underpost 3.2.28 → 3.2.70

package/docker-compose.yml

@@ -26,7 +26,7 @@ services:
   mongodb:
     image: ${MONGO_IMAGE:-mongo:latest}
     container_name: dd-mongodb
-    entrypoint: ["bash", "/docker-init/entrypoint.sh"]
+    entrypoint: ['bash', '/docker-init/entrypoint.sh']
     environment:
       MONGO_INITDB_ROOT_USERNAME: ${MONGO_INITDB_ROOT_USERNAME:?set MONGO_INITDB_ROOT_USERNAME in docker/compose.env}
       MONGO_INITDB_ROOT_PASSWORD: ${MONGO_INITDB_ROOT_PASSWORD:?set MONGO_INITDB_ROOT_PASSWORD in docker/compose.env}
@@ -38,9 +38,9 @@ services:
     networks:
       - dd-internal
     expose:
-      - "27017"
+      - '27017'
     ports:
-      - "${MONGO_HOST_PORT:-27017}:27017"
+      - '${MONGO_HOST_PORT:-27017}:27017'
     healthcheck:
       test:
         - CMD-SHELL
@@ -58,18 +58,18 @@ services:
   valkey-service:
     image: ${VALKEY_IMAGE:-valkey/valkey:latest}
     container_name: dd-valkey
-    command: ["valkey-server", "--port", "6379", "--bind", "0.0.0.0", "--protected-mode", "no"]
+    command: ['valkey-server', '--port', '6379', '--bind', '0.0.0.0', '--protected-mode', 'no']
     volumes:
       - valkey-data:/data
     networks:
       - dd-internal
     expose:
-      - "6379"
+      - '6379'
     # NodePort equivalent (manifests/valkey/valkey-nodeport.yaml nodePort 32079).
     ports:
-      - "${VALKEY_NODEPORT:-32079}:6379"
+      - '${VALKEY_NODEPORT:-32079}:6379'
     healthcheck:
-      test: ["CMD", "valkey-cli", "-p", "6379", "ping"]
+      test: ['CMD', 'valkey-cli', '-p', '6379', 'ping']
       interval: 10s
       timeout: 5s
       retries: 10
@@ -81,7 +81,7 @@ services:
   # (dd-default-development-blue). Connection targets use Docker service
   # discovery instead of hardcoded localhost.
   app:
-    image: ${APP_IMAGE:-underpost/underpost-engine}:${APP_TAG:-v3.2.22}
+    image: ${APP_IMAGE:-underpost/underpost-engine}:${APP_TAG:-v3.2.70}
     container_name: dd-app
     # The start command is supplied by the generated override docker/compose.app.yml
     # (see `underpost docker-compose --generate --deploy-id <id>`), keeping this
@@ -100,18 +100,18 @@ services:
     networks:
       - dd-internal
     expose:
-      - "4001"
-      - "4002"
-      - "4003"
-      - "4004"
+      - '4001'
+      - '4002'
+      - '4003'
+      - '4004'
     # Direct access to the LoadBalancer-equivalent ports (manifest 4001-4004).
     ports:
-      - "${APP_PORT_4001:-4001}:4001"
-      - "${APP_PORT_4002:-4002}:4002"
-      - "${APP_PORT_4003:-4003}:4003"
-      - "${APP_PORT_4004:-4004}:4004"
+      - '${APP_PORT_4001:-4001}:4001'
+      - '${APP_PORT_4002:-4002}:4002'
+      - '${APP_PORT_4003:-4003}:4003'
+      - '${APP_PORT_4004:-4004}:4004'
     healthcheck:
-      test: ["CMD-SHELL", "timeout 2 bash -c '</dev/tcp/127.0.0.1/4001' || exit 1"]
+      test: ['CMD-SHELL', "timeout 2 bash -c '</dev/tcp/127.0.0.1/4001' || exit 1"]
       interval: 15s
       timeout: 5s
       retries: 5
@@ -134,9 +134,9 @@ services:
     networks:
       - dd-internal
     ports:
-      - "${PROXY_HTTP_PORT:-80}:80"
+      - '${PROXY_HTTP_PORT:-80}:80'
     healthcheck:
-      test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1/healthz"]
+      test: ['CMD', 'wget', '-q', '-O', '-', 'http://127.0.0.1/healthz']
       interval: 15s
       timeout: 5s
       retries: 5
@@ -162,11 +162,11 @@ services:
     networks:
       - dd-internal
     expose:
-      - "9090"
+      - '9090'
     ports:
-      - "${PROMETHEUS_PORT:-9090}:9090"
+      - '${PROMETHEUS_PORT:-9090}:9090'
     healthcheck:
-      test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:9090/-/healthy"]
+      test: ['CMD', 'wget', '-q', '-O', '-', 'http://127.0.0.1:9090/-/healthy']
       interval: 15s
       timeout: 5s
       retries: 5
@@ -185,18 +185,18 @@ services:
     environment:
       GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER:-admin}
       GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:-admin}
-      GF_USERS_ALLOW_SIGN_UP: "false"
+      GF_USERS_ALLOW_SIGN_UP: 'false'
     volumes:
       - ./docker/grafana/provisioning:/etc/grafana/provisioning:ro
       - grafana-data:/var/lib/grafana
     networks:
       - dd-internal
     expose:
-      - "3000"
+      - '3000'
     ports:
-      - "${GRAFANA_PORT:-3000}:3000"
+      - '${GRAFANA_PORT:-3000}:3000'
     healthcheck:
-      test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:3000/api/health"]
+      test: ['CMD', 'wget', '-q', '-O', '-', 'http://127.0.0.1:3000/api/health']
       interval: 15s
       timeout: 5s
       retries: 5

