backend: harden rootless app lifecycle orchestration

core/container/src/podman_client.rs

@@ -56,9 +56,9 @@ pub enum ContainerState {
 impl From<&str> for ContainerState {
     fn from(s: &str) -> Self {
         match s.to_lowercase().as_str() {
-            "created" => ContainerState::Created,
+            "created" | "initialized" => ContainerState::Created,
             "running" => ContainerState::Running,
-            "stopping" => ContainerState::Stopping,
+            "stopping" | "removing" => ContainerState::Stopping,
             "stopped" => ContainerState::Stopped,
             "exited" => ContainerState::Exited,
             "paused" => ContainerState::Paused,
@@ -129,7 +129,6 @@ impl PodmanClient {
             "filebrowser" => "http://localhost:8083",
             "nginx-proxy-manager" => "http://localhost:8081",
             "portainer" => "http://localhost:9000",
-            "saleor" => "http://localhost:9011",
             "uptime-kuma" => "http://localhost:3002",
             "fedimint" | "fedimintd" => "http://localhost:8175",
             "fedimint-gateway" => "http://localhost:8176",
@@ -390,7 +389,7 @@ impl PodmanClient {
             "cap_add": cap_add,
             "cap_drop": cap_drop,
             "read_only_filesystem": manifest.app.security.readonly_root,
-            "no_new_privileges": true,
+            "no_new_privileges": manifest.app.security.no_new_privileges,
             "restart_policy": "unless-stopped",
             "restart_tries": 5,
             "netns": {
@@ -635,6 +634,7 @@ fn podman_network_settings(
         Some("bridge") => ("bridge", None),
         Some("none") => ("none", None),
         Some("slirp4netns") => ("slirp4netns", None),
+        Some("pasta") => ("pasta", None),
         Some("private") => ("private", None),
         Some(custom) => ("bridge", Some(custom.to_string())),
         None if network_policy == "host" => ("host", None),