSHA256(tmp, template.SHA256); err != nil {
+			_ = os.Remove(tmp)
+			return err
+		}
+	}
+	if progress != nil {
+		progress(CustomImageDownloadProgress{Stage: "validating", Percent: 100})
+	}
+	if err := ValidateCustomRootfsArchive(tmp); err != nil {
+		_ = os.Remove(tmp)
+		return err
+	}
+	if err := os.Rename(tmp, target); err != nil {
+		_ = os.Remove(tmp)
+		return err
+	}
+	return os.Chmod(target, 0644)
+}
+
+func downloadCustomRootfs(ctx context.Context, sourceURL, target string, progress CustomImageDownloadProgressFunc) error {
+	response, err := safehttp.Get(ctx, sourceURL, "CLICD/1.0 LXC image downloader", 30*time.Minute)
+	if err != nil {
+		return err
+	}
+	defer response.Body.Close()
+	if response.StatusCode < 200 || response.StatusCode >= 300 {
+		return fmt.Errorf("download failed: %s", response.Status)
+	}
+	file, err := os.OpenFile(target, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0600)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	total := response.ContentLength
+	buffer := make([]byte, 128*1024)
+	var downloaded int64
+	for {
+		count, readErr := response.Body.Read(buffer)
+		if count > 0 {
+			if _, err := file.Write(buffer[:count]); err != nil {
+				return err
+			}
+			downloaded += int64(count)
+			if progress != nil {
+				percent := 0
+				if total > 0 {
+					percent = int(downloaded * 100 / total)
+					if percent > 100 {
+						percent = 100
+					}
+				}
+				progress(CustomImageDownloadProgress{
+					Stage:           "downloading",
+					DownloadedBytes: downloaded,
+					TotalBytes:      total,
+					Percent:         percent,
+				})
+			}
+		}
+		if readErr == io.EOF {
+			break
+		}
+		if readErr != nil {
+			return readErr
+		}
+	}
+	return file.Sync()
+}
+
+func verifyCustomRootfsSHA256(filePath, expected string) error {
+	file, err := os.Open(filePath)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	hash := sha256.New()
+	if _, err := io.Copy(hash, file); err != nil {
+		return err
+	}
+	actual := hex.EncodeToString(hash.Sum(nil))
+	if !strings.EqualFold(actual, strings.TrimSpace(expected)) {
+		return fmt.Errorf("SHA-256 mismatch: expected %s, got %s", expected, actual)
+	}
+	return nil
+}
+
+func ValidateCustomRootfsArchive(archivePath string) error {
+	command := exec.Command("tar", "-tf", archivePath)
+	stdout, err := command.StdoutPipe()
+	if err != nil {
+		return err
+	}
+	var stderr strings.Builder
+	command.Stderr = &stderr
+	if err := command.Start(); err != nil {
+		return fmt.Errorf("failed to inspect rootfs archive: %v", err)
+	}
+
+	scanner := bufio.NewScanner(stdout)
+	scanner.Buffer(make([]byte, 64*1024), 1024*1024)
+	entries := make([]string, 0, 4096)
+	for scanner.Scan() {
+		if len(entries) >= 2_000_000 {
+			_ = command.Process.Kill()
+			return fmt.Errorf("rootfs archive contains too many entries")
+		}
+		entries = append(entries, scanner.Text())
+	}
+	scanErr := scanner.Err()
+	waitErr := command.Wait()
+	if scanErr != nil {
+		return fmt.Errorf("failed to read rootfs archive: %v", scanErr)
+	}
+	if waitErr != nil {
+		return fmt.Errorf("invalid rootfs archive: %v, output: %s", waitErr, strings.TrimSpace(stderr.String()))
+	}
+	return validateCustomRootfsEntries(entries)
+}
+
+func validateCustomRootfsEntries(entries []string) error {
+	hasInit := false
+	for _, entry := range entries {
+		entry = strings.TrimSpace(strings.ReplaceAll(entry, "\\", "/"))
+		entry = strings.TrimPrefix(entry, "./")
+		if entry == "" || entry == "." {
+			continue
+		}
+		if strings.HasPrefix(entry, "/") {
+			return fmt.Errorf("rootfs archive contains an absolute path: %s", entry)
+		}
+		clean := path.Clean(entry)
+		if clean == ".." || strings.HasPrefix(clean, "../") {
+			return fmt.Errorf("rootfs archive contains path traversal: %s", entry)
+		}
+		switch strings.TrimSuffix(clean, "/") {
+		case "sbin/init", "usr/lib/systemd/systemd", "lib/systemd/systemd", "bin/busybox", "bin/sh":
+			hasInit = true
+		}
+	}
+	if len(entries) == 0 {
+		return fmt.Errorf("rootfs archive is empty")
+	}
+	if !hasInit {
+		return fmt.Errorf("rootfs archive does not contain a supported init")
+	}
+	return nil
+}
+
+func ExtractCustomRootfs(templateID, destination string) error {
+	template := FindTemplate(templateID)
+	if template == nil || !template.Custom {
+		return fmt.Errorf("custom LXC image not found: %s", templateID)
+	}
+	archive := CustomImagePath(template.ID)
+	if ok, _ := CustomImageDownloadedInfo(template.ID); !ok {
+		return fmt.Errorf("custom LXC image is not downloaded: %s", templateID)
+	}
+	if err := ValidateCustomRootfsArchive(archive); err != nil {
+		return err
+	}
+	if err := os.MkdirAll(destination, 0755); err != nil {
+		return err
+	}
+	output, err := exec.Command("tar", "-xpf", archive, "-C", destination).CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("failed to extract custom LXC rootfs: %v, output: %s", err, strings.TrimSpace(string(output)))
+	}
+	if err := secureExtractedRootfs(destination); err != nil {
+		return err
+	}
+	if !rootfsHasInit(destination) {
+		return fmt.Errorf("extracted custom LXC rootfs is invalid: init not found")
+	}
+	return nil
+}
+
+func secureExtractedRootfs(root string) error {
+	root, err := filepath.Abs(root)
+	if err != nil {
+		return err
+	}
+	return filepath.WalkDir(root, func(filePath string, entry os.DirEntry, walkErr error) error {
+		if walkErr != nil {
+			return walkErr
+		}
+		info, err := entry.Info()
+		if err != nil {
+			return err
+		}
+		if info.Mode()&os.ModeSymlink == 0 {
+			return nil
+		}
+		target, err := os.Readlink(filePath)
+		if err != nil {
+			return err
+		}
+		var resolved string
+		if filepath.IsAbs(target) {
+			resolved = filepath.Join(root, strings.TrimLeft(filepath.ToSlash(target), "/"))
+			relative, err := filepath.Rel(filepath.Dir(filePath), resolved)
+			if err != nil {
+				return err
+			}
+			if err := os.Remove(filePath); err != nil {
+				return err
+			}
+			if err := os.Symlink(relative, filePath); err != nil {
+				return err
+			}
+		} else {
+			resolved = filepath.Join(filepath.Dir(filePath), target)
+		}
+		relativeToRoot, err := filepath.Rel(root, filepath.Clean(resolved))
+		if err != nil {
+			return err
+		}
+		if relativeToRoot == ".." || strings.HasPrefix(relativeToRoot, ".."+string(os.PathSeparator)) {
+			return fmt.Errorf("rootfs symlink escapes the archive root: %s -> %s", filePath, target)
+		}
+		return nil
+	})
+}

backend/internal/lxc/custom_images_test.go

@@ -0,0 +1,61 @@
+package lxc
+
+import (
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"clicd/internal/config"
+)
+
+func TestGetTemplatesIncludesHostArchitectureCustomLXCImage(t *testing.T) {
+	previous := config.AppConfig
+	t.Cleanup(func() { config.AppConfig = previous })
+	config.AppConfig = &config.ClicdConfig{CustomLXCImages: []config.CustomLXCImage{
+		{
+			ID: "custom-lxc-host", Name: "Host Rootfs", Distro: "alpine",
+			Release: "3.21", Arch: runtime.GOARCH, URL: "https://example.test/rootfs.tar.xz",
+		},
+		{
+			ID: "custom-lxc-other", Name: "Other Rootfs", Distro: "alpine",
+			Release: "3.21", Arch: "not-" + runtime.GOARCH, URL: "https://example.test/other.tar.xz",
+		},
+	}}
+
+	template := FindTemplate("custom-lxc-host")
+	if template == nil || !template.Custom || template.URL == "" {
+		t.Fatalf("custom LXC template was not exposed correctly: %+v", template)
+	}
+	if FindTemplate("custom-lxc-other") != nil {
+		t.Fatal("custom LXC template for another architecture was exposed")
+	}
+}
+
+func TestCustomImagePathUsesAllowlistedID(t *testing.T) {
+	previous := config.AppConfig
+	t.Cleanup(func() { config.AppConfig = previous })
+	config.AppConfig = &config.ClicdConfig{}
+
+	for _, id := range []string{"", ".", "..", "../../etc/passwd", "/absolute", "unknown"} {
+		got := filepath.ToSlash(CustomImagePath(id))
+		if filepath.Base(filepath.Dir(got)) != "__invalid_image_id__" {
+			t.Fatalf("CustomImagePath(%q) = %q", id, got)
+		}
+	}
+}
+
+func TestValidateCustomRootfsEntries(t *testing.T) {
+	if err := validateCustomRootfsEntries([]string{"./etc/", "./bin/", "./bin/sh"}); err != nil {
+		t.Fatalf("valid rootfs entries failed: %v", err)
+	}
+	for _, entries := range [][]string{
+		{},
+		{"etc/passwd"},
+		{"/etc/passwd", "bin/sh"},
+		{"../../etc/passwd", "bin/sh"},
+	} {
+		if err := validateCustomRootfsEntries(entries); err == nil {
+			t.Fatalf("unsafe rootfs entries unexpectedly passed: %#v", entries)
+		}
+	}
+}

backend/internal/lxc/ipv6.go

@@ -1515,6 +1515,75 @@ func (m *Manager) AssignIPv6(id int) (*config.Container, error) {
 	return c, nil
 }
 
+func (m *Manager) UpdateIPv6Assignments(id int, requested []string, count int, auto bool) (*config.Container, error) {
+	c := config.FindContainer(id)
+	if c == nil {
+		return nil, fmt.Errorf("container not found: %d", id)
+	}
+
+	oldAssignments := append([]config.IPv6Assignment(nil), c.IPv6Addresses...)
+	oldPrimary := c.IPv6
+	oldPrimaryPrefixLen := c.IPv6PrefixLen
+	oldPrimaryInterface := c.IPv6Interface
+
+	assignments := []config.IPv6Assignment{}
+	if auto || len(requested) > 0 {
+		allocated, err := m.allocateIPv6AssignmentsForContainer(id, requested, count, auto)
+		if err != nil {
+			return nil, err
+		}
+		assignments = allocated
+	}
+
+	for _, assignment := range oldAssignments {
+		uplink := assignment.Interface
+		if uplink == "" {
+			uplink = oldPrimaryInterface
+		}
+		removeHostIPv6Routing(assignment.Address, uplink)
+	}
+	if len(oldAssignments) == 0 && oldPrimary != "" {
+		removeHostIPv6Routing(oldPrimary, oldPrimaryInterface)
+		oldAssignments = append(oldAssignments, config.IPv6Assignment{Address: oldPrimary, PrefixLen: oldPrimaryPrefixLen, Interface: oldPrimaryInterface})
+	}
+
+	c.IPv6 = ""
+	c.IPv6PrefixLen = 0
+	c.IPv6Interface = ""
+	c.IPv6Addresses = assignments
+	c.NormalizeNetworkAssignments()
+	config.SaveConfig()
+
+	if err := m.applyIPv6Config(c.LxcName(), c.IPv6AddressStrings()...); err != nil {
+		return nil, err
+	}
+	rootfsPath := filepath.Join(m.LxcPath, c.LxcName(), "rootfs")
+	if _, err := os.Stat(rootfsPath); err == nil {
+		if len(c.IPv6Addresses) == 0 {
+			if err := removeContainerIPv6Init(rootfsPath); err != nil {
+				fmt.Printf("Warning: failed to remove IPv6 init in %s: %v\n", c.LxcName(), err)
+			}
+		} else if err := installContainerIPv6Init(rootfsPath, c.IPv6AddressStrings()...); err != nil {
+			fmt.Printf("Warning: failed to install IPv6 init in %s: %v\n", c.LxcName(), err)
+		}
+	}
+	status, _ := m.GetContainerStatus(c.LxcName())
+	if status == "running" {
+		m.removeGuestIPv6Addresses(c.LxcName(), oldAssignments)
+	}
+	if len(c.IPv6Addresses) > 0 {
+		if err := m.ApplyIPv6(id); err != nil {
+			return nil, err
+		}
+	} else if status == "running" {
+		m.removeGuestIPv6DefaultRoute(c.LxcName())
+		if err := ApplyFirewallRules(c.ID); err != nil {
+			fmt.Printf("Warning: failed to re-apply firewall rules after IPv6 removal for %s: %v\n", c.Name, err)
+		}
+	}
+	return c, nil
+}
+
 func (m *Manager) applyIPv6Config(lxcName string, ipv6s ...string) error {
 	configFile := filepath.Join(m.LxcPath, lxcName, "config")
 	data, err := os.ReadFile(configFile)
@@ -1522,7 +1591,7 @@ func (m *Manager) applyIPv6Config(lxcName string, ipv6s ...string) error {
 		return fmt.Errorf("failed to read container config: %v", err)
 	}
 	lines := strings.Split(string(data), "\n")
-	next := make([]string, 0, len(lines)+4)
+	next := make([]string, 0, len(lines))
 	for _, line := range lines {
 		trimmed := strings.TrimSpace(line)
 		if strings.Contains(trimmed, "# clicd managed: public IPv6") ||
@@ -1705,6 +1774,25 @@ exit 0
 	return nil
 }
 
+func removeContainerIPv6Init(rootfsPath string) error {
+	paths := []string{
+		filepath.Join(rootfsPath, "usr", "local", "sbin", "clicd-ipv6-init"),
+		filepath.Join(rootfsPath, "etc", "systemd", "system", "clicd-ipv6.service"),
+		filepath.Join(rootfsPath, "etc", "systemd", "system", "multi-user.target.wants", "clicd-ipv6.service"),
+		filepath.Join(rootfsPath, "etc", "init.d", "clicd-ipv6"),
+		filepath.Join(rootfsPath, "etc", "runlevels", "default", "clicd-ipv6"),
+	}
+	for _, level := range []string{"2", "3", "4", "5"} {
+		paths = append(paths, filepath.Join(rootfsPath, "etc", "rc"+level+".d", "S99clicd-ipv6"))
+	}
+	for _, path := range paths {
+		if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
+			return err
+		}
+	}
+	return nil
+}
+
 func installContainerIPv6Systemd(rootfsPath string) error {
 	servicePath := filepath.Join(rootfsPath, "etc", "systemd", "system", "clicd-ipv6.service")
 	if err := os.MkdirAll(filepath.Dir(servicePath), 0755); err != nil {
@@ -1873,6 +1961,21 @@ func containerIPv6ConnectivityOK(lxcName string) bool {
 	return false
 }
 
+func (m *Manager) removeGuestIPv6Addresses(lxcName string, assignments []config.IPv6Assignment) {
+	addrs := ipv6AssignmentAddresses(assignments)
+	if len(addrs) == 0 {
+		return
+	}
+	quoted := shellQuotedIPv6List(addrs)
+	_ = exec.Command("lxc-attach", "-n", lxcName, "--", "sh", "-c",
+		fmt.Sprintf("for ip in %s; do ip -6 addr del \"$ip/128\" dev eth0 2>/dev/null || true; done", quoted)).Run()
+}
+
+func (m *Manager) removeGuestIPv6DefaultRoute(lxcName string) {
+	_ = exec.Command("lxc-attach", "-n", lxcName, "--", "sh", "-c",
+		fmt.Sprintf("ip -6 route del default via %s dev eth0 2>/dev/null || true", shellQuote(ipv6GatewayLinkLocal))).Run()
+}
+
 func ensureIPv6NAT66(ipv6, uplink string) {
 	if ipv6 == "" || uplink == "" {
 		return

backend/internal/lxc/lxc_test.go

@@ -6,6 +6,8 @@ import (
 	"reflect"
 	"strings"
 	"testing"
+
+	"clicd/internal/config"
 )
 
 func TestRootfsCommandAddsSeparatorForAllowedCommand(t *testing.T) {
@@ -27,6 +29,335 @@ func TestRootfsCommandAddsSeparatorForAllowedCommand(t *testing.T) {
 	}
 }
 
+func TestNormalizeCreateNATMappingsSupportsDifferentHostAndContainerPorts(t *testing.T) {
+	previous := config.AppConfig
+	t.Cleanup(func() { config.AppConfig = previous })
+	config.AppConfig = &config.ClicdConfig{NATPortStart: 20000, NATPortEnd: 65535}
+
+	cfg := ContainerConfig{
+		PortMappingCount: 2,
+		NATPortMappings: []config.PortMapping{{
+			HostPort:      30080,
+			ContainerPort: 80,
+			Protocol:      "TCP",
+		}},
+	}
+	if err := cfg.NormalizeCreateNATMappings(); err != nil {
+		t.Fatal(err)
+	}
+	if cfg.PortMappingCount != 2 || len(cfg.NATPortMappings) != 1 {
+		t.Fatalf("normalized config = %+v", cfg)
+	}
+	mapping := cfg.NATPortMappings[0]
+	if mapping.HostPort != 30080 || mapping.ContainerPort != 80 || mapping.Protocol != "tcp" {
+		t.Fatalf("normalized mapping = %+v", mapping)
+	}
+
+	container := &config.Container{
+		ID: -1,
+		PortMappings: []config.PortMapping{{
+			HostPort:      22000,
+			ContainerPort: 22,
+			Protocol:      "tcp",
+			Description:   "SSH",
+		}},
+	}
+	mappings, err := SetupCreatePortMappings(container, cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(mappings) != 2 || mappings[1].HostPort != 30080 || mappings[1].ContainerPort != 80 {
+		t.Fatalf("created mappings = %+v", mappings)
+	}
+}
+
+func TestNormalizeCreateNATMappingsKeepsLegacyExtraPortsCompatible(t *testing.T) {
+	previous := config.AppConfig
+	t.Cleanup(func() { config.AppConfig = previous })
+	config.AppConfig = &config.ClicdConfig{NATPortStart: 20000, NATPortEnd: 65535}
+
+	cfg := ContainerConfig{ExtraPorts: []int{30080, 30443}}
+	if err := cfg.NormalizeCreateNATMappings(); err != nil {
+		t.Fatal(err)
+	}
+	if len(cfg.ExtraPorts) != 0 || len(cfg.NATPortMappings) != 2 {
+		t.Fatalf("legacy ports were not converted: %+v", cfg)
+	}
+	for _, mapping := range cfg.NATPortMappings {
+		if mapping.HostPort != mapping.ContainerPort {
+			t.Fatalf("legacy mapping changed semantics: %+v", mapping)
+		}
+	}
+}
+
+func TestNormalizeCreateNATMappingsRejectsDuplicateHostPort(t *testing.T) {
+	previous := config.AppConfig
+	t.Cleanup(func() { config.AppConfig = previous })
+	config.AppConfig = &config.ClicdConfig{NATPortStart: 20000, NATPortEnd: 65535}
+
+	cfg := ContainerConfig{NATPortMappings: []config.PortMapping{
+		{HostPort: 30080, ContainerPort: 80, Protocol: "tcp"},
+		{HostPort: 30080, ContainerPort: 8080, Protocol: "tcp"},
+	}}
+	if err := cfg.NormalizeCreateNATMappings(); err == nil {
+		t.Fatal("duplicate host port was accepted")
+	}
+}
+
+func TestNormalizeCreateNATMappingsRejectsManagementPortConflict(t *testing.T) {
+	previous := config.AppConfig
+	t.Cleanup(func() { config.AppConfig = previous })
+	config.AppConfig = &config.ClicdConfig{NATPortStart: 20000, NATPortEnd: 65535}
+
+	cfg := ContainerConfig{
+		ManagementPort: 30022,
+		NATPortMappings: []config.PortMapping{{
+			HostPort:      30022,
+			ContainerPort: 8080,
+			Protocol:      "tcp",
+		}},
+	}
+	if err := cfg.NormalizeCreateNATMappings(); err == nil || !strings.Contains(err.Error(), "management_port") {
+		t.Fatalf("management port conflict returned %v", err)
+	}
+}
+
+func TestTaggedRuleLineNumbersReturnsMatchingRulesDescending(t *testing.T) {
+	output := []byte(`Chain PREROUTING (policy ACCEPT)
+num  target prot opt source destination
+2 DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:30080 /* clicd-c12-any-30080 */
+7 DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:30081 /* clicd-c13-any-30081 */
+11 DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:30082 /* clicd-c12-any-30082 */
+`)
+	got := taggedRuleLineNumbers(output, "clicd-c12-")
+	want := []int{11, 2}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("taggedRuleLineNumbers() = %v, want %v", got, want)
+	}
+}
+
+func TestPortMappingConntrackDeleteArgs(t *testing.T) {
+	got := portMappingConntrackDeleteArgs(config.PortMapping{
+		HostIP:   "203.0.113.10",
+		HostPort: 32022,
+		Protocol: "TCP",
+	})
+	want := []string{"-D", "-p", "tcp", "--dport", "32022", "--dst", "203.0.113.10"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("portMappingConntrackDeleteArgs() = %v, want %v", got, want)
+	}
+
+	if got := portMappingConntrackDeleteArgs(config.PortMapping{HostPort: 32022, Protocol: "icmp"}); got != nil {
+		t.Fatalf("unsupported protocol returned args: %v", got)
+	}
+}
+
+func TestUpdateSSHPortMappingKeepsIdentityAndSynchronizesSSHPort(t *testing.T) {
+	previous := config.AppConfig
+	t.Cleanup(func() { config.AppConfig = previous })
+	config.AppConfig = &config.ClicdConfig{
+		NATPortStart: 30000,
+		NATPortEnd:   65535,
+		Containers: []config.Container{{
+			ID:      12,
+			Name:    "ct-test",
+			Status:  "stopped",
+			SSHPort: 30022,
+			PortMappings: []config.PortMapping{{
+				HostPort:      30022,
+				ContainerPort: 22,
+				Protocol:      "tcp",
+				Description:   "SSH",
+			}},
+		}},
+	}
+
+	manager := NewManager()
+	mappings, err := manager.UpdatePortMapping(12, 0, config.PortMapping{
+		HostPort:      31022,
+		ContainerPort: 22,
+		Protocol:      "tcp",
+		Description:   "renamed",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(mappings) != 1 || mappings[0].Description != "SSH" {
+		t.Fatalf("updated mappings = %+v", mappings)
+	}
+	container := config.FindContainer(12)
+	if container == nil || container.SSHPort != 31022 {
+		t.Fatalf("container after SSH update = %+v", container)
+	}
+	if _, err := manager.DeletePortMapping(12, 0); err == nil {
+		t.Fatal("updated SSH mapping became deletable")
+	}
+}
+
+func TestReserveCreateNATPortsProtectsConcurrentTasks(t *testing.T) {
+	previous := config.AppConfig
+	t.Cleanup(func() { config.AppConfig = previous })
+	config.AppConfig = &config.ClicdConfig{
+		NATPortStart: 20000,
+		NATPortEnd:   65535,
+		NextSSHPort:  22000,
+	}
+
+	createNATReservationMu.Lock()
+	createNATReservations = map[uint64][]config.PortMapping{}
+	queuedCreateNATReservations = map[string][]config.PortMapping{}
+	createNATReservationMu.Unlock()
+	t.Cleanup(func() {
+		createNATReservationMu.Lock()
+		createNATReservations = map[uint64][]config.PortMapping{}
+		queuedCreateNATReservations = map[string][]config.PortMapping{}
+		createNATReservationMu.Unlock()
+	})
+
+	cfg := ContainerConfig{NATPortMappings: []config.PortMapping{{
+		HostPort:      22000,
+		ContainerPort: 80,
+		Protocol:      "tcp",
+	}}}
+	if err := cfg.NormalizeCreateNATMappings(); err != nil {
+		t.Fatal(err)
+	}
+
+	managementPort, release, err := ReserveCreateNATPorts(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if managementPort == 22000 {
+		t.Fatal("management port collided with the requested custom host port")
+	}
+	if _, _, err := ReserveCreateNATPorts(cfg); err == nil {
+		t.Fatal("concurrent task reserved an already reserved custom host port")
+	}
+
+	release()
+	if _, releaseAgain, err := ReserveCreateNATPorts(cfg); err != nil {
+		t.Fatalf("released custom host port remained reserved: %v", err)
+	} else {
+		releaseAgain()
+	}
+
+	explicit := ContainerConfig{ManagementPort: 30022}
+	if err := explicit.NormalizeCreateNATMappings(); err != nil {
+		t.Fatal(err)
+	}
+	if port, releaseExplicit, err := ReserveCreateNATPorts(explicit); err != nil {
+		t.Fatal(err)
+	} else {
+		defer releaseExplicit()
+		if port != explicit.ManagementPort {
+			t.Fatalf("reserved management port = %d, want %d", port, explicit.ManagementPort)
+		}
+	}
+}
+
+func TestReserveBatchCreateNATPortsPlansAllAutomaticPorts(t *testing.T) {
+	previous := config.AppConfig
+	t.Cleanup(func() { config.AppConfig = previous })
+	config.AppConfig = &config.ClicdConfig{
+		NATPortStart: 30000,
+		NATPortEnd:   30010,
+		NextSSHPort:  30001,
+	}
+
+	createNATReservationMu.Lock()
+	createNATReservations = map[uint64][]config.PortMapping{}
+	queuedCreateNATReservations = map[string][]config.PortMapping{}
+	createNATReservationMu.Unlock()
+	t.Cleanup(func() {
+		createNATReservationMu.Lock()
+		createNATReservations = map[uint64][]config.PortMapping{}
+		queuedCreateNATReservations = map[string][]config.PortMapping{}
+		createNATReservationMu.Unlock()
+	})
+
+	configs := []ContainerConfig{
+		{Name: "batch-1", PortMappingCount: 2},
+		{Name: "batch-2", PortMappingCount: 2},
+	}
+	for i := range configs {
+		if err := configs[i].NormalizeCreateNATMappings(); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	planned, err := ReserveBatchCreateNATPorts(configs)
+	if err != nil {
+		t.Fatal(err)
+	}
+	used := map[int]string{}
+	for _, cfg := range planned {
+		if cfg.ManagementPort == 0 {
+			t.Fatalf("%s has no planned management port", cfg.Name)
+		}
+		if len(cfg.NATPortMappings) != 1 {
+			t.Fatalf("%s automatic mappings = %d, want 1", cfg.Name, len(cfg.NATPortMappings))
+		}
+		for _, port := range []int{cfg.ManagementPort, cfg.NATPortMappings[0].HostPort} {
+			if owner := used[port]; owner != "" {
+				t.Fatalf("planned port %d is shared by %s and %s", port, owner, cfg.Name)
+			}
+			used[port] = cfg.Name
+		}
+	}
+
+	for _, cfg := range planned {
+		port, release, err := ReserveCreateNATPorts(cfg)
+		if err != nil {
+			t.Fatalf("%s could not claim its queued reservation: %v", cfg.Name, err)
+		}
+		if port != cfg.ManagementPort {
+			t.Fatalf("%s claimed management port %d, want %d", cfg.Name, port, cfg.ManagementPort)
+		}
+		release()
+	}
+	if len(queuedCreateNATReservations) != 0 {
+		t.Fatalf("queued reservations remain after claim: %v", queuedCreateNATReservations)
+	}
+}
+
+func TestReserveBatchCreateNATPortsRejectsWholeConflictingBatch(t *testing.T) {
+	previous := config.AppConfig
+	t.Cleanup(func() { config.AppConfig = previous })
+	config.AppConfig = &config.ClicdConfig{
+		NATPortStart: 30000,
+		NATPortEnd:   30010,
+		NextSSHPort:  30001,
+	}
+
+	createNATReservationMu.Lock()
+	createNATReservations = map[uint64][]config.PortMapping{}
+	queuedCreateNATReservations = map[string][]config.PortMapping{}
+	createNATReservationMu.Unlock()
+	t.Cleanup(func() {
+		createNATReservationMu.Lock()
+		createNATReservations = map[uint64][]config.PortMapping{}
+		queuedCreateNATReservations = map[string][]config.PortMapping{}
+		createNATReservationMu.Unlock()
+	})
+
+	configs := []ContainerConfig{
+		{Name: "batch-1", NATPortMappings: []config.PortMapping{{HostPort: 30005, ContainerPort: 80, Protocol: "tcp"}}},
+		{Name: "batch-2", NATPortMappings: []config.PortMapping{{HostPort: 30005, ContainerPort: 8080, Protocol: "tcp"}}},
+	}
+	for i := range configs {
+		if err := configs[i].NormalizeCreateNATMappings(); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	if _, err := ReserveBatchCreateNATPorts(configs); err == nil {
+		t.Fatal("conflicting batch was accepted")
+	}
+	if len(queuedCreateNATReservations) != 0 {
+		t.Fatalf("conflicting batch left partial reservations: %v", queuedCreateNATReservations)
+	}
+}
+
 func TestRootfsCommandRejectsUnmanagedCommand(t *testing.T) {
 	base := t.TempDir()
 	rootfs := filepath.Join(base, "ct-1", "rootfs")
@@ -88,3 +419,96 @@ func TestSafeRootfsPathRejectsSiblingPrefix(t *testing.T) {
 		t.Fatalf("safeRootfsPath returned %v, want unsafe rootfs path error", err)
 	}
 }
+
+func TestIsLXCVDenylistSeccompProfile(t *testing.T) {
+	tests := []string{`
+# base profile
+2
+denylist
+[all]
+open_by_handle_at errno 1
+`, `
+2
+blacklist allow
+[all]
+open_by_handle_at errno 1
+`}
+
+	for _, profile := range tests {
+		if !isLXCVDenylistSeccompProfile(profile) {
+			t.Fatalf("expected v2 denylist profile for\n%s", profile)
+		}
+	}
+	if isLXCVDenylistSeccompProfile("1\nallowlist\n1\n") {
+		t.Fatal("did not expect v1 allowlist profile")
+	}
+}
+
+func TestManagedPrlimitLinesDoNotSetNproc(t *testing.T) {
+	for _, line := range managedPrlimitLines() {
+		if strings.HasPrefix(strings.TrimSpace(line), "lxc.prlimit.nproc") {
+			t.Fatalf("managed prlimit lines must not set nproc: %q", line)
+		}
+	}
+}
+
+func TestRootfsHasSSHD(t *testing.T) {
+	rootfs := t.TempDir()
+	if rootfsHasSSHD(rootfs) {
+		t.Fatal("empty rootfs unexpectedly reports sshd")
+	}
+	sshd := filepath.Join(rootfs, "usr", "sbin", "sshd")
+	if err := os.MkdirAll(filepath.Dir(sshd), 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(sshd, []byte("#!/bin/sh\n"), 0755); err != nil {
+		t.Fatal(err)
+	}
+	if !rootfsHasSSHD(rootfs) {
+		t.Fatal("executable sshd was not detected")
+	}
+}
+
+func TestSameFilesystemPathResolvesContainerStorageSymlink(t *testing.T) {
+	base := t.TempDir()
+	storageContainer := filepath.Join(base, "storage", "ct-1")
+	rootfs := filepath.Join(storageContainer, "rootfs")
+	if err := os.MkdirAll(rootfs, 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	lxcPath := filepath.Join(base, "lxc")
+	if err := os.MkdirAll(lxcPath, 0755); err != nil {
+		t.Fatal(err)
+	}
+	containerLink := filepath.Join(lxcPath, "ct-1")
+	if err := os.Symlink(storageContainer, containerLink); err != nil {
+		t.Skipf("directory symlinks are unavailable: %v", err)
+	}
+
+	linkedRootfs := filepath.Join(containerLink, "rootfs")
+	if !sameFilesystemPath(rootfs, linkedRootfs) {
+		t.Fatalf("sameFilesystemPath(%q, %q) = false, want true", rootfs, linkedRootfs)
+	}
+}
+
+func TestAppendMissingSeccompRulesAddsFutexMitigationOnce(t *testing.T) {
+	base := "2\ndenylist\n[all]\nopen_by_handle_at errno 1\n"
+
+	once := appendMissingSeccompRules(base, cve202643499FutexSeccompRules)
+	twice := appendMissingSeccompRules(once, cve202643499FutexSeccompRules)
+
+	for _, want := range []string{
+		"futex errno 1 [1,0x6,SCMP_CMP_MASKED_EQ,0x7f]",
+		"futex errno 1 [1,0xb,SCMP_CMP_MASKED_EQ,0x7f]",
+		"futex errno 1 [1,0xc,SCMP_CMP_MASKED_EQ,0x7f]",
+		"futex errno 1 [1,0xd,SCMP_CMP_MASKED_EQ,0x7f]",
+	} {
+		if !strings.Contains(once, want) {
+			t.Fatalf("missing seccomp rule %q in\n%s", want, once)
+		}
+		if strings.Count(twice, want) != 1 {
+			t.Fatalf("rule %q duplicated in\n%s", want, twice)
+		}
+	}
+}

backend/internal/lxc/portmap.go

@@ -1,15 +1,26 @@
 package lxc
 
 import (
+	"errors"
 	"fmt"
 	"net/netip"
 	"os/exec"
+	"regexp"
+	"sort"
 	"strconv"
 	"strings"
+	"sync"
 
 	"clicd/internal/config"
 )
 
+var (
+	createNATReservationMu      sync.Mutex
+	createNATReservationNextID  uint64
+	createNATReservations       = map[uint64][]config.PortMapping{}
+	queuedCreateNATReservations = map[string][]config.PortMapping{}
+)
+
 // ApplyPortMappings applies iptables DNAT rules for a container's port mappings
 func (m *Manager) ApplyPortMappings(id int) error {
 	c := config.FindContainer(id)
@@ -22,14 +33,16 @@ func (m *Manager) ApplyPortMappings(id int) error {
 	EnsureAssignedPublicIPv4s(c.PublicIPv4s)
 	tag := clicdTag(id)
 	bridge := "lxcbr0"
-	subnet := "10.0.3.0/24"
+	subnet := config.LXCNATNetwork().Subnet
 	if c.IsKVM() {
 		bridge = "virbr0"
-		subnet = "192.168.122.0/24"
+		subnet = config.KVMNATNetwork().Subnet
 	}
 
 	EnsureForwardRules(bridge)
-	m.CleanPortMappings(id)
+	if err := m.CleanPortMappings(id); err != nil {
+		return fmt.Errorf("clean existing port mappings for container %d: %w", id, err)
+	}
 	deleteBridgeMasquerade(subnet)
 
 	for _, pm := range c.PortMappings {
@@ -236,9 +249,13 @@ func clicdTag(id int) string { return "c" + strconv.Itoa(id) }
 
 func EnsureAllRunningPortMappings() {
 	m := NewManager()
+	m.cleanOrphanedPortMappings()
 	for i := range config.AppConfig.Containers {
 		c := &config.AppConfig.Containers[i]
 		if c.Status != "running" || strings.TrimSpace(c.IP) == "" {
+			if err := m.CleanPortMappings(c.ID); err != nil {
+				fmt.Printf("Warning: failed to clean inactive port mappings for %s: %v\n", c.Name, err)
+			}
 			continue
 		}
 		if err := m.ApplyPortMappings(c.ID); err != nil {
@@ -247,11 +264,39 @@ func EnsureAllRunningPortMappings() {
 	}
 }
 