package/manifests/cronjobs/dd-cron/dd-cron-backup.yaml

@@ -23,7 +23,7 @@ spec:
         spec:
           containers:
             - name: dd-cron-backup
-              image: underpost/underpost-engine:v3.2.28
+              image: underpost/underpost-engine:v3.2.70
               command:
                 - /bin/sh
                 - -c

package/manifests/cronjobs/dd-cron/dd-cron-dns.yaml

@@ -23,7 +23,7 @@ spec:
         spec:
           containers:
             - name: dd-cron-dns
-              image: underpost/underpost-engine:v3.2.28
+              image: underpost/underpost-engine:v3.2.70
               command:
                 - /bin/sh
                 - -c

package/manifests/deployment/dd-default-development/deployment.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: dd-default-development-blue
-          image: underpost/underpost-engine:v3.2.28
+          image: underpost/underpost-engine:v3.2.70
           #          resources:
           #            requests:
           #              memory: "124Ki"
@@ -98,7 +98,7 @@ spec:
     spec:
       containers:
         - name: dd-default-development-green
-          image: underpost/underpost-engine:v3.2.28
+          image: underpost/underpost-engine:v3.2.70
           #          resources:
           #            requests:
           #              memory: "124Ki"

package/package.json

@@ -2,7 +2,7 @@
     "type": "module",
     "main": "src/index.js",
     "name": "underpost",
-    "version": "3.2.28",
+    "version": "3.2.70",
     "description": "Underpost Platform — end-to-end CI/CD and application-delivery toolchain CLI. Covers bare metal, Kubernetes, K3s, kubeadm, LXD, container/image orchestration, secrets, databases, cron jobs, monitoring, SSH, runners, PWA + Workbox delivery, and release orchestration. Extensible via downstream CLIs.",
     "scripts": {
         "start": "node --max-old-space-size=8192 src/server",
@@ -71,14 +71,14 @@
     },
     "homepage": "https://github.com/underpostnet/pwa-microservices-template#readme",
     "dependencies": {
-        "@fortawesome/fontawesome-free": "^7.2.0",
+        "@fortawesome/fontawesome-free": "^7.3.0",
         "@fullcalendar/rrule": "^6.1.21",
         "@grpc/grpc-js": "^1.14.4",
         "@grpc/proto-loader": "^0.8.1",
         "@neodrag/vanilla": "^2.3.1",
-        "adm-zip": "^0.5.17",
-        "ag-grid-community": "^35.3.1",
-        "axios": "^1.18.0",
+        "adm-zip": "^0.5.18",
+        "ag-grid-community": "^36.0.0",
+        "axios": "^1.18.1",
         "bumpp": "^11.1.0",
         "chai": "^6.2.2",
         "clipboardy": "^5.3.1",
@@ -100,11 +100,11 @@
         "express-slow-down": "^3.1.0",
         "fast-json-stable-stringify": "^2.1.0",
         "favicons": "^7.3.0",
-        "fs-extra": "^11.3.5",
+        "fs-extra": "^11.3.6",
         "fullcalendar": "^6.1.21",
         "helmet": "^8.2.0",
         "html-minifier-terser": "^7.2.0",
-        "http-proxy-middleware": "^4.1.1",
+        "http-proxy-middleware": "^4.2.0",
         "ignore-walk": "^9.0.0",
         "iovalkey": "^0.3.3",
         "json-colorizer": "^3.0.1",
@@ -112,9 +112,9 @@
         "mariadb": "^3.5.3",
         "marked": "^18.0.5",
         "mocha": "^11.7.6",
-        "mongoose": "^9.7.1",
+        "mongoose": "^9.7.3",
         "morgan": "^1.11.0",
-        "nodemailer": "^9.0.0",
+        "nodemailer": "^9.0.3",
         "nodemon": "^3.0.1",
         "peer": "^1.0.2",
         "peerjs": "^1.5.5",
@@ -128,7 +128,7 @@
         "split-file": "^2.3.0",
         "swagger-autogen": "^2.23.7",
         "swagger-ui-express": "^5.0.0",
-        "typedoc": "^0.28.19",
+        "typedoc": "^0.28.20",
         "typescript": "^6.0.3",
         "validator": "^13.15.35",
         "vanilla-jsoneditor": "^3.12.0",

package/scripts/disk-clean.sh

@@ -7,20 +7,20 @@ set -euo pipefail
 
 VACUUM_SIZE="200M"          # journalctl vacuum target
 LARGE_LOG_SIZE="+100M"      # threshold for truncation (find syntax)
-TMP_AGE_DAYS=3              # remove files older than this from /tmp and /var/tmp
-CACHE_AGE_DAYS=30           # remove caches older than this from /var/cache
+TMP_AGE_DAYS=1              # remove files older than this from /tmp and /var/tmp
+CACHE_AGE_DAYS=5           # remove caches older than this from /var/cache
 KEEP_KERNELS=2              # keep this many latest kernels
 REMOVE_OPT=0                # ALWAYS allow removing /opt entries (user requested)
 
 timestamp() { date +"%F %T"; }
 log() {
-  echo "$(timestamp) $*"
+    echo "$(timestamp) $*"
 }
 
 # must be root
 if [ "$EUID" -ne 0 ]; then
-  echo "This script must be run as root. Exiting."
-  exit 1
+    echo "This script must be run as root. Exiting."
+    exit 1
 fi
 
 log "=== Starting Rocky Linux 9 automated cleanup (batch mode) ==="
@@ -46,8 +46,8 @@ journalctl --vacuum-size="$VACUUM_SIZE"
 # 3) Truncate very large logs in /var/log (safer than delete)
 log "Truncating logs in /var/log larger than ${LARGE_LOG_SIZE} (keeps zero-sized file so services don't break)..."
 find /var/log -type f -size "$LARGE_LOG_SIZE" -print0 2>/dev/null | while IFS= read -r -d '' f; do
-  echo "Truncating $f"
-  : > "$f" || echo "Failed to truncate $f"
+    echo "Truncating $f"
+    : > "$f" || echo "Failed to truncate $f"
 done
 
 # 4) Clean /tmp and /var/tmp older than TMP_AGE_DAYS
@@ -62,87 +62,110 @@ find /var/cache -mindepth 1 -mtime +"$CACHE_AGE_DAYS" -print0 2>/dev/null | xarg
 # 6) Clean user caches (~/.cache) and Downloads older than CACHE_AGE_DAYS
 log "Cleaning user caches and old downloads (home dirs)..."
 for homedir in /home/* /root; do
-  [ -d "$homedir" ] || continue
-  usercache="$homedir/.cache"
-  userdownloads="$homedir/Downloads"
-  usertrash="$homedir/.local/share/Trash"
-
-  if [ -d "$usercache" ]; then
-    log "Removing contents of $usercache"
-    rm -rf "${usercache:?}/"* 2>/dev/null
-  fi
-  if [ -d "$userdownloads" ]; then
-    log "Removing files older than ${CACHE_AGE_DAYS} days from $userdownloads"
-    find "$userdownloads" -type f -mtime +"$CACHE_AGE_DAYS" -print0 2>/dev/null | xargs -0r rm -f -- 2>/dev/null
-  fi
-  if [ -d "$usertrash" ]; then
-    log "Emptying trash in $usertrash"
-    rm -rf "${usertrash:?}/"* 2>/dev/null
-  fi
+    [ -d "$homedir" ] || continue
+    usercache="$homedir/.cache"
+    userdownloads="$homedir/Downloads"
+    usertrash="$homedir/.local/share/Trash"
+    
+    if [ -d "$usercache" ]; then
+        log "Removing contents of $usercache"
+        rm -rf "${usercache:?}/"* 2>/dev/null
+    fi
+    if [ -d "$userdownloads" ]; then
+        log "Removing files older than ${CACHE_AGE_DAYS} days from $userdownloads"
+        find "$userdownloads" -type f -mtime +"$CACHE_AGE_DAYS" -print0 2>/dev/null | xargs -0r rm -f -- 2>/dev/null
+    fi
+    if [ -d "$usertrash" ]; then
+        log "Emptying trash in $usertrash"
+        rm -rf "${usertrash:?}/"* 2>/dev/null
+    fi
 done
 
-# 7) Docker / Podman cleanup (if present)
+# 7) Docker / Podman cleanup (if present) — this is what actually reclaims the
+#    overlay storage behind those duplicated `overlay` df lines.
 if command -v docker >/dev/null 2>&1; then
-  log "Docker detected: pruning images/containers/volumes (aggressive)..."
-  docker system df
-  docker system prune -a --volumes -f
+    log "Docker detected: pruning images/containers/volumes/build cache (aggressive)..."
+    docker system df || true
+    docker system prune -a --volumes -f || true
+    docker builder prune -a -f || true
 fi
 
 if command -v podman >/dev/null 2>&1; then
-  log "Podman detected: pruning images/containers (aggressive)..."
-  podman system df
-  podman system prune -a -f
+    log "Podman detected: pruning images/containers/volumes (aggressive)..."
+    podman system df || true
+    podman system prune -a --volumes -f || true
 fi
 
+if command -v buildah >/dev/null 2>&1; then
+    log "Buildah detected: removing leftover working containers..."
+    buildah rm --all || true
+fi
+
+# 7b) Unmount leaked container overlay 'merged' mounts. Pruning frees the data
+#     but leaves these mountpoints attached, so they keep flooding `df -h` with
+#     identical `overlay ... /merged` rows. Only unmount overlays not backing a
+#     still-existing container, so running workloads are never disturbed.
+log "Unmounting orphaned container overlay mounts..."
+if command -v podman >/dev/null 2>&1; then
+    podman umount --all >/dev/null 2>&1 || true
+fi
+active_merged="$(podman ps -aq 2>/dev/null | xargs -r -I{} podman inspect --format '{{.GraphDriver.Data.MergedDir}}' {} 2>/dev/null || true)"
+findmnt -rn -o TARGET 2>/dev/null | grep -E '/var/lib/(containers/storage|docker)/overlay.*/merged' | sort -r | while IFS= read -r m; do
+    if ! printf '%s\n' "$active_merged" | grep -qxF "$m"; then
+        echo "Unmounting orphaned overlay: $m"
+        umount -l "$m" 2>/dev/null || true
+    fi
+done
+
 # 8) Flatpak unused runtimes/apps (if present)
 if command -v flatpak >/dev/null 2>&1; then
-  log "Flatpak detected: trying to uninstall unused runtimes/apps..."
-  flatpak uninstall --unused -y || flatpak uninstall --unused
-  flatpak repair
+    log "Flatpak detected: trying to uninstall unused runtimes/apps..."
+    flatpak uninstall --unused -y || flatpak uninstall --unused
+    flatpak repair
 fi
 