+var taggedContainerIDPattern = regexp.MustCompile(`clicd-c([0-9]+)-`)
+
+func (m *Manager) cleanOrphanedPortMappings() {
+	output, err := exec.Command("iptables-save").Output()
+	if err != nil {
+		return
+	}
+	configured := make(map[int]bool, len(config.AppConfig.Containers))
+	for i := range config.AppConfig.Containers {
+		configured[config.AppConfig.Containers[i].ID] = true
+	}
+	seen := map[int]bool{}
+	for _, match := range taggedContainerIDPattern.FindAllSubmatch(output, -1) {
+		if len(match) < 2 {
+			continue
+		}
+		id, err := strconv.Atoi(string(match[1]))
+		if err != nil || configured[id] || seen[id] {
+			continue
+		}
+		seen[id] = true
+		if err := m.CleanPortMappings(id); err != nil {
+			fmt.Printf("Warning: failed to clean orphaned port mappings for container %d: %v\n", id, err)
+		}
+	}
+}
+
 // EnsureForwardRules makes sure iptables FORWARD chain allows bridge traffic.
 func EnsureForwardRules(bridge string) {
 	if bridge == "" {
 		bridge = "lxcbr0"
 	}
+	ensureLibvirtForwardRules(bridge)
 	rules := [][]string{
 		{"-i", bridge, "-j", "ACCEPT"},
 		{"-o", bridge, "-j", "ACCEPT"},
@@ -269,18 +314,137 @@ func EnsureForwardRules(bridge string) {
 	}
 }
 
+func ensureLibvirtForwardRules(bridge string) {
+	if bridge != "virbr0" || exec.Command("iptables", "-L", "LIBVIRT_FWI", "-n").Run() != nil {
+		return
+	}
+	rules := []struct {
+		chain string
+		args  []string
+	}{
+		{chain: "LIBVIRT_FWI", args: []string{"-o", bridge, "-j", "ACCEPT"}},
+		{chain: "LIBVIRT_FWO", args: []string{"-i", bridge, "-j", "ACCEPT"}},
+		{chain: "LIBVIRT_FWX", args: []string{"-i", bridge, "-o", bridge, "-j", "ACCEPT"}},
+	}
+	for _, rule := range rules {
+		if exec.Command("iptables", "-L", rule.chain, "-n").Run() != nil {
+			continue
+		}
+		for {
+			deleteArgs := append([]string{"-D", rule.chain}, rule.args...)
+			if exec.Command("iptables", deleteArgs...).Run() != nil {
+				break
+			}
+		}
+		insertArgs := append([]string{"-I", rule.chain, "1"}, rule.args...)
+		exec.Command("iptables", insertArgs...).Run()
+	}
+}
+
 // CleanPortMappings removes all iptables rules for a container
 func (m *Manager) CleanPortMappings(id int) error {
-	tag := clicdTag(id)
-	for _, chain := range []string{"PREROUTING", "POSTROUTING"} {
-		cmd := exec.Command("sh", "-c",
-			fmt.Sprintf("iptables -t nat -L %s -n --line-numbers 2>/dev/null | grep 'clicd-%s-' | awk '{print $1}' | sort -rn | while read num; do iptables -t nat -D %s $num; done", chain, tag, chain))
-		cmd.Run()
+	marker := "clicd-" + clicdTag(id) + "-"
+	var cleanupErrors []error
+	for _, target := range []struct {
+		table string
+		chain string
+	}{
+		{table: "nat", chain: "PREROUTING"},
+		{table: "nat", chain: "POSTROUTING"},
+		{chain: "FORWARD"},
+	} {
+		if err := deleteTaggedIPTablesRules(target.table, target.chain, marker); err != nil {
+			cleanupErrors = append(cleanupErrors, err)
 		}
-	cmd := exec.Command("sh", "-c",
-		fmt.Sprintf("iptables -S FORWARD 2>/dev/null | grep 'clicd-%s-' | sed 's/^-A /-D /' | while read rule; do iptables $rule; done", tag))
-	cmd.Run()
+	}
+	if c := config.FindContainer(id); c != nil {
+		for _, mapping := range c.PortMappings {
+			clearPortMappingConntrack(mapping)
+		}
+	}
+	return errors.Join(cleanupErrors...)
+}
+
+func deleteTaggedIPTablesRules(table, chain, marker string) error {
+	listArgs := []string{"-w", "5"}
+	if table != "" {
+		listArgs = append(listArgs, "-t", table)
+	}
+	listArgs = append(listArgs, "-L", chain, "-n", "--line-numbers")
+	output, err := exec.Command("iptables", listArgs...).CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("list iptables %s/%s: %w: %s", tableName(table), chain, err, strings.TrimSpace(string(output)))
+	}
+
+	var deleteErrors []error
+	for _, lineNumber := range taggedRuleLineNumbers(output, marker) {
+		deleteArgs := []string{"-w", "5"}
+		if table != "" {
+			deleteArgs = append(deleteArgs, "-t", table)
+		}
+		deleteArgs = append(deleteArgs, "-D", chain, strconv.Itoa(lineNumber))
+		if output, err := exec.Command("iptables", deleteArgs...).CombinedOutput(); err != nil {
+			deleteErrors = append(deleteErrors, fmt.Errorf(
+				"delete iptables %s/%s rule %d: %w: %s",
+				tableName(table), chain, lineNumber, err, strings.TrimSpace(string(output)),
+			))
+		}
+	}
+	return errors.Join(deleteErrors...)
+}
+
+func taggedRuleLineNumbers(output []byte, marker string) []int {
+	lineNumbers := make([]int, 0)
+	for _, line := range strings.Split(string(output), "\n") {
+		if !strings.Contains(line, marker) {
+			continue
+		}
+		fields := strings.Fields(line)
+		if len(fields) == 0 {
+			continue
+		}
+		lineNumber, err := strconv.Atoi(fields[0])
+		if err == nil && lineNumber > 0 {
+			lineNumbers = append(lineNumbers, lineNumber)
+		}
+	}
+	sort.Sort(sort.Reverse(sort.IntSlice(lineNumbers)))
+	return lineNumbers
+}
+
+func tableName(table string) string {
+	if table == "" {
+		return "filter"
+	}
+	return table
+}
+
+func clearPortMappingConntrack(mapping config.PortMapping) {
+	args := portMappingConntrackDeleteArgs(mapping)
+	if len(args) == 0 {
+		return
+	}
+	// conntrack exits non-zero when no matching flow exists; that is already clean.
+	_ = exec.Command("conntrack", args...).Run()
+}
+
+func portMappingConntrackDeleteArgs(mapping config.PortMapping) []string {
+	protocol := strings.ToLower(strings.TrimSpace(mapping.Protocol))
+	if protocol != "tcp" && protocol != "udp" {
 		return nil
+	}
+	if mapping.HostPort < 1 || mapping.HostPort > 65535 {
+		return nil
+	}
+	args := []string{
+		"-D",
+		"-p", protocol,
+		"--dport", strconv.Itoa(mapping.HostPort),
+	}
+	if hostIP := strings.TrimSpace(mapping.HostIP); hostIP != "" {
+		args = append(args, "--dst", hostIP)
+	}
+	return args
 }
 
 // SetupDefaultPortMappings creates default port mappings
@@ -333,14 +497,19 @@ func (m *Manager) UpdatePortMapping(id int, index int, pm config.PortMapping) ([
 	if index < 0 || index >= len(c.PortMappings) {
 		return nil, fmt.Errorf("invalid port mapping index: %d", index)
 	}
+	existing := c.PortMappings[index]
 	normalized, err := normalizePortMapping(c, index, pm)
 	if err != nil {
 		return nil, err
 	}
+	if strings.EqualFold(existing.Description, "SSH") {
+		normalized.Description = "SSH"
+	}
 	c.PortMappings[index] = normalized
 	if err := persistAndReloadMappings(m, c); err != nil {
 		return nil, err
 	}
+	clearPortMappingConntrack(existing)
 	return c.PortMappings, nil
 }
 
@@ -353,17 +522,20 @@ func (m *Manager) DeletePortMapping(id int, index int) ([]config.PortMapping, er
 	if index < 0 || index >= len(c.PortMappings) {
 		return nil, fmt.Errorf("invalid port mapping index: %d", index)
 	}
-	if c.PortMappings[index].Description == "SSH" {
+	removed := c.PortMappings[index]
+	if strings.EqualFold(removed.Description, "SSH") {
 		return nil, fmt.Errorf("SSH default mapping cannot be deleted")
 	}
 	c.PortMappings = append(c.PortMappings[:index], c.PortMappings[index+1:]...)
 	if err := persistAndReloadMappings(m, c); err != nil {
 		return nil, err
 	}
+	clearPortMappingConntrack(removed)
 	return c.PortMappings, nil
 }
 
 func persistAndReloadMappings(m *Manager, c *config.Container) error {
+	syncContainerSSHPort(c)
 	config.SaveConfig()
 	if c.Status == "running" && c.IP != "" {
 		return m.ApplyPortMappings(c.ID)
@@ -371,6 +543,76 @@ func persistAndReloadMappings(m *Manager, c *config.Container) error {
 	return nil
 }
 
+func syncContainerSSHPort(c *config.Container) {
+	if c == nil {
+		return
+	}
+	for _, mapping := range c.PortMappings {
+		if strings.EqualFold(mapping.Description, "SSH") {
+			c.SSHPort = mapping.HostPort
+			return
+		}
+	}
+}
+
+func (m *Manager) UpdatePublicIPv4Assignments(id int, requested []string, count int, auto bool) (*config.Container, error) {
+	c := config.FindContainer(id)
+	if c == nil {
+		return nil, fmt.Errorf("container not found: %d", id)
+	}
+	if c.UsesLANIPv4() {
+		return nil, fmt.Errorf("public IPv4 cannot be assigned while LAN IPv4 mode is enabled")
+	}
+
+	assignments := []config.PublicIPv4Assignment{}
+	if auto || len(requested) > 0 {
+		allocated, err := AllocatePublicIPv4Assignments(id, requested, count, auto)
+		if err != nil {
+			return nil, err
+		}
+		assignments = allocated
+	}
+
+	c.PublicIPv4s = assignments
+	reconcilePortMappingHostIPs(c)
+	c.NormalizeNetworkAssignments()
+	config.SaveConfig()
+
+	_ = m.CleanPortMappings(id)
+	EnsureAssignedPublicIPv4s(c.PublicIPv4s)
+	if c.Status == "running" && c.IP != "" {
+		if err := m.ApplyPortMappings(id); err != nil {
+			return nil, err
+		}
+	}
+	return c, nil
+}
+
+func reconcilePortMappingHostIPs(c *config.Container) {
+	if c == nil {
+		return
+	}
+	assigned := map[string]bool{}
+	for _, item := range c.PublicIPv4s {
+		if addr := strings.TrimSpace(item.Address); addr != "" {
+			assigned[addr] = true
+		}
+	}
+	replacement := ""
+	if len(assigned) == 1 {
+		for addr := range assigned {
+			replacement = addr
+		}
+	}
+	for i := range c.PortMappings {
+		hostIP := strings.TrimSpace(c.PortMappings[i].HostIP)
+		if hostIP == "" || assigned[hostIP] {
+			continue
+		}
+		c.PortMappings[i].HostIP = replacement
+	}
+}
+
 func normalizePortMapping(c *config.Container, skipIndex int, pm config.PortMapping) (config.PortMapping, error) {
 	if pm.ContainerPort < 1 || pm.ContainerPort > 65535 {
 		return pm, fmt.Errorf("container port must be 1-65535")
@@ -423,6 +665,283 @@ func normalizePortMapping(c *config.Container, skipIndex int, pm config.PortMapp
 	return pm, nil
 }
 
+// SetupCreatePortMappings appends validated custom or automatically allocated
+// mappings to a container's management port mapping.
+func SetupCreatePortMappings(c *config.Container, cfg ContainerConfig) ([]config.PortMapping, error) {
+	if c == nil {
+		return nil, fmt.Errorf("container is required")
+	}
+	requested := append([]config.PortMapping(nil), cfg.NATPortMappings...)
+	if len(requested) == 0 && cfg.PortMappingCount > 1 {
+		for _, port := range allocateDefaultEqualPorts(c, cfg.PortMappingCount-1) {
+			requested = append(requested, config.PortMapping{
+				ContainerPort: port,
+				HostPort:      port,
+				Protocol:      "tcp",
+				Description:   fmt.Sprintf("Port-%d", port),
+			})
+		}
+	}
+	for _, mapping := range requested {
+		pm, err := normalizePortMapping(c, -1, mapping)
+		if err != nil {
+			return nil, err
+		}
+		c.PortMappings = append(c.PortMappings, pm)
+	}
+	return c.PortMappings, nil
+}
+
+// ReserveCreateNATPorts keeps concurrent create tasks from selecting each
+// other's custom or management ports before their containers are persisted.
+func ReserveCreateNATPorts(cfg ContainerConfig) (int, func(), error) {
+	if !cfg.WantsNAT() {
+		return 0, func() {}, nil
+	}
+
+	createNATReservationMu.Lock()
+	defer createNATReservationMu.Unlock()
+
+	owner := createNATReservationOwner(cfg.Name)
+	requestedReservations := createNATReservationMappings(cfg, cfg.ManagementPort)
+	if queued, ok := queuedCreateNATReservations[owner]; ok {
+		if !sameCreateNATReservations(queued, requestedReservations) {
+			return 0, nil, fmt.Errorf("queued NAT port plan for %s no longer matches the create task", cfg.Name)
+		}
+		delete(queuedCreateNATReservations, owner)
+		return activateCreateNATReservationLocked(cfg.ManagementPort, queued)
+	}
+
+	if err := ValidateCreateNATPortAvailability(cfg); err != nil {
+		return 0, nil, err
+	}
+	if err := validateCreateNATReservationsAvailableLocked(requestedReservations, owner); err != nil {
+		return 0, nil, err
+	}
+
+	excluded := cfg.RequestedNATHostPorts()
+	excluded = append(excluded, allReservedCreateNATHostPortsLocked(owner)...)
+	managementPort := cfg.ManagementPort
+	if managementPort == 0 {
+		var err error
+		managementPort, err = config.AllocateSSHPortExcluding(excluded)
+		if err != nil {
+			return 0, nil, err
+		}
+	}
+
+	reservations := createNATReservationMappings(cfg, managementPort)
+	return activateCreateNATReservationLocked(managementPort, reservations)
+}
+
+// ReserveBatchCreateNATPorts resolves every automatic NAT port and reserves
+// the complete batch before any create task is enqueued.
+func ReserveBatchCreateNATPorts(configs []ContainerConfig) ([]ContainerConfig, error) {
+	createNATReservationMu.Lock()
+	defer createNATReservationMu.Unlock()
+
+	planned := append([]ContainerConfig(nil), configs...)
+	addedOwners := make([]string, 0, len(planned))
+	rollback := func() {
+		for _, owner := range addedOwners {
+			delete(queuedCreateNATReservations, owner)
+		}
+	}
+
+	for i := range planned {
+		cfg := &planned[i]
+		cfg.NATPortMappings = append([]config.PortMapping(nil), cfg.NATPortMappings...)
+		if !cfg.WantsNAT() {
+			continue
+		}
+		owner := createNATReservationOwner(cfg.Name)
+		if owner == "" {
+			rollback()
+			return nil, fmt.Errorf("container name is required for NAT port reservation")
+		}
+		if _, exists := queuedCreateNATReservations[owner]; exists {
+			rollback()
+			return nil, fmt.Errorf("container creation already has reserved NAT ports: %s", cfg.Name)
+		}
+		if err := ValidateCreateNATPortAvailability(*cfg); err != nil {
+			rollback()
+			return nil, fmt.Errorf("%s: %w", cfg.Name, err)
+		}
+
+		explicit := createNATReservationMappings(*cfg, cfg.ManagementPort)
+		if err := validateCreateNATReservationsAvailableLocked(explicit, owner); err != nil {
+			rollback()
+			return nil, fmt.Errorf("%s: %w", cfg.Name, err)
+		}
+
+		excluded := cfg.RequestedNATHostPorts()
+		excluded = append(excluded, allReservedCreateNATHostPortsLocked(owner)...)
+		if cfg.ManagementPort == 0 {
+			port, err := config.AllocateSSHPortExcluding(excluded)
+			if err != nil {
+				rollback()
+				return nil, fmt.Errorf("%s: %w", cfg.Name, err)
+			}
+			cfg.ManagementPort = port
+		}
+
+		if len(cfg.NATPortMappings) == 0 && cfg.PortMappingCount > 1 {
+			generated, err := planDefaultCreateNATMappingsLocked(*cfg, cfg.PortMappingCount-1, owner)
+			if err != nil {
+				rollback()
+				return nil, fmt.Errorf("%s: %w", cfg.Name, err)
+			}
+			cfg.NATPortMappings = generated
+			cfg.PortMappingCount = len(generated) + 1
+		}
+
+		reservations := createNATReservationMappings(*cfg, cfg.ManagementPort)
+		if err := validateCreateNATReservationsAvailableLocked(reservations, owner); err != nil {
+			rollback()
+			return nil, fmt.Errorf("%s: %w", cfg.Name, err)
+		}
+		queuedCreateNATReservations[owner] = reservations
+		addedOwners = append(addedOwners, owner)
+	}
+	return planned, nil
+}
+
+func ReleaseQueuedCreateNATPorts(name string) {
+	owner := createNATReservationOwner(name)
+	if owner == "" {
+		return
+	}
+	createNATReservationMu.Lock()
+	delete(queuedCreateNATReservations, owner)
+	createNATReservationMu.Unlock()
+}
+
+func activateCreateNATReservationLocked(managementPort int, reservations []config.PortMapping) (int, func(), error) {
+	createNATReservationNextID++
+	reservationID := createNATReservationNextID
+	createNATReservations[reservationID] = append([]config.PortMapping(nil), reservations...)
+
+	var once sync.Once
+	release := func() {
+		once.Do(func() {
+			createNATReservationMu.Lock()
+			delete(createNATReservations, reservationID)
+			createNATReservationMu.Unlock()
+		})
+	}
+	return managementPort, release, nil
+}
+
+func createNATReservationOwner(name string) string {
+	return strings.ToLower(strings.TrimSpace(name))
+}
+
+func createNATReservationMappings(cfg ContainerConfig, managementPort int) []config.PortMapping {
+	reservations := make([]config.PortMapping, 0, len(cfg.NATPortMappings))
+	if managementPort > 0 {
+		reservations = append(reservations, config.PortMapping{HostPort: managementPort, Protocol: "tcp"})
+	}
+	reservations = append(reservations, cfg.NATPortMappings...)
+	return reservations
+}
+
+func validateCreateNATReservationsAvailableLocked(requested []config.PortMapping, exceptOwner string) error {
+	for _, candidate := range requested {
+		for _, reservations := range createNATReservations {
+			if conflictingCreateNATReservation(candidate, reservations) {
+				return fmt.Errorf("NAT host port %d/%s is reserved by another create task", candidate.HostPort, candidate.Protocol)
+			}
+		}
+		for owner, reservations := range queuedCreateNATReservations {
+			if owner == exceptOwner {
+				continue
+			}
+			if conflictingCreateNATReservation(candidate, reservations) {
+				return fmt.Errorf("NAT host port %d/%s is reserved by queued create task %s", candidate.HostPort, candidate.Protocol, owner)
+			}
+		}
+	}
+	return nil
+}
+
+func conflictingCreateNATReservation(candidate config.PortMapping, reservations []config.PortMapping) bool {
+	for _, reserved := range reservations {
+		if candidate.HostPort == reserved.HostPort && protocolsOverlap(candidate.Protocol, reserved.Protocol) {
+			return true
+		}
+	}
+	return false
+}
+
+func allReservedCreateNATHostPortsLocked(exceptOwner string) []int {
+	ports := make([]int, 0)
+	for _, reservations := range createNATReservations {
+		for _, reserved := range reservations {
+			ports = append(ports, reserved.HostPort)
+		}
+	}
+	for owner, reservations := range queuedCreateNATReservations {
+		if owner == exceptOwner {
+			continue
+		}
+		for _, reserved := range reservations {
+			ports = append(ports, reserved.HostPort)
+		}
+	}
+	return ports
+}
+
+func planDefaultCreateNATMappingsLocked(cfg ContainerConfig, count int, owner string) ([]config.PortMapping, error) {
+	if count <= 0 {
+		return nil, nil
+	}
+	unavailable := map[int]bool{cfg.ManagementPort: true}
+	for _, port := range allReservedCreateNATHostPortsLocked(owner) {
+		unavailable[port] = true
+	}
+	for _, mapping := range cfg.NATPortMappings {
+		unavailable[mapping.HostPort] = true
+	}
+
+	candidate := &config.Container{ID: -1}
+	start, end := config.NATPortRange()
+	mappings := make([]config.PortMapping, 0, count)
+	for port := start; port <= end && len(mappings) < count; port++ {
+		if unavailable[port] || !HostPortAvailable(candidate, "", port, "tcp") {
+			continue
+		}
+		unavailable[port] = true
+		mappings = append(mappings, config.PortMapping{
+			HostPort:      port,
+			ContainerPort: port,
+			Protocol:      "tcp",
+			Description:   fmt.Sprintf("Port-%d", port),
+		})
+	}
+	if len(mappings) != count {
+		return nil, fmt.Errorf("not enough free NAT4 host ports for %d automatic mappings", count)
+	}
+	return mappings, nil
+}
+
+func sameCreateNATReservations(left, right []config.PortMapping) bool {
+	if len(left) != len(right) {
+		return false
+	}
+	counts := make(map[string]int, len(left))
+	for _, mapping := range left {
+		counts[fmt.Sprintf("%d/%s", mapping.HostPort, strings.ToLower(mapping.Protocol))]++
+	}
+	for _, mapping := range right {
+		key := fmt.Sprintf("%d/%s", mapping.HostPort, strings.ToLower(mapping.Protocol))
+		if counts[key] == 0 {
+			return false
+		}
+		counts[key]--
+	}
+	return true
+}
+
 func allocateDefaultEqualPorts(c *config.Container, count int) []int {
 	if count <= 0 {
 		return nil

backend/internal/lxc/snapshot.go

@@ -16,7 +16,7 @@ import (
 
 var snapshotMu sync.Mutex
 
-func (m *Manager) CreateSnapshot(id int, createdBy string, scheduled bool, rotateLimit int) (config.Snapshot, error) {
+func (m *Manager) CreateSnapshot(id int, createdBy string, scheduled bool, rotateLimit int, storagePoolID ...string) (config.Snapshot, error) {
 	snapshotMu.Lock()
 	defer snapshotMu.Unlock()
 
@@ -42,12 +42,21 @@ func (m *Manager) CreateSnapshot(id int, createdBy string, scheduled bool, rotat
 	if _, err := os.Stat(containerDir); err != nil {
 		return config.Snapshot{}, fmt.Errorf("container storage not found: %v", err)
 	}
+	pool, err := config.SelectStoragePoolForContent(
+		config.StorageContentSnapshots,
+		firstString(storagePoolID),
+		dirSizeBytes(containerDir),
+	)
+	if err != nil {
+		return config.Snapshot{}, err
+	}
 
 	now := time.Now()
 	snapshotID := fmt.Sprintf("snap-%d-%s", id, now.Format("20060102150405-000000000"))
 	// Use container ID instead of lxcName to avoid collision when containers are recreated
-	snapshotDir := filepath.Join(snapshotBaseDir(), strconv.Itoa(id), snapshotID)
-	if err := safePathUnder(snapshotDir, snapshotBaseDir()); err != nil {
+	baseDir := filepath.Join(pool.Path, "snapshots")
+	snapshotDir := filepath.Join(baseDir, strconv.Itoa(id), snapshotID)
+	if err := safePathUnder(snapshotDir, baseDir); err != nil {
 		return config.Snapshot{}, err
 	}
 	if err := os.MkdirAll(snapshotDir, 0700); err != nil {
@@ -100,7 +109,7 @@ func (m *Manager) DeleteSnapshot(id string) error {
 
 func (m *Manager) deleteSnapshotLocked(snapshot config.Snapshot) error {
 	if snapshot.Path != "" {
-		if err := safePathUnder(snapshot.Path, snapshotBaseDir()); err != nil {
+		if err := safeSnapshotPath(snapshot.Path); err != nil {
 			return err
 		}
 		if err := os.RemoveAll(snapshot.Path); err != nil {
@@ -122,7 +131,7 @@ func (m *Manager) RestoreSnapshot(id string) error {
 	if snapshot.Path == "" {
 		return fmt.Errorf("snapshot path is empty")
 	}
-	if err := safePathUnder(snapshot.Path, snapshotBaseDir()); err != nil {
+	if err := safeSnapshotPath(snapshot.Path); err != nil {
 		return err
 	}
 	if _, err := os.Stat(snapshot.Path); err != nil {
@@ -295,7 +304,33 @@ func (m *Manager) prepareContainerForColdCopy(id int, lxcName string, containerD
 }
 
 func snapshotBaseDir() string {
-	return filepath.Join(config.AppConfig.DataDir, "snapshots")
+	return snapshotBaseDirForPool("")
+}
+
+func snapshotBaseDirForPool(poolID string) string {
+	if pool, err := config.SelectStoragePoolForContent(config.StorageContentSnapshots, poolID, 0); err == nil {
+		return filepath.Join(pool.Path, "snapshots")
+	}
+	return ""
+}
+
+func safeSnapshotPath(path string) error {
+	if err := safePathUnder(path, filepath.Join(config.AppConfig.DataDir, "snapshots")); err == nil {
+		return nil
+	}
+	for _, pool := range config.StoragePoolsForContent(config.StorageContentSnapshots) {
+		if err := safePathUnder(path, filepath.Join(pool.Path, "snapshots")); err == nil {
+			return nil
+		}
+	}
+	return fmt.Errorf("unsafe snapshot path: %s", path)
+}
+
+func firstString(values []string) string {
+	if len(values) == 0 {
+		return ""
+	}
+	return strings.TrimSpace(values[0])
 }
 
 func copyTree(src string, dst string) error {
@@ -313,6 +348,9 @@ func copyTree(src string, dst string) error {
 }
 
 func dirSizeBytes(path string) int64 {
+	if resolved, err := filepath.EvalSymlinks(path); err == nil {
+		path = resolved
+	}
 	out, err := exec.Command("du", "-s", "-B1", path).Output()
 	if err != nil {
 		return 0

backend/internal/lxc/templates.go

@@ -1,5 +1,11 @@
 package lxc
 
+import (
+	"runtime"
+
+	"clicd/internal/config"
+)
+
 // Template represents an LXC image template
 type Template struct {
 	ID          string `json:"id"`
@@ -9,57 +15,92 @@ type Template struct {
 	Arch        string `json:"arch"`
 	Variant     string `json:"variant"`
 	Description string `json:"description"`
+	URL         string `json:"url,omitempty"`
+	SHA256      string `json:"sha256,omitempty"`
+	Custom      bool   `json:"custom,omitempty"`
 }
 
 // GetTemplates returns available LXC image templates (only verified working ones)
 func GetTemplates() []Template {
-	return []Template{
+	arch := defaultTemplateArch()
+	templates := []Template{
 		{
 			ID: "ubuntu-noble", Name: "Ubuntu 24.04",
-			Distro: "ubuntu", Release: "noble", Arch: "amd64",
+			Distro: "ubuntu", Release: "noble", Arch: arch,
 			Description: "Ubuntu 24.04 LTS",
 		},
 		{
 			ID: "ubuntu-jammy", Name: "Ubuntu 22.04",
-			Distro: "ubuntu", Release: "jammy", Arch: "amd64",
+			Distro: "ubuntu", Release: "jammy", Arch: arch,
 			Description: "Ubuntu 22.04 LTS",
 		},
+		{
+			ID: "debian-trixie", Name: "Debian 13",
+			Distro: "debian", Release: "trixie", Arch: arch,
+			Description: "Debian 13 (Trixie)",
+		},
 		{
 			ID: "debian-bookworm", Name: "Debian 12",
-			Distro: "debian", Release: "bookworm", Arch: "amd64",
+			Distro: "debian", Release: "bookworm", Arch: arch,
 			Description: "Debian 12 (Bookworm)",
 		},
 		{
 			ID: "debian-bullseye", Name: "Debian 11",
-			Distro: "debian", Release: "bullseye", Arch: "amd64",
+			Distro: "debian", Release: "bullseye", Arch: arch,
 			Description: "Debian 11 (Bullseye)",
 		},
 		{
 			ID: "alpine-3.21", Name: "Alpine 3.21",
-			Distro: "alpine", Release: "3.21", Arch: "amd64",
+			Distro: "alpine", Release: "3.21", Arch: arch,
 			Description: "Alpine Linux 3.21",
 		},
 		{
 			ID: "centos-9-stream", Name: "CentOS 9 Stream",
-			Distro: "centos", Release: "9-Stream", Arch: "amd64",
+			Distro: "centos", Release: "9-Stream", Arch: arch,
 			Description: "CentOS 9 Stream",
 		},
 		{
 			ID: "archlinux-current", Name: "Arch Linux",
-			Distro: "archlinux", Release: "current", Arch: "amd64",
+			Distro: "archlinux", Release: "current", Arch: arch,
 			Description: "Arch Linux (Rolling)",
 		},
 		{
 			ID: "fedora-44", Name: "Fedora 44",
-			Distro: "fedora", Release: "44", Arch: "amd64",
+			Distro: "fedora", Release: "44", Arch: arch,
 			Description: "Fedora 44",
 		},
 		{
 			ID: "rockylinux-10", Name: "Rocky Linux 10",
-			Distro: "rockylinux", Release: "10", Arch: "amd64",
+			Distro: "rockylinux", Release: "10", Arch: arch,
 			Description: "Rocky Linux 10",
 		},
 	}
+	for _, custom := range config.ListCustomLXCImages() {
+		if custom.Arch != arch {
+			continue
+		}
+		templates = append(templates, Template{
+			ID:          custom.ID,
+			Name:        custom.Name,
+			Distro:      custom.Distro,
+			Release:     custom.Release,
+			Arch:        custom.Arch,
+			Description: custom.Description,
+			URL:         custom.URL,
+			SHA256:      custom.SHA256,
+			Custom:      true,
+		})
+	}
+	return templates
+}
+
+func defaultTemplateArch() string {
+	switch runtime.GOARCH {
+	case "arm64":
+		return "arm64"
+	default:
+		return "amd64"
+	}
 }
 