 # 9) Python Pip cleanup
 if command -v pip3 >/dev/null 2>&1 || command -v pip >/dev/null 2>&1; then
-  log "Python Pip detected: cleaning cache..."
-  if command -v pip3 >/dev/null 2>&1; then
-    pip3 cache purge
-  elif command -v pip >/dev/null 2>&1; then
-    pip cache purge
-  fi
+    log "Python Pip detected: cleaning cache..."
+    if command -v pip3 >/dev/null 2>&1; then
+        pip3 cache purge
+        elif command -v pip >/dev/null 2>&1; then
+        pip cache purge
+    fi
 fi
 
 # 10) Conda cleanup
 if command -v conda >/dev/null 2>&1; then
-  log "Conda detected: cleaning all..."
-  conda clean --all -y
+    log "Conda detected: cleaning all..."
+    conda clean --all -y
 fi
 
 # 11) Remove old kernels but keep the last KEEP_KERNELS (safe)
 log "Removing old kernels, keeping the last $KEEP_KERNELS kernels..."
 OLD_KERNELS=$(dnf repoquery --installonly --latest-limit=-$KEEP_KERNELS -q 2>/dev/null)
 if [ -n "$OLD_KERNELS" ]; then
-  log "Old kernels to remove: $OLD_KERNELS"
-  dnf -y remove $OLD_KERNELS
+    log "Old kernels to remove: $OLD_KERNELS"
+    dnf -y remove $OLD_KERNELS
 else
-  log "No old kernels found by DNF repoquery. Only $KEEP_KERNELS or fewer are currently installed."
+    log "No old kernels found by DNF repoquery. Only $KEEP_KERNELS or fewer are currently installed."
 fi
 
 # 12) /opt review and removal (ON by default now)
 if [ -d /opt ]; then
-  log "/opt usage (top entries):"
-  du -sh /opt/* 2>/dev/null | sort -h | head -n 20
-
-  if [ "$REMOVE_OPT" = "1" ]; then
-    OPT_TARGETS=(/opt/local-path-provisioner)
-    for t in "${OPT_TARGETS[@]}"; do
-      if [ -d "$t" ]; then
-        log "Removing $t as REMOVE_OPT=1"
-        rm -rf "$t"
-      fi
-    done
-  else
-    log "Automatic /opt removals disabled (set REMOVE_OPT=1 to enable)."
-  fi
+    log "/opt usage (top entries):"
+    du -sh /opt/* 2>/dev/null | sort -h | head -n 20
+    
+    if [ "$REMOVE_OPT" = "1" ]; then
+        OPT_TARGETS=(/opt/local-path-provisioner)
+        for t in "${OPT_TARGETS[@]}"; do
+            if [ -d "$t" ]; then
+                log "Removing $t as REMOVE_OPT=1"
+                rm -rf "$t"
+            fi
+        done
+    else
+        log "Automatic /opt removals disabled (set REMOVE_OPT=1 to enable)."
+    fi
 fi
 
 # 13) Find large files > 100MB (report only)
@@ -150,8 +173,10 @@ log "Listing files larger than 100MB (report only):"
 find / -xdev -type f -size +100M -printf '%s\t%p\n' 2>/dev/null | sort -nr | head -n 50 | awk '{printf "%.1fMB\t%s\n",$1/1024/1024,$2}'
 