 // FindTemplate finds a template by ID

backend/internal/safehttp/safehttp.go

@@ -0,0 +1,214 @@
+package safehttp
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+)
+
+const maxRedirects = 10
+
+var blockedPrefixes = []netip.Prefix{
+	netip.MustParsePrefix("0.0.0.0/8"),
+	netip.MustParsePrefix("10.0.0.0/8"),
+	netip.MustParsePrefix("100.64.0.0/10"),
+	netip.MustParsePrefix("127.0.0.0/8"),
+	netip.MustParsePrefix("169.254.0.0/16"),
+	netip.MustParsePrefix("172.16.0.0/12"),
+	netip.MustParsePrefix("192.0.0.0/24"),
+	netip.MustParsePrefix("192.0.2.0/24"),
+	netip.MustParsePrefix("192.88.99.0/24"),
+	netip.MustParsePrefix("192.168.0.0/16"),
+	netip.MustParsePrefix("198.18.0.0/15"),
+	netip.MustParsePrefix("198.51.100.0/24"),
+	netip.MustParsePrefix("203.0.113.0/24"),
+	netip.MustParsePrefix("224.0.0.0/4"),
+	netip.MustParsePrefix("240.0.0.0/4"),
+	netip.MustParsePrefix("::/128"),
+	netip.MustParsePrefix("::1/128"),
+	netip.MustParsePrefix("64:ff9b::/96"),
+	netip.MustParsePrefix("64:ff9b:1::/48"),
+	netip.MustParsePrefix("100::/64"),
+	netip.MustParsePrefix("2001::/32"),
+	netip.MustParsePrefix("2001:2::/48"),
+	netip.MustParsePrefix("2001:db8::/32"),
+	netip.MustParsePrefix("2001:20::/28"),
+	netip.MustParsePrefix("2002::/16"),
+	netip.MustParsePrefix("fc00::/7"),
+	netip.MustParsePrefix("fec0::/10"),
+	netip.MustParsePrefix("fe80::/10"),
+	netip.MustParsePrefix("ff00::/8"),
+}
+
+// ValidateURL performs the URL checks that do not require DNS. Host addresses
+// are checked again after resolution and immediately before every connection.
+func ValidateURL(rawURL string) (*url.URL, error) {
+	if len(rawURL) == 0 || len(rawURL) > 4096 {
+		return nil, fmt.Errorf("download URL must be between 1 and 4096 characters")
+	}
+	parsed, err := url.ParseRequestURI(rawURL)
+	if err != nil {
+		return nil, fmt.Errorf("invalid download URL: %v", err)
+	}
+	if parsed.Scheme != "http" && parsed.Scheme != "https" {
+		return nil, fmt.Errorf("download URL must use HTTP or HTTPS")
+	}
+	if parsed.Host == "" || parsed.Hostname() == "" {
+		return nil, fmt.Errorf("download URL must include a host")
+	}
+	if parsed.User != nil {
+		return nil, fmt.Errorf("download URL must not include credentials")
+	}
+	if parsed.Fragment != "" {
+		return nil, fmt.Errorf("download URL must not include a fragment")
+	}
+	if port := parsed.Port(); port != "" {
+		value, err := strconv.Atoi(port)
+		if err != nil || value < 1 || value > 65535 {
+			return nil, fmt.Errorf("download URL contains an invalid port")
+		}
+	}
+	if addr, err := netip.ParseAddr(parsed.Hostname()); err == nil && !isPublicAddress(addr) {
+		return nil, fmt.Errorf("download URL resolves to a non-public address")
+	}
+	return parsed, nil
+}
+
+// Get retrieves a resource only when every resolved destination is public.
+func Get(ctx context.Context, rawURL, userAgent string, timeout time.Duration) (*http.Response, error) {
+	parsed, err := ValidateURL(rawURL)
+	if err != nil {
+		return nil, err
+	}
+	if err := validateHost(ctx, net.DefaultResolver, parsed.Hostname()); err != nil {
+		return nil, err
+	}
+
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, parsed.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+	request.Header.Set("User-Agent", userAgent)
+
+	client := &http.Client{
+		Timeout:   timeout,
+		Transport: publicTransport(net.DefaultResolver),
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			if len(via) >= maxRedirects {
+				return fmt.Errorf("too many redirects")
+			}
+			redirect, err := ValidateURL(req.URL.String())
+			if err != nil {
+				return err
+			}
+			if err := validateHost(req.Context(), net.DefaultResolver, redirect.Hostname()); err != nil {
+				return err
+			}
+			if len(via) > 0 {
+				req.Header.Set("User-Agent", via[0].Header.Get("User-Agent"))
+			}
+			return nil
+		},
+	}
+
+	// All URL components, redirects, DNS answers and dial destinations are
+	// constrained above and in publicTransport.
+	// lgtm[go/request-forgery]
+	return client.Do(request)
+}
+
+func publicTransport(resolver *net.Resolver) *http.Transport {
+	dialer := &net.Dialer{
+		Timeout:   30 * time.Second,
+		KeepAlive: 30 * time.Second,
+	}
+	return &http.Transport{
+		Proxy: nil,
+		DialContext: func(ctx context.Context, network, address string) (net.Conn, error) {
+			host, port, err := net.SplitHostPort(address)
+			if err != nil {
+				return nil, fmt.Errorf("invalid download destination: %v", err)
+			}
+			addresses, err := resolvePublicHost(ctx, resolver, host)
+			if err != nil {
+				return nil, err
+			}
+			var lastErr error
+			for _, addr := range addresses {
+				conn, err := dialer.DialContext(ctx, network, net.JoinHostPort(addr.String(), port))
+				if err == nil {
+					return conn, nil
+				}
+				lastErr = err
+			}
+			if lastErr == nil {
+				lastErr = fmt.Errorf("host has no usable public addresses")
+			}
+			return nil, lastErr
+		},
+		ForceAttemptHTTP2:   true,
+		TLSHandshakeTimeout: 30 * time.Second,
+		IdleConnTimeout:     90 * time.Second,
+	}
+}
+
+func validateHost(ctx context.Context, resolver *net.Resolver, host string) error {
+	_, err := resolvePublicHost(ctx, resolver, host)
+	return err
+}
+
+func resolvePublicHost(ctx context.Context, resolver *net.Resolver, host string) ([]netip.Addr, error) {
+	host = strings.TrimSpace(strings.TrimSuffix(host, "."))
+	if host == "" {
+		return nil, fmt.Errorf("download URL host is empty")
+	}
+	if strings.EqualFold(host, "localhost") || strings.HasSuffix(strings.ToLower(host), ".localhost") {
+		return nil, fmt.Errorf("download URL host is not public")
+	}
+
+	if addr, err := netip.ParseAddr(host); err == nil {
+		addr = addr.Unmap()
+		if !isPublicAddress(addr) {
+			return nil, fmt.Errorf("download URL resolves to a non-public address")
+		}
+		return []netip.Addr{addr}, nil
+	}
+
+	addresses, err := resolver.LookupNetIP(ctx, "ip", host)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve download host: %v", err)
+	}
+	if len(addresses) == 0 {
+		return nil, fmt.Errorf("download host has no IP addresses")
+	}
+	result := make([]netip.Addr, 0, len(addresses))
+	for _, address := range addresses {
+		address = address.Unmap()
+		if !isPublicAddress(address) {
+			return nil, fmt.Errorf("download host resolves to a non-public address")
+		}
+		result = append(result, address)
+	}
+	return result, nil
+}
+
+func isPublicAddress(address netip.Addr) bool {
+	if !address.IsValid() || address.Zone() != "" || !address.IsGlobalUnicast() || address.IsPrivate() ||
+		address.IsLoopback() || address.IsLinkLocalUnicast() || address.IsLinkLocalMulticast() ||
+		address.IsMulticast() || address.IsUnspecified() {
+		return false
+	}
+	address = address.Unmap()
+	for _, prefix := range blockedPrefixes {
+		if prefix.Contains(address) {
+			return false
+		}
+	}
+	return true
+}

backend/internal/safehttp/safehttp_test.go

@@ -0,0 +1,74 @@
+package safehttp
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+	"time"
+)
+
+func TestValidateURLRejectsUnsafeDestinations(t *testing.T) {
+	t.Parallel()
+	for _, rawURL := range []string{
+		"file:///etc/passwd",
+		"http://user:pass@example.com/image",
+		"http://127.0.0.1/image",
+		"http://[::1]/image",
+		"http://169.254.169.254/latest/meta-data",
+		"http://10.0.0.1/image",
+		"http://192.168.1.10/image",
+		"http://100.64.0.1/image",
+		"http://example.com:99999/image",
+	} {
+		if _, err := ValidateURL(rawURL); err == nil {
+			t.Fatalf("ValidateURL(%q) succeeded, want rejection", rawURL)
+		}
+	}
+}
+
+func TestValidateURLAcceptsPublicHTTPURL(t *testing.T) {
+	t.Parallel()
+	parsed, err := ValidateURL("https://example.com/images/rootfs.tar.xz?variant=default")
+	if err != nil {
+		t.Fatalf("ValidateURL returned error: %v", err)
+	}
+	if parsed.Hostname() != "example.com" {
+		t.Fatalf("hostname = %q, want example.com", parsed.Hostname())
+	}
+}
+
+func TestIsPublicAddress(t *testing.T) {
+	t.Parallel()
+	tests := map[string]bool{
+		"8.8.8.8":              true,
+		"1.1.1.1":              true,
+		"2606:4700:4700::1111": true,
+		"127.0.0.1":            false,
+		"10.0.0.1":             false,
+		"100.64.0.1":           false,
+		"169.254.169.254":      false,
+		"192.0.2.1":            false,
+		"198.18.0.1":           false,
+		"::1":                  false,
+		"64:ff9b::127.0.0.1":   false,
+		"2002:7f00:1::1":       false,
+		"fc00::1":              false,
+		"fec0::1":              false,
+		"fe80::1":              false,
+		"2001:db8::1":          false,
+	}
+	for raw, expected := range tests {
+		if actual := isPublicAddress(netip.MustParseAddr(raw)); actual != expected {
+			t.Errorf("isPublicAddress(%s) = %v, want %v", raw, actual, expected)
+		}
+	}
+}
+
+func TestGetRejectsLoopbackBeforeRequest(t *testing.T) {
+	t.Parallel()
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	if _, err := Get(ctx, "http://127.0.0.1:1/image", "test", time.Second); err == nil {
+		t.Fatal("Get accepted a loopback destination")
+	}
+}

backend/internal/server/access_policy.go

@@ -0,0 +1,39 @@
+package server
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+
+	"clicd/internal/config"
+)
+
+func panelAccessMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		decision := config.EvaluatePanelAccess(
+			config.AppConfig.PanelAccessPolicy,
+			r.RemoteAddr,
+			config.ForwardedClientHeaders{
+				ForwardedFor:   r.Header.Get("X-Forwarded-For"),
+				RealIP:         r.Header.Get("X-Real-IP"),
+				CFConnectingIP: r.Header.Get("CF-Connecting-IP"),
+			},
+		)
+		if decision.Allowed {
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		w.Header().Set("Cache-Control", "no-store")
+		if strings.HasPrefix(r.URL.Path, "/api/") {
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusForbidden)
+			_ = json.NewEncoder(w).Encode(map[string]any{
+				"success": false,
+				"message": "Access denied by panel source policy",
+			})
+			return
+		}
+		http.Error(w, "Access denied by panel source policy", http.StatusForbidden)
+	})
+}

backend/internal/server/access_policy_test.go

@@ -0,0 +1,46 @@
+package server
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"clicd/internal/config"
+)
+
+func TestPanelAccessMiddleware(t *testing.T) {
+	previous := config.AppConfig
+	config.AppConfig = &config.ClicdConfig{
+		PanelAccessPolicy: config.PanelAccessPolicy{
+			Enabled:        true,
+			AllowedSources: []string{"192.0.2.0/24"},
+			TrustedProxies: []string{"10.0.0.1"},
+		},
+	}
+	t.Cleanup(func() {
+		config.AppConfig = previous
+	})
+
+	handler := panelAccessMiddleware(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	allowed := httptest.NewRequest(http.MethodGet, "/api/version", nil)
+	allowed.RemoteAddr = "192.0.2.8:50000"
+	allowedRecorder := httptest.NewRecorder()
+	handler.ServeHTTP(allowedRecorder, allowed)
+	if allowedRecorder.Code != http.StatusNoContent {
+		t.Fatalf("allowed status = %d", allowedRecorder.Code)
+	}
+
+	denied := httptest.NewRequest(http.MethodGet, "/api/version", nil)
+	denied.RemoteAddr = "198.51.100.8:50000"
+	deniedRecorder := httptest.NewRecorder()
+	handler.ServeHTTP(deniedRecorder, denied)
+	if deniedRecorder.Code != http.StatusForbidden {
+		t.Fatalf("denied status = %d", deniedRecorder.Code)
+	}
+	if got := deniedRecorder.Header().Get("Content-Type"); got != "application/json" {
+		t.Fatalf("denied content type = %q", got)
+	}
+}

backend/internal/server/server.go

@@ -49,11 +49,13 @@ func setupRoutes(mux *http.ServeMux) {
 	mux.HandleFunc("/api/login-logs", corsMiddleware(api.AdminMiddleware(api.HandleLoginLogs)))
 	mux.HandleFunc("/api/ssl", corsMiddleware(api.AdminMiddleware(api.HandleSSLSettings)))
 	mux.HandleFunc("/api/webssh-origins", corsMiddleware(api.AdminMiddleware(api.HandleWebSSHOriginSettings)))
+	mux.HandleFunc("/api/access-policy", corsMiddleware(api.AdminMiddleware(api.HandlePanelAccessPolicy)))
 	mux.HandleFunc("/api/containers", corsMiddleware(api.AuthMiddleware(api.SubUserMiddleware(api.HandleContainers))))
 	mux.HandleFunc("/api/containers/list", corsMiddleware(api.AuthMiddleware(api.SubUserMiddleware(api.HandleContainerListAlias))))
 	mux.HandleFunc("/api/containers/", corsMiddleware(api.AuthMiddleware(api.SubUserMiddleware(api.HandleSingleContainer))))
 	mux.HandleFunc("/api/templates", corsMiddleware(api.AuthMiddleware(api.HandleTemplates)))
 	mux.HandleFunc("/api/images", corsMiddleware(api.AdminMiddleware(api.HandleImages)))
+	mux.HandleFunc("/api/images/custom", corsMiddleware(api.AdminMiddleware(api.HandleCustomKVMImages)))
 	mux.HandleFunc("/api/images/download", corsMiddleware(api.AdminMiddleware(api.HandleImageDownload)))
 	mux.HandleFunc("/api/images/cancel", corsMiddleware(api.AdminMiddleware(api.HandleImageCancel)))
 	mux.HandleFunc("/api/images/delete", corsMiddleware(api.AdminMiddleware(api.HandleImageDelete)))
@@ -61,13 +63,16 @@ func setupRoutes(mux *http.ServeMux) {
 	mux.HandleFunc("/api/images/enabled", corsMiddleware(api.AuthMiddleware(api.SubUserMiddleware(api.HandleEnabledImages))))
 	mux.HandleFunc("/api/dashboard", corsMiddleware(api.AdminMiddleware(api.HandleDashboard)))
 	mux.HandleFunc("/api/host-info", corsMiddleware(api.AdminMiddleware(api.HandleHostInfo)))
+	mux.HandleFunc("/api/host-history", corsMiddleware(api.AdminMiddleware(api.HandleHostHistory)))
 	mux.HandleFunc("/api/host-report", corsMiddleware(api.AdminMiddleware(api.HandleHostReport)))
 	mux.HandleFunc("/api/snapshots", corsMiddleware(api.AdminMiddleware(api.HandleSnapshots)))
 	mux.HandleFunc("/api/routing/ipv4-scan", corsMiddleware(api.AdminMiddleware(api.HandleRoutingIPv4Scan)))
 	mux.HandleFunc("/api/routing", corsMiddleware(api.AdminMiddleware(api.HandleRouting)))
+	mux.HandleFunc("/api/storage", corsMiddleware(api.AdminMiddleware(api.HandleStorage)))
 	mux.HandleFunc("/api/ipv6/status", corsMiddleware(api.AdminMiddleware(api.HandleIPv6Status)))
 	mux.HandleFunc("/api/tasks", corsMiddleware(api.AuthMiddleware(api.SubUserMiddleware(api.HandleTasks))))
 	mux.HandleFunc("/api/tasks/", corsMiddleware(api.AuthMiddleware(api.AdminMiddleware(api.HandleTaskDelete))))
+	mux.HandleFunc("/api/task-queue/settings", corsMiddleware(api.AdminMiddleware(api.HandleTaskQueueSettings)))
 	mux.HandleFunc("/api/batch-create", corsMiddleware(api.AdminMiddleware(api.HandleBatchCreate)))
 	mux.HandleFunc("/api/batch-action", corsMiddleware(api.AdminMiddleware(api.HandleBatchAction)))
 	mux.HandleFunc("/api/sub-user/create", corsMiddleware(api.AdminMiddleware(api.HandleSubUserCreate)))
@@ -98,19 +103,23 @@ func setupRoutes(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/containers/", corsMiddleware(api.AuthMiddleware(api.SubUserMiddleware(api.HandleSingleContainer))))
 	mux.HandleFunc("/api/v1/templates", corsMiddleware(api.AuthMiddleware(api.HandleTemplates)))
 	mux.HandleFunc("/api/v1/images", corsMiddleware(api.AuthMiddleware(api.HandleImages)))
+	mux.HandleFunc("/api/v1/images/custom", corsMiddleware(api.AuthMiddleware(api.HandleCustomKVMImages)))
 	mux.HandleFunc("/api/v1/images/download", corsMiddleware(api.AuthMiddleware(api.HandleImageDownload)))
 	mux.HandleFunc("/api/v1/images/cancel", corsMiddleware(api.AuthMiddleware(api.HandleImageCancel)))
 	mux.HandleFunc("/api/v1/images/delete", corsMiddleware(api.AuthMiddleware(api.HandleImageDelete)))
 	mux.HandleFunc("/api/v1/images/toggle", corsMiddleware(api.AuthMiddleware(api.HandleImageToggle)))
 	mux.HandleFunc("/api/v1/images/enabled", corsMiddleware(api.AuthMiddleware(api.SubUserMiddleware(api.HandleEnabledImages))))
 	mux.HandleFunc("/api/v1/host-info", corsMiddleware(api.AuthMiddleware(api.HandleHostInfo)))
+	mux.HandleFunc("/api/v1/host-history", corsMiddleware(api.AuthMiddleware(api.HandleHostHistory)))
 	mux.HandleFunc("/api/v1/host-report", corsMiddleware(api.AuthMiddleware(api.HandleHostReport)))
 	mux.HandleFunc("/api/v1/snapshots", corsMiddleware(api.AuthMiddleware(api.ScopeMiddleware("snapshot:read", api.HandleSnapshots))))
 	mux.HandleFunc("/api/v1/routing/ipv4-scan", corsMiddleware(api.AuthMiddleware(api.HandleRoutingIPv4Scan)))
 	mux.HandleFunc("/api/v1/routing", corsMiddleware(api.AuthMiddleware(api.HandleRouting)))
+	mux.HandleFunc("/api/v1/storage", corsMiddleware(api.AdminMiddleware(api.HandleStorage)))
 	mux.HandleFunc("/api/v1/ipv6/status", corsMiddleware(api.AuthMiddleware(api.HandleIPv6Status)))
 	mux.HandleFunc("/api/v1/tasks", corsMiddleware(api.AuthMiddleware(api.SubUserMiddleware(api.HandleTasks))))
 	mux.HandleFunc("/api/v1/tasks/", corsMiddleware(api.AuthMiddleware(api.HandleTaskDelete)))
+	mux.HandleFunc("/api/v1/task-queue/settings", corsMiddleware(api.AdminMiddleware(api.HandleTaskQueueSettings)))
 	mux.HandleFunc("/api/v1/batch-create", corsMiddleware(api.AuthMiddleware(api.HandleBatchCreate)))
 	mux.HandleFunc("/api/v1/batch-action", corsMiddleware(api.AuthMiddleware(api.HandleBatchAction)))
 	mux.HandleFunc("/api/v1/sub-user/create", corsMiddleware(api.AuthMiddleware(api.HandleSubUserCreate)))
@@ -120,6 +129,7 @@ func setupRoutes(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/login-logs", corsMiddleware(api.AuthMiddleware(api.HandleLoginLogs)))
 	mux.HandleFunc("/api/v1/ssl", corsMiddleware(api.AdminMiddleware(api.HandleSSLSettings)))
 	mux.HandleFunc("/api/v1/webssh-origins", corsMiddleware(api.AdminMiddleware(api.HandleWebSSHOriginSettings)))
+	mux.HandleFunc("/api/v1/access-policy", corsMiddleware(api.AdminMiddleware(api.HandlePanelAccessPolicy)))
 	mux.HandleFunc("/api/v1/security/alerts", corsMiddleware(api.AuthMiddleware(api.ScopeMiddleware("security:read", api.HandleSecurityAlerts))))
 	mux.HandleFunc("/api/v1/security/check", corsMiddleware(api.AuthMiddleware(api.ScopeMiddleware("security:check", api.HandleSecurityCheck))))
 	mux.HandleFunc("/api/v1/security/logs", corsMiddleware(api.AuthMiddleware(api.ScopeMiddleware("security:read", api.HandleSecurityLogs))))
@@ -174,6 +184,8 @@ func setupRoutes(mux *http.ServeMux) {
 func Run() error {
 	// Use embedded frontend files
 	webFS = GetEmbeddedFS()
+	api.StartHostMetricSampler()
+	api.StartContainerMetricSampler()
 
 	mux := http.NewServeMux()
 	setupRoutes(mux)
@@ -184,7 +196,7 @@ func Run() error {
 
 	server := &http.Server{
 		Addr:    addr,
-		Handler: mux,
+		Handler: panelAccessMiddleware(mux),
 	}
 
 	if sslEnabled() {

backend/internal/server/web/.gitkeep

@@ -0,0 +1 @@
+ 

backend/internal/version/version.go

@@ -1,7 +1,7 @@
 package version
 
 var (
-	Version = "1.1.20"
+	Version = "1.1.28"
 	Repo    = "MengMengCode/CLICD"
 )
 

backend/main.go

@@ -4,7 +4,10 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
+	"os/signal"
 	"strings"
+	"sync"
+	"syscall"
 
 	"clicd/internal/api"
 	"clicd/internal/cli"
@@ -16,12 +19,15 @@ import (
 	"golang.org/x/term"
 )
 
+var shutdownCaptureOnce sync.Once
+
 func main() {
 	isTerminal := term.IsTerminal(int(os.Stdin.Fd()))
 
 	isServerMode := false
 	isCliMode := false
 	noWebAutostart := false
+	isAccessPolicyCommand := len(os.Args) > 1 && os.Args[1] == "access-policy"
 	for _, arg := range os.Args[1:] {
 		if arg == "server" || arg == "-s" || arg == "--server" {
 			isServerMode = true
@@ -43,8 +49,19 @@ func main() {
 	}
 	_ = cfg
 
+	if isAccessPolicyCommand {
+		if err := cli.RunAccessPolicyCommand(os.Args[2:]); err != nil {
+			fmt.Fprintf(os.Stderr, "Access policy error: %v\n", err)
+			os.Exit(1)
+		}
+		return
+	}
+
 	if isServerMode || (!isTerminal && !isCliMode) {
+		installShutdownStateCapture()
+
 		// Restore persisted state
+		api.ConfigureTaskQueue(cfg.TaskConcurrency)
 		api.RestoreTasks()
 		api.RestoreLoginLogs()
 
@@ -75,6 +92,7 @@ func main() {
 
 		// Clean up stale container configs (LXC dir was deleted but config remains)
 		config.CleanStaleContainers()
+		api.StartHostBootRestore()
 		lxc.EnsureAllRunningPortMappings()
 
 		// Pre-warm SSH for containers already running after host boot or service restart.
@@ -97,6 +115,17 @@ func main() {
 	}
 }
 
+func installShutdownStateCapture() {
+	signals := make(chan os.Signal, 1)
+	signal.Notify(signals, syscall.SIGINT, syscall.SIGTERM)
+	go func() {
+		sig := <-signals
+		fmt.Fprintf(os.Stderr, "Received %s, capturing workload restore state...\n", sig)
+		shutdownCaptureOnce.Do(api.CaptureRuntimeRestoreState)
+		os.Exit(0)
+	}()
+}
+
 func isWebPanelSystemdRunning() bool {
 	cmd := exec.Command("systemctl", "is-active", "clicd")
 	output, err := cmd.Output()

build.sh

@@ -6,6 +6,7 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 BUILD_DIR="$SCRIPT_DIR/build"
+DIST_DIR="$SCRIPT_DIR/dist"
 FRONTEND_DIR="$SCRIPT_DIR/frontend"
 BACKEND_DIR="$SCRIPT_DIR/backend"
 WEB_DIR="$SCRIPT_DIR/web"
@@ -17,9 +18,11 @@ echo "====================================="
 
 # Clean previous build
 rm -rf "$BUILD_DIR"
+rm -rf "$DIST_DIR"
 rm -rf "$WEB_DIR"
 rm -rf "$EMBED_WEB_DIR"
 mkdir -p "$BUILD_DIR"
+mkdir -p "$DIST_DIR"
 mkdir -p "$WEB_DIR"
 mkdir -p "$EMBED_WEB_DIR"
 touch "$EMBED_WEB_DIR/.gitkeep"
@@ -51,9 +54,26 @@ cd "$BACKEND_DIR"
 go mod tidy
 go mod download
 
-# Build for Linux amd64
 BUILD_VERSION="${CLICD_VERSION:-dev}"
-GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags="-s -w -X clicd/internal/version.Version=${BUILD_VERSION}" -o "$BUILD_DIR/clicd" .
+TARGET_GOOS="${CLICD_GOOS:-linux}"
+TARGET_GOARCH="${CLICD_GOARCH:-amd64}"
+
+case "$TARGET_GOARCH" in
+    all) TARGET_GOARCH_LIST="amd64 arm64" ;;
+    amd64|arm64) TARGET_GOARCH_LIST="$TARGET_GOARCH" ;;
+    *)
+        echo "Unsupported CLICD_GOARCH: $TARGET_GOARCH (expected amd64, arm64, or all)" >&2
+        exit 2
+        ;;
+esac
+
+for arch in $TARGET_GOARCH_LIST; do
+    echo "Target: ${TARGET_GOOS}/${arch}"
+    GOOS="$TARGET_GOOS" GOARCH="$arch" CGO_ENABLED=0 go build -ldflags="-s -w -X clicd/internal/version.Version=${BUILD_VERSION}" -o "$BUILD_DIR/clicd-linux-${arch}" .
+done
+
+first_arch="${TARGET_GOARCH_LIST%% *}"
+cp "$BUILD_DIR/clicd-linux-${first_arch}" "$BUILD_DIR/clicd"
 
 echo "Go backend built successfully"
 
@@ -62,7 +82,20 @@ echo ""
 echo "[3/3] Packaging..."
 cp -r "$WEB_DIR" "$BUILD_DIR/web"
 cp "$SCRIPT_DIR/install.sh" "$BUILD_DIR/install.sh" 2>/dev/null || true
-chmod +x "$BUILD_DIR/clicd"
+chmod +x "$BUILD_DIR"/clicd*
+
+for arch in $TARGET_GOARCH_LIST; do
+    asset_dir="clicd-linux-${arch}"
+    package_root="$BUILD_DIR/package-${arch}"
+    rm -rf "$package_root"
+    mkdir -p "$package_root/$asset_dir"
+    cp "$BUILD_DIR/clicd-linux-${arch}" "$package_root/$asset_dir/clicd"
+    cp "$BUILD_DIR/install.sh" "$package_root/$asset_dir/install.sh" 2>/dev/null || true
+    chmod +x "$package_root/$asset_dir/clicd"
+    [ ! -f "$package_root/$asset_dir/install.sh" ] || chmod +x "$package_root/$asset_dir/install.sh"
+    tar -C "$package_root" -czf "$DIST_DIR/${asset_dir}.tar.gz" "$asset_dir"
+    cp "$BUILD_DIR/clicd-linux-${arch}" "$DIST_DIR/${asset_dir}"
+done
 
 echo ""
 echo "====================================="
@@ -70,6 +103,11 @@ echo "  Build Complete!"
 echo "====================================="
 echo "  Output: $BUILD_DIR/clicd"
 echo "  Web:    $BUILD_DIR/web/"
+echo "  Dist:   $DIST_DIR/"
+for arch in $TARGET_GOARCH_LIST; do
+    echo "          dist/clicd-linux-${arch}"
+    echo "          dist/clicd-linux-${arch}.tar.gz"
+done
 echo ""
 echo "  To deploy:"
 echo "    1. Copy build/ directory to server"

docs/developer/build.md

@@ -30,6 +30,25 @@ bash build.sh
 
 该脚本用于串联前端构建、静态资源同步和 Go 二进制构建。
 
+默认目标为 Linux amd64。需要构建 ARM64 包时可以指定：
+
+```bash
+CLICD_GOARCH=arm64 bash build.sh
+```
+
+需要同时构建 amd64 和 arm64 发布包时：
+
+```bash
+CLICD_GOARCH=all bash build.sh
+```
+
+构建完成后会生成：
+
+- `dist/clicd-linux-amd64`
+- `dist/clicd-linux-amd64.tar.gz`
+- `dist/clicd-linux-arm64`
+- `dist/clicd-linux-arm64.tar.gz`
+
 ## 文档站构建
 
 ```bash

docs/developer/release.md

@@ -12,16 +12,18 @@ CLICD 的安装和升级依赖 GitHub Release 产物。发布时建议使用语
 
 ## Release 产物
 
-安装脚本会优先下载 Linux AMD64 产物：
+安装脚本会按宿主架构优先下载 Linux AMD64 或 ARM64 产物：
 
 ```text
 clicd-linux-amd64.tar.gz
+clicd-linux-arm64.tar.gz
 ```
 
 在部分场景中也会尝试下载单独二进制：
 
 ```text
 clicd-linux-amd64
+clicd-linux-arm64
 ```
 
 ## 安装脚本行为

docs/en/developer/build.md

@@ -30,6 +30,25 @@ bash build.sh
 
 The script chains frontend build, static asset sync, and Go binary build.
 
+The default target is Linux amd64. To build an ARM64 package, set:
+
+```bash
+CLICD_GOARCH=arm64 bash build.sh
+```
+
+To build both amd64 and arm64 release assets at once:
+
+```bash
+CLICD_GOARCH=all bash build.sh
+```
+
+The build writes:
+
+- `dist/clicd-linux-amd64`
+- `dist/clicd-linux-amd64.tar.gz`
+- `dist/clicd-linux-arm64`
+- `dist/clicd-linux-arm64.tar.gz`
+
 ## Docs Build
 
 ```bash

docs/en/developer/release.md

@@ -12,16 +12,18 @@ Check the version in:
 
 ## Release Artifacts
 
-The installer first tries to download the Linux AMD64 archive:
+The installer first tries to download the Linux AMD64 or ARM64 archive for the host architecture:
 
 ```text
 clicd-linux-amd64.tar.gz
+clicd-linux-arm64.tar.gz
 ```
 
 In some cases, it may also try the standalone binary:
 
 ```text
 clicd-linux-amd64
+clicd-linux-arm64
 ```
 
 ## Installer Behavior

docs/en/features/api.md

@@ -191,6 +191,26 @@ Update example:
 | `disabled` | Whether this key is disabled. |
 | `container_uuids` | Optional container allowlist that limits the key to specific containers. |
 
+## Panel Access Source Policy
+
+Use `GET /api/v1/access-policy` to read the panel source allowlist and `PUT /api/v1/access-policy` to update it. Both endpoints require `admin:access`. The policy covers panel pages, login endpoints, and every API.
+
+```json
+{
+  "enabled": true,
+  "allowed_sources": [
+    "203.0.113.10",
+    "192.168.1.0/24",
+    "2001:db8::/32"
+  ],
+  "trusted_proxies": [
+    "127.0.0.1"
+  ]
+}
+```
+
+Both lists accept IPv4, IPv6, and CIDR values. The backend only uses `X-Forwarded-For`, `X-Real-IP`, or `CF-Connecting-IP` when the direct peer matches `trusted_proxies`, so untrusted clients cannot bypass the policy by spoofing those headers. An enabled policy requires at least one allowed source, and the API rejects changes that exclude the current administrator source. Direct loopback access remains available as a CLI/SSH recovery path.
+
 ## Python Example
 
 Fetch containers:
@@ -302,6 +322,8 @@ print(resp.json())
 | GET | `/api/v1/templates` | Template list |
 | GET | `/api/v1/images` | Image management list |
 | GET | `/api/v1/images/enabled` | Enabled and downloaded images; supports `type=lxc\|kvm` |
+| POST | `/api/v1/images/custom` | Add a third-party LXC/KVM image source |
+| DELETE | `/api/v1/images/custom` | Remove a third-party LXC/KVM image source and cache |
 | POST | `/api/v1/images/download` | Download image |
 | POST | `/api/v1/images/cancel` | Cancel image download |
 | DELETE | `/api/v1/images/delete` | Delete image cache |

docs/en/guide/configuration.md

@@ -21,6 +21,23 @@ systemctl restart clicd
 journalctl -u clicd -n 100 --no-pager
 ```
 
+## Panel Access Allowlist CLI
+
+```bash
+# Show the current policy
+clicd access-policy show
+
+# Allow selected addresses and networks; add reverse proxies when needed
+clicd access-policy set \
+  --allow "203.0.113.10,192.168.1.0/24,2001:db8::/32" \
+  --trusted-proxy "127.0.0.1"
+
+# Disable source restrictions
+clicd access-policy disable
+```
+
+The same controls are available from the "Panel access allowlist" item in `clicd cli`. Both paths persist the setting and restart the running panel service automatically.
+
 ## Security Recommendations
 
 - Do not expose the web panel directly to untrusted networks.

docs/en/guide/installation.md

@@ -4,7 +4,7 @@ CLICD provides a one-line installer. By default, it installs the latest version
 
 ## Requirements
 
-- Linux x86_64 host.
+- Linux x86_64/amd64 or ARM64/aarch64 host.
 - Root privileges.
 - systemd.
 - Network access to GitHub Release downloads.
@@ -17,7 +17,9 @@ CLICD provides a one-line installer. By default, it installs the latest version
 curl -fsSL https://raw.githubusercontent.com/MengMengCode/CLICD/main/install.sh | sudo sh
 ```
 
-The script defaults to `CLICD_VERSION=latest`, which downloads `clicd-linux-amd64.tar.gz` from `releases/latest`.
+The installer asks for separate LXC and KVM NAT private subnets. Press Enter to scan host routes, interfaces, bridges, and libvirt networks and select non-overlapping RFC1918 `/24` networks, or enter a CIDR such as `172.28.40.0/24`. For unattended installation, set `CLICD_LXC_SUBNET` and `CLICD_KVM_SUBNET`.
+
+The script defaults to `CLICD_VERSION=latest` and downloads `clicd-linux-amd64.tar.gz` or `clicd-linux-arm64.tar.gz` from `releases/latest` according to the host architecture.
 
 ## Install a Specific Version
 

docs/en/guide/introduction.md

@@ -26,4 +26,4 @@ CLICD is a lightweight virtualization management panel for LXC and KVM. It bring
 
 - Backend: Go, `net/http`, SQLite, systemd, LXC, KVM/libvirt, cgroup v2, iptables, conntrack.
 - Frontend: React, TypeScript, Vite, Tailwind CSS, lucide-react, xterm.js, noVNC.
-- Release: GitHub Actions builds Linux AMD64 release artifacts. The installer fetches the latest release by default.
+- Release: GitHub Actions builds Linux AMD64/ARM64 release artifacts. The installer fetches the latest release by default.

docs/en/operations/faq.md

@@ -2,7 +2,7 @@
 
 ## Which version does the installer install by default?
 
-It installs the latest version from GitHub Releases. The script default is `CLICD_VERSION=latest`, which downloads the Linux AMD64 artifact from `releases/latest`.
+It installs the latest version from GitHub Releases. The script default is `CLICD_VERSION=latest`, which downloads the Linux AMD64 or ARM64 artifact from `releases/latest` according to the host architecture.
 
 ## Can I pin a specific version?
 

docs/features/api.md

@@ -191,6 +191,26 @@ curl -H "Authorization: Bearer YOUR_API_KEY" https://panel.example.com/api/v1/da
 | `disabled` | 是否禁用该 Key。 |
 | `container_uuids` | 可选；限制该 Key 只能访问指定容器。 |
 
+## 面板访问来源策略
+
+`GET /api/v1/access-policy` 读取面板访问白名单，`PUT /api/v1/access-policy` 更新策略。两者均需要 `admin:access` 权限。策略覆盖面板页面、登录入口和全部 API。
+
+```json
+{
+  "enabled": true,
+  "allowed_sources": [
+    "203.0.113.10",
+    "192.168.1.0/24",
+    "2001:db8::/32"
+  ],
+  "trusted_proxies": [
+    "127.0.0.1"
+  ]
+}
+```
+
+`allowed_sources` 和 `trusted_proxies` 均支持 IPv4、IPv6 及 CIDR。只有直接连接来源命中 `trusted_proxies` 时，后端才会使用 `X-Forwarded-For`、`X-Real-IP` 或 `CF-Connecting-IP`；其他客户端伪造这些请求头不会绕过白名单。启用策略时至少要配置一个允许来源，且接口会拒绝排除当前管理来源的配置。本机回环直连保留为 CLI/SSH 故障恢复通道。
+
 ## Python 示例
 
 获取容器列表：
@@ -302,6 +322,8 @@ print(resp.json())
 | GET | `/api/v1/templates` | 模板列表 |
 | GET | `/api/v1/images` | 镜像管理列表 |
 | GET | `/api/v1/images/enabled` | 已启用且已下载的镜像；支持 `type=lxc\|kvm` |
+| POST | `/api/v1/images/custom` | 添加第三方 LXC/KVM 镜像源 |
+| DELETE | `/api/v1/images/custom` | 移除第三方 LXC/KVM 镜像源及缓存 |
 | POST | `/api/v1/images/download` | 下载镜像 |
 | POST | `/api/v1/images/cancel` | 取消镜像下载 |
 | DELETE | `/api/v1/images/delete` | 删除镜像缓存 |

docs/guide/configuration.md

@@ -21,6 +21,23 @@ systemctl restart clicd
 journalctl -u clicd -n 100 --no-pager
 ```
 
+## 面板访问白名单 CLI
+
+```bash
+# 查看当前策略
+clicd access-policy show
+
+# 仅允许指定 IP/网段；反向代理地址按需填写
+clicd access-policy set \
+  --allow "203.0.113.10,192.168.1.0/24,2001:db8::/32" \
+  --trusted-proxy "127.0.0.1"
+
+# 关闭白名单限制
+clicd access-policy disable
+```
+
+也可以运行 `clicd cli`，在交互菜单中选择“面板访问白名单”。直接命令和交互菜单都会保存配置，并在服务运行时自动重启面板。
+
 ## 安全建议
 
 - 不要把 Web 面板直接暴露给不可信来源。

docs/guide/installation.md

@@ -4,7 +4,7 @@ CLICD 提供一键安装脚本。脚本默认安装 GitHub Releases 的最新版
 
 ## 环境要求
 
-- Linux x86_64 宿主机。
+- Linux x86_64/amd64 或 ARM64/aarch64 宿主机。
 - root 权限。
 - systemd。
 - 网络可访问 GitHub Release 下载地址。
@@ -17,7 +17,9 @@ CLICD 提供一键安装脚本。脚本默认安装 GitHub Releases 的最新版
 curl -fsSL https://raw.githubusercontent.com/MengMengCode/CLICD/main/install.sh | sudo sh
 ```
 
-脚本当前默认使用 `CLICD_VERSION=latest`，也就是下载 `releases/latest` 对应的 `clicd-linux-amd64.tar.gz`。
+安装器会分别询问 LXC 与 KVM 的 NAT 私网网段。直接回车时，脚本会扫描宿主机路由、网卡、网桥和 libvirt 网络，自动选择未冲突的 RFC1918 `/24` 网段；也可以输入 `172.28.40.0/24` 这类 CIDR。非交互安装可设置 `CLICD_LXC_SUBNET` 和 `CLICD_KVM_SUBNET`。
+
+脚本当前默认使用 `CLICD_VERSION=latest`，会按宿主架构下载 `releases/latest` 对应的 `clicd-linux-amd64.tar.gz` 或 `clicd-linux-arm64.tar.gz`。
 
 ## 安装指定版本
 

docs/guide/introduction.md

@@ -26,4 +26,4 @@ CLICD 是一个面向 LXC/KVM 的轻量虚拟化管理面板。它把常见宿
 
 - 后端：Go、`net/http`、SQLite、systemd、LXC、KVM/libvirt、cgroup v2、iptables、conntrack。
 - 前端：React、TypeScript、Vite、Tailwind CSS、lucide-react、xterm.js、noVNC。
-- 发布：GitHub Actions 构建 Linux AMD64 release 产物，安装脚本默认拉取最新 Release。
+- 发布：GitHub Actions 构建 Linux AMD64/ARM64 release 产物，安装脚本默认拉取最新 Release。

docs/operations/faq.md

@@ -2,7 +2,7 @@
 
 ## 安装脚本默认安装哪个版本？
 
-默认安装 GitHub Releases 的最新版本。脚本中默认值是 `CLICD_VERSION=latest`，会下载 `releases/latest` 下的 Linux AMD64 产物。
+默认安装 GitHub Releases 的最新版本。脚本中默认值是 `CLICD_VERSION=latest`，会按宿主架构下载 `releases/latest` 下的 Linux AMD64 或 ARM64 产物。
 
 ## 可以固定安装某个版本吗？
 

docs/package-lock.json

@@ -2065,9 +2065,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.12",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
-      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
+      "version": "3.3.16",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
+      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
       "dev": true,
       "funding": [
         {
@@ -2123,9 +2123,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.15",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
-      "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
+      "version": "8.5.23",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz",
+      "integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==",
       "dev": true,
       "funding": [
         {
@@ -2143,7 +2143,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.12",
+        "nanoid": "^3.3.16",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -2475,9 +2475,9 @@
       }
     },
     "node_modules/vite": {
-      "version": "6.4.2",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.2.tgz",
-      "integrity": "sha512-2N/55r4JDJ4gdrCvGgINMy+HH3iRpNIz8K6SFwVsA+JbQScLiC+clmAxBgwiSPgcG9U15QmvqCGWzMbqda5zGQ==",
+      "version": "6.4.3",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-6.4.3.tgz",
+      "integrity": "sha512-NTKlcQjlAK7MlQoyb6LgaqHc8sso/pVyUJYWMws3jg21uTJw/LddqIFPcPqP6PzpgbIcZyKI85sFE4HBrQDA8A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {

docs/package.json

@@ -11,7 +11,8 @@
     "vitepress": "^1.6.4"
   },
   "overrides": {
-    "vite": "6.4.2",
-    "esbuild": "0.28.1"
+    "vite": "6.4.3",
+    "esbuild": "0.28.1",
+    "postcss": "8.5.23"
   }
 }

frontend/package-lock.json

@@ -1,28 +1,28 @@
 {
   "name": "clicd-frontend",
-  "version": "1.1.19",
+  "version": "1.1.28",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "clicd-frontend",
-      "version": "1.1.19",
+      "version": "1.1.28",
       "dependencies": {
         "@novnc/novnc": "1.5.0",
         "@xterm/addon-fit": "^0.11.0",
         "@xterm/xterm": "^6.0.0",
-        "axios": "^1.7.7",
+        "axios": "^1.18.0",
         "lucide-react": "^0.454.0",
-        "react": "^18.3.1",
-        "react-dom": "^18.3.1",
-        "react-router-dom": "^6.28.0"
+        "react": "19.2.8",
+        "react-dom": "19.2.8",
+        "react-router": "8.3.0"
       },
       "devDependencies": {
-        "@types/react": "^18.3.12",
-        "@types/react-dom": "^18.3.1",
+        "@types/react": "^19.2.17",
+        "@types/react-dom": "^19.2.3",
         "@vitejs/plugin-react": "^5.2.0",
         "autoprefixer": "^10.4.20",
-        "postcss": "^8.4.49",
+        "postcss": "^8.5.23",
         "tailwindcss": "^3.4.15",
         "typescript": "^5.6.3",
         "vite": "^8.0.16"
@@ -480,15 +480,6 @@
         "url": "https://github.com/sponsors/Boshen"
       }
     },
-    "node_modules/@remix-run/router": {
-      "version": "1.23.3",
-      "resolved": "https://registry.npmjs.org/@remix-run/router/-/router-1.23.3.tgz",
-      "integrity": "sha512-4An71tdz9X8+3sI4Qqqd2LWd9vS39J7sqd9EU4Scw7TJE/qB10Flv/UuqbPVgfQV9XoK8Np6jNquZitnZq5i+Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=14.0.0"
-      }
-    },
     "node_modules/@rolldown/binding-android-arm64": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.3.tgz",
@@ -809,32 +800,24 @@
         "@babel/types": "^7.28.2"
       }
     },
-    "node_modules/@types/prop-types": {
-      "version": "15.7.15",
-      "resolved": "https://registry.npmjs.org/@types/prop-types/-/prop-types-15.7.15.tgz",
-      "integrity": "sha512-F6bEyamV9jKGAFBEmlQnesRPGOQqS2+Uwi0Em15xenOxHaf2hv6L8YCVn3rPdPJOiJfPiCnLIRyvwVaqMY3MIw==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/@types/react": {
-      "version": "18.3.30",
-      "resolved": "https://registry.npmjs.org/@types/react/-/react-18.3.30.tgz",
-      "integrity": "sha512-3ek6mwJL5/VBewBcY4S66cqlCtK3qi4WIq37Z0m/NHw1hjhI7274Mx1qz/+ggSzyBCOEf7eHjBN6INjPAWYfYw==",
+      "version": "19.2.17",
+      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.17.tgz",
+      "integrity": "sha512-MXfmqaVPEVgkBT/aY0aGCkRWWtByiYQXo3xdQ8r5RzuFrPiRn8Gar2tQdXSUQ2GKV3bkXckek89V8wQBY2Q/Aw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@types/prop-types": "*",
         "csstype": "^3.2.2"
       }
     },
     "node_modules/@types/react-dom": {
-      "version": "18.3.7",
-      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-18.3.7.tgz",
-      "integrity": "sha512-MEe3UeoENYVFXzoXEWsvcpg6ZvlrFNlOQ7EOsvhI3CfAXwzPfO8Qwuxd40nepsYKqyyVQnTdEfv68q91yLcKrQ==",
+      "version": "19.2.3",
+      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-19.2.3.tgz",
+      "integrity": "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==",
       "dev": true,
       "license": "MIT",
       "peerDependencies": {
-        "@types/react": "^18.0.0"
+        "@types/react": "^19.2.0"
       }
     },
     "node_modules/@vitejs/plugin-react": {
@@ -957,9 +940,9 @@
       }
     },
     "node_modules/axios": {
-      "version": "1.17.0",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.17.0.tgz",
-      "integrity": "sha512-J8SwNxprqqpbfenehxWYXE7CW+wM1BB4w3+N+g+/Wx40xM4rsLrfPmHHxSWIxJLYDgSY/HqlFPIYb2/S3rxafw==",
+      "version": "1.18.0",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.18.0.tgz",
+      "integrity": "sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw==",
       "license": "MIT",
       "dependencies": {
         "follow-redirects": "^1.16.0",
@@ -1152,6 +1135,12 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/cookie-es": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/cookie-es/-/cookie-es-3.1.1.tgz",
+      "integrity": "sha512-UaXxwISYJPTr9hwQxMFYZ7kNhSXboMXP+Z3TRX6f1/NyaGPfuNUZOWP1pUEb75B2HjfklIYLVRfWiFZJyC6Npg==",
+      "license": "MIT"
+    },
     "node_modules/cssesc": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/cssesc/-/cssesc-3.0.0.tgz",
@@ -1625,6 +1614,7 @@
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
       "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/jsesc": {
@@ -1934,18 +1924,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/loose-envify": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/loose-envify/-/loose-envify-1.4.0.tgz",
-      "integrity": "sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==",
-      "license": "MIT",
-      "dependencies": {
-        "js-tokens": "^3.0.0 || ^4.0.0"
-      },
-      "bin": {
-        "loose-envify": "cli.js"
-      }
-    },
     "node_modules/lru-cache": {
       "version": "5.1.1",
       "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",
@@ -2038,9 +2016,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.12",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
-      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
+      "version": "3.3.16",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
+      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
       "dev": true,
       "funding": [
         {
@@ -2144,9 +2122,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.15",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
-      "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
+      "version": "8.5.23",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz",
+      "integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==",
       "dev": true,
       "funding": [
         {
@@ -2164,7 +2142,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.12",
+        "nanoid": "^3.3.16",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -2337,28 +2315,24 @@
       "license": "MIT"
     },
     "node_modules/react": {
-      "version": "18.3.1",
-      "resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz",
-      "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==",
+      "version": "19.2.8",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.2.8.tgz",
+      "integrity": "sha512-PWaYA1L/q9u2u7xYQi+Y3L3Yfnie7XyLeaJICV1MGD6LprsBxcAqGjYyr0eY3p+QdsA+x/Irkt4Qif8D63+Sbw==",
       "license": "MIT",
-      "dependencies": {
-        "loose-envify": "^1.1.0"
-      },
       "engines": {
         "node": ">=0.10.0"
       }
     },
     "node_modules/react-dom": {
-      "version": "18.3.1",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.3.1.tgz",
-      "integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==",
+      "version": "19.2.8",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.8.tgz",
+      "integrity": "sha512-rVprimfGBG3DR+Tq0IQG2DT5PxKth1WIGDmj5yPmlzr4YBe7uyE+Du4oVqTDXZSHGGGXRtTJEGSSePyQCMBglQ==",
       "license": "MIT",
       "dependencies": {
-        "loose-envify": "^1.1.0",
-        "scheduler": "^0.23.2"
+        "scheduler": "^0.27.0"
       },
       "peerDependencies": {
-        "react": "^18.3.1"
+        "react": "^19.2.8"
       }
     },
     "node_modules/react-refresh": {
@@ -2372,35 +2346,24 @@
       }
     },
     "node_modules/react-router": {
-      "version": "6.30.4",
-      "resolved": "https://registry.npmjs.org/react-router/-/react-router-6.30.4.tgz",
-      "integrity": "sha512-SVUsDe+DybHM/WmYKIVYhZh1o5Dcuf16yM6WjG02Q9XVFMZIJyHYhwrr6bFBXZkVP6z69kNkMyBCujt8FaFLJA==",
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-8.3.0.tgz",
+      "integrity": "sha512-qyPMvW83jGIct3yiieisxdk9M745anqhpIMKN5m1t6yBMfgVPpt77aHOqs5fUlEJRMCGffg9BaQLH9oPVOL7xQ==",
       "license": "MIT",
       "dependencies": {
-        "@remix-run/router": "1.23.3"
+        "cookie-es": "^3.1.1"
       },
       "engines": {
-        "node": ">=14.0.0"
+        "node": ">=22.22.0"
       },
       "peerDependencies": {
-        "react": ">=16.8"
+        "react": ">=19.2.7",
+        "react-dom": ">=19.2.7"
+      },
+      "peerDependenciesMeta": {
+        "react-dom": {
+          "optional": true
         }
-    },
-    "node_modules/react-router-dom": {
-      "version": "6.30.4",
-      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-6.30.4.tgz",
-      "integrity": "sha512-q4HvNl+mmDdkS0g+MqiBZNteQJCuimWoOyHMy4T/RQLAn9Z29+E91QXRaxOujeMl2HTzRSS0KFPd7lxX3PjV0Q==",
-      "license": "MIT",
-      "dependencies": {
-        "@remix-run/router": "1.23.3",
-        "react-router": "6.30.4"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      },
-      "peerDependencies": {
-        "react": ">=16.8",
-        "react-dom": ">=16.8"
       }
     },
     "node_modules/read-cache": {
@@ -2525,13 +2488,10 @@
       }
     },
     "node_modules/scheduler": {
-      "version": "0.23.2",
-      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.23.2.tgz",
-      "integrity": "sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ==",
-      "license": "MIT",
-      "dependencies": {
-        "loose-envify": "^1.1.0"
-      }
+      "version": "0.27.0",
+      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
+      "integrity": "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==",
+      "license": "MIT"
     },
     "node_modules/semver": {
       "version": "6.3.1",

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clicd-frontend",
   "private": true,
-  "version": "1.1.20",
+  "version": "1.1.28",
   "type": "module",
   "scripts": {
     "dev": "vite",
@@ -12,18 +12,18 @@
     "@novnc/novnc": "1.5.0",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
-    "axios": "^1.7.7",
+    "axios": "^1.18.0",
     "lucide-react": "^0.454.0",
-    "react": "^18.3.1",
-    "react-dom": "^18.3.1",
-    "react-router-dom": "^6.28.0"
+    "react": "19.2.8",
+    "react-dom": "19.2.8",
+    "react-router": "8.3.0"
   },
   "devDependencies": {
-    "@types/react": "^18.3.12",
-    "@types/react-dom": "^18.3.1",
+    "@types/react": "^19.2.17",
+    "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^5.2.0",
     "autoprefixer": "^10.4.20",
-    "postcss": "^8.4.49",
+    "postcss": "^8.5.23",
     "tailwindcss": "^3.4.15",
     "typescript": "^5.6.3",
     "vite": "^8.0.16"

frontend/src/App.tsx

@@ -1,4 +1,4 @@
-import { Routes, Route, Navigate } from 'react-router-dom'
+import { Routes, Route, Navigate } from 'react-router'
 import { useAuth } from './contexts/AuthContext'
 import Login from './pages/Login'
 import Dashboard from './pages/Dashboard'
@@ -13,6 +13,7 @@ import Settings from './pages/Settings'
 import ImageManagement from './pages/ImageManagement'
 import Snapshots from './pages/Snapshots'
 import Routing from './pages/Routing'
+import Storage from './pages/Storage'
 import SubUserManagement from './pages/SubUserManagement'
 import Layout from './components/Layout'
 
@@ -63,6 +64,7 @@ function App() {
         <Route path="security" element={<Security />} />
         <Route path="snapshots" element={<Snapshots />} />
         <Route path="routing" element={<Routing />} />
+        <Route path="storage" element={<Storage />} />
         <Route path="audit-logs" element={<AuditLogs />} />
         <Route path="api-integration" element={<ApiIntegration />} />
         <Route path="host-report" element={<HostReport />} />

frontend/src/components/AutoTranslate.tsx

@@ -1,5 +1,5 @@
 import { useEffect } from 'react'
-import { useLocation } from 'react-router-dom'
+import { useLocation } from 'react-router'
 import { useLanguage } from '../contexts/LanguageContext'
 import { shouldTranslateText, translateText } from '../utils/i18n'
 

frontend/src/components/BrowserDialogTranslator.tsx

@@ -1,19 +1,21 @@
 import { useEffect } from 'react'
 import { useLanguage } from '../contexts/LanguageContext'
+import { useDialog } from './Dialog'
 
 export default function BrowserDialogTranslator() {
   const { t } = useLanguage()
+  const { alert: showAlert } = useDialog()
 
   useEffect(() => {
     const originalAlert = window.alert
     const originalConfirm = window.confirm
-    window.alert = (message?: unknown) => originalAlert(t(String(message ?? '')))
+    window.alert = (message?: unknown) => { void showAlert('提示', String(message ?? '')) }
     window.confirm = (message?: string) => originalConfirm(t(String(message ?? '')))
     return () => {
       window.alert = originalAlert
       window.confirm = originalConfirm
     }
-  }, [t])
+  }, [showAlert, t])
 
   return null
 }

frontend/src/components/ContainerCard.tsx

@@ -1,4 +1,4 @@
-import { useNavigate } from 'react-router-dom'
+import { useNavigate } from 'react-router'
 import {
   Server,
   Cpu,

frontend/src/components/Dialog.tsx

@@ -1,17 +1,23 @@
-import { useState, useCallback, createContext, useContext, ReactNode } from 'react'
-import { AlertTriangle, CheckCircle, X } from 'lucide-react'
+import { useState, useCallback, createContext, useContext, ReactNode, useEffect, useRef } from 'react'
+import { AlertTriangle, CheckCircle2, CircleAlert, Info, X } from 'lucide-react'
 import { useLanguage } from '../contexts/LanguageContext'
 
-type DialogType = 'confirm' | 'alert'
-
 interface DialogState {
   open: boolean
-  type: DialogType
   title: string
   message: string
   resolve?: (value: boolean) => void
 }
 
+type ToastTone = 'success' | 'error' | 'warning' | 'info'
+
+interface ToastState {
+  id: number
+  title: string
+  message: string
+  tone: ToastTone
+}
+
 interface DialogContextType {
   confirm: (title: string, message: string) => Promise<boolean>
   alert: (title: string, message: string) => Promise<void>
@@ -19,67 +25,107 @@ interface DialogContextType {
 
 const DialogContext = createContext<DialogContextType | undefined>(undefined)
 
+const toastStyles = {
+  success: { icon: CheckCircle2, iconClass: 'bg-emerald-50 text-emerald-600 dark:bg-emerald-950 dark:text-emerald-300', borderClass: 'border-emerald-200 dark:border-emerald-800' },
+  error: { icon: CircleAlert, iconClass: 'bg-red-50 text-red-600 dark:bg-red-950 dark:text-red-300', borderClass: 'border-red-200 dark:border-red-800' },
+  warning: { icon: AlertTriangle, iconClass: 'bg-amber-50 text-amber-600 dark:bg-amber-950 dark:text-amber-300', borderClass: 'border-amber-200 dark:border-amber-800' },
+  info: { icon: Info, iconClass: 'bg-gray-100 text-gray-600 dark:bg-gray-800 dark:text-gray-300', borderClass: 'border-gray-200 dark:border-gray-700' },
+}
+
+function toastTone(title: string): ToastTone {
+  if (/失败|错误|异常|不可用|failed|error/i.test(title)) return 'error'
+  if (/提示|警告|未配置|格式|配额|封禁|warning/i.test(title)) return 'warning'
+  if (/完成|成功|已保存|success/i.test(title)) return 'success'
+  return 'info'
+}
+
 export function DialogProvider({ children }: { children: ReactNode }) {
-  const [dialog, setDialog] = useState<DialogState>({ open: false, type: 'alert', title: '', message: '' })
+  const [dialog, setDialog] = useState<DialogState>({ open: false, title: '', message: '' })
+  const [toasts, setToasts] = useState<ToastState[]>([])
+  const toastID = useRef(0)
+  const toastTimers = useRef(new Map<number, number>())
   const { t } = useLanguage()
 
   const confirm = useCallback((title: string, message: string) => {
     return new Promise<boolean>((resolve) => {
-      setDialog({ open: true, type: 'confirm', title, message, resolve })
+      setDialog({ open: true, title, message, resolve })
     })
   }, [])
 
+  const dismissToast = useCallback((id: number) => {
+    setToasts((current) => current.filter((toast) => toast.id !== id))
+    const timer = toastTimers.current.get(id)
+    if (timer !== undefined) window.clearTimeout(timer)
+    toastTimers.current.delete(id)
+  }, [])
+
   const alert = useCallback((title: string, message: string) => {
-    return new Promise<void>((resolve) => {
-      setDialog({ open: true, type: 'alert', title, message, resolve: () => resolve() })
-    })
+    const id = ++toastID.current
+    setToasts((current) => [...current, { id, title, message, tone: toastTone(title) }].slice(-4))
+    const timer = window.setTimeout(() => dismissToast(id), 4200)
+    toastTimers.current.set(id, timer)
+    return Promise.resolve()
+  }, [dismissToast])
+
+  useEffect(() => () => {
+    toastTimers.current.forEach((timer) => window.clearTimeout(timer))
+    toastTimers.current.clear()
   }, [])
 
   const close = (result: boolean) => {
     dialog.resolve?.(result)
-    setDialog({ open: false, type: 'alert', title: '', message: '' })
+    setDialog({ open: false, title: '', message: '' })
   }
 
   return (
     <DialogContext.Provider value={{ confirm, alert }}>
       {children}
-      {dialog.open && (
-        <div className="fixed inset-0 z-[100] flex items-center justify-center bg-black/50 p-4">
-          <div className="bg-white rounded-lg shadow-xl border border-gray-200 w-full max-w-sm overflow-hidden">
-            <div className="flex items-center gap-3 px-5 py-4 border-b border-gray-100">
-              <div className={`w-8 h-8 rounded-full flex items-center justify-center ${
-                dialog.type === 'confirm' ? 'bg-amber-50 text-amber-600' : 'bg-gray-100 text-gray-600'
-              }`}>
-                {dialog.type === 'confirm' ? <AlertTriangle className="w-4 h-4" /> : <CheckCircle className="w-4 h-4" />}
+      <div className="pointer-events-none fixed right-4 top-4 z-[120] flex w-[calc(100vw-2rem)] max-w-sm flex-col gap-2" aria-live="polite" aria-atomic="true">
+        {toasts.map((toast) => {
+          const style = toastStyles[toast.tone]
+          const ToastIcon = style.icon
+          return (
+            <div key={toast.id} className={`pointer-events-auto rounded-lg border bg-white shadow-lg dark:bg-gray-900 dark:shadow-black/40 ${style.borderClass}`} role="status">
+              <div className="flex items-start gap-3 p-3.5">
+                <div className={`mt-0.5 flex h-7 w-7 flex-shrink-0 items-center justify-center rounded-full ${style.iconClass}`}>
+                  <ToastIcon className="h-4 w-4" />
                 </div>
-              <h3 className="text-sm font-semibold text-black flex-1">{t(dialog.title)}</h3>
-              {dialog.type === 'alert' && (
-                <button onClick={() => close(true)} className="p-1 text-gray-400 hover:text-black rounded">
-                  <X className="w-4 h-4" />
+                <div className="min-w-0 flex-1">
+                  <div className="text-sm font-semibold text-gray-900 dark:text-white">{t(toast.title)}</div>
+                  <div className="mt-0.5 break-words text-sm leading-5 text-gray-600 dark:text-gray-300">{t(toast.message)}</div>
+                </div>
+                <button onClick={() => dismissToast(toast.id)} className="rounded p-1 text-gray-400 hover:bg-gray-100 hover:text-black dark:text-gray-500 dark:hover:bg-gray-800 dark:hover:text-white" title={t('关闭')}>
+                  <X className="h-4 w-4" />
                 </button>
-              )}
+              </div>
+            </div>
+          )
+        })}
+      </div>
+      {dialog.open && (
+        <div className="fixed inset-0 z-[100] flex items-center justify-center bg-black/50 p-4 dark:bg-black/70">
+          <div className="w-full max-w-sm overflow-hidden rounded-lg border border-gray-200 bg-white shadow-xl dark:border-gray-700 dark:bg-gray-900">
+            <div className="flex items-center gap-3 border-b border-gray-100 px-5 py-4 dark:border-gray-700">
+              <div className="flex h-8 w-8 items-center justify-center rounded-full bg-amber-50 text-amber-600 dark:bg-amber-950 dark:text-amber-300">
+                <AlertTriangle className="h-4 w-4" />
+              </div>
+              <h3 className="flex-1 text-sm font-semibold text-black dark:text-white">{t(dialog.title)}</h3>
             </div>
             <div className="px-5 py-4">
-              <p className="text-sm text-gray-600">{t(dialog.message)}</p>
+              <p className="text-sm text-gray-600 dark:text-gray-300">{t(dialog.message)}</p>
             </div>
-            <div className="flex justify-end gap-2 px-5 py-3 bg-gray-50 border-t border-gray-100">
-              {dialog.type === 'confirm' && (
+            <div className="flex justify-end gap-2 border-t border-gray-100 bg-gray-50 px-5 py-3 dark:border-gray-700 dark:bg-gray-800">
               <button
                 onClick={() => close(false)}
-                  className="px-4 py-2 text-sm text-gray-700 hover:bg-gray-200 rounded-md transition-colors"
+                className="rounded-md px-4 py-2 text-sm text-gray-700 transition-colors hover:bg-gray-200 dark:text-gray-300 dark:hover:bg-gray-700"
               >
                 {t('取消')}
               </button>
-              )}
               <button
                 onClick={() => close(true)}
-                className={`px-4 py-2 text-sm rounded-md transition-colors ${
-                  dialog.type === 'confirm'
-                    ? 'bg-black text-white hover:bg-gray-800'
-                    : 'bg-black text-white hover:bg-gray-800'
-                }`}
+                className="rounded-md bg-black px-4 py-2 text-sm text-white transition-colors hover:bg-gray-800 dark:bg-white dark:text-black dark:hover:bg-gray-200"
               >
-                {dialog.type === 'confirm' ? t('确认') : t('确定')}
+                {t('确认')}
               </button>
             </div>
           </div>

frontend/src/components/Layout.tsx

@@ -1,4 +1,4 @@
-import { Outlet } from 'react-router-dom'
+import { Outlet } from 'react-router'
 import Sidebar from './Sidebar'
 import { useState } from 'react'
 import AutoTranslate from './AutoTranslate'
@@ -12,7 +12,7 @@ export default function Layout() {
       <AutoTranslate />
       <BrowserDialogTranslator />
       <Sidebar collapsed={sidebarCollapsed} onToggle={() => setSidebarCollapsed(!sidebarCollapsed)} />
-      <main className={`flex-1 transition-all duration-300 ${sidebarCollapsed ? 'ml-16' : 'ml-60'}`}>
+      <main className={`min-w-0 flex-1 transition-all duration-300 ${sidebarCollapsed ? 'ml-16' : 'ml-60'}`}>
         <div className="p-6">
           <Outlet />
         </div>

frontend/src/components/Sidebar.tsx

@@ -1,11 +1,12 @@
 import { useEffect, useState } from 'react'
-import { useLocation, useNavigate } from 'react-router-dom'
+import { useLocation, useNavigate } from 'react-router'
 import {
   ChevronLeft,
   ChevronRight,
   Code2,
   Cpu,
   Camera,
+  HardDrive,
   LayoutDashboard,
   LogOut,
   Moon,
@@ -83,6 +84,7 @@ export default function Sidebar({ collapsed, onToggle }: SidebarProps) {
 
   const isSnapshotsPage = location.pathname.startsWith('/snapshots')
   const isRoutingPage = location.pathname.startsWith('/routing')
+  const isStoragePage = location.pathname.startsWith('/storage')
   const isAuditLogsPage = location.pathname.startsWith('/audit-logs')
   const isApiIntegrationPage = location.pathname.startsWith('/api-integration')
   const isHostReportPage = location.pathname.startsWith('/host-report')
@@ -201,6 +203,18 @@ export default function Sidebar({ collapsed, onToggle }: SidebarProps) {
               {!collapsed && <span>路由管理</span>}
             </button>
 
+            <button
+              onClick={() => navigate('/storage')}
+              className={`w-full flex items-center gap-3 px-3 py-2.5 rounded-md text-sm transition-colors ${
+                isStoragePage
+                  ? 'bg-black text-white dark:bg-white dark:text-black'
+                  : 'text-gray-700 hover:bg-gray-100 dark:text-gray-300 dark:hover:bg-gray-800'
+              }`}
+            >
+              <HardDrive className="w-4 h-4" />
+              {!collapsed && <span>存储管理</span>}
+            </button>
+
             <button
               onClick={() => navigate('/audit-logs')}
               className={`w-full flex items-center gap-3 px-3 py-2.5 rounded-md text-sm transition-colors ${

frontend/src/contexts/AuthContext.tsx

@@ -1,5 +1,5 @@
 import React, { createContext, useContext, useState, useEffect, ReactNode } from 'react'
-import { useNavigate } from 'react-router-dom'
+import { useNavigate } from 'react-router'
 import api, { login as apiLogin, checkAuth, LoginResponse } from '../services/api'
 
 interface AuthContextType {

frontend/src/index.css

@@ -17,6 +17,7 @@ body {
 /* Scrollbar */
 ::-webkit-scrollbar {
   width: 6px;
+  height: 6px;
 }
 ::-webkit-scrollbar-track {
   background: #f1f1f1;
@@ -83,6 +84,8 @@ body {
 /* Shadow */
 .dark .shadow-sm { box-shadow: 0 1px 2px 0 rgba(0,0,0,0.3) !important; }
 .dark .shadow-md { box-shadow: 0 4px 6px -1px rgba(0,0,0,0.4) !important; }
+.dark .shadow-lg,
+.dark .shadow-xl { box-shadow: 0 12px 28px rgba(0,0,0,0.45) !important; }
 
 /* bg-black buttons in dark mode -> light */
 .dark .bg-black { background-color: #f9fafb !important; }
@@ -121,6 +124,7 @@ body {
 .dark .bg-amber-50 { background-color: #451a03 !important; }
 .dark .bg-emerald-50 { background-color: #064e3b !important; }
 .dark .bg-amber-100 { background-color: #78350f !important; }
+.dark .bg-indigo-50 { background-color: #1e1b4b !important; }
 
 /* Status badge text */
 .dark .text-green-700 { color: #6ee7b7 !important; }
@@ -129,6 +133,14 @@ body {
 .dark .text-amber-600 { color: #fcd34d !important; }
 .dark .text-amber-700 { color: #fcd34d !important; }
 .dark .text-emerald-700 { color: #6ee7b7 !important; }
+.dark .text-emerald-600 { color: #6ee7b7 !important; }
+.dark .text-amber-800 { color: #fde68a !important; }
+.dark .text-indigo-700 { color: #a5b4fc !important; }
+
+/* Colored notification borders */
+.dark .border-emerald-200 { border-color: #065f46 !important; }
+.dark .border-red-200 { border-color: #991b1b !important; }
+.dark .border-amber-200 { border-color: #92400e !important; }
 
 /* Focus ring */
 .dark .focus\:ring-black:focus { --tw-ring-color: #f9fafb !important; }
@@ -137,6 +149,37 @@ body {
 /* Accent */
 .dark .accent-black { accent-color: #f9fafb !important; }
 
+/* Native form controls */
+.dark input,
+.dark select,
+.dark textarea { color-scheme: dark; }
+
+/* Explicit dark variants take precedence over the compatibility overrides above. */
+.dark .dark\:bg-white { background-color: #f9fafb !important; }
+.dark .dark\:bg-gray-950 { background-color: #030712 !important; }
+.dark .dark\:bg-gray-900 { background-color: #111827 !important; }
+.dark .dark\:bg-gray-800 { background-color: #1f2937 !important; }
+.dark .dark\:bg-gray-700 { background-color: #374151 !important; }
+.dark .dark\:bg-emerald-950 { background-color: #022c22 !important; }
+.dark .dark\:bg-red-950 { background-color: #450a0a !important; }
+.dark .dark\:bg-amber-950 { background-color: #451a03 !important; }
+.dark .dark\:text-white { color: #f9fafb !important; }
+.dark .dark\:text-black { color: #111827 !important; }
+.dark .dark\:text-gray-300 { color: #d1d5db !important; }
+.dark .dark\:text-gray-400 { color: #9ca3af !important; }
+.dark .dark\:text-gray-500 { color: #6b7280 !important; }
+.dark .dark\:text-emerald-300 { color: #6ee7b7 !important; }
+.dark .dark\:text-red-300 { color: #fca5a5 !important; }
+.dark .dark\:text-amber-300 { color: #fcd34d !important; }
+.dark .dark\:border-gray-700 { border-color: #374151 !important; }
+.dark .dark\:border-emerald-800 { border-color: #065f46 !important; }
+.dark .dark\:border-red-800 { border-color: #991b1b !important; }
+.dark .dark\:border-amber-800 { border-color: #92400e !important; }
+.dark .dark\:hover\:bg-gray-800:hover { background-color: #1f2937 !important; color: inherit !important; }
+.dark .dark\:hover\:bg-gray-700:hover { background-color: #374151 !important; color: inherit !important; }
+.dark .dark\:hover\:bg-gray-200:hover { background-color: #e5e7eb !important; color: #111827 !important; }
+.dark .dark\:hover\:text-white:hover { color: #f9fafb !important; }
+
 /* Spinner */
 .dark .border-black { border-color: #f9fafb !important; }
 .dark .border-b-black { border-bottom-color: #f9fafb !important; }
@@ -157,4 +200,6 @@ body {
 .dark .peer-checked\:bg-black:checked ~ * { background-color: #f9fafb !important; }
 .dark .peer-checked\:bg-black:checked + *,
 .dark input.peer:checked + .peer-checked\:bg-black { background-color: #f9fafb !important; }
+.dark .access-policy-switch .access-policy-switch-thumb { background-color: #e5e7eb !important; }
+.dark .access-policy-switch[aria-checked="true"] .access-policy-switch-thumb { background-color: #111827 !important; }
 

frontend/src/main.tsx

@@ -1,6 +1,6 @@
 import React from 'react'
 import ReactDOM from 'react-dom/client'
-import { BrowserRouter } from 'react-router-dom'
+import { BrowserRouter } from 'react-router'
 import App from './App'
 import { AuthProvider } from './contexts/AuthContext'
 import { ThemeProvider } from './contexts/ThemeContext'