 # Final disk usage
-log "Disk usage after cleanup:"
+log "Disk usage cleanup:"
 df -h
+log "Top-level usage ( / ):"
+du -xh --max-depth=1 / | sort -rh | head -n 20
 
 log "=== Cleanup finished ==="
 exit 0

package/scripts/test-monitor.sh

@@ -2,9 +2,7 @@
 #
 # test-monitor.sh — end-to-end deploy + two-phase monitor smoke test.
 #
-# Two deployment shapes are supported (see
-# src/client/public/nexodev/docs/references/Deploy-Monitor-PRD.md and
-# 'Deploy custom instance to K8S.md'):
+# Two deployment shapes are supported:
 #
 #   --mode runtime   `underpost start` deploy (e.g. dd-test). Monitored with the
 #                    HTTP gate: /_internal/ready probes + port-forward status.
@@ -26,11 +24,11 @@ MODE=runtime                                  # runtime | instance
 ENV=development                               # development | production
 DEPLOY_ID=dd-test                             # deploy id (instance mode: parent of conf.instances.json)
 INSTANCE_IDS=                                 # instance mode: csv of ids (default: all in conf.instances.json)
-IMAGE=underpost/wp:v3.2.14                    # runtime mode image (instance mode reads image from conf)
+IMAGE=underpost/wp:v3.2.70                    # runtime mode image (instance mode reads image from conf)
 VERSIONS=green                                # csv of blue/green versions
 REPLICAS=1                                    # replicas per deployment
 NAMESPACE=default                             # k8s namespace
-CLUSTER=                                      # kind | kubeadm | k3s | "" (auto/none)
+CLUSTER=kind                                  # kind | kubeadm | k3s | "" (auto/none)
 TIMEOUT_RESPONSE=300000ms                     # HTTPProxy per-route response timeout
 TEMPLATE_REPO=underpostnet/pwa-microservices-template-private  # runtime mode link repo
 ENVOY_NAMESPACE=projectcontour                # ingress namespace (instance TLS exposure)

package/src/cli/cluster.js

@@ -876,6 +876,74 @@ net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-k3s.conf > /dev/null`,
       }
     },
 
+    /**
+     * @method _pruneContainerCaches
+     * @description Reclaims container-runtime disk left behind after a cluster
+     * teardown: stopped containers, unused images, build cache and anonymous
+     * volumes. Best-effort across every runtime present on the host (docker,
+     * podman, and optionally the CRI runtime via crictl). Each block is guarded
+     * by a command-existence check, so it is safe to call when a runtime is
+     * absent. This is what turns a "cluster deleted" into "disk actually freed":
+     * `kind delete` / `kubeadm reset` remove the cluster but leave gigabytes of
+     * images and overlay layers under /var/lib/{docker,containers}.
+     * @param {object} [options]
+     * @param {boolean} [options.all=true] - Remove all unused images, not just dangling ones.
+     * @param {boolean} [options.crictl=false] - Also prune the CRI runtime via crictl.