frontend/src/pages/ApiIntegration.tsx

@@ -81,7 +81,7 @@ const scopeGroups = [
       ['container:delete', '删除容器'],
       ['container:resize', '资源/到期'],
       ['container:traffic', '流量管理'],
-      ['container:network', '端口映射'],
+      ['container:network', '网络与端口映射'],
       ['container:password', '重置密码'],
       ['ipv6:assign', '分配 IPv6'],
     ],
@@ -140,6 +140,8 @@ const endpointGroups: Array<{ title: string; endpoints: EndpointTuple[] }> = [
     endpoints: [
       ['GET', '/api/v1/dashboard', '控制面板统计'],
       ['GET', '/api/v1/host-info', '主机资源'],
+      ['GET', '/api/v1/host-history', '宿主机历史指标（后台每 30 秒采集）'],
+      ['GET', '/api/v1/host-report', '宿主机硬件、网络与运行环境探测报告'],
       ['GET', '/api/v1/routing', 'NAT/IPv4/IPv6 路由'],
       ['PUT', '/api/v1/routing', '更新公网 IPv4/IPv6 池'],
       ['POST', '/api/v1/routing/ipv4-scan', '扫描公网 IPv4 段'],
@@ -161,6 +163,7 @@ const endpointGroups: Array<{ title: string; endpoints: EndpointTuple[] }> = [
       ['POST', '/api/v1/containers/{id}/reinstall', '重装'],
       ['DELETE', '/api/v1/containers/{id}/delete', '删除'],
       ['GET', '/api/v1/containers/{id}/usage', '资源用量'],
+      ['GET', '/api/v1/containers/{id}/history', '容器历史指标（后台每 30 秒采集）'],
       ['GET', '/api/v1/containers/{id}/traffic', '流量统计'],
       ['POST', '/api/v1/containers/{id}/traffic-reset', '重置流量'],
       ['PUT', '/api/v1/containers/{id}/traffic-limit', '调整流量限制'],
@@ -168,6 +171,8 @@ const endpointGroups: Array<{ title: string; endpoints: EndpointTuple[] }> = [
       ['PUT', '/api/v1/containers/{id}/expiry', '调整到期时间'],
       ['POST', '/api/v1/containers/{id}/reset-password', '重置 SSH 密码'],
       ['POST', '/api/v1/containers/{id}/ipv6', '分配 IPv6'],
+      ['PUT', '/api/v1/containers/{id}/public-ipv4', '更新独立公网 IPv4 地址'],
+      ['PUT', '/api/v1/containers/{id}/ipv6-addresses', '更新独立 IPv6 地址'],
     ],
   },
   {
@@ -193,6 +198,9 @@ const endpointGroups: Array<{ title: string; endpoints: EndpointTuple[] }> = [
     endpoints: [
       ['GET', '/api/v1/templates', '模板列表'],
       ['GET', '/api/v1/images', '镜像管理列表'],
+      ['GET', '/api/v1/images/enabled?type=lxc&container={id}', '可用于创建或重装的已启用镜像'],
+      ['POST', '/api/v1/images/custom', '添加第三方 LXC/KVM 镜像源'],
+      ['DELETE', '/api/v1/images/custom', '移除第三方 LXC/KVM 镜像源'],
       ['POST', '/api/v1/images/download', '下载镜像'],
       ['POST', '/api/v1/images/cancel', '取消镜像下载'],
       ['DELETE', '/api/v1/images/delete', '删除镜像缓存'],
@@ -211,6 +219,23 @@ const endpointGroups: Array<{ title: string; endpoints: EndpointTuple[] }> = [
       ['POST', '/api/v1/vnc-ticket', '创建 WebVNC 票据'],
     ],
   },
+  {
+    title: '主机与设置',
+    endpoints: [
+      ['GET', '/api/v1/storage', '已挂载磁盘、存储池和空间占用'],
+      ['PUT', '/api/v1/storage', '更新各磁盘的存储用途和默认盘'],
+      ['GET', '/api/v1/task-queue/settings', '任务队列并发状态'],
+      ['PUT', '/api/v1/task-queue/settings', '调整任务并发数量'],
+      ['GET', '/api/v1/ssl', 'SSL 配置和证书状态'],
+      ['PUT', '/api/v1/ssl', '更新 SSL 配置'],
+      ['GET', '/api/v1/webssh-origins', 'WebSSH/VNC Origin 白名单'],
+      ['PUT', '/api/v1/webssh-origins', '更新 WebSSH/VNC Origin 白名单'],
+      ['GET', '/api/v1/access-policy', '面板访问来源策略'],
+      ['PUT', '/api/v1/access-policy', '更新面板访问来源策略'],
+      ['GET', '/api/v1/language', '面板语言'],
+      ['PUT', '/api/v1/language', '更新面板语言'],
+    ],
+  },
   {
     title: '账号与日志',
     endpoints: [
@@ -728,6 +753,7 @@ const requestBodySamples: Record<string, Record<string, unknown>> = {
     name: 'demo-lxc-01',
     virtualization: 'lxc',
     template_id: 'debian-bookworm',
+    storage_pool_id: 'disk-root',
     vcpu: 1,
     ram_mb: 512,
     disk_gb: 10,
@@ -741,10 +767,26 @@ const requestBodySamples: Record<string, Record<string, unknown>> = {
     io_speed_mbps: 0,
     io_read_mbps: 80,
     io_write_mbps: 30,
-    extra_ports: [8080],
+    extra_ports: [],
+    nat_port_mappings: [
+      {
+        host_port: 30080,
+        container_port: 80,
+        protocol: 'tcp',
+        description: 'HTTP',
+      },
+    ],
+    management_port: 30022,
     port_mapping_count: 2,
     assign_nat: true,
+    lan_ipv4_mode: '',
+    lan_interface: '',
+    lan_ipv4_address: '',
+    lan_ipv4_prefix_len: 24,
+    lan_ipv4_gateway: '',
     snapshot_limit: 1,
+    allowed_image_ids: ['debian-bookworm'],
+    image_limit_configured: true,
     assign_ipv4: false,
     ipv4_count: 1,
     public_ipv4s: [],
@@ -780,6 +822,14 @@ const requestBodySamples: Record<string, Record<string, unknown>> = {
   },
   'PUT /api/v1/containers/{id}/expiry': { expires_at: '2026-12-31 23:59:59' },
   'POST /api/v1/containers/{id}/reset-password': { password: 'NewPass123456' },
+  'PUT /api/v1/containers/{id}/public-ipv4': {
+    mode: 'random',
+    count: 1,
+  },
+  'PUT /api/v1/containers/{id}/ipv6-addresses': {
+    mode: 'custom',
+    addresses: ['2001:db8:100::1005'],
+  },
   'POST /api/v1/containers/{id}/port-mappings': {
     container_port: 8080,
     host_port: 61320,
@@ -792,16 +842,59 @@ const requestBodySamples: Record<string, Record<string, unknown>> = {
     protocol: 'tcp',
     description: 'HTTP',
   },
+  'POST /api/v1/containers/{id}/snapshots': { storage_pool_id: 'disk-root' },
   'POST /api/v1/containers/{id}/snapshots/schedule': {
     enabled: true,
     interval_hours: 24,
     time: '03:00',
   },
   'PUT /api/v1/containers/{id}/snapshots/quota': { snapshot_limit: 2 },
+  'POST /api/v1/images/custom': {
+    type: 'kvm',
+    name: 'Custom Ubuntu Cloud',
+    description: 'Private mirror image',
+    distro: 'ubuntu',
+    release: 'noble',
+    arch: 'amd64',
+    url: 'https://images.example.com/ubuntu-noble.qcow2',
+    provisioner: 'linux-cloud-init',
+    sha256: '',
+  },
+  'DELETE /api/v1/images/custom': { id: 'custom-kvm-a1b2c3d4e5' },
   'POST /api/v1/images/download': { template_id: 'debian-bookworm' },
   'POST /api/v1/images/cancel': { template_id: 'debian-bookworm' },
   'DELETE /api/v1/images/delete': { template_id: 'debian-bookworm' },
   'PUT /api/v1/images/toggle': { template_id: 'debian-bookworm', enabled: true },
+  'PUT /api/v1/storage': {
+    pools: [
+      {
+        id: 'disk-root',
+        name: 'system (/)',
+        path: '/var/lib/clicd',
+        mount_point: '/',
+        content_types: ['lxc', 'kvm', 'images', 'snapshots', 'backups'],
+        default_contents: ['lxc', 'kvm', 'images', 'snapshots', 'backups'],
+        enabled: true,
+      },
+    ],
+  },
+  'PUT /api/v1/task-queue/settings': { concurrency: 4 },
+  'PUT /api/v1/ssl': {
+    enabled: true,
+    mode: 'letsencrypt',
+    target: 'panel.example.com',
+    email: 'admin@example.com',
+    apply_now: false,
+  },
+  'PUT /api/v1/webssh-origins': {
+    origins: ['https://panel.example.com'],
+  },
+  'PUT /api/v1/access-policy': {
+    enabled: true,
+    allowed_sources: ['203.0.113.10', '192.168.1.0/24', '2001:db8::/32'],
+    trusted_proxies: ['127.0.0.1'],
+  },
+  'PUT /api/v1/language': { language: 'zh' },
   'PUT /api/v1/routing': {
     items: [
       {
@@ -850,7 +943,16 @@ const requestBodySamples: Record<string, Record<string, unknown>> = {
         ram_mb: 512,
         disk_gb: 10,
         assign_nat: true,
+        management_port: 30022,
         port_mapping_count: 2,
+        nat_port_mappings: [
+          {
+            host_port: 30080,
+            container_port: 80,
+            protocol: 'tcp',
+            description: 'HTTP',
+          },
+        ],
         snapshot_limit: 1,
         assign_ipv4: false,
         ipv4_count: 1,
@@ -910,11 +1012,47 @@ const responseSamples: Record<string, unknown> = {
       load: { load1: 0.01, load5: 0.03, load15: 0.01 },
     },
   },
+  'GET /api/v1/host-history': {
+    success: true,
+    data: [
+      {
+        ts: 1784642400000,
+        cpu: 8.4,
+        memory: 21.3,
+        network: 12288,
+        network_rx: 10240,
+        network_tx: 2048,
+        disk_io: 1052672,
+        disk_read: 4096,
+        disk_write: 1048576,
+        disk_usage_pct: 18.8,
+      },
+    ],
+  },
+  'GET /api/v1/host-report': {
+    success: true,
+    data: {
+      generated_at: '2026-07-21 14:00:00',
+      hostname: 'ubuntu',
+      os: 'Ubuntu 22.04.5 LTS',
+      kernel: 'Linux 6.8.0-1054-oracle aarch64 GNU/Linux',
+      cpu: { model: 'Neoverse-N1', cores: 4, threads: 4, architecture: 'arm64', virtualization: true },
+      memory: { total_mb: 11980, used_mb: 2100, free_mb: 9880, modules: [] },
+      runtime: { lxc_available: true, kvm_available: false, support_mode: 'lxc_only' },
+      public_ipv4: [{ address: '203.0.113.10', interface: 'eth0' }],
+      ipv6_prefixes: [],
+    },
+  },
   'GET /api/v1/routing': {
     success: true,
     data: {
       nat4: { used: 62, remaining: '45474', total: '45536' },
       nat4_port_range: { start: 20000, end: 65535 },
+      nat4_next_port: 22005,
+      nat4_networks: {
+        lxc: { subnet: '10.0.3.0/24', gateway: '10.0.3.1', netmask: '255.255.255.0', dhcp_start: '10.0.3.2', dhcp_end: '10.0.3.254', dhcp_max: 253, prefix_bits: 24 },
+        kvm: { subnet: '192.168.122.0/24', gateway: '192.168.122.1', netmask: '255.255.255.0', dhcp_start: '192.168.122.2', dhcp_end: '192.168.122.254', dhcp_max: 253, prefix_bits: 24 },
+      },
       ipv4: { used: 1, remaining: '3', total: '4' },
       ipv6: { used: 31, remaining: 'large', total: 'large' },
       public_ipv4_addresses: [{ address: '203.0.113.10', interface: 'eth0', prefix_len: 32, gateway: '203.0.113.1' }],
@@ -930,6 +1068,11 @@ const responseSamples: Record<string, unknown> = {
     data: {
       nat4: { used: 62, remaining: '45474', total: '45536' },
       nat4_port_range: { start: 20000, end: 65535 },
+      nat4_next_port: 22005,
+      nat4_networks: {
+        lxc: { subnet: '10.0.3.0/24', gateway: '10.0.3.1' },
+        kvm: { subnet: '192.168.122.0/24', gateway: '192.168.122.1' },
+      },
       ipv4: { used: 1, remaining: '3', total: '4' },
       public_ipv4_addresses: [{ address: '203.0.113.10', interface: 'eth0', prefix_len: 32, gateway: '203.0.113.1' }],
       ipv6_prefixes: [{ interface: 'eth0', address: '2001:db8:100::2', prefix: '2001:db8:100::/64', prefix_len: 64, gateway: '2001:db8:100::1' }],
@@ -1016,6 +1159,12 @@ const responseSamples: Record<string, unknown> = {
       load15: 0.01,
     },
   },
+  'GET /api/v1/containers/{id}/history': {
+    success: true,
+    data: [
+      { ts: 1784642400000, cpu: 1.2, memory: 5.6, network: 4096, network_rx: 3072, network_tx: 1024, disk_io: 8192, disk_read: 2048, disk_write: 6144 },
+    ],
+  },
   'GET /api/v1/containers/{id}/traffic': {
     success: true,
     data: {
@@ -1036,6 +1185,16 @@ const responseSamples: Record<string, unknown> = {
   'PUT /api/v1/containers/{id}/expiry': { success: true, message: 'Expiry updated' },
   'POST /api/v1/containers/{id}/reset-password': { success: true, message: 'SSH password reset successfully', data: { password: '***' } },
   'POST /api/v1/containers/{id}/ipv6': { success: true, message: 'IPv6 assigned', data: { id: 5, name: 'example-vm', ipv6: '2001:db8:100::1005' } },
+  'PUT /api/v1/containers/{id}/public-ipv4': {
+    success: true,
+    message: 'Public IPv4 assignments updated',
+    data: { id: 5, name: 'example-vm', public_ipv4s: ['203.0.113.10'] },
+  },
+  'PUT /api/v1/containers/{id}/ipv6-addresses': {
+    success: true,
+    message: 'IPv6 assignments updated',
+    data: { id: 5, name: 'example-vm', ipv6_addresses: ['2001:db8:100::1005'] },
+  },
   'GET /api/v1/containers/{id}/random-port': { success: true, data: { port: 61320 } },
   'POST /api/v1/containers/{id}/port-mappings': {
     success: true,
@@ -1100,10 +1259,65 @@ const responseSamples: Record<string, unknown> = {
       { id: 'ubuntu-noble', name: 'Ubuntu 24.04', type: 'lxc', downloaded: true, enabled: true, downloading: false, progress: 0, size_bytes: 135005452 },
     ],
   },
+  'GET /api/v1/images/enabled?type=lxc&container={id}': {
+    success: true,
+    data: [
+      { id: 'debian-bookworm', name: 'Debian 12', distro: 'debian', release: 'bookworm', arch: 'amd64', type: 'lxc', downloaded: true, enabled: true },
+    ],
+  },
+  'POST /api/v1/images/custom': {
+    success: true,
+    message: 'Custom image added',
+    data: { id: 'custom-kvm-a1b2c3d4e5', name: 'Custom Ubuntu Cloud' },
+  },
+  'DELETE /api/v1/images/custom': { success: true, message: 'Custom image removed' },
   'POST /api/v1/images/download': { success: true, message: 'Already downloaded' },
   'POST /api/v1/images/cancel': { success: true, message: 'Cancel requested' },
   'DELETE /api/v1/images/delete': { success: true, message: 'Deleted' },
   'PUT /api/v1/images/toggle': { success: true, message: 'OK' },
+  'GET /api/v1/storage': {
+    success: true,
+    data: {
+      pools: [
+        {
+          id: 'disk-root',
+          name: 'system (/)',
+          path: '/var/lib/clicd',
+          mount_point: '/',
+          content_types: ['lxc', 'kvm', 'images', 'snapshots', 'backups'],
+          default_contents: ['lxc', 'kvm', 'images', 'snapshots', 'backups'],
+          enabled: true,
+          available: true,
+          free_bytes: 54653493248,
+        },
+      ],
+      disks: [
+        { name: 'sda2', path: '/dev/sda2', fstype: 'ext4', mount_point: '/', size_bytes: 67331063808, used_bytes: 12677570560, free_bytes: 54653493248 },
+      ],
+      content_types: ['lxc', 'kvm', 'images', 'snapshots', 'backups'],
+    },
+  },
+  'PUT /api/v1/storage': {
+    success: true,
+    data: {
+      pools: [{ id: 'disk-root', path: '/var/lib/clicd', mount_point: '/', content_types: ['lxc', 'kvm', 'images', 'snapshots', 'backups'], enabled: true, available: true }],
+      disks: [],
+      content_types: ['lxc', 'kvm', 'images', 'snapshots', 'backups'],
+    },
+  },
+  'GET /api/v1/task-queue/settings': { success: true, data: { concurrency: 4, active: 1, pending: 2 } },
+  'PUT /api/v1/task-queue/settings': { success: true, message: '任务队列设置已保存', data: { concurrency: 4, active: 1, pending: 2 } },
+  'GET /api/v1/ssl': {
+    success: true,
+    data: { enabled: true, mode: 'letsencrypt', target: 'panel.example.com', email: 'admin@example.com', detected_host: 'panel.example.com', certificate: { subject: 'panel.example.com', issuer: "Let's Encrypt", dns_names: ['panel.example.com'], ip_names: [], valid: true } },
+  },
+  'PUT /api/v1/ssl': { success: true, message: 'SSL settings saved', data: { enabled: true, mode: 'letsencrypt', target: 'panel.example.com', needs_restart: true } },
+  'GET /api/v1/webssh-origins': { success: true, data: { origins: ['https://panel.example.com'], current_origin: 'https://panel.example.com' } },
+  'PUT /api/v1/webssh-origins': { success: true, message: 'Origin allowlist saved', data: { origins: ['https://panel.example.com'], current_origin: 'https://panel.example.com' } },
+  'GET /api/v1/access-policy': { success: true, data: { enabled: true, allowed_sources: ['203.0.113.10', '192.168.1.0/24'], trusted_proxies: ['127.0.0.1'], current_source: '203.0.113.10', direct_source: '127.0.0.1', using_forwarded: true } },
+  'PUT /api/v1/access-policy': { success: true, message: 'Panel access policy saved', data: { enabled: true, allowed_sources: ['203.0.113.10', '192.168.1.0/24'], trusted_proxies: ['127.0.0.1'], current_source: '203.0.113.10', direct_source: '127.0.0.1', using_forwarded: true } },
+  'GET /api/v1/language': { success: true, data: { language: 'zh' } },
+  'PUT /api/v1/language': { success: true, data: { language: 'zh' } },
   'GET /api/v1/security/alerts': { success: true, data: [] },
   'POST /api/v1/security/check': { success: true, message: 'Security check completed' },
   'GET /api/v1/security/logs?container={name}': { success: true, data: [] },
@@ -1181,13 +1395,18 @@ function endpointNoteFor(key: string) {
   const notes: string[] = []
   if (key === 'POST /api/v1/containers') {
     notes.push('Linux container creation supports ssh_auth_mode=auto_password|password|key. Public IPv4, IPv6, and NAT can be configured with assign_nat, assign_ipv4, and assign_ipv6.')
+    notes.push('Set management_port to choose the public/source port for SSH (target 22) or Windows RDP (target 3389). Omit it or pass 0 for automatic allocation.')
+    notes.push('For other custom NAT rules, use nat_port_mappings with host_port (public/source port), container_port (target port), and protocol=tcp|udp. extra_ports remains accepted for compatibility and maps each port to the same port inside the container.')
     notes.push('Supports independent upload/download bandwidth limits and read/write I/O limits. network_bw_mbps and io_speed_mbps are deprecated symmetric compatibility aliases. New integrations should use network_down_mbps, network_up_mbps, io_read_mbps, and io_write_mbps.')
+    notes.push('storage_pool_id selects an enabled disk for the runtime. For an LXC with an independent LAN address, set lan_ipv4_mode=dhcp or static and set assign_nat=false; static mode also requires lan_ipv4_address, lan_ipv4_prefix_len, and lan_ipv4_gateway.')
+    notes.push('allowed_image_ids and image_limit_configured define which downloaded images the container owner may use for reinstall. Include the initial template ID when it should remain reinstallable.')
   }
   if (key === 'POST /api/v1/containers/{id}/reinstall') {
     notes.push('Reinstall supports ssh_auth_mode=keep|auto_password|password|key. keep is only for reinstall requests; if SSH fields are omitted, the existing behavior is kept.')
   }
   if (key === 'POST /api/v1/batch-create') {
-    notes.push('Each containers[] item in batch creation supports the same network and SSH authentication fields as POST /api/v1/containers.')
+    notes.push('Each containers[] item in batch creation supports the same storage, network, image allowlist, and SSH authentication fields as POST /api/v1/containers.')
+    notes.push('Custom management_port and NAT host_port values must be unique across the batch. The panel places each later source-port group after the previous container\'s highest public port while keeping every target container_port unchanged; direct API clients should submit the expanded values explicitly.')
   }
   if (key === 'PUT /api/v1/containers/{id}/resource-limit') {
     notes.push('Supports independent download/upload bandwidth limits and read/write I/O limits. Omitted fields keep their current values, and explicitly passing 0 makes that direction unlimited. network_bw_mbps and io_speed_mbps are deprecated symmetric compatibility aliases.')
@@ -1204,6 +1423,33 @@ function endpointNoteFor(key: string) {
   if (key === 'POST /api/v1/routing/ipv4-scan') {
     notes.push('Scanning public IPv4 prefixes requires routing:write. When verify=true, the API also attempts to check address availability.')
   }
+  if (key === 'GET /api/v1/host-history' || key === 'GET /api/v1/containers/{id}/history') {
+    notes.push('Metrics are collected in the background every 30 seconds, even when the statistics page is closed.')
+  }
+  if (key === 'PUT /api/v1/containers/{id}/public-ipv4' || key === 'PUT /api/v1/containers/{id}/ipv6-addresses') {
+    notes.push('mode accepts random, custom, or clear. random uses count, custom uses addresses, and clear removes all assignments of that address family.')
+  }
+  if (key === 'GET /api/v1/images/enabled?type=lxc&container={id}') {
+    notes.push('type accepts lxc or kvm. Supplying container applies that container image allowlist; omit container when listing images for a new container.')
+  }
+  if (key === 'POST /api/v1/containers/{id}/snapshots') {
+    notes.push('storage_pool_id is optional. The selected pool must be enabled for snapshots; otherwise the server chooses an available snapshot pool by free space and default priority.')
+  }
+  if (key === 'PUT /api/v1/storage') {
+    notes.push('Start from GET /api/v1/storage and submit mounted disks returned by the server. Paths and mount points are server-managed and custom paths are rejected. content_types enables a disk for each workload; only one pool may be the default for each type.')
+  }
+  if (key.includes('/api/v1/storage') || key.includes('/task-queue/settings') || key.includes('/api/v1/ssl') || key.includes('/webssh-origins') || key.includes('/access-policy')) {
+    notes.push('This endpoint requires an API key with admin:access.')
+  }
+  if (key === 'PUT /api/v1/access-policy') {
+    notes.push('allowed_sources and trusted_proxies accept IPv4, IPv6, or CIDR values. Forwarded client headers are ignored unless the direct peer matches trusted_proxies. The server rejects an enabled policy that excludes the current source.')
+  }
+  if (key === 'PUT /api/v1/task-queue/settings') {
+    notes.push('concurrency must be between 1 and 16. Tasks targeting the same container are still serialized.')
+  }
+  if (key === 'PUT /api/v1/ssl') {
+    notes.push('mode accepts disabled, letsencrypt, self_signed, or uploaded. uploaded mode uses cert_pem and key_pem. apply_now requests a service restart after saving.')
+  }
   if (key.includes('/vnc-ticket')) notes.push('WebVNC only applies to KVM VMs; LXC containers return "VNC console is only available for KVM VMs".')
   if (key.includes('/containers/{id}/delete') || key.includes('/batch-action')) notes.push('This API enters the task queue. Call GET /api/v1/tasks afterward to check execution status.')
   if (key.includes('/reset-password') || key.includes('/api-keys') || key.includes('/sub-user')) notes.push('Keys, passwords, and tickets in examples are masked. Full secrets from create APIs appear only once in the creation response.')

frontend/src/pages/ContainerDetail.tsx

@@ -1,5 +1,5 @@
 import { useState, useEffect, useCallback, useRef, type ReactNode } from 'react'
-import { useParams, useNavigate } from 'react-router-dom'
+import { useParams, useNavigate } from 'react-router'
 import {
   ArrowLeft,
   AlertTriangle,
@@ -32,6 +32,7 @@ import {
   assignIPv6,
   APIResponse,
   Container,
+  ContainerMetricPoint as ContainerMetricSample,
   ContainerUsage,
   createSubUser,
   createContainerSnapshot,
@@ -39,16 +40,21 @@ import {
   deleteContainerSnapshot,
   deletePortMapping,
   getContainer,
+  getContainerHistory,
   getContainerSnapshots,
   getContainerUsage,
   getHostInfo,
+  getStorageInfo,
   getTrafficInfo,
   HostInfo,
   TrafficInfo,
   getEnabledImages,
   getFirewall,
   PortMapping,
+  PublicIPv4Info,
   FirewallRule,
+  updatePublicIPv4Assignments,
+  updateIPv6Assignments,
   reinstallContainer,
   resetSSHPassword,
   restartContainer,
@@ -56,6 +62,7 @@ import {
   stopContainer,
   Snapshot,
   SnapshotSchedule,
+  StorageInfo,
   Template,
   updateContainerExpiry,
   updateFirewall,
@@ -70,6 +77,7 @@ import {
 } from '../services/api'
 import { useDialog } from '../components/Dialog'
 import { useAuth } from '../contexts/AuthContext'
+import { useLanguage } from '../contexts/LanguageContext'
 import WebSSHViewer from '../components/WebSSHViewer'
 import WebVNCViewer from '../components/WebVNCViewer'
 import { RingStat } from '../components/RingStats'
@@ -105,6 +113,8 @@ type MappingDraft = {
   protocol: string
 }
 
+type IPAssignMode = 'clear' | 'random' | 'custom'
+
 const emptyDraft: MappingDraft = {
   index: null,
   description: '',
@@ -120,6 +130,7 @@ export default function ContainerDetail() {
   const navigate = useNavigate()
   const dialog = useDialog()
   const { isSubUser } = useAuth()
+  const { t } = useLanguage()
   const [container, setContainer] = useState<Container | null>(null)
   const [hostInfo, setHostInfo] = useState<HostInfo | null>(null)
   const [usage, setUsage] = useState<ContainerUsage | null>(null)
@@ -133,6 +144,14 @@ export default function ContainerDetail() {
   const vncFullscreenRef = useRef<HTMLDivElement>(null)
   const [vncFullscreen, setVncFullscreen] = useState(false)
   const [showNat, setShowNat] = useState(false)
+  const [showIPAssign, setShowIPAssign] = useState(false)
+  const [savingIPAssign, setSavingIPAssign] = useState(false)
+  const [ipv4AssignMode, setIPv4AssignMode] = useState<IPAssignMode>('clear')
+  const [ipv4AssignCount, setIPv4AssignCount] = useState(1)
+  const [ipv4Selected, setIPv4Selected] = useState<string[]>([])
+  const [ipv6AssignMode, setIPv6AssignMode] = useState<IPAssignMode>('clear')
+  const [ipv6AssignCount, setIPv6AssignCount] = useState(1)
+  const [ipv6DraftText, setIPv6DraftText] = useState('')
   const [showMappingEditor, setShowMappingEditor] = useState(false)
   const [showExpiryEdit, setShowExpiryEdit] = useState(false)
   const [editExpiry, setEditExpiry] = useState('')
@@ -167,6 +186,9 @@ export default function ContainerDetail() {
   const [editingSnapshotQuota, setEditingSnapshotQuota] = useState(false)
   const [snapshotSchedule, setSnapshotSchedule] = useState<SnapshotSchedule | null>(null)
   const [snapshotBusy, setSnapshotBusy] = useState('')
+  const [storageInfo, setStorageInfo] = useState<StorageInfo | null>(null)
+  const [storageLoading, setStorageLoading] = useState(!isSubUser)
+  const [snapshotStoragePoolID, setSnapshotStoragePoolID] = useState('')
   const [showSnapshotSchedule, setShowSnapshotSchedule] = useState(false)
   const [snapshotScheduleDraft, setSnapshotScheduleDraft] = useState({ intervalHours: 24, time: '03:00' })
   const [showFirewall, setShowFirewall] = useState(false)
@@ -209,39 +231,36 @@ export default function ContainerDetail() {
     }
   }, [containerIdentifier, container?.snapshot_limit])
 
-  const appendUsagePoint = useCallback((nextUsage: ContainerUsage, currentContainer: Container | null) => {
-    if (!containerIdentifier || !currentContainer) return
-
-    const memoryTotalBytes = nextUsage.memory_total_bytes && nextUsage.memory_total_bytes > 0
-      ? nextUsage.memory_total_bytes
-      : currentContainer.ram_mb * 1024 * 1024
-    const memoryPct = memoryTotalBytes > 0
-      ? (nextUsage.memory_usage_bytes / memoryTotalBytes) * 100
-      : 0
-    const networkRx = nextUsage.network_rx_bps || 0
-    const networkTx = nextUsage.network_tx_bps || 0
-    const diskRead = nextUsage.disk_read_bps || 0
-    const diskWrite = nextUsage.disk_write_bps || 0
-
-    const point: MetricPoint = {
-      ts: Date.now(),
-      cpu: clamp((nextUsage.cpu_usage_pct || 0) / (currentContainer.vcpu || 1)),
-      memory: clamp(memoryPct),
-      network: networkRx + networkTx,
-      networkRx,
-      networkTx,
-      diskIO: diskRead + diskWrite,
-      diskRead,
-      diskWrite,
+  const fetchStorage = useCallback(async () => {
+    if (isSubUser) {
+      setStorageLoading(false)
+      return
     }
+    setStorageLoading(true)
+    try {
+      const res = await getStorageInfo()
+      setStorageInfo(res.data.data || null)
+    } catch (err) {
+      console.error('Failed to fetch storage:', err)
+      setStorageInfo(null)
+    } finally {
+      setStorageLoading(false)
+    }
+  }, [isSubUser])
 
-    setHistory((prev) => {
-      const cutoff = Date.now() - statsRanges['1w']
-      const next = [...prev.filter((item) => item.ts >= cutoff), point]
-      localStorage.setItem(historyKey(currentContainer.uuid || containerIdentifier), JSON.stringify(next))
-      return next
-    })
-  }, [containerIdentifier])
+  const fetchMetricHistory = useCallback(async () => {
+    if (!containerIdentifier) return
+    try {
+      const res = await getContainerHistory(containerIdentifier)
+      const points = (res.data.data || []).map(normalizeContainerMetricSample)
+      if (points.length > 0) {
+        setHistory(points)
+        localStorage.setItem(historyKey(container?.uuid || containerIdentifier), JSON.stringify(points))
+      }
+    } catch (err) {
+      console.error('Failed to fetch metric history:', err)
+    }
+  }, [containerIdentifier, container?.uuid])
 
   const fetchUsage = useCallback(async () => {
     if (!containerIdentifier) return
@@ -249,12 +268,11 @@ export default function ContainerDetail() {
       const res = await getContainerUsage(containerIdentifier)
       if (res.data.data) {
         setUsage(res.data.data)
-        appendUsagePoint(res.data.data, container)
       }
     } catch (err) {
       console.error('Failed to fetch usage:', err)
     }
-  }, [containerIdentifier, container, appendUsagePoint])
+  }, [containerIdentifier])
 
   useEffect(() => {
     if (!containerIdentifier) return
@@ -297,8 +315,17 @@ export default function ContainerDetail() {
   }, [fetchUsage])
 
   useEffect(() => {
-    if (showSnapshots) fetchSnapshots()
-  }, [showSnapshots, fetchSnapshots])
+    fetchMetricHistory()
+    const timer = window.setInterval(fetchMetricHistory, 30000)
+    return () => window.clearInterval(timer)
+  }, [fetchMetricHistory])
+
+  useEffect(() => {
+    if (showSnapshots) {
+      fetchSnapshots()
+      fetchStorage()
+    }
+  }, [showSnapshots, fetchSnapshots, fetchStorage])
 
   // Poll task status for this container
   useEffect(() => {
@@ -523,10 +550,12 @@ export default function ContainerDetail() {
 
   const openReinstall = async () => {
     try {
-      const res = await getEnabledImages(container?.virtualization || 'lxc')
+      const res = await getEnabledImages(container?.virtualization || 'lxc', containerIdentifier)
       if (res.data.data) {
-        setTemplates(res.data.data)
-        setSelectedTemplate(res.data.data[0]?.id || '')
+        const data = res.data.data
+        setTemplates(data)
+        const currentTemplate = container?.template || ''
+        setSelectedTemplate(data.some((template) => template.id === currentTemplate) ? currentTemplate : (data[0]?.id || ''))
       }
       setReinstallAuthMode('keep')
       setReinstallPasswordDraft('')
@@ -641,6 +670,42 @@ export default function ContainerDetail() {
     }
   }
 
+  const openIPAssign = () => {
+    const currentIPv4 = (container?.public_ipv4s || []).map((item) => item.address).filter(Boolean)
+    const currentIPv6 = (container?.ipv6_addresses || []).map((item) => item.address).filter(Boolean)
+    setIPv4Selected(currentIPv4)
+    setIPv4AssignMode(currentIPv4.length > 0 ? 'custom' : 'clear')
+    setIPv4AssignCount(Math.max(1, currentIPv4.length || 1))
+    setIPv6DraftText(currentIPv6.join('\n'))
+    setIPv6AssignMode(currentIPv6.length > 0 ? 'custom' : 'clear')
+    setIPv6AssignCount(Math.max(1, currentIPv6.length || 1))
+    setShowIPAssign(true)
+  }
+
+  const submitIPAssign = async () => {
+    if (!containerIdentifier) return
+    setSavingIPAssign(true)
+    try {
+      await updatePublicIPv4Assignments(containerIdentifier, {
+        mode: ipv4AssignMode,
+        count: Math.max(1, Math.round(ipv4AssignCount || 1)),
+        addresses: ipv4AssignMode === 'custom' ? ipv4Selected : [],
+      })
+      await updateIPv6Assignments(containerIdentifier, {
+        mode: ipv6AssignMode,
+        count: Math.max(1, Math.round(ipv6AssignCount || 1)),
+        addresses: ipv6AssignMode === 'custom' ? splitAddressLines(ipv6DraftText) : [],
+      })
+      await fetchContainer()
+      setShowIPAssign(false)
+    } catch (err: unknown) {
+      const error = err as { response?: { data?: { message?: string } } }
+      dialog.alert('公网 IP 分配失败', error.response?.data?.message || '请检查地址是否可用或已被占用')
+    } finally {
+      setSavingIPAssign(false)
+    }
+  }
+
   const openAddMapping = () => {
     if (isSubUser && container?.policy_blocked) return
     setDraft(emptyDraft)
@@ -736,6 +801,10 @@ export default function ContainerDetail() {
   const handleCreateSnapshot = async () => {
     if (!containerIdentifier) return
     if (!(await ensureSubUserCanOperate())) return
+    if (!snapshotStorageReady) {
+      await dialog.alert('未配置快照存储', '请先在存储管理中为快照开启至少一块存储磁盘。')
+      return
+    }
     if (isSubUser && snapshots.length >= snapshotQuota) {
       await dialog.alert('快照配额已满', '已达到管理员设置的快照配额，请先删除旧快照。')
       return
@@ -749,7 +818,7 @@ export default function ContainerDetail() {
     }
     setSnapshotBusy('create')
     try {
-      await createContainerSnapshot(containerIdentifier)
+      await createContainerSnapshot(containerIdentifier, { storage_pool_id: snapshotStoragePoolID || undefined })
       await Promise.all([fetchSnapshots(), fetchContainer()])
     } catch (err: unknown) {
       const error = err as { response?: { data?: { message?: string } } }
@@ -761,6 +830,10 @@ export default function ContainerDetail() {
 
   const openSnapshotSchedule = () => {
     if (isSubUser && container?.policy_blocked) return
+    if (!snapshotStorageReady) {
+      dialog.alert('未配置快照存储', '请先在存储管理中为快照开启至少一块存储磁盘。')
+      return
+    }
     setSnapshotScheduleDraft({
       intervalHours: Math.max(snapshotSchedule?.interval_hours || 24, 24),
       time: snapshotSchedule?.time || '03:00',
@@ -875,6 +948,7 @@ export default function ContainerDetail() {
   const policyBlockedText = container.policy_blocked_reason || '虚拟机被策略临时封禁'
   const publicIPv4s = container.public_ipv4s || []
   const assignedIPv4List = publicIPv4s.map((item) => item.address).filter(Boolean)
+  const allocatableIPv4s = mergeIPv4Choices(hostInfo?.network.public_ipv4_addresses || [], publicIPv4s)
   const publicHost = assignedIPv4List[0] || hostInfo?.network.public_ipv4 || PUBLIC_HOST
   const ipv6List = (container.ipv6_addresses || [])
     .map((item) => item.address)
@@ -885,6 +959,10 @@ export default function ContainerDetail() {
   const hasIndependentIPv4 = assignedIPv4List.length > 0
   const hasIndependentIPv6 = ipv6List.length > 0
   const defaultConnPort = isWindows ? 3389 : 22
+  const snapshotStoragePools = (storageInfo?.pools || []).filter((pool) =>
+    pool.enabled !== false && pool.available !== false && (pool.content_types || []).includes('snapshots')
+  )
+  const snapshotStorageReady = isSubUser || snapshotStoragePools.length > 0
 
   let publicEndpoint = '-'
   let sshCommand = ''
@@ -1192,21 +1270,34 @@ export default function ContainerDetail() {
           <PlainRow label="vCPU" value={`${container.vcpu} 核`} />
           <PlainRow label="内存" value={`${container.ram_mb} MB`} />
           <PlainRow label="磁盘" value={`${container.disk_gb} GB`} />
-          <PlainRow label="网络速率" value={formatDirectionalLimit('下行', networkDownLimit, '上行', networkUpLimit, 'Mbps')} />
-          <PlainRow label="IO 速度" value={formatDirectionalLimit('读取', ioReadLimit, '写入', ioWriteLimit, 'MB/s')} />
+          <PlainRow label="网络速率" value={formatDirectionalLimit(t('下行'), networkDownLimit, t('上行'), networkUpLimit, 'Mbps')} />
+          <PlainRow label="IO 速度" value={formatDirectionalLimit(t('读取'), ioReadLimit, t('写入'), ioWriteLimit, 'MB/s')} />
         </Panel>
 
         <Panel title="实时状态">
           <PlainRow label="识别码" value={container.uuid || '-'} mono copyValue={container.uuid} onCopy={copyText} />
           <PlainRow label="状态" value={isRunning ? '运行中' : '已停止'} />
           <PlainRow label="内网 IP" value={container.ip || '-'} mono />
-          <PlainRow label="Public IPv4" value={assignedIPv4List.length ? assignedIPv4List.join(', ') : '-'} mono copyValue={assignedIPv4List[0]} onCopy={copyText} />
+          <PlainRow label="Public IPv4" value={assignedIPv4List.length ? assignedIPv4List.join(', ') : '-'} mono copyValue={assignedIPv4List[0]} onCopy={copyText}>
+            {!isSubUser && (
+              <button onClick={openIPAssign} className="ml-1 p-0.5 text-gray-400 hover:text-black rounded" title="修改公网 IP 分配">
+                <Pencil className="w-3 h-3" />
+              </button>
+            )}
+          </PlainRow>
           <PlainRow label="IPv6" value={ipv6List.length ? ipv6List.join(', ') : '-'} mono copyValue={ipv6List[0]} onCopy={copyText}>
-            {!isSubUser && ipv6List.length === 0 && (
+            {!isSubUser && (
+              <>
+                {ipv6List.length === 0 && (
                   <button onClick={handleAssignIPv6} disabled={actionLoading === 'ipv6'} className="ml-1 px-1.5 py-0.5 text-[10px] text-gray-600 border border-gray-200 rounded hover:bg-gray-50 disabled:opacity-50">
                     Assign
                   </button>
                 )}
+                <button onClick={openIPAssign} className="ml-1 p-0.5 text-gray-400 hover:text-black rounded" title="修改公网 IP 分配">
+                  <Pencil className="w-3 h-3" />
+                </button>
+              </>
+            )}
           </PlainRow>
           <PlainRow label="CPU 累计时间" value={formatCPU(usage?.cpu_usage_usec || 0)} />
           <PlainRow label="创建时间" value={container.created_at} />
@@ -1440,7 +1531,7 @@ export default function ContainerDetail() {
             <div className="flex items-center gap-2">
               <button
                 onClick={openSnapshotSchedule}
-                disabled={!!snapshotBusy}
+                disabled={!!snapshotBusy || storageLoading || !snapshotStorageReady}
                 className={`inline-flex items-center gap-1.5 rounded-md px-3 py-1.5 text-xs ${
                   snapshotSchedule?.enabled
                     ? 'border border-blue-200 bg-blue-50 text-blue-700 hover:bg-blue-100'
@@ -1452,7 +1543,7 @@ export default function ContainerDetail() {
               </button>
               <button
                 onClick={handleCreateSnapshot}
-                disabled={!!snapshotBusy || (isSubUser && snapshots.length >= snapshotQuota)}
+                disabled={!!snapshotBusy || storageLoading || !snapshotStorageReady || (isSubUser && snapshots.length >= snapshotQuota)}
                 className="inline-flex items-center gap-1.5 rounded-md bg-black px-3 py-1.5 text-xs text-white hover:bg-gray-800 disabled:opacity-50"
               >
                 <Camera className="w-3.5 h-3.5" />
@@ -1462,6 +1553,20 @@ export default function ContainerDetail() {
           }
         >
           <div className="space-y-4">
+            {storageLoading && !isSubUser && (
+              <div className="flex items-center gap-2 rounded-lg border border-gray-200 bg-gray-50 px-4 py-3 text-sm text-gray-600">
+                <RefreshCw className="h-4 w-4 animate-spin" />
+                正在检查存储配置...
+              </div>
+            )}
+            {!storageLoading && !snapshotStorageReady && (
+              <div className="flex items-center justify-between gap-4 rounded-lg border border-amber-200 bg-amber-50 px-4 py-3 text-sm text-amber-800">
+                <span>尚未开启快照存储，无法新建或启用定时快照。</span>
+                <button onClick={() => { setShowSnapshots(false); navigate('/storage') }} className="shrink-0 rounded-md border border-amber-300 bg-white px-3 py-1.5 text-xs font-medium hover:bg-amber-100">
+                  去开启
+                </button>
+              </div>
+            )}
             <div className="flex flex-wrap items-center justify-between gap-3 rounded-lg border border-gray-200 bg-gray-50 px-4 py-3 text-xs text-gray-600">
               <div>
                 快照数量：
@@ -1497,6 +1602,26 @@ export default function ContainerDetail() {
               )}
             </div>
 
+            {!isSubUser && snapshotStoragePools.length > 0 && (
+              <div className="flex flex-wrap items-end gap-3 rounded-lg border border-gray-200 bg-white px-4 py-3">
+                <Field label="新建快照存储磁盘">
+                  <select
+                    value={snapshotStoragePoolID}
+                    onChange={(event) => setSnapshotStoragePoolID(event.target.value)}
+                    className="w-72 px-3 py-2 border border-gray-300 rounded-md text-sm text-black bg-white focus:outline-none focus:ring-2 focus:ring-black focus:border-black"
+                  >
+                    <option value="">自动选择（默认盘优先，空间不足自动切换）</option>
+                    {snapshotStoragePools.map((pool) => (
+                      <option key={pool.id} value={pool.id}>
+                        {pool.name} · {pool.mount_point || pool.path}
+                      </option>
+                    ))}
+                  </select>
+                </Field>
+                <div className="pb-2 text-xs text-gray-400">仅影响手动新建快照；定时快照使用默认磁盘。</div>
+              </div>
+            )}
+
             {editingSnapshotQuota && !isSubUser && (
               <div className="flex flex-wrap items-end gap-3 rounded-lg border border-gray-200 bg-white px-4 py-3">
                 <Field label="子用户每台容器快照上限">
@@ -1828,6 +1953,88 @@ export default function ContainerDetail() {
         </Modal>
       )}
 
+      {showIPAssign && (
+        <Modal title="公网 IP 分配" onClose={() => setShowIPAssign(false)} wide>
+          <div className="grid gap-5 md:grid-cols-2">
+            <div className="space-y-3">
+              <div>
+                <h3 className="text-sm font-medium text-gray-900">独立 IPv4</h3>
+                <p className="mt-1 text-xs text-gray-500">修改后会重放端口映射、SNAT 和防火墙规则。</p>
+              </div>
+              <Segmented value={ipv4AssignMode} onChange={setIPv4AssignMode} />
+              {ipv4AssignMode === 'random' && (
+                <Field label="随机数量">
+                  <input type="number" min={1} max={64} value={ipv4AssignCount} onChange={(e) => setIPv4AssignCount(parseInt(e.target.value || '1', 10))} className={inputClass} />
+                </Field>
+              )}
+              {ipv4AssignMode === 'custom' && (
+                <div className="space-y-2">
+                  {allocatableIPv4s.length === 0 ? (
+                    <div className="rounded-md border border-gray-200 bg-gray-50 px-3 py-2 text-xs text-gray-500">没有可选择的公网 IPv4，请先到路由管理配置 IPv4 池。</div>
+                  ) : (
+                    <div className="grid gap-2">
+                      {allocatableIPv4s.map((ip) => (
+                        <label key={`${ip.interface}-${ip.address}`} className="flex min-w-0 items-center gap-2 rounded-md border border-gray-200 px-3 py-2 text-xs text-gray-700">
+                          <input
+                            type="checkbox"
+                            checked={ipv4Selected.includes(ip.address)}
+                            onChange={(event) => {
+                              const next = event.target.checked
+                                ? Array.from(new Set([...ipv4Selected, ip.address]))
+                                : ipv4Selected.filter((value) => value !== ip.address)
+                              setIPv4Selected(next)
+                              setIPv4AssignCount(Math.max(1, next.length || 1))
+                            }}
+                          />
+                          <span className="truncate font-mono">{ip.address}</span>
+                          <span className="shrink-0 text-gray-400">{ip.interface}</span>
+                          {ip.gateway && <span className="shrink-0 text-gray-400">gw {ip.gateway}</span>}
+                        </label>
+                      ))}
+                    </div>
+                  )}
+                </div>
+              )}
+            </div>
+
+            <div className="space-y-3">
+              <div>
+                <h3 className="text-sm font-medium text-gray-900">独立 IPv6</h3>
+                <p className="mt-1 text-xs text-gray-500">自定义地址必须落在路由管理配置的 IPv6 前缀内。</p>
+              </div>
+              <Segmented value={ipv6AssignMode} onChange={setIPv6AssignMode} />
+              {ipv6AssignMode === 'random' && (
+                <Field label="随机数量">
+                  <input type="number" min={1} max={64} value={ipv6AssignCount} onChange={(e) => setIPv6AssignCount(parseInt(e.target.value || '1', 10))} className={inputClass} />
+                </Field>
+              )}
+              {ipv6AssignMode === 'custom' && (
+                <Field label="IPv6 地址">
+                  <textarea
+                    value={ipv6DraftText}
+                    onChange={(e) => {
+                      setIPv6DraftText(e.target.value)
+                      setIPv6AssignCount(Math.max(1, splitAddressLines(e.target.value).length || 1))
+                    }}
+                    className={`${inputClass} min-h-32 font-mono text-xs`}
+                    placeholder="2001:db8:100::100&#10;2001:db8:100::101"
+                  />
+                </Field>
+              )}
+            </div>
+          </div>
+          <div className="mt-5 flex justify-end gap-2 border-t border-gray-200 pt-4">
+            <button onClick={() => setShowIPAssign(false)} disabled={savingIPAssign} className="rounded-md border border-gray-300 px-3 py-2 text-sm text-gray-700 hover:bg-gray-50 disabled:opacity-50">
+              取消
+            </button>
+            <button onClick={submitIPAssign} disabled={savingIPAssign} className="inline-flex items-center gap-1.5 rounded-md bg-black px-3 py-2 text-sm text-white hover:bg-gray-800 disabled:opacity-50">
+              <Save className="h-4 w-4" />
+              {savingIPAssign ? '保存中...' : '保存'}
+            </button>
+          </div>
+        </Modal>
+      )}
+
       {showNat && !hasIndependentIPv4 && (
         <Modal title="IPv4 NAT 端口管理" onClose={() => { setShowNat(false); setDraft(emptyDraft); setShowMappingEditor(false) }} wide extra={
           !isSubUser && canAddMapping && (
@@ -2453,6 +2660,28 @@ function Field({ label, children, hint }: { label: string; children: ReactNode;
   )
 }
 
+function Segmented({ value, onChange }: { value: IPAssignMode; onChange: (value: IPAssignMode) => void }) {
+  const items: Array<{ value: IPAssignMode; label: string }> = [
+    { value: 'clear', label: '不分配' },
+    { value: 'random', label: '随机分配' },
+    { value: 'custom', label: '自定义' },
+  ]
+  return (
+    <div className="grid grid-cols-3 gap-1 rounded-md bg-gray-100 p-1">
+      {items.map((item) => (
+        <button
+          key={item.value}
+          type="button"
+          onClick={() => onChange(item.value)}
+          className={`rounded px-2 py-1.5 text-xs font-medium ${value === item.value ? 'bg-white text-black shadow-sm' : 'text-gray-600 hover:text-black'}`}
+        >
+          {item.label}
+        </button>
+      ))}
+    </div>
+  )
+}
+
 function Modal({ title, children, onClose, wide = false, extra, flush = false }: { title: string; children: ReactNode; onClose: () => void; wide?: boolean; extra?: ReactNode; flush?: boolean }) {
   return (
     <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4">
@@ -2490,6 +2719,45 @@ function readHistory(containerName: string): MetricPoint[] {
   }
 }
 
+function normalizeContainerMetricSample(point: ContainerMetricSample): MetricPoint {
+  return {
+    ts: point.ts,
+    cpu: clamp(point.cpu),
+    memory: clamp(point.memory),
+    network: point.network || 0,
+    networkRx: point.network_rx || 0,
+    networkTx: point.network_tx || 0,
+    diskIO: point.disk_io || 0,
+    diskRead: point.disk_read || 0,
+    diskWrite: point.disk_write || 0,
+  }
+}
+
+function splitAddressLines(value: string) {
+  return value
+    .split(/[\n,，\s]+/)
+    .map((item) => item.trim())
+    .filter(Boolean)
+}
+
+function mergeIPv4Choices(candidates: PublicIPv4Info[], assigned: { address: string; interface?: string; prefix_len?: number; gateway?: string }[]) {
+  const byAddress = new Map<string, PublicIPv4Info>()
+  for (const item of candidates) {
+    if (item.address) byAddress.set(item.address, item)
+  }
+  for (const item of assigned) {
+    if (!item.address || byAddress.has(item.address)) continue
+    byAddress.set(item.address, {
+      address: item.address,
+      interface: item.interface || '',
+      prefix: item.prefix_len ? `${item.address}/${item.prefix_len}` : item.address,
+      prefix_len: item.prefix_len,
+      gateway: item.gateway,
+    })
+  }
+  return Array.from(byAddress.values()).sort((a, b) => a.address.localeCompare(b.address, undefined, { numeric: true }))
+}
+
 function historyKey(containerName: string) {
   return `clicd_container_metric_history:${containerName}`
 }

frontend/src/pages/Containers.tsx

@@ -1,5 +1,5 @@
 import { useCallback, useEffect, useMemo, useState, type ReactNode } from 'react'
-import { useNavigate } from 'react-router-dom'
+import { useNavigate } from 'react-router'
 import {
   ArrowDown,
   ArrowUp,
@@ -21,6 +21,7 @@ import {
 } from 'lucide-react'
 import CreateContainerModal from '../components/CreateContainerModal'
 import { useAuth } from '../contexts/AuthContext'
+import { useLanguage } from '../contexts/LanguageContext'
 import {
   Container,
   CreateContainerRequest,
@@ -391,14 +392,12 @@ export default function Containers() {
                 {pageContainers.map((container) => {
                   const isRunning = container.status === 'running'
                   const isInitializing = container.status === 'initializing'
-                  const task = (container.id > 0 ? taskStatusMap[container.id] : taskNameMap[container.name]) || container.createTask
+                  const task = (container.id > 0 ? taskStatusMap[container.id] : undefined) || taskNameMap[container.name] || container.createTask
                   const isPlaceholder = !!container.isPlaceholder
                   const isPolicyBlocked = !!container.policy_blocked
                   const usage = usageByName[container.name]
-                  const isKVM = (container.virtualization || 'lxc') === 'kvm'
-
                   const cpuPct = isRunning
-                    ? clamp((usage?.cpu_usage_pct || 0) / (isKVM ? (container.vcpu || 1) : 1))
+                    ? clamp((usage?.cpu_usage_pct || 0) / (container.vcpu || 1))
                     : 0
                   const ramTotalBytes = usage?.memory_total_bytes && usage.memory_total_bytes > 0
                     ? usage.memory_total_bytes
@@ -583,12 +582,13 @@ type DisplayContainer = Container & {
 }
 
 function StatusBadge({ running, initializing, task, placeholder, policyBlocked }: { running: boolean; initializing?: boolean; task?: Task; placeholder?: boolean; policyBlocked?: boolean }) {
+  const { t } = useLanguage()
   const baseClass = "inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-[11px] font-medium whitespace-nowrap"
   if (policyBlocked) {
     return (
       <span className={`${baseClass} bg-red-50 text-red-700`}>
         <span className="w-1.5 h-1.5 rounded-full bg-red-500"></span>
-        策略封禁
+        {t('策略封禁')}
       </span>
     )
   }
@@ -597,7 +597,7 @@ function StatusBadge({ running, initializing, task, placeholder, policyBlocked }
     return (
       <span className={`${baseClass} bg-red-50 text-red-700`}>
         <span className="w-1.5 h-1.5 rounded-full bg-red-500"></span>
-        初始化失败
+        {t('初始化失败')}
       </span>
     )
   }
@@ -606,16 +606,17 @@ function StatusBadge({ running, initializing, task, placeholder, policyBlocked }
     return (
       <span className={`${baseClass} bg-emerald-50 text-emerald-700`}>
         <span className="w-1.5 h-1.5 rounded-full bg-emerald-500"></span>
-        初始化完成
+        {t('初始化完成')}
       </span>
     )
   }
 
   if (task?.type === 'create' && task.status === 'running') {
+    const detail = t(task.stage_detail || '正在初始化')
     return (
-      <span className={`${baseClass} bg-amber-50 text-amber-700`}>
-        <span className="w-1.5 h-1.5 rounded-full bg-amber-500 animate-pulse"></span>
-        正在初始化
+      <span className={`${baseClass} max-w-[210px] bg-amber-50 text-amber-700`} title={`${t('正在初始化')}: ${detail}`}>
+        <span className="h-1.5 w-1.5 flex-shrink-0 rounded-full bg-amber-500 animate-pulse"></span>
+        <span className="truncate">{detail}</span>
       </span>
     )
   }
@@ -624,7 +625,7 @@ function StatusBadge({ running, initializing, task, placeholder, policyBlocked }
     return (
       <span className={`${baseClass} bg-gray-100 text-gray-500`}>
         <span className="w-1.5 h-1.5 rounded-full bg-gray-400"></span>
-        排队等待
+        {t('排队等待')}
       </span>
     )
   }
@@ -636,7 +637,7 @@ function StatusBadge({ running, initializing, task, placeholder, policyBlocked }
     return (
       <span className={`${baseClass} bg-amber-50 text-amber-700`}>
         <span className="w-1.5 h-1.5 rounded-full bg-amber-500 animate-pulse"></span>
-        {taskLabels[task.type] || '处理中'}
+        {t(taskLabels[task.type] || '处理中')}
       </span>
     )
   }
@@ -645,7 +646,7 @@ function StatusBadge({ running, initializing, task, placeholder, policyBlocked }
     return (
       <span className={`${baseClass} bg-amber-50 text-amber-700`}>
         <span className="w-1.5 h-1.5 rounded-full bg-amber-500 animate-pulse"></span>
-        正在初始化
+        {t('正在初始化')}
       </span>
     )
   }
@@ -653,7 +654,7 @@ function StatusBadge({ running, initializing, task, placeholder, policyBlocked }
   return (
     <span className={`${baseClass} ${running ? 'bg-green-50 text-green-700' : 'bg-red-50 text-red-600'}`}>
       <span className={`w-1.5 h-1.5 rounded-full flex-shrink-0 ${running ? 'bg-green-500' : 'bg-red-500'}`}></span>
-      {running ? '在线' : '离线'}
+      {t(running ? '在线' : '离线')}
     </span>
   )
 }
@@ -790,7 +791,7 @@ type ContainerFilters = {
 function filterContainers(containers: DisplayContainer[], filters: ContainerFilters): DisplayContainer[] {
   const keyword = filters.search.trim().toLowerCase()
   return containers.filter((container) => {
-    const task = (container.id > 0 ? filters.taskStatusMap[container.id] : filters.taskNameMap[container.name]) || container.createTask
+    const task = (container.id > 0 ? filters.taskStatusMap[container.id] : undefined) || filters.taskNameMap[container.name] || container.createTask
     if (filters.system !== 'all' && getSystemFilterValue(container.template) !== filters.system) {
       return false
     }
@@ -867,6 +868,7 @@ function getContainerStatusFilterValue(container: DisplayContainer, task?: Task)
 function taskLineLabel(task: Task, actionLabels: Record<string, string>) {
   if (task.status === 'failed') return task.type === 'create' ? '初始化失败' : '处理失败'
   if (task.type === 'create' && task.status === 'done') return '初始化完成'
+  if (task.type === 'create' && task.status === 'running') return task.stage_detail || '正在初始化'
   return actionLabels[task.type] || '处理中...'
 }
 
@@ -875,13 +877,14 @@ function TaskQueueModal({ tasks, onRefresh, onClose }: {
   onRefresh: () => void | Promise<void>
   onClose: () => void
 }) {
+  const { t } = useLanguage()
   return (
     <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4">
-      <div className="flex max-h-[86vh] w-full max-w-5xl flex-col overflow-hidden rounded-lg border border-gray-200 bg-white shadow-xl">
+      <div className="flex max-h-[86vh] w-full max-w-6xl flex-col overflow-hidden rounded-lg border border-gray-200 bg-white shadow-xl">
         <div className="flex items-center justify-between gap-4 border-b border-gray-200 px-5 py-4">
           <div>
-            <h2 className="text-base font-semibold text-black">任务队列</h2>
-            <p className="mt-0.5 text-xs text-gray-500">共 {tasks.length} 个任务</p>
+            <h2 className="text-base font-semibold text-black">{t('任务队列')}</h2>
+            <p className="mt-0.5 text-xs text-gray-500">{t(`共 ${tasks.length} 个任务`)}</p>
           </div>
           <div className="flex items-center gap-2">
             <button
@@ -889,26 +892,27 @@ function TaskQueueModal({ tasks, onRefresh, onClose }: {
               className="inline-flex items-center gap-2 rounded-md border border-gray-300 px-3 py-2 text-sm text-gray-700 hover:bg-gray-50"
             >
               <RefreshCw className="h-4 w-4" />
-              刷新
+              {t('刷新')}
             </button>
-            <button onClick={onClose} className="rounded p-2 text-gray-500 hover:bg-gray-100" title="关闭">
+            <button onClick={onClose} className="rounded p-2 text-gray-500 hover:bg-gray-100" title={t('关闭')}>
               <X className="h-4 w-4" />
             </button>
           </div>
         </div>
 
         {tasks.length === 0 ? (
-          <div className="p-8 text-center text-sm text-gray-500">暂无任务</div>
+          <div className="p-8 text-center text-sm text-gray-500">{t('暂无任务')}</div>
         ) : (
           <div className="overflow-auto">
             <table className="w-full text-sm">
               <thead>
                 <tr className="border-b border-gray-100 bg-gray-50 text-left text-xs font-medium text-gray-500">
-                  <th className="whitespace-nowrap px-4 py-2.5">状态</th>
-                  <th className="whitespace-nowrap px-4 py-2.5">操作</th>
-                  <th className="whitespace-nowrap px-4 py-2.5">容器</th>
-                  <th className="whitespace-nowrap px-4 py-2.5">创建时间</th>
-                  <th className="px-4 py-2.5">错误</th>
+                  <th className="whitespace-nowrap px-4 py-2.5">{t('状态')}</th>
+                  <th className="whitespace-nowrap px-4 py-2.5">{t('操作')}</th>
+                  <th className="whitespace-nowrap px-4 py-2.5">{t('容器')}</th>
+                  <th className="whitespace-nowrap px-4 py-2.5">{t('当前阶段')}</th>
+                  <th className="whitespace-nowrap px-4 py-2.5">{t('创建时间')}</th>
+                  <th className="px-4 py-2.5">{t('错误')}</th>
                   <th className="whitespace-nowrap px-4 py-2.5 w-10"></th>
                 </tr>
               </thead>
@@ -917,11 +921,14 @@ function TaskQueueModal({ tasks, onRefresh, onClose }: {
                   <tr key={task.id} className="hover:bg-gray-50">
                     <td className="whitespace-nowrap px-4 py-2.5">
                       <span className={`rounded px-1.5 py-0.5 text-xs font-medium ${taskStatusClass(task.status)}`}>
-                        {taskStatusLabel(task.status)}
+                        {t(taskStatusLabel(task.status))}
                       </span>
                     </td>
-                    <td className="whitespace-nowrap px-4 py-2.5 text-gray-800">{actionLabel(task.type)}</td>
+                    <td className="whitespace-nowrap px-4 py-2.5 text-gray-800">{t(actionLabel(task.type))}</td>
                     <td className="whitespace-nowrap px-4 py-2.5 font-mono text-xs text-gray-700">{task.container_name}</td>
+                    <td className="min-w-[210px] px-4 py-2.5 text-xs text-gray-700">
+                      {task.type === 'create' ? t(task.stage_detail || (task.status === 'pending' ? '排队等待' : '-')) : '-'}
+                    </td>
                     <td className="whitespace-nowrap px-4 py-2.5 font-mono text-xs text-gray-500">{task.created_at}</td>
                     <td className="min-w-[260px] px-4 py-2.5 text-gray-600">{task.error || '-'}</td>
                     <td className="whitespace-nowrap px-2 py-2.5">
@@ -934,7 +941,7 @@ function TaskQueueModal({ tasks, onRefresh, onClose }: {
                             } catch { /* ignore */ }
                           }}
                           className="p-1 rounded hover:bg-red-50 text-gray-400 hover:text-red-600 transition-colors"
-                          title="取消任务"
+                          title={t('取消任务')}
                         >
                           <X className="w-3.5 h-3.5" />
                         </button>
@@ -969,6 +976,7 @@ function getTemplateName(id: string) {
   const map: Record<string, string> = {
     'ubuntu-noble': 'Ubuntu 24.04',
     'ubuntu-jammy': 'Ubuntu 22.04',
+    'debian-trixie': 'Debian 13',
     'debian-bookworm': 'Debian 12',
     'debian-bullseye': 'Debian 11',
     'alpine-3.21': 'Alpine 3.21',
@@ -978,9 +986,12 @@ function getTemplateName(id: string) {
     'rockylinux-10': 'Rocky 10',
     'kvm-ubuntu-noble': 'Ubuntu 24.04',
     'kvm-ubuntu-jammy': 'Ubuntu 22.04',
+    'kvm-debian-trixie': 'Debian 13',
+    'kvm-debian-trixie-xfce': 'Debian 13 XFCE',
     'kvm-debian-bookworm': 'Debian 12',
     'kvm-debian-bullseye': 'Debian 11',
     'kvm-rockylinux-9': 'Rocky 9',
+    'kvm-windows-11': 'Windows 11',
     'kvm-windows-10': 'Windows 10',
   }
   return map[id] || id

frontend/src/pages/Dashboard.tsx

@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useState } from 'react'
+import { useCallback, useEffect, useState, type ReactNode } from 'react'
 import { Cpu, HardDrive, MemoryStick, Network, Server } from 'lucide-react'
 import RingStats from '../components/RingStats'
 import ResourceStatsPanel, {
@@ -7,7 +7,7 @@ import ResourceStatsPanel, {
   StatsRangeKey,
   statsRanges,
 } from '../components/ResourceStatsPanel'
-import { DashboardStats, getDashboard, getHostInfo, HostInfo } from '../services/api'
+import { DashboardStats, getDashboard, getHostHistory, getHostInfo, HostInfo, HostMetricPoint as HostMetricSample } from '../services/api'
 
 type HostMetricPoint = {
   ts: number
@@ -30,6 +30,19 @@ export default function Dashboard() {
   const [range, setRange] = useState<StatsRangeKey>('30m')
   const [loading, setLoading] = useState(true)
 
+  const fetchHistory = useCallback(async () => {
+    try {
+      const res = await getHostHistory()
+      const points = (res.data.data || []).map(normalizeHostMetricSample)
+      if (points.length > 0) {
+        setHistory(points)
+        localStorage.setItem(hostHistoryKey, JSON.stringify(points))
+      }
+    } catch (err) {
+      console.error(err)
+    }
+  }, [])
+
   const fetchData = useCallback(async () => {
     try {
       const [dashRes, hostRes] = await Promise.all([getDashboard(), getHostInfo()])
@@ -37,7 +50,6 @@ export default function Dashboard() {
       if (hostRes.data.data) {
         const nextHost = hostRes.data.data
         setHost(nextHost)
-        appendHostPoint(nextHost, setHistory)
       }
     } catch (err) {
       console.error(err)
@@ -47,10 +59,15 @@ export default function Dashboard() {
   }, [])
 
   useEffect(() => {
+    fetchHistory()
     fetchData()
     const interval = window.setInterval(fetchData, 5000)
-    return () => window.clearInterval(interval)
-  }, [fetchData])
+    const historyInterval = window.setInterval(fetchHistory, 30000)
+    return () => {
+      window.clearInterval(interval)
+      window.clearInterval(historyInterval)
+    }
+  }, [fetchData, fetchHistory])
 
   if (loading) {
     return (
@@ -154,7 +171,7 @@ function SummaryCard({
   value,
   muted = false,
 }: {
-  icon?: JSX.Element
+  icon?: ReactNode
   dot?: string
   title: string
   value: number
@@ -172,31 +189,6 @@ function SummaryCard({
   )
 }
 
-function appendHostPoint(host: HostInfo, setHistory: (updater: (prev: HostMetricPoint[]) => HostMetricPoint[]) => void) {
-  const networkRx = host.network.rx_bps || 0
-  const networkTx = host.network.tx_bps || 0
-  const diskRead = host.disk_io.read_bps || 0
-  const diskWrite = host.disk_io.write_bps || 0
-  const point: HostMetricPoint = {
-    ts: Date.now(),
-    cpu: clamp(host.cpu.usage_pct),
-    memory: host.ram.total_mb > 0 ? clamp((host.ram.used_mb / host.ram.total_mb) * 100) : 0,
-    network: networkRx + networkTx,
-    networkRx,
-    networkTx,
-    diskIO: diskRead + diskWrite,
-    diskRead,
-    diskWrite,
-  }
-
-  setHistory((prev) => {
-    const cutoff = Date.now() - statsRanges['1w']
-    const next = [...prev.filter((item) => item.ts >= cutoff), point]
-    localStorage.setItem(hostHistoryKey, JSON.stringify(next))
-    return next
-  })
-}
-
 function readHostHistory(): HostMetricPoint[] {
   try {
     const raw = localStorage.getItem(hostHistoryKey)
@@ -221,6 +213,20 @@ function toChartPoints(history: HostMetricPoint[], key: keyof Omit<HostMetricPoi
   })
 }
 
+function normalizeHostMetricSample(point: HostMetricSample): HostMetricPoint {
+  return {
+    ts: point.ts,
+    cpu: clamp(point.cpu),
+    memory: clamp(point.memory),
+    network: point.network || 0,
+    networkRx: point.network_rx || 0,
+    networkTx: point.network_tx || 0,
+    diskIO: point.disk_io || 0,
+    diskRead: point.disk_read || 0,
+    diskWrite: point.disk_write || 0,
+  }
+}
+
 function clamp(value: number) {
   if (!Number.isFinite(value)) return 0
   return Math.max(0, Math.min(value, 100))

frontend/src/pages/HostReport.tsx

@@ -205,7 +205,7 @@ const hostReportText = {
     ipv4Address: 'IPv4 地址',
     ipv4Prefix: 'IPv4 段',
     ipv6Address: 'IPv6 地址',
-    ipv6Prefix: 'IPv6 段',
+    ipv6Prefix: '可分配 IPv6 前缀',
     gateway: '网关',
     memoryModules: '内存条',
     noMemoryModules: '未检测到内存条明细，可能缺少 dmidecode 或权限受限',
@@ -277,7 +277,7 @@ const hostReportText = {
     ipv4Address: 'IPv4 Addresses',
     ipv4Prefix: 'IPv4 Prefixes',
     ipv6Address: 'IPv6 Addresses',
-    ipv6Prefix: 'IPv6 Prefixes',
+    ipv6Prefix: 'Allocatable IPv6 Prefixes',
     gateway: 'Gateway',
     memoryModules: 'Memory Modules',
     noMemoryModules: 'No memory module details detected. dmidecode may be missing or permissions may be limited.',
@@ -511,6 +511,7 @@ function diskTypeLabel(d: { type?: string; rotational?: boolean; virtual?: boole
 }
 
 function gpuTypeLabel(value: string, language: Language) {
+  if (value === 'virtual') return language === 'en' ? 'Virtual' : '虚拟'
   if (value === 'integrated') return language === 'en' ? 'Integrated' : '核显'
   if (value === 'discrete') return language === 'en' ? 'Discrete' : '独显'
   return value || '-'

frontend/src/pages/ImageManagement.tsx

@@ -1,4 +1,5 @@
 import { useCallback, useEffect, useState, type ReactNode } from 'react'
+import { useNavigate } from 'react-router'
 import {
   Download,
   Trash2,
@@ -10,16 +11,37 @@ import {
   Loader2,
   AlertCircle,
   X,
+  Plus,
+  Unlink,
+  CloudDownload,
 } from 'lucide-react'
-import { getImages, downloadImage, cancelImageDownload, deleteImage, toggleImage, ImageInfo } from '../services/api'
+import {
+  getImages,
+  getStorageInfo,
+  downloadImage,
+  cancelImageDownload,
+  deleteImage,
+  toggleImage,
+  createCustomKVMImage,
+  removeCustomKVMImage,
+  ImageInfo,
+  StorageInfo,
+  CustomKVMImageInput,
+} from '../services/api'
 import { useDialog } from '../components/Dialog'
+import { useLanguage } from '../contexts/LanguageContext'
 
 export default function ImageManagement() {
   const dialog = useDialog()
+  const { t } = useLanguage()
+  const navigate = useNavigate()
   const [images, setImages] = useState<ImageInfo[]>([])
   const [loading, setLoading] = useState(true)
   const [actionLoading, setActionLoading] = useState<string | null>(null)
   const [error, setError] = useState('')
+  const [storageInfo, setStorageInfo] = useState<StorageInfo | null>(null)
+  const [storageLoading, setStorageLoading] = useState(true)
+  const [customModalOpen, setCustomModalOpen] = useState<'lxc' | 'kvm' | null>(null)
 
   const fetchImages = useCallback(async () => {
     try {
@@ -33,9 +55,22 @@ export default function ImageManagement() {
     }
   }, [])
 
+  const fetchStorage = useCallback(async () => {
+    setStorageLoading(true)
+    try {
+      const res = await getStorageInfo()
+      setStorageInfo(res.data.data || null)
+    } catch {
+      setStorageInfo(null)
+    } finally {
+      setStorageLoading(false)
+    }
+  }, [])
+
   useEffect(() => {
     fetchImages()
-  }, [fetchImages])
+    fetchStorage()
+  }, [fetchImages, fetchStorage])
 
   useEffect(() => {
     const hasDownloads = images.some((img) => img.downloading)
@@ -98,9 +133,40 @@ export default function ImageManagement() {
     }
   }
 