+     * @param {string} [options.criSocket] - Optional crictl --runtime-endpoint override.
+     * @private
+     */
+    _pruneContainerCaches(options = {}) {
+      const all = options.all !== false;
+      const a = all ? '-a ' : '';
+      logger.info(`  -> Pruning container-runtime caches (all=${all})...`);
+      // Docker (also matches the podman-docker shim when docker is symlinked to podman).
+      shellExec(
+        `if command -v docker >/dev/null 2>&1; then sudo docker system prune ${a}--volumes -f; sudo docker builder prune ${a}-f; fi`,
+        { silentOnError: true },
+      );
+      // Podman native — on this host images/overlays live under /var/lib/containers/storage.
+      shellExec(
+        `if command -v podman >/dev/null 2>&1; then sudo podman system prune ${a}--volumes -f; fi`,
+        { silentOnError: true },
+      );
+      if (options.crictl) {
+        const ep = options.criSocket ? `--runtime-endpoint ${options.criSocket} ` : '';
+        shellExec(
+          `if command -v crictl >/dev/null 2>&1; then sudo env PATH="$PATH:/usr/local/bin:/usr/bin" crictl ${ep}rmi --prune; fi`,
+          { silentOnError: true },
+        );
+      }
+      Underpost.cluster._unmountOrphanContainerOverlays();
+    },
+
+    /**
+     * @method _unmountOrphanContainerOverlays
+     * @description Unmounts leaked container overlay 'merged' mounts under
+     * /var/lib/{containers/storage,docker}/overlay. Pruning images/containers
+     * frees the backing data but leaves these mountpoints attached, so they
+     * keep showing up as identical `overlay ... /merged` rows in `df -h` long
+     * after the containers are gone. Only overlays NOT backing a still-existing
+     * container are unmounted, so running workloads are never disturbed.
+     * Best-effort; safe to call when no runtime is present.
+     * @private
+     */
+    _unmountOrphanContainerOverlays() {
+      logger.info('  -> Unmounting orphaned container overlay mounts...');
+      shellExec(`if command -v podman >/dev/null 2>&1; then sudo podman umount --all >/dev/null 2>&1 || true; fi`, {
+        silentOnError: true,
+      });
+      shellExec(
+        `active="$(sudo podman ps -aq 2>/dev/null | xargs -r -I{} sudo podman inspect --format '{{.GraphDriver.Data.MergedDir}}' {} 2>/dev/null || true)"
+findmnt -rn -o TARGET 2>/dev/null | grep -E '/var/lib/(containers/storage|docker)/overlay.*/merged' | sort -r | while IFS= read -r m; do
+  if ! printf '%s\\n' "$active" | grep -qxF "$m"; then
+    echo "Unmounting orphaned overlay: $m"
+    sudo umount -l "$m" 2>/dev/null || true
+  fi
+done`,
+        { silentOnError: true },
+      );
+    },
+
     /**
      * @method _lazyUmountKubeletMounts
      * @description Lazy-unmounts every mount under /var/lib/kubelet so a
@@ -910,7 +978,7 @@ net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-k3s.conf > /dev/null`,
       if (options.removeVolumeHostPaths) Underpost.cluster._cleanHostPathPvs();
       else logger.info('  -> Skipping (pass --remove-volume-host-paths to enable).');
 