+  const handleRemoveCustom = async (templateId: string) => {
+    if (!(await dialog.confirm('移除第三方镜像', '确定移除该镜像源和已下载的缓存吗？正在使用该镜像的虚拟机不会允许移除。'))) return
+    setActionLoading(templateId)
+    setError('')
+    try {
+      await removeCustomKVMImage(templateId)
+      await fetchImages()
+      dialog.alert('完成', '第三方镜像已移除')
+    } catch (err: unknown) {
+      dialog.alert('失败', apiErrorMessage(err, '移除第三方镜像失败'))
+    } finally {
+      setActionLoading(null)
+    }
+  }
+
+  const handleCustomCreated = async (payload: CustomKVMImageInput) => {
+    const response = await createCustomKVMImage(payload)
+    const image = response.data.data
+    if (!image) throw new Error('镜像源保存成功，但服务器没有返回镜像 ID')
+    try {
+      await downloadImage(image.id)
+      dialog.alert('完成', '第三方镜像已添加，下载任务已启动')
+    } catch (err: unknown) {
+      dialog.alert('提示', `镜像源已保存，但下载未启动：${apiErrorMessage(err, '请在列表中重试')}`)
+    }
+    await fetchImages()
+  }
+
   const downloadedCount = images.filter((img) => img.downloaded).length
   const lxcImages = images.filter((img) => img.type === 'lxc')
   const kvmImages = images.filter((img) => img.type === 'kvm')
+  const imageStorageReady = (storageInfo?.pools || []).some((pool) =>
+    pool.enabled !== false && pool.available !== false && (pool.content_types || []).includes('images')
+  )
 
   if (loading) {
     return (
@@ -121,7 +187,7 @@ export default function ImageManagement() {
           </p>
         </div>
         <button
-          onClick={fetchImages}
+          onClick={() => { fetchImages(); fetchStorage() }}
           className="flex items-center gap-1.5 px-3 py-1.5 border border-gray-300 text-gray-700 rounded-md hover:bg-gray-50 transition-colors text-xs font-medium"
         >
           <RefreshCw className="w-3.5 h-3.5" />
@@ -136,6 +202,25 @@ export default function ImageManagement() {
         </div>
       )}
 
+      {storageLoading && (
+        <div className="flex items-center gap-2 rounded-lg border border-gray-200 bg-gray-50 px-4 py-3 text-sm text-gray-600">
+          <Loader2 className="h-4 w-4 shrink-0 animate-spin" />
+          正在检查存储配置...
+        </div>
+      )}
+
+      {!storageLoading && !imageStorageReady && (
+        <div className="flex items-center justify-between gap-4 rounded-lg border border-amber-200 bg-amber-50 px-4 py-3 text-sm text-amber-800">
+          <div className="flex items-center gap-2">
+            <AlertCircle className="h-4 w-4 shrink-0" />
+            尚未开启镜像缓存存储，无法下载新镜像。
+          </div>
+          <button onClick={() => navigate('/storage')} className="shrink-0 rounded-md border border-amber-300 bg-white px-3 py-1.5 text-xs font-medium hover:bg-amber-100">
+            去开启
+          </button>
+        </div>
+      )}
+
       <ImageTable
         title="LXC 容器镜像"
         images={lxcImages}
@@ -146,8 +231,24 @@ export default function ImageManagement() {
         onCancelDownload={handleCancelDownload}
         onDelete={handleDelete}
         onToggle={handleToggle}
+        onRemoveCustom={handleRemoveCustom}
+        storageReady={imageStorageReady}
+        storageLoading={storageLoading}
+        headerAction={(
+          <button
+            type="button"
+            onClick={() => setCustomModalOpen('lxc')}
+            disabled={storageLoading || !imageStorageReady}
+            title={storageLoading ? t('正在检查存储配置...') : imageStorageReady ? t('下载第三方 LXC 镜像') : t('请先在存储管理中开启镜像缓存存储')}
+            className="inline-flex items-center gap-1.5 rounded-md bg-black px-3 py-1.5 text-xs font-medium text-white transition-colors hover:bg-gray-800 disabled:cursor-not-allowed disabled:opacity-50 dark:bg-white dark:text-black dark:hover:bg-gray-200"
+          >
+            <Plus className="h-3.5 w-3.5" />
+            {t('第三方镜像')}
+          </button>
+        )}
       />
 
+      {kvmImages.length > 0 && (
         <ImageTable
           title="KVM 虚拟机镜像"
           images={kvmImages}
@@ -158,7 +259,206 @@ export default function ImageManagement() {
           onCancelDownload={handleCancelDownload}
           onDelete={handleDelete}
           onToggle={handleToggle}
+          onRemoveCustom={handleRemoveCustom}
+          storageReady={imageStorageReady}
+          storageLoading={storageLoading}
+          headerAction={(
+            <button
+              type="button"
+              onClick={() => setCustomModalOpen('kvm')}
+              disabled={storageLoading || !imageStorageReady}
+              title={storageLoading ? t('正在检查存储配置...') : imageStorageReady ? t('下载第三方 KVM 镜像') : t('请先在存储管理中开启镜像缓存存储')}
+              className="inline-flex items-center gap-1.5 rounded-md bg-black px-3 py-1.5 text-xs font-medium text-white transition-colors hover:bg-gray-800 disabled:cursor-not-allowed disabled:opacity-50 dark:bg-white dark:text-black dark:hover:bg-gray-200"
+            >
+              <Plus className="h-3.5 w-3.5" />
+              {t('第三方镜像')}
+            </button>
+          )}
         />
+      )}
+      {customModalOpen !== null && (
+        <CustomKVMImageModal
+          virtualization={customModalOpen}
+          arch={(customModalOpen === 'lxc' ? lxcImages[0]?.arch : kvmImages[0]?.arch) || 'amd64'}
+          onClose={() => setCustomModalOpen(null)}
+          onSubmit={handleCustomCreated}
+        />
+      )}
+    </div>
+  )
+}
+
+const emptyCustomImage = (arch: string, virtualization: 'lxc' | 'kvm'): CustomKVMImageInput => ({
+  type: virtualization,
+  name: '',
+  description: '',
+  distro: '',
+  release: '',
+  arch,
+  url: '',
+  provisioner: virtualization === 'lxc' ? 'lxc-rootfs' : 'linux-cloud-init',
+  sha256: '',
+})
+
+function CustomKVMImageModal({
+  virtualization,
+  arch,
+  onClose,
+  onSubmit,
+}: {
+  virtualization: 'lxc' | 'kvm'
+  arch: string
+  onClose: () => void
+  onSubmit: (payload: CustomKVMImageInput) => Promise<void>
+}) {
+  const { t } = useLanguage()
+  const [form, setForm] = useState<CustomKVMImageInput>(() => emptyCustomImage(arch, virtualization))
+  const [submitting, setSubmitting] = useState(false)
+  const [formError, setFormError] = useState('')
+  const windows = virtualization === 'kvm' && form.provisioner !== 'linux-cloud-init'
+
+  useEffect(() => {
+    const closeOnEscape = (event: KeyboardEvent) => {
+      if (event.key === 'Escape' && !submitting) onClose()
+    }
+    window.addEventListener('keydown', closeOnEscape)
+    return () => window.removeEventListener('keydown', closeOnEscape)
+  }, [onClose, submitting])
+
+  const updateProvisioner = (provisioner: 'linux-cloud-init' | 'windows-10' | 'windows-11') => {
+    setForm((current) => ({
+      ...current,
+      provisioner,
+      distro: provisioner === 'linux-cloud-init' ? (current.distro === 'windows' ? '' : current.distro) : 'windows',
+      release: provisioner === 'windows-10' ? '10' : provisioner === 'windows-11' ? '11' : (current.distro === 'windows' ? '' : current.release),
+    }))
+  }
+
+  const submit = async () => {
+    if (!form.name.trim() || !form.distro.trim() || !form.release.trim() || !form.url.trim()) {
+      setFormError(t('请填写名称、发行版、版本和下载地址'))
+      return
+    }
+    if (form.sha256 && !/^[a-fA-F0-9]{64}$/.test(form.sha256.trim())) {
+      setFormError(t('SHA-256 必须是 64 位十六进制字符串'))
+      return
+    }
+    setSubmitting(true)
+    setFormError('')
+    try {
+      await onSubmit({
+        ...form,
+        name: form.name.trim(),
+        description: form.description.trim(),
+        distro: form.distro.trim().toLowerCase(),
+        release: form.release.trim().toLowerCase(),
+        url: form.url.trim(),
+        sha256: form.sha256?.trim().toLowerCase(),
+      })
+      onClose()
+    } catch (err: unknown) {
+      setFormError(apiErrorMessage(err, t('添加第三方镜像失败')))
+    } finally {
+      setSubmitting(false)
+    }
+  }
+
+  const inputClass = 'mt-1.5 w-full rounded-md border border-gray-300 bg-white px-3 py-2 text-sm text-black outline-none focus:border-black focus:ring-2 focus:ring-black/10 dark:border-gray-700 dark:bg-gray-950 dark:text-white dark:focus:border-white dark:focus:ring-white/10'
+
+  return (
+    <div className="fixed inset-0 z-[90] flex items-center justify-center bg-black/55 p-4 dark:bg-black/75">
+      <div className="w-full max-w-2xl overflow-hidden rounded-lg border border-gray-200 bg-white shadow-xl dark:border-gray-700 dark:bg-gray-900">
+        <div className="flex items-center justify-between border-b border-gray-200 px-5 py-4 dark:border-gray-700">
+          <div>
+            <h3 className="text-base font-semibold text-gray-900 dark:text-white">{t(virtualization === 'lxc' ? '下载第三方 LXC 镜像' : '下载第三方 KVM 镜像')}</h3>
+            <p className="mt-0.5 text-xs text-gray-500 dark:text-gray-400">
+              {t(virtualization === 'lxc' ? '支持 tar、tar.gz、tar.xz、tar.zst 格式的 Linux rootfs' : '镜像格式必须与所选无人值守安装模板匹配')}
+            </p>
+          </div>
+          <button type="button" onClick={onClose} disabled={submitting} className="rounded p-1.5 text-gray-400 hover:bg-gray-100 hover:text-black disabled:opacity-50 dark:hover:bg-gray-800 dark:hover:text-white" title={t('关闭')}>
+            <X className="h-4 w-4" />
+          </button>
+        </div>
+
+        <div className="max-h-[72vh] space-y-5 overflow-y-auto px-5 py-4">
+          {virtualization === 'kvm' && <div>
+            <label className="text-sm font-medium text-gray-700 dark:text-gray-200">{t('无人值守安装模板')}</label>
+            <div className="mt-2 grid grid-cols-1 gap-2 sm:grid-cols-3">
+              {([
+                ['linux-cloud-init', 'Linux cloud-init', 'QCOW2 / IMG'],
+                ['windows-10', 'Windows 10', '安装 ISO'],
+                ['windows-11', 'Windows 11', '安装 ISO'],
+              ] as const).map(([value, label, hint]) => (
+                <button
+                  key={value}
+                  type="button"
+                  onClick={() => updateProvisioner(value)}
+                  disabled={arch !== 'amd64' && value !== 'linux-cloud-init'}
+                  className={`rounded-md border px-3 py-2 text-left transition-colors disabled:cursor-not-allowed disabled:opacity-40 ${
+                    form.provisioner === value
+                      ? 'border-black bg-gray-50 dark:border-white dark:bg-gray-800'
+                      : 'border-gray-200 hover:border-gray-400 dark:border-gray-700 dark:hover:border-gray-500'
+                  }`}
+                >
+                  <span className="block text-sm font-medium text-gray-900 dark:text-white">{label}</span>
+                  <span className="mt-0.5 block text-xs text-gray-500 dark:text-gray-400">{t(hint)}</span>
+                </button>
+              ))}
+            </div>
+          </div>}
+
+          <div className="grid grid-cols-1 gap-4 sm:grid-cols-2">
+            <label className="text-sm text-gray-700 dark:text-gray-200">
+              {t('镜像名称')}
+              <input className={inputClass} value={form.name} maxLength={100} onChange={(event) => setForm({ ...form, name: event.target.value })} placeholder={virtualization === 'lxc' ? 'Alpine Custom Rootfs' : windows ? 'Windows 11 Custom' : 'Ubuntu Custom Cloud'} />
+            </label>
+            <label className="text-sm text-gray-700 dark:text-gray-200">
+              {t('架构')}
+              <select className={inputClass} value={form.arch} disabled>
+                <option value={arch}>{arch}</option>
+              </select>
+            </label>
+            <label className="text-sm text-gray-700 dark:text-gray-200">
+              {t('发行版')}
+              <input className={inputClass} value={form.distro} disabled={windows} maxLength={64} onChange={(event) => setForm({ ...form, distro: event.target.value })} placeholder="ubuntu" />
+            </label>
+            <label className="text-sm text-gray-700 dark:text-gray-200">
+              {t('版本 / 代号')}
+              <input className={inputClass} value={form.release} disabled={windows} maxLength={64} onChange={(event) => setForm({ ...form, release: event.target.value })} placeholder="noble" />
+            </label>
+          </div>
+
+          <label className="block text-sm text-gray-700 dark:text-gray-200">
+            {t('备注')}
+            <textarea className={`${inputClass} min-h-20 resize-y`} value={form.description} maxLength={500} onChange={(event) => setForm({ ...form, description: event.target.value })} placeholder={t('镜像来源、版本或用途')} />
+          </label>
+
+          <label className="block text-sm text-gray-700 dark:text-gray-200">
+            {t('镜像下载地址')}
+            <input className={`${inputClass} font-mono text-xs`} value={form.url} onChange={(event) => setForm({ ...form, url: event.target.value })} placeholder={virtualization === 'lxc' ? 'https://example.com/rootfs.tar.xz' : windows ? 'https://example.com/windows.iso' : 'https://example.com/image.qcow2'} />
+          </label>
+
+          <label className="block text-sm text-gray-700 dark:text-gray-200">
+            SHA-256 <span className="text-xs text-gray-400">({t('可选')})</span>
+            <input className={`${inputClass} font-mono text-xs`} value={form.sha256 || ''} maxLength={64} onChange={(event) => setForm({ ...form, sha256: event.target.value })} placeholder={t('用于校验下载文件完整性')} />
+          </label>
+
+          {formError && (
+            <div className="flex items-start gap-2 rounded-md border border-red-200 bg-red-50 px-3 py-2 text-sm text-red-700 dark:border-red-900 dark:bg-red-950 dark:text-red-300">
+              <AlertCircle className="mt-0.5 h-4 w-4 shrink-0" />
+              {formError}
+            </div>
+          )}
+        </div>
+
+        <div className="flex justify-end gap-2 border-t border-gray-200 bg-gray-50 px-5 py-3 dark:border-gray-700 dark:bg-gray-800">
+          <button type="button" onClick={onClose} disabled={submitting} className="rounded-md px-4 py-2 text-sm text-gray-700 hover:bg-gray-200 disabled:opacity-50 dark:text-gray-300 dark:hover:bg-gray-700">{t('取消')}</button>
+          <button type="button" onClick={submit} disabled={submitting} className="inline-flex items-center gap-2 rounded-md bg-black px-4 py-2 text-sm text-white hover:bg-gray-800 disabled:opacity-50 dark:bg-white dark:text-black dark:hover:bg-gray-200">
+            {submitting ? <Loader2 className="h-4 w-4 animate-spin" /> : <CloudDownload className="h-4 w-4" />}
+            {submitting ? t('正在添加...') : t('添加并下载')}
+          </button>
+        </div>
+      </div>
     </div>
   )
 }
@@ -173,6 +473,10 @@ function ImageTable({
   onCancelDownload,
   onDelete,
   onToggle,
+  onRemoveCustom,
+  storageReady,
+  storageLoading,
+  headerAction,
 }: {
   title: string
   images: ImageInfo[]
@@ -183,15 +487,22 @@ function ImageTable({
   onCancelDownload: (id: string) => void
   onDelete: (id: string) => void
   onToggle: (id: string, enabled: boolean) => void
+  onRemoveCustom: (id: string) => void
+  storageReady: boolean
+  storageLoading: boolean
+  headerAction?: ReactNode
 }) {
   return (
     <div className="space-y-3">
+      <div className="flex items-center justify-between gap-3">
         <div className="flex items-center gap-3">
-        <h2 className="text-lg font-semibold text-gray-800">{title}</h2>
+          <h2 className="text-lg font-semibold text-gray-800 dark:text-gray-100">{title}</h2>
           <span className="text-xs text-gray-400">
             已下载 {downloadedCount}/{totalCount}
           </span>
         </div>
+        {headerAction}
+      </div>
       <div className="bg-white border border-gray-200 rounded-lg overflow-hidden">
         <div className="overflow-x-auto">
           <table className="w-full">
@@ -225,10 +536,11 @@ function ImageTable({
                     <td className="px-4 py-3">
                       <div className="flex items-center gap-3">
                         <span className="w-8 h-8 flex items-center justify-center flex-shrink-0">
-                          {getTemplateIcon(img.id)}
+                          {getTemplateIcon(img.id, img.distro, img.custom)}
                         </span>
                         <div>
-                          <span className="font-medium text-gray-900 text-sm">{img.name}</span>
+                          <span className="font-medium text-gray-900 text-sm dark:text-gray-100">{img.name}</span>
+                          {img.custom && <span className="ml-2 rounded bg-blue-50 px-1.5 py-0.5 text-[10px] font-medium text-blue-700 dark:bg-blue-950 dark:text-blue-300">第三方</span>}
                           <p className="text-[11px] text-gray-400">{img.description}</p>
 
                         </div>
@@ -251,7 +563,8 @@ function ImageTable({
                         {!img.downloaded && !img.downloading && (
                           <button
                             onClick={() => onDownload(img.id)}
-                            disabled={isBusy}
+                            disabled={isBusy || storageLoading || !storageReady}
+                            title={storageLoading ? '正在检查存储配置...' : storageReady ? '下载镜像' : '请先在存储管理中开启镜像缓存存储'}
                             className="inline-flex items-center gap-1.5 px-3 py-1.5 bg-black text-white rounded-md hover:bg-gray-800 transition-colors text-xs font-medium disabled:opacity-50"
                           >
                             {isBusy ? (
@@ -279,7 +592,8 @@ function ImageTable({
                           <>
                             <button
                               onClick={() => onToggle(img.id, img.enabled)}
-                              disabled={isBusy}
+                              disabled={isBusy || storageLoading || !storageReady}
+                              title={storageLoading ? '正在检查存储配置...' : storageReady ? (img.enabled ? '禁用镜像' : '启用镜像') : '请先在存储管理中开启镜像缓存存储'}
                               className={`inline-flex items-center gap-1 px-2.5 py-1.5 rounded-md text-xs font-medium transition-colors disabled:opacity-50 ${
                                 img.enabled
                                   ? 'bg-emerald-50 text-emerald-700 border border-emerald-200 hover:bg-emerald-100'
@@ -299,6 +613,16 @@ function ImageTable({
                             </button>
                           </>
                         )}
+                        {img.custom && !img.downloading && (
+                          <button
+                            onClick={() => onRemoveCustom(img.id)}
+                            disabled={isBusy}
+                            className="inline-flex items-center rounded-md border border-gray-200 p-1.5 text-gray-500 hover:border-red-200 hover:bg-red-50 hover:text-red-600 disabled:opacity-50 dark:border-gray-700 dark:text-gray-400 dark:hover:border-red-900 dark:hover:bg-red-950 dark:hover:text-red-300"
+                            title="移除第三方镜像源和缓存"
+                          >
+                            <Unlink className="h-3.5 w-3.5" />
+                          </button>
+                        )}
                       </div>
                     </td>
                   </tr>
@@ -315,7 +639,7 @@ function ImageTable({
 function StatusBadge({ img }: { img: ImageInfo }) {
   if (img.downloading) {
     const progress = Math.max(0, Math.min(100, img.progress || 0))
-    const showProgress = img.stage === 'downloading' && progress > 0
+    const showProgress = img.stage === 'downloading' && (progress > 0 || img.downloaded_bytes > 0)
     return (
       <div className="inline-flex flex-col gap-1">
         <span
@@ -327,7 +651,10 @@ function StatusBadge({ img }: { img: ImageInfo }) {
         </span>
         {showProgress && (
           <span className="block h-1 w-24 overflow-hidden rounded-full bg-amber-100">
-            <span className="block h-full rounded-full bg-amber-500 transition-all" style={{ width: `${progress}%` }} />
+            <span
+              className={`block h-full rounded-full bg-amber-500 transition-all ${progress <= 0 ? 'animate-pulse' : ''}`}
+              style={{ width: progress > 0 ? `${progress}%` : '35%' }}
+            />
           </span>
         )}
       </div>
@@ -371,8 +698,10 @@ function StatusBadge({ img }: { img: ImageInfo }) {
 function downloadStatusLabel(img: ImageInfo) {
   if (img.stage === 'canceling') return '取消中'
   if (img.stage === 'converting') return '转换中'
+  if (img.stage === 'validating') return '校验中'
   if (img.stage === 'lxc-create') return '下载中'
   if (img.progress > 0) return `下载中 ${Math.min(100, img.progress)}%`
+  if (img.downloaded_bytes > 0) return `下载中 · ${formatSize(img.downloaded_bytes)}`
   return '下载中'
 }
 
@@ -389,8 +718,9 @@ function isWindowsImage(img: ImageInfo) {
   return img.distro === 'windows' || img.id.toLowerCase().includes('windows')
 }
 
-function getTemplateIcon(id: string): ReactNode {
+function getTemplateIcon(id: string, distro = '', custom = false): ReactNode {
   const size = 'w-5 h-5'
+  id = (custom && distro ? distro : id).toLowerCase()
   id = id.startsWith('kvm-') ? id.slice(4) : id
   if (id.startsWith('debian')) return <svg className={size} viewBox="0 0 1024 1024"><path d="M935.473 375.359a558.602 558.602 0 0 0-22.351-114.655l13.308 4.436c-35.66-81.385-90.086-163.623-153.556-199.282-8.701-5.118-35.147 4.948-26.616-12.113s-37.536-8.19-56.816-4.778c-26.275 4.266-30.028-29.175-75.071-35.83-25.593-3.582-32.247 18.427-44.702 13.309-23.545-9.384-20.816-27.64-57.669-9.384-18.427 9.042 11.602-26.105-49.138-4.607L457.744 0C349.23 41.63 318.69 76.266 288.15 79.337c-6.996 0-34.124 32.759-53.574 53.062-17.062 17.062-26.275 36.512-49.138 39.583l-17.062 70.636A136.494 136.494 0 0 0 119.41 339.7a66.711 66.711 0 0 1 4.436-52.892c-17.062 6.825-45.896 17.062-29.687 96.91 12.796 63.13-5.29 135.13 10.066 204.742 4.777 20.986 0 40.095 6.142 51.185 107.66 235.794 208.836 392.08 472.44 384.06l4.436-8.872c-28.152-6.825-55.11-17.062-111.584-30.711-18.597-4.436-23.033-34.124-40.265-44.19-9.384-5.46-28.323-4.095-37.195-9.896s4.266-21.668-19.962-14.332c-8.531 2.56-13.82-10.92-20.133-17.061s0-23.716-23.375-24.74-18.426-29.687-19.791-44.702c-12.114 1.536-1.195-1.535-13.308 4.436a63.64 63.64 0 0 1-23.887-31.735c-10.237-48.967-10.578-21.497-15.014-32.417a322.297 322.297 0 0 0-19.28-42.142l26.787 8.872h4.436l4.436-13.309-26.616-8.701h31.223c-7.678 13.99 2.047 5.29-13.479 8.872v13.308l22.35-8.872v-13.308c-20.644-10.237-28.663-13.308-49.137-22.01l9.043 8.872v4.436h-49.138c-22.01-14.843-13.99-31.734-17.915-53.062 17.062 0 9.213 6.655 17.062-13.137l-17.062 8.872 13.308-33.953-13.308 13.138c-29.176-38.73-16.209-97.764-11.943-152.02A180.684 180.684 0 0 1 211.2 372.97c8.872-10.067 5.119-25.251 5.46-37.195l31.223-26.445H265.8c7.678 17.061 4.777 5.46 0 22.01l8.872 4.435c7.166-8.701 6.142-5.971 8.872-22.01-10.066-10.578-6.995-9.895-26.616-13.308A119.432 119.432 0 0 1 368.51 243.13l4.436-13.308-17.915 9.043-4.436-13.138a109.536 109.536 0 0 1 76.095-27.128c6.313 0 6.996-17.062 12.797-19.45 161.574-60.57 309.33 9.383 371.093 147.413a324.173 324.173 0 0 1 8.19 34.123c17.061 56.987-7.167 121.48 9.725 155.604-7.849 36-36.683 13.82-40.266 30.881-8.531 41.29-14.844 59.717-40.778 78.826a196.38 196.38 0 0 1-30.711 22.35 84.285 84.285 0 0 0 22.35-39.753c-106.294 111.584-262.58 63.981-290.049-105.954a101.176 101.176 0 0 1 35.147-93.157c92.987-87.527 150.144-52.38 205.765-20.474l-8.872-30.711c-32.93-24.398-17.062-19.792-9.043-57.328v-4.436l-17.915-13.137c2.56 10.066 1.024 5.289 9.043 17.061-4.436 16.039 0 9.043-8.872 17.062-15.014 9.725-23.716 7.337-44.702 4.436l4.436-13.308-13.308-13.308c0 11.773-4.095 2.73 0 17.062-126.086 9.896-218.05 80.02-178.636 260.191a220.608 220.608 0 0 0 8.872 44.19l-8.872 8.702-4.436-26.446h-13.48l-4.435 13.308c-12.626-25.763-0.853 10.75 40.265 52.892a149.29 149.29 0 0 0 12.797 12.625c47.773 34.124 113.29 81.385 201.328 49.138h9.043v-4.436l-102.37-13.308-4.436-8.701c106.806 24.74 176.93-8.531 236.646-48.456 13.138-17.062 11.431-24.057 22.18-9.043 19.28-17.061 3.925-26.786 13.48-44.019 6.483-11.772 32.587-17.062 44.7-35.318l40.096-136.494h-17.062c3.071-14.332 22.522-34.123-4.436-48.455-2.559-1.536 9.043-1.365 8.872-4.266a145.537 145.537 0 0 0-22.18-66.37c33.1 21.669 36.342 68.247 53.574 105.783v8.872h4.436V375.36zM453.308 595.455l-9.555-26.446 62.446 57.328zM146.196 211.736l-23.204-4.436v39.754c16.72-10.578 18.939-10.407 22.35-35.318z m574.981 176.419a57.498 57.498 0 0 0-17.062 44.19l13.48 8.701a37.877 37.877 0 0 0 4.435-52.891zM868.42 555.872c26.275-11.602 54.598-58.01 35.83-97.081l-35.83 96.91z m-174.03-79.508c-15.697 11.773-19.791 13.308-22.35 39.754l13.307 8.872 17.915-8.872a60.228 60.228 0 0 0 4.436-48.455c-8.36 13.478-2.559 20.644-13.308 8.701z m-67.053 79.508c15.868-10.92 11.944-14.844 17.915-22.18v-4.778a292.097 292.097 0 0 1-62.446 0c-13.137-13.99-13.308-29.346-31.223-39.583 17.062 35.147 3.242 38.218 31.223 61.764a158.162 158.162 0 0 0 40.095 4.436c1.536 0-6.824-1.024 4.436 0zM207.79 520.554H194.31l-8.872 8.702c9.555 10.237 5.46 7.166 13.308-4.436L212.225 547l4.436-17.062-8.872-8.701z m17.062 57.328l4.436-8.873c-10.067-8.701 0-3.583-13.308 0l-13.309-17.061 4.436 17.061v8.873h17.062z" fill="#CE0C48"/></svg>
   if (id.startsWith('ubuntu')) return <svg className={size} viewBox="0 0 1024 1024"><circle cx="512" cy="512" r="511" fill="#DD4814"/><path d="M164.532 442.532c-37.676 0-68.2 30.524-68.2 68.2 0 37.656 30.524 68.184 68.2 68.184 37.66 0 68.184-30.528 68.184-68.184 0-37.676-30.524-68.2-68.184-68.2z m486.86 309.912c-32.612 18.84-43.8 60.52-24.96 93.116 18.82 32.616 60.5 43.796 93.116 24.96 32.612-18.82 43.796-60.5 24.96-93.12-18.82-32.592-60.524-43.772-93.116-24.956z m-338.744-241.712c0-67.384 33.472-126.92 84.684-162.968L347.48 264.268c-59.656 39.88-104.048 100.816-122.496 172.188 21.528 17.56 35.304 44.3 35.304 74.272 0 29.956-13.776 56.696-35.304 74.26C243.408 656.376 287.8 717.32 347.48 757.2l49.852-83.52c-51.212-36.028-84.684-95.56-84.684-162.948z m199.168-199.188c104.052 0 189.42 79.776 198.38 181.52l97.16-1.432c-4.776-75.112-37.592-142.544-88.008-192.128-25.928 9.796-55.88 8.296-81.76-6.624-25.932-14.964-42.192-40.208-46.636-67.608a297.04 297.04 0 0 0-79.14-10.76 295.148 295.148 0 0 0-131.276 30.652l47.38 84.908a198.384 198.384 0 0 1 83.9-18.528z m0 398.36a198.404 198.404 0 0 1-83.896-18.528l-47.38 84.9a294.848 294.848 0 0 0 131.28 30.684 296.16 296.16 0 0 0 79.136-10.788c4.444-27.4 20.708-52.62 46.632-67.608 25.904-14.948 55.836-16.42 81.76-6.624 50.42-49.584 83.232-117.016 88.016-192.128l-97.188-1.432c-8.94 101.772-94.304 181.52-198.36 181.52z m139.552-440.924c32.616 18.832 74.3 7.68 93.116-24.936 18.84-32.616 7.68-74.3-24.936-93.14-32.616-18.816-74.296-7.64-93.14 24.976-18.812 32.6-7.632 74.28 24.96 93.1z" fill="#FFF"/></svg>
@@ -400,6 +730,7 @@ function getTemplateIcon(id: string): ReactNode {
   if (id.startsWith('fedora')) return <svg className={size} viewBox="0 0 1024 1024"><path d="M512 0C229.344 0 0.224 229.024 0 511.648V907.84a116.384 116.384 0 0 0 116.384 116.128h395.808c282.656-0.128 511.776-229.28 511.776-512 0-282.752-229.248-512-512-512z m196.064 237.952c-16.16 0-22.016-3.104-45.728-3.104a126.848 126.848 0 0 0-126.848 126.624v110.208c0 9.888 8.032 17.92 17.92 17.92h83.328c31.072 0 56.16 24.736 56.16 55.904 0 31.328-25.344 55.968-56.736 55.968h-100.608v127.36a240.32 240.32 0 0 1-240.288 240.288h-1.248a190.944 190.944 0 0 1-53.216-7.52l1.344 0.32c-27.168-7.072-49.376-29.408-49.376-55.296 0-31.328 22.752-54.112 56.736-54.112 16.128 0 22.016 3.072 45.696 3.072a126.848 126.848 0 0 0 126.848-126.624v-110.208a17.92 17.92 0 0 0-17.92-17.888h-83.328a55.808 55.808 0 0 1-56.096-55.904c0-31.328 25.344-55.968 56.736-55.968h100.576v-127.36a240.32 240.32 0 0 1 240.288-240.288c20.128 0 34.432 2.272 53.088 7.136 27.168 7.136 49.408 29.44 49.408 55.296 0 31.36-22.752 54.144-56.736 54.144z" fill="#294172"/></svg>
   if (id.startsWith('rockylinux')) return <svg className={size} viewBox="0 0 1024 1024"><path d="M995.498667 680.362667c18.474667-52.778667 28.501333-109.568 28.501333-168.704C1024 229.077333 794.752 0 512 0S0 229.077333 0 511.658667c0 139.818667 56.106667 266.496 147.114667 358.826666L666.453333 351.530667l128.213334 128.170666 200.832 200.704z m-93.525334 162.816l-235.52-235.349334-368.896 368.597334A510.506667 510.506667 0 0 0 512 1023.274667c156.16 0 296.106667-69.888 389.973333-180.053334h0.042667z" fill="#10B981"/></svg>
   if (id.startsWith('windows')) return <svg className={size} viewBox="0 0 1024 1024"><path d="M56.888889 227.555556l398.222222-70.542223V512H56.888889V227.555556z m0 625.777777l398.222222 70.542223V568.888889H56.888889v284.444444zM512 147.342222L1024 56.888889v455.111111H512V147.342222z m0 786.204445L1024 1024v-455.111111H512v364.657778z" fill="#16C6FE"/></svg>
+  if (custom) return <CloudDownload className={`${size} text-blue-600 dark:text-blue-300`} />
   return null
 }
 

frontend/src/pages/Login.tsx

@@ -40,8 +40,12 @@ export default function Login() {
         await login(username, password)
       }
     } catch (err: unknown) {
-      const error = err as { response?: { data?: { message?: string } } }
+      const error = err as { response?: { status?: number; data?: { message?: string } } }
+      if (error.response?.status === 401) {
+        setError(t(isAccessCodeLogin ? '访问码或密码错误' : '用户名或密码错误'))
+      } else {
         setError(error.response?.data?.message || t('登录失败，请检查用户名和密码'))
+      }
     } finally {
       setLoading(false)
     }
@@ -79,7 +83,7 @@ export default function Login() {
               {!isAccessCodeLogin && (
                 <div>
                   <label className="block text-sm font-medium text-gray-700 mb-1.5">
-                    用户名
+                    {t('用户名')}
                   </label>
                   <div className="relative">
                     <div className="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
@@ -90,7 +94,7 @@ export default function Login() {
                       value={username}
                       onChange={(event) => setUsername(event.target.value)}
                       className="block w-full pl-10 pr-3 py-2.5 border border-gray-300 rounded-md text-black bg-white placeholder-gray-400 focus:outline-none focus:ring-2 focus:ring-black focus:border-black text-sm"
-                      placeholder="输入用户名"
+                      placeholder={t('输入用户名')}
                       required
                       autoComplete="username"
                     />
@@ -100,7 +104,7 @@ export default function Login() {
 
             <div>
               <label className="block text-sm font-medium text-gray-700 mb-1.5">
-                密码
+                {t('密码')}
               </label>
               <div className="relative">
                 <div className="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
@@ -111,7 +115,7 @@ export default function Login() {
                   value={password}
                   onChange={(event) => setPassword(event.target.value)}
                   className="block w-full pl-10 pr-3 py-2.5 border border-gray-300 rounded-md text-black bg-white placeholder-gray-400 focus:outline-none focus:ring-2 focus:ring-black focus:border-black text-sm"
-                  placeholder="输入密码"
+                  placeholder={t('输入密码')}
                   required
                   autoComplete="current-password"
                 />
@@ -123,12 +127,12 @@ export default function Login() {
               disabled={loading}
               className="w-full bg-black text-white py-2.5 rounded-md hover:bg-gray-800 focus:outline-none focus:ring-2 focus:ring-black focus:ring-offset-2 transition-colors disabled:opacity-50 disabled:cursor-not-allowed text-sm font-medium"
             >
-              {loading ? '登录中...' : '登录'}
+              {loading ? t('登录中...') : t('登录')}
             </button>
           </form>
         </div>
 
-        <p className="text-center text-xs text-gray-400 mt-6">CLICD v1.1.20</p>
+        <p className="text-center text-xs text-gray-400 mt-6">CLICD v1.1.28</p>
       </div>
     </div>
   )

frontend/src/pages/Routing.tsx

@@ -1,6 +1,6 @@
 import { useCallback, useEffect, useMemo, useRef, useState, type ReactNode } from 'react'
 import { Globe2, Network, Pencil, Plus, RefreshCw, Router, Save, Search, Server, Trash2, X } from 'lucide-react'
-import { useNavigate } from 'react-router-dom'
+import { useNavigate } from 'react-router'
 import { useLanguage, type Language } from '../contexts/LanguageContext'
 import {
   getRoutingInfo,
@@ -9,6 +9,7 @@ import {
   updateRoutingPools,
   type IPv4Route,
   type IPv6Route,
+  type LANDHCPRoute,
   type IPv6PrefixInfo,
   type NAT4PortRange,
   type NAT4Route,
@@ -56,10 +57,12 @@ export default function Routing() {
 
   const publicIPv4s = routing?.public_ipv4_addresses || []
   const ipv4Assignments = routing?.ipv4_assignments || []
+  const lanDHCPAssignments = routing?.lan_dhcp_assignments || []
   const nat4Mappings = routing?.nat4_mappings || []
   const ipv6Prefixes = routing?.ipv6_prefixes || []
   const ipv6Assignments = routing?.ipv6_assignments || []
   const nat4Range = routing?.nat4_port_range || { start: 20000, end: 65535 }
+  const nat4Networks = routing?.nat4_networks
   const defaultIPv4Interface = routing?.host_public_ipv4?.interface || publicIPv4s[0]?.interface || 'eth0'
   const defaultIPv4Gateway = routing?.host_public_ipv4?.gateway || publicIPv4s[0]?.gateway || ''
   const defaultIPv4PrefixLen = routing?.host_public_ipv4?.prefix_len || publicIPv4s[0]?.prefix_len || 32
@@ -276,7 +279,7 @@ export default function Routing() {
         </button>
       </div>
 
-      <div className="grid gap-4 md:grid-cols-3">
+      <div className="grid gap-4 md:grid-cols-4">
         <CapacityCard
           title={text.nat4Ports}
           watermark="NAT4"
@@ -285,7 +288,10 @@ export default function Routing() {
           used={routing?.nat4.used || 0}
           label={text.remainingTotal}
           usedLabel={text.used}
-          detail={formatNATRange(nat4Range, language)}
+          detail={[
+            formatNATRange(nat4Range, language),
+            nat4Networks ? `LXC ${nat4Networks.lxc.subnet} · KVM ${nat4Networks.kvm.subnet}` : '',
+          ].filter(Boolean).join(' · ')}
           action={
             <button onClick={startEditNAT4} className="rounded p-1.5 text-gray-500 hover:bg-gray-100 hover:text-black" title={text.editNAT4Range}>
               <Pencil className="h-4 w-4" />
@@ -293,6 +299,7 @@ export default function Routing() {
           }
         />
         <CapacityCard title={text.publicIPv4} watermark="IPv4" remaining={routing?.ipv4.remaining || '0'} total={routing?.ipv4.total || '0'} used={routing?.ipv4.used || 0} label={formatPoolCount(publicIPv4s.length, language)} usedLabel={text.used} />
+        <CapacityCard title={text.lanDHCP} watermark="LAN" remaining={String(routing?.lan_dhcp.used || 0)} total={routing?.lan_dhcp.total || 'DHCP'} used={routing?.lan_dhcp.used || 0} label={text.dhcpManagedByLAN} usedLabel={text.used} />
         <CapacityCard title="IPv6" watermark="IPv6" remaining={formatCapacity(routing?.ipv6.remaining || '0', language)} total={formatCapacity(routing?.ipv6.total || '0', language)} used={routing?.ipv6.used || 0} label={formatDetectedPrefixCount(ipv6Prefixes.length, language)} usedLabel={text.used} />
       </div>
 
@@ -541,6 +548,48 @@ export default function Routing() {
         </RouteModal>
       )}
 
+      <Panel title={text.lanDHCPAssignments} subtitle={formatAddressSubtitle(lanDHCPAssignments.length, lanDHCPAssignments.length, language)}>
+        {lanDHCPAssignments.length === 0 ? (
+          <EmptyState text={text.noLANDHCPAssignments} icon={<Network className="h-7 w-7" />} />
+        ) : (
+          <div className="overflow-x-auto">
+            <table className="w-full min-w-[980px] text-sm">
+              <thead className="border-b border-gray-200 bg-gray-50 text-xs text-gray-500">
+                <tr>
+                  <th className="px-4 py-3 text-left font-medium">{text.container}</th>
+                  <th className="px-4 py-3 text-left font-medium">{text.runtimeName}</th>
+                  <th className="px-4 py-3 text-left font-medium">{text.guestIPv4}</th>
+                  <th className="px-4 py-3 text-left font-medium">模式</th>
+                  <th className="px-4 py-3 text-left font-medium">{text.gateway}</th>
+                  <th className="px-4 py-3 text-left font-medium">MAC</th>
+                  <th className="px-4 py-3 text-left font-medium">{text.interface}</th>
+                  <th className="px-4 py-3 text-left font-medium">{text.status}</th>
+                </tr>
+              </thead>
+              <tbody className="divide-y divide-gray-100">
+                {lanDHCPAssignments.map((item: LANDHCPRoute) => (
+                  <tr key={`${item.container_id}-${item.interface}-${item.mac_address || item.address}`} className="hover:bg-gray-50">
+                    <td className="px-4 py-3">
+                      <button onClick={() => navigate(`/container/${item.container_id}`)} className="inline-flex items-center gap-2 text-left font-medium text-black hover:underline">
+                        <Server className="h-4 w-4 text-gray-400" />
+                        {item.container_name}
+                      </button>
+                    </td>
+                    <td className="px-4 py-3 font-mono text-xs text-gray-600">{item.lxc_name}</td>
+                    <td className="px-4 py-3 font-mono text-xs text-gray-700">{item.address ? `${item.address}${item.prefix_len ? `/${item.prefix_len}` : ''}` : '-'}</td>
+                    <td className="px-4 py-3 text-xs text-gray-600">{item.mode === 'static' ? '手动' : 'DHCP'}</td>
+                    <td className="px-4 py-3 font-mono text-xs text-gray-600">{item.gateway || '-'}</td>
+                    <td className="px-4 py-3 font-mono text-xs text-gray-600">{item.mac_address || '-'}</td>
+                    <td className="px-4 py-3 font-mono text-xs text-gray-600">{item.interface || '-'}</td>
+                    <td className="px-4 py-3"><StatusBadge status={item.status} language={language} /></td>
+                  </tr>
+                ))}
+              </tbody>
+            </table>
+          </div>
+        )}
+      </Panel>
+
       <Panel title={text.ipv4NAT} subtitle={formatMappingSubtitle(filteredNat4.length, nat4Mappings.length, language)} action={<SearchBox value={nat4Search} onChange={setNat4Search} placeholder={text.searchNAT} />}>
         {nat4Mappings.length === 0 ? (
           <EmptyState text={text.noIPv4NATMappings} icon={<Network className="h-7 w-7" />} />
@@ -851,6 +900,10 @@ const routingText = {
     saveNAT4RangeFailed: '保存 NAT4 范围失败',
     remainingTotal: '剩余 / 总数',
     publicIPv4: '公网 IPv4',
+    lanDHCP: '局域网 DHCP',
+    dhcpManagedByLAN: '由局域网 DHCP 分配',
+    lanDHCPAssignments: '局域网 DHCP 分配',
+    noLANDHCPAssignments: '暂无局域网 DHCP 分配',
     publicIPv4Pool: '公网 IPv4 池',
     editPool: '编辑 IP 池',
     noPublicIPv4Pool: '暂未配置公网 IPv4 池',
@@ -922,6 +975,10 @@ const routingText = {
     saveNAT4RangeFailed: 'Save NAT4 range failed',
     remainingTotal: 'remaining / total',
     publicIPv4: 'Public IPv4',
+    lanDHCP: 'LAN DHCP',
+    dhcpManagedByLAN: 'Managed by LAN DHCP',
+    lanDHCPAssignments: 'LAN DHCP assignments',
+    noLANDHCPAssignments: 'No LAN DHCP assignments',
     publicIPv4Pool: 'Public IPv4 pool',
     editPool: 'Edit pool',
     noPublicIPv4Pool: 'No public IPv4 pool configured',

frontend/src/pages/Settings.tsx

@@ -1,23 +1,42 @@
 import { Dispatch, SetStateAction, useCallback, useEffect, useState } from 'react'
-import { Clock, Globe, Lock, LogIn, Monitor, RefreshCw, ShieldCheck, Terminal, Upload, UserCog } from 'lucide-react'
+import { Clock, Globe, ListTodo, Lock, LogIn, Minus, Monitor, Plus, RefreshCw, Save, Shield, ShieldCheck, Terminal, Upload, UserCog } from 'lucide-react'
 import {
   changePassword,
   changeUsername,
   getLoginLogs,
+  getPanelAccessPolicy,
   getSSLSettings,
+  getTaskQueueSettings,
   getWebSSHOriginSettings,
   LoginLog,
+  PanelAccessPolicy,
   SSLSettings,
+  TaskQueueSettings,
+  updateTaskQueueSettings,
   updateSSLSettings,
+  updatePanelAccessPolicy,
   updateWebSSHOriginSettings,
   WebSSHOriginSettings,
 } from '../services/api'
 import { useDialog } from '../components/Dialog'
 import { useAuth } from '../contexts/AuthContext'
+import { useLanguage } from '../contexts/LanguageContext'
+
+type SettingsSection = 'tasks' | 'account' | 'access' | 'webssh' | 'ssl' | 'logs'
+
+const settingsSections = [
+  { id: 'tasks', label: '任务队列', icon: ListTodo },
+  { id: 'account', label: '账号设置', icon: UserCog },
+  { id: 'access', label: '访问来源', icon: Shield },
+  { id: 'webssh', label: 'WebSSH 访问', icon: Terminal },
+  { id: 'ssl', label: 'SSL 证书', icon: ShieldCheck },
+  { id: 'logs', label: '登录日志', icon: LogIn },
+] as const
 
 export default function Settings() {
   const dialog = useDialog()
   const { username } = useAuth()
+  const { t } = useLanguage()
   const [logs, setLogs] = useState<LoginLog[]>([])
   const [loading, setLoading] = useState(true)
   const [logPage, setLogPage] = useState(1)
@@ -39,6 +58,15 @@ export default function Settings() {
   const [webSSHOrigins, setWebSSHOrigins] = useState<WebSSHOriginSettings | null>(null)
   const [webSSHOriginsText, setWebSSHOriginsText] = useState('')
   const [savingWebSSHOrigins, setSavingWebSSHOrigins] = useState(false)
+  const [taskQueue, setTaskQueue] = useState<TaskQueueSettings | null>(null)
+  const [taskConcurrency, setTaskConcurrency] = useState(2)
+  const [savingTaskQueue, setSavingTaskQueue] = useState(false)
+  const [accessPolicy, setAccessPolicy] = useState<PanelAccessPolicy | null>(null)
+  const [accessEnabled, setAccessEnabled] = useState(false)
+  const [allowedSourcesText, setAllowedSourcesText] = useState('')
+  const [trustedProxiesText, setTrustedProxiesText] = useState('')
+  const [savingAccessPolicy, setSavingAccessPolicy] = useState(false)
+  const [activeSection, setActiveSection] = useState<SettingsSection>('tasks')
 
   const fetchLogs = useCallback(async () => {
     try {
@@ -78,13 +106,64 @@ export default function Settings() {
     }
   }, [])
 
+  const fetchTaskQueue = useCallback(async () => {
+    try {
+      const res = await getTaskQueueSettings()
+      const data = res.data.data
+      if (!data) return
+      setTaskQueue(data)
+      setTaskConcurrency(data.concurrency)
+    } catch (err) {
+      console.error(err)
+    }
+  }, [])
+
+  const fetchAccessPolicy = useCallback(async () => {
+    try {
+      const res = await getPanelAccessPolicy()
+      const data = res.data.data
+      if (!data) return
+      setAccessPolicy(data)
+      setAccessEnabled(data.enabled)
+      setAllowedSourcesText((data.allowed_sources || []).join('\n'))
+      setTrustedProxiesText((data.trusted_proxies || []).join('\n'))
+    } catch (err) {
+      console.error(err)
+    }
+  }, [])
+
   useEffect(() => {
     fetchLogs()
     fetchSSL()
     fetchWebSSHOrigins()
-    const timer = setInterval(fetchLogs, 15000)
-    return () => clearInterval(timer)
-  }, [fetchLogs, fetchSSL, fetchWebSSHOrigins])
+    fetchTaskQueue()
+    fetchAccessPolicy()
+    const logTimer = setInterval(fetchLogs, 15000)
+    const taskTimer = setInterval(fetchTaskQueue, 5000)
+    return () => {
+      clearInterval(logTimer)
+      clearInterval(taskTimer)
+    }
+  }, [fetchAccessPolicy, fetchLogs, fetchSSL, fetchTaskQueue, fetchWebSSHOrigins])
+
+  const handleSaveTaskQueue = async () => {
+    const concurrency = Math.max(1, Math.min(16, Math.round(taskConcurrency || 1)))
+    setSavingTaskQueue(true)
+    try {
+      const res = await updateTaskQueueSettings(concurrency)
+      const data = res.data.data
+      if (data) {
+        setTaskQueue(data)
+        setTaskConcurrency(data.concurrency)
+      }
+      dialog.alert('完成', '任务队列并发设置已保存并立即生效')
+    } catch (err: unknown) {
+      const e = err as { response?: { data?: { message?: string } } }
+      dialog.alert('失败', e.response?.data?.message || '任务队列设置保存失败')
+    } finally {
+      setSavingTaskQueue(false)
+    }
+  }
 
   const handleSSLModeChange = (mode: SSLSettings['mode']) => {
     setSSLMode(mode)
@@ -139,6 +218,38 @@ export default function Settings() {
     }
   }
 
+  const handleAccessEnabledChange = (enabled: boolean) => {
+    setAccessEnabled(enabled)
+    if (enabled && !allowedSourcesText.trim() && accessPolicy?.current_source) {
+      setAllowedSourcesText(accessPolicy.current_source)
+    }
+  }
+
+  const handleSaveAccessPolicy = async () => {
+    const splitEntries = (value: string) => value.split(/[\s,;]+/).map(item => item.trim()).filter(Boolean)
+    setSavingAccessPolicy(true)
+    try {
+      const res = await updatePanelAccessPolicy({
+        enabled: accessEnabled,
+        allowed_sources: splitEntries(allowedSourcesText),
+        trusted_proxies: splitEntries(trustedProxiesText),
+      })
+      const data = res.data.data
+      if (data) {
+        setAccessPolicy(data)
+        setAccessEnabled(data.enabled)
+        setAllowedSourcesText((data.allowed_sources || []).join('\n'))
+        setTrustedProxiesText((data.trusted_proxies || []).join('\n'))
+      }
+      dialog.alert('完成', accessEnabled ? '面板访问来源策略已保存并立即生效' : '面板访问来源限制已关闭')
+    } catch (err: unknown) {
+      const e = err as { response?: { data?: { message?: string } } }
+      dialog.alert('失败', e.response?.data?.message || '面板访问来源策略保存失败')
+    } finally {
+      setSavingAccessPolicy(false)
+    }
+  }
+
   const handleSaveAccount = async () => {
     if (!oldPwd) {
       dialog.alert('提示', '请输入当前密码以确认修改')
@@ -190,14 +301,101 @@ export default function Settings() {
   const totalPages = Math.ceil(logs.length / pageSize)
 
   return (
-    <div className="space-y-6">
+    <div className="space-y-5">
       <div>
-        <h1 className="text-2xl font-bold text-black">面板设置</h1>
-        <p className="mt-1 text-sm text-gray-500">账号、安全证书与登录日志</p>
+        <h1 className="text-2xl font-bold text-black dark:text-white">面板设置</h1>
+        <p className="mt-1 text-sm text-gray-500 dark:text-gray-400">任务队列、账号、访问控制、安全证书与访问记录</p>
       </div>
 
-      <div className="grid items-start gap-6 xl:grid-cols-[minmax(0,1.15fr)_minmax(360px,0.85fr)]">
-        <div className="space-y-6">
+      <div className="grid items-start gap-4 lg:grid-cols-[210px_minmax(0,1fr)]">
+        <aside className="overflow-x-auto rounded-lg border border-gray-200 bg-white p-2 dark:border-gray-700 dark:bg-gray-900 lg:sticky lg:top-4">
+          <nav className="flex min-w-max gap-1 lg:min-w-0 lg:flex-col" aria-label="设置分类">
+            {settingsSections.map((section) => {
+              const Icon = section.icon
+              const active = activeSection === section.id
+              return (
+                <button
+                  key={section.id}
+                  type="button"
+                  onClick={() => setActiveSection(section.id)}
+                  className={`flex items-center gap-2 rounded-md px-3 py-2.5 text-left text-sm font-medium transition-colors ${active ? 'bg-black text-white dark:bg-white dark:text-black' : 'text-gray-600 hover:bg-gray-100 hover:text-black dark:text-gray-300 dark:hover:bg-gray-800 dark:hover:text-white'}`}
+                >
+                  <Icon className="h-4 w-4 flex-shrink-0" />
+                  <span>{t(section.label)}</span>
+                </button>
+              )
+            })}
+          </nav>
+        </aside>
+
+        <section className="min-w-0">
+          {activeSection === 'tasks' && (
+            <TaskQueueCard
+              settings={taskQueue}
+              concurrency={taskConcurrency}
+              saving={savingTaskQueue}
+              onConcurrencyChange={setTaskConcurrency}
+              onRefresh={fetchTaskQueue}
+              onSave={handleSaveTaskQueue}
+            />
+          )}
+
+          {activeSection === 'account' && (
+            <div className="rounded-lg border border-gray-200 bg-white p-5 dark:border-gray-700 dark:bg-gray-900">
+              <h2 className="mb-4 flex items-center gap-2 text-sm font-semibold text-black dark:text-white">
+                <UserCog className="h-4 w-4" />账号设置
+              </h2>
+              <div className="grid gap-4 md:grid-cols-2">
+                <div>
+                  <label className="mb-1 block text-xs text-gray-500">当前用户名</label>
+                  <input type="text" value={username || ''} disabled className="w-full rounded-md border border-gray-200 bg-gray-50 px-3 py-2 text-sm text-gray-400 dark:border-gray-700 dark:bg-gray-800 dark:text-gray-500" />
+                </div>
+                <div>
+                  <label className="mb-1 block text-xs text-gray-500">新用户名，留空则不修改</label>
+                  <input type="text" value={newUsername} onChange={(e) => setNewUsername(e.target.value)} className="w-full rounded-md border border-gray-300 bg-white px-3 py-2 text-sm text-black dark:border-gray-700 dark:bg-gray-950 dark:text-white" placeholder="至少 3 位" />
+                </div>
+                <div>
+                  <label className="mb-1 block text-xs text-gray-500">新密码，留空则不修改</label>
+                  <input type="password" value={newPwd} onChange={(e) => setNewPwd(e.target.value)} className="w-full rounded-md border border-gray-300 bg-white px-3 py-2 text-sm text-black dark:border-gray-700 dark:bg-gray-950 dark:text-white" placeholder="至少 6 位" />
+                </div>
+                <div>
+                  <label className="mb-1 block text-xs text-gray-500">当前密码，验证身份</label>
+                  <input type="password" value={oldPwd} onChange={(e) => setOldPwd(e.target.value)} className="w-full rounded-md border border-gray-300 bg-white px-3 py-2 text-sm text-black dark:border-gray-700 dark:bg-gray-950 dark:text-white" placeholder="输入当前密码以确认修改" />
+                </div>
+              </div>
+              <div className="mt-4 flex justify-end">
+                <button onClick={handleSaveAccount} className="rounded-md bg-black px-4 py-2 text-sm text-white hover:bg-gray-800 dark:bg-white dark:text-black dark:hover:bg-gray-200">保存修改</button>
+              </div>
+            </div>
+          )}
+
+          {activeSection === 'webssh' && (
+            <WebSSHOriginCard
+              settings={webSSHOrigins}
+              originsText={webSSHOriginsText}
+              saving={savingWebSSHOrigins}
+              onOriginsTextChange={setWebSSHOriginsText}
+              onRefresh={fetchWebSSHOrigins}
+              onSave={handleSaveWebSSHOrigins}
+            />
+          )}
+
+          {activeSection === 'access' && (
+            <PanelAccessPolicyCard
+              policy={accessPolicy}
+              enabled={accessEnabled}
+              allowedSourcesText={allowedSourcesText}
+              trustedProxiesText={trustedProxiesText}
+              saving={savingAccessPolicy}
+              onEnabledChange={handleAccessEnabledChange}
+              onAllowedSourcesTextChange={setAllowedSourcesText}
+              onTrustedProxiesTextChange={setTrustedProxiesText}
+              onRefresh={fetchAccessPolicy}
+              onSave={handleSaveAccessPolicy}
+            />
+          )}
+
+          {activeSection === 'ssl' && (
             <SSLCard
               ssl={ssl}
               sslEnabled={sslEnabled}
@@ -218,44 +416,176 @@ export default function Settings() {
               onApplyNowChange={setApplyNow}
               onSave={handleSaveSSL}
             />
+          )}
 
-          <WebSSHOriginCard
-            settings={webSSHOrigins}
-            originsText={webSSHOriginsText}
-            saving={savingWebSSHOrigins}
-            onOriginsTextChange={setWebSSHOriginsText}
-            onRefresh={fetchWebSSHOrigins}
-            onSave={handleSaveWebSSHOrigins}
+          {activeSection === 'logs' && (
+            <LoginLogCard logs={logs} logPage={logPage} pageSize={pageSize} totalPages={totalPages} setLogPage={setLogPage} />
+          )}
+        </section>
+      </div>
+    </div>
+  )
+}
+
+interface TaskQueueCardProps {
+  settings: TaskQueueSettings | null
+  concurrency: number
+  saving: boolean
+  onConcurrencyChange: (value: number) => void
+  onRefresh: () => void
+  onSave: () => void
+}
+
+interface PanelAccessPolicyCardProps {
+  policy: PanelAccessPolicy | null
+  enabled: boolean
+  allowedSourcesText: string
+  trustedProxiesText: string
+  saving: boolean
+  onEnabledChange: (enabled: boolean) => void
+  onAllowedSourcesTextChange: (value: string) => void
+  onTrustedProxiesTextChange: (value: string) => void
+  onRefresh: () => void
+  onSave: () => void
+}
+
+function PanelAccessPolicyCard(props: PanelAccessPolicyCardProps) {
+  return (
+    <div className="rounded-lg border border-gray-200 bg-white p-5 dark:border-gray-700 dark:bg-gray-900">
+      <div className="mb-4 flex items-center justify-between gap-3">
+        <div>
+          <h2 className="flex items-center gap-2 text-sm font-semibold text-black dark:text-white">
+            <Shield className="h-4 w-4" />访问来源策略
+          </h2>
+          <p className="mt-1 text-xs text-gray-500 dark:text-gray-400">限制可访问面板、登录和 API 的来源地址</p>
+        </div>
+        <button type="button" onClick={props.onRefresh} className="rounded-md border border-gray-200 p-1.5 text-gray-500 hover:bg-gray-50 dark:border-gray-700 dark:text-gray-400 dark:hover:bg-gray-800" title="刷新">
+          <RefreshCw className="h-4 w-4" />
+        </button>
+      </div>
+
+      <div className="flex items-center justify-between gap-4 border-y border-gray-100 py-3 dark:border-gray-800">
+        <div>
+          <div className="text-sm font-medium text-gray-800 dark:text-gray-200">启用访问白名单</div>
+          <div className="mt-0.5 text-xs text-gray-500 dark:text-gray-400">关闭后不限制访问来源</div>
+        </div>
+        <button
+          type="button"
+          role="switch"
+          aria-checked={props.enabled}
+          onClick={() => props.onEnabledChange(!props.enabled)}
+          className={`access-policy-switch relative inline-flex h-6 w-11 flex-shrink-0 items-center rounded-full border transition-colors focus:outline-none focus:ring-2 focus:ring-black focus:ring-offset-2 dark:focus:ring-white dark:focus:ring-offset-gray-900 ${
+            props.enabled
+              ? 'border-black bg-black dark:border-white dark:bg-white'
+              : 'border-gray-300 bg-gray-300 dark:border-gray-600 dark:bg-gray-700'
+          }`}
+          title={props.enabled ? '关闭访问白名单' : '启用访问白名单'}
+        >
+          <span
+            aria-hidden="true"
+            className={`access-policy-switch-thumb pointer-events-none absolute left-0.5 top-0.5 h-5 w-5 rounded-full shadow-sm ring-1 ring-black/5 transition-[transform,background-color] duration-200 ${
+              props.enabled
+                ? 'translate-x-5 bg-white dark:bg-gray-900'
+                : 'translate-x-0 bg-white dark:bg-gray-200'
+            }`}
+          />
+        </button>
+      </div>
+
+      <div className="mt-4 grid gap-4 lg:grid-cols-2">
+        <div>
+          <label className="mb-1.5 block text-xs font-medium text-gray-600 dark:text-gray-300">允许的 IP / CIDR</label>
+          <textarea
+            value={props.allowedSourcesText}
+            onChange={(event) => props.onAllowedSourcesTextChange(event.target.value)}
+            rows={6}
+            disabled={!props.enabled}
+            className="w-full rounded-md border border-gray-300 bg-white px-3 py-2 font-mono text-xs text-black outline-none focus:border-black focus:ring-1 focus:ring-black disabled:bg-gray-50 disabled:text-gray-400 dark:border-gray-700 dark:bg-gray-950 dark:text-white dark:focus:border-white dark:focus:ring-white dark:disabled:bg-gray-800 dark:disabled:text-gray-500"
+            placeholder={'203.0.113.10\n192.168.1.0/24\n2001:db8::/32'}
           />
         </div>
+        <div>
+          <label className="mb-1.5 block text-xs font-medium text-gray-600 dark:text-gray-300">可信代理 IP / CIDR</label>
+          <textarea
+            value={props.trustedProxiesText}
+            onChange={(event) => props.onTrustedProxiesTextChange(event.target.value)}
+            rows={6}
+            disabled={!props.enabled}
+            className="w-full rounded-md border border-gray-300 bg-white px-3 py-2 font-mono text-xs text-black outline-none focus:border-black focus:ring-1 focus:ring-black disabled:bg-gray-50 disabled:text-gray-400 dark:border-gray-700 dark:bg-gray-950 dark:text-white dark:focus:border-white dark:focus:ring-white dark:disabled:bg-gray-800 dark:disabled:text-gray-500"
+            placeholder={'127.0.0.1\n10.0.0.0/8'}
+          />
+          <p className="mt-1.5 text-xs text-gray-500 dark:text-gray-400">仅可信代理可提供真实客户端地址；未使用反向代理时留空</p>
+        </div>
+      </div>
 
-        <div className="rounded-lg border border-gray-200 bg-white p-5">
-          <h2 className="mb-4 flex items-center gap-2 text-sm font-semibold text-black">
-            <UserCog className="h-4 w-4" />账号设置
+      <div className="mt-4 grid gap-2 rounded-md border border-gray-100 bg-gray-50 p-3 text-xs dark:border-gray-800 dark:bg-gray-950 sm:grid-cols-2">
+        <div>
+          <span className="text-gray-500 dark:text-gray-400">当前识别来源</span>
+          <div className="mt-0.5 break-all font-mono text-gray-800 dark:text-gray-200">{props.policy?.current_source || '-'}</div>
+        </div>
+        <div>
+          <span className="text-gray-500 dark:text-gray-400">直接连接来源</span>
+          <div className="mt-0.5 break-all font-mono text-gray-800 dark:text-gray-200">{props.policy?.direct_source || '-'}</div>
+        </div>
+      </div>
+
+      <div className="mt-4 flex justify-end">
+        <button type="button" onClick={props.onSave} disabled={props.saving} className="inline-flex items-center justify-center gap-2 rounded-md bg-black px-4 py-2 text-sm text-white hover:bg-gray-800 disabled:opacity-50 dark:bg-white dark:text-black dark:hover:bg-gray-200">
+          <Save className="h-4 w-4" />
+          {props.saving ? '保存中...' : '保存访问策略'}
+        </button>
+      </div>
+    </div>
+  )
+}
+
+function TaskQueueCard(props: TaskQueueCardProps) {
+  const setBounded = (value: number) => props.onConcurrencyChange(Math.max(1, Math.min(16, value)))
+  return (
+    <div className="rounded-lg border border-gray-200 bg-white p-4">
+      <div className="mb-4 flex items-center justify-between gap-3">
+        <h2 className="flex items-center gap-2 text-sm font-semibold text-black">
+          <ListTodo className="h-4 w-4" />任务队列
         </h2>
-          <div className="space-y-4">
-            <div>
-              <label className="mb-1 block text-xs text-gray-500">当前用户名</label>
-              <input type="text" value={username || ''} disabled className="w-full rounded-md border border-gray-200 bg-gray-50 px-3 py-2 text-sm text-gray-400" />
+        <button onClick={props.onRefresh} className="rounded-md border border-gray-200 p-1.5 text-gray-500 hover:bg-gray-50" title="刷新">
+          <RefreshCw className="h-4 w-4" />
+        </button>
       </div>
-            <div>
-              <label className="mb-1 block text-xs text-gray-500">新用户名，留空则不修改</label>
-              <input type="text" value={newUsername} onChange={(e) => setNewUsername(e.target.value)} className="w-full rounded-md border border-gray-300 bg-white px-3 py-2 text-sm text-black" placeholder="至少 3 位" />
+      <div className="grid grid-cols-2 divide-x divide-gray-200 border-y border-gray-100 bg-gray-50">
+        <div className="px-3 py-2">
+          <div className="text-[11px] text-gray-500">运行中</div>
+          <div className="mt-0.5 text-lg font-semibold text-gray-900">{props.settings?.active ?? 0}</div>
         </div>
-            <div className="border-t border-gray-100 pt-3">
-              <label className="mb-1 block text-xs text-gray-500">新密码，留空则不修改</label>
-              <input type="password" value={newPwd} onChange={(e) => setNewPwd(e.target.value)} className="w-full rounded-md border border-gray-300 bg-white px-3 py-2 text-sm text-black" placeholder="至少 6 位" />
-            </div>
-            <div>
-              <label className="mb-1 block text-xs text-gray-500">当前密码，验证身份</label>
-              <input type="password" value={oldPwd} onChange={(e) => setOldPwd(e.target.value)} className="w-full rounded-md border border-gray-300 bg-white px-3 py-2 text-sm text-black" placeholder="输入当前密码以确认修改" />
-            </div>
-            <button onClick={handleSaveAccount} className="w-full rounded-md bg-black px-4 py-2 text-sm text-white hover:bg-gray-800">保存修改</button>
+        <div className="px-3 py-2">
+          <div className="text-[11px] text-gray-500">等待中</div>
+          <div className="mt-0.5 text-lg font-semibold text-gray-900">{props.settings?.pending ?? 0}</div>
         </div>
       </div>
+      <div className="mt-4">
+        <label className="mb-1.5 block text-xs text-gray-500">总并发上限</label>
+        <div className="flex h-9 items-stretch">
+          <button type="button" onClick={() => setBounded(props.concurrency - 1)} disabled={props.concurrency <= 1} className="flex w-10 items-center justify-center rounded-l-md border border-gray-300 text-gray-600 hover:bg-gray-50 disabled:opacity-30" title="减少并发">
+            <Minus className="h-4 w-4" />
+          </button>
+          <input
+            type="number"
+            min={1}
+            max={16}
+            value={props.concurrency}
+            onChange={(event) => setBounded(Number(event.target.value) || 1)}
+            className="min-w-0 flex-1 border-y border-gray-300 px-2 text-center text-sm font-medium text-black outline-none focus:ring-2 focus:ring-inset focus:ring-black"
+          />
+          <button type="button" onClick={() => setBounded(props.concurrency + 1)} disabled={props.concurrency >= 16} className="flex w-10 items-center justify-center rounded-r-md border border-gray-300 text-gray-600 hover:bg-gray-50 disabled:opacity-30" title="增加并发">
+            <Plus className="h-4 w-4" />
+          </button>
+        </div>
+      </div>
+      <div className="mt-4 flex justify-end">
+        <button onClick={props.onSave} disabled={props.saving} className="inline-flex items-center justify-center gap-2 rounded-md bg-black px-4 py-2 text-sm text-white hover:bg-gray-800 disabled:opacity-50">
+          <Save className="h-4 w-4" />
+          {props.saving ? '保存中...' : '保存队列设置'}
+        </button>
       </div>
-
-      <LoginLogCard logs={logs} logPage={logPage} pageSize={pageSize} totalPages={totalPages} setLogPage={setLogPage} />
     </div>
   )
 }
@@ -292,7 +622,7 @@ interface WebSSHOriginCardProps {
 
 function WebSSHOriginCard(props: WebSSHOriginCardProps) {
   return (
-    <div className="rounded-lg border border-gray-200 bg-white p-5">
+    <div className="rounded-lg border border-gray-200 bg-white p-4">
       <div className="mb-4 flex items-center justify-between gap-3">
         <h2 className="flex items-center gap-2 text-sm font-semibold text-black">
           <Terminal className="h-4 w-4" />WebSSH Origin 白名单
@@ -307,7 +637,7 @@ function WebSSHOriginCard(props: WebSSHOriginCardProps) {
           <textarea
             value={props.originsText}
             onChange={(e) => props.onOriginsTextChange(e.target.value)}
-            rows={5}
+            rows={4}
             className="w-full rounded-md border border-gray-300 bg-white px-3 py-2 font-mono text-xs text-black"
           />
         </div>
@@ -315,12 +645,14 @@ function WebSSHOriginCard(props: WebSSHOriginCardProps) {
           <div className="truncate font-mono" title={props.settings?.current_origin || ''}>当前面板来源：{props.settings?.current_origin || '-'}</div>
           <div className="mt-1">默认允许当前面板来源和本机回环来源；额外域名每行填写一个完整 Origin。</div>
         </div>
-        <button onClick={props.onSave} disabled={props.saving} className="inline-flex w-full items-center justify-center gap-2 rounded-md bg-black px-4 py-2 text-sm text-white hover:bg-gray-800 disabled:opacity-50">
+        <div className="flex justify-end">
+          <button onClick={props.onSave} disabled={props.saving} className="inline-flex items-center justify-center gap-2 rounded-md bg-black px-4 py-2 text-sm text-white hover:bg-gray-800 disabled:opacity-50">
             <Upload className="h-4 w-4" />
             {props.saving ? '保存中...' : '保存 Origin 白名单'}
           </button>
         </div>
       </div>
+    </div>
   )
 }
 
@@ -425,12 +757,14 @@ function SSLCard(props: SSLCardProps) {
           保存后自动重启服务并立即生效
         </label>
 
-        <button onClick={props.onSave} disabled={props.savingSSL} className="inline-flex w-full items-center justify-center gap-2 rounded-md bg-black px-4 py-2 text-sm text-white hover:bg-gray-800 disabled:opacity-50">
+        <div className="flex justify-end">
+          <button onClick={props.onSave} disabled={props.savingSSL} className="inline-flex items-center justify-center gap-2 rounded-md bg-black px-4 py-2 text-sm text-white hover:bg-gray-800 disabled:opacity-50">
             <Upload className="h-4 w-4" />
             {props.savingSSL ? '保存中...' : '保存 SSL 设置'}
           </button>
         </div>
       </div>
+    </div>
   )
 }