-      logger.info('Phase 3/5: Deleting all Kind clusters...');
+      logger.info('Phase 3/6: Deleting all Kind clusters...');
       shellExec(`clusters=$(kind get clusters)
 if [ -n "$clusters" ]; then
   for c in $clusters; do
@@ -919,11 +987,14 @@ if [ -n "$clusters" ]; then
   done
 fi`);
 
-      logger.info('Phase 4/5: Cleaning kubeconfig and Kind Docker networks...');
+      logger.info('Phase 4/6: Cleaning kubeconfig and Kind Docker networks...');
       shellExec(`rm -rf "$HOME/.kube"`);
       Underpost.cluster.recoverKindDockerNetworks();
 
-      logger.info('Phase 5/5: Re-applying host configuration (Docker, containerd, sysctl).');
+      logger.info('Phase 5/6: Pruning container-runtime caches (kindest/node images, build cache, volumes)...');
+      Underpost.cluster._pruneContainerCaches({ all: true });
+
+      logger.info('Phase 6/6: Re-applying host configuration (Docker, containerd, sysctl).');
       Underpost.cluster.config();
 
       logger.info('=== KIND SAFE RESET COMPLETE ===');
@@ -995,7 +1066,7 @@ fi`);
       shellExec(`if ip link show tunl0 >/dev/null 2>&1; then sudo ip link del tunl0; fi`);
       shellExec(`sudo iptables -F`);
       shellExec(`sudo iptables -t nat -F`);
-      shellExec(`if command -v crictl >/dev/null 2>&1; then sudo crictl rmi --prune; fi`);
+      Underpost.cluster._pruneContainerCaches({ all: true, crictl: true });
 
       logger.info('Phase 7/7: Re-applying host configuration (Docker, containerd, sysctl).');
       Underpost.cluster.config();
@@ -1042,6 +1113,8 @@ fi`);
       shellExec(`if [ -d /etc/rancher/k3s ]; then sudo rm -rf /etc/rancher/k3s; fi`);
       shellExec(`if ip link show flannel.1 >/dev/null 2>&1; then sudo ip link del flannel.1; fi`);
       shellExec(`if ip link show cni0 >/dev/null 2>&1; then sudo ip link del cni0; fi`);
+      // k3s-uninstall.sh removes /var/lib/rancher/k3s; still prune any host docker/podman leftovers.
+      Underpost.cluster._pruneContainerCaches({ all: true });
 
       logger.info('Phase 5/5: Re-applying minimal K3s host config.');
       Underpost.cluster.configMinimalK3s();