feat: allows filters to be set at user level (#3456)

docs/guide/agent.md

@@ -117,6 +117,23 @@ services:
 
 This will change the agent's name to `my-special-name` and will be reflected on the UI when connecting to the agent.
 
+## Setting Up Filters
+
+You can set up filters for the agent to limit the containers it can access. These filters are passed directly to Docker, restricting what Dozzle can view.
+
+```yaml
+services:
+  dozzle-agent:
+    image: amir20/dozzle:latest
+    command: agent
+    environment:
+      - DOZZLE_FILTER=label=color
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+```
+
+This will restrict the agent to displaying only containers with the label `color`. Keep in mind that these filters are combined with the UI filters to narrow down the containers. To learn more about the different types of filters, read the [filters documentation](/guide/filters#ui-agents-and-user-filters).
+
 ## Custom Certificates
 
 By default, Dozzle uses self-signed certificates for communication between agents. This is a private certificate which is only valid to other Dozzle instances. This is secure and recommended for most use cases. However, if Dozzle is exposed externally and an attacker knows exactly which port the agent is running on, then they can set up their own Dozzle instance and connect to the agent. To prevent this, you can provide your own certificates.
@@ -169,5 +186,6 @@ Agents are similar to remote connections, but they have some advantages. General
 | Permissions | Full access to Docker        | Can be controlled with a proxy  |
 | Reconnect   | Automatically reconnects     | Requires UI restart             |
 | Healthcheck | Built-in healthcheck         | No healthcheck                  |
+| Filters     | Supports filters             | No support for filters          |
 
 If you do plan to use remote connections, make sure to secure the connection using Docker TLS or a reverse proxy.

docs/guide/authentication.md

@@ -2,7 +2,7 @@
 title: Authentication
 ---
 
-# Setting Up Authentication
+# Setting Up Authentication <Badge type="tip" text="Updated" />
 
 Dozzle supports two configurations for authentication. In the first configuration, you bring your own authentication method by protecting Dozzle through a proxy. Dozzle can read appropriate headers out of the box.
 
@@ -22,6 +22,7 @@ users:
     name: Admin
     # Generate with docker run amir20/dozzle generate --name Admin --email me@email.net --password secret admin
     password: $2a$11$9ho4vY2LdJ/WBopFcsAS0uORC0x2vuFHQgT/yBqZyzclhHsoaIkzK
+    filter:
 ```
 
 Dozzle uses `email` to generate avatars using [Gravatar](https://gravatar.com/). It is optional. The password is hashed using `bcrypt` which can be generated using `docker run amir20/dozzle generate`.
@@ -90,15 +91,39 @@ services:
 
 Note that only duration is supported. You can only use `s`, `m`, `h` for seconds, minutes and hours respectively.
 
+### Setting specific filters for users
+
+Dozzle supports setting filters for users. Filters are used to restrict the containers that a user can see. Filters are set in the `users.yml` file. Here is an example:
+
+```yaml
+users:
+  admin:
+    email:
+    name: Admin
+    password: $2a$11$9ho4vY2LdJ/WBopFcsAS0uORC0x2vuFHQgT/yBqZyzclhHsoaIkzK
+    filter:
+
+  guest:
+    email:
+    name: Guest
+    password: $2a$11$9ho4vY2LdJ/WBopFcsAS0uORC0x2vuFHQgT/yBqZyzclhHsoaIkzK
+    filter: "label=com.example.app"
+```
+
+In this example, the `admin` user has no filter, so they can see all containers. The `guest` user can only see containers with the label `com.example.app`. This is useful for restricting access to specific containers.
+
+> [!NOTE]
+> Filters can also be set [globally](/guide/filters) with the `--filter` flag. This flag is applied to all users. If a user has a filter set, it will override the global filter.
+
 ## Generating users.yml
 
 Dozzle has a built-in `generate` command to generate `users.yml`. Here is an example:
 
 ```sh
-docker run amir20/dozzle generate admin --password password --email test@email.net --name "John Doe" > users.yml
+docker run amir20/dozzle generate admin --password password --email test@email.net --name "John Doe" --user-filter name=foo > users.yml
 ```
 
-In this example, `admin` is the username. Email and name are optional but recommended to display accurate avatars. `docker run amir20/dozzle generate --help` displays all options.
+In this example, `admin` is the username. Email and name are optional but recommended to display accurate avatars. `docker run amir20/dozzle generate --help` displays all options. The `--user-filter` flag is a comma-separated list of filters.
 
 ## Forward Proxy
 
@@ -129,6 +154,7 @@ In this mode, Dozzle expects the following headers:
 - `Remote-User` to map to the username e.g. `johndoe`
 - `Remote-Email` to map to the user's email address. This email is also used to find the right [Gravatar](https://gravatar.com/) for the user.
 - `Remote-Name` to be a display name like `John Doe`
+- `Remote-Filter` to be a comma-separated list of filters allowed for user.
 
 ### Setting up Dozzle with Authelia
 

docs/guide/filters.md

@@ -27,3 +27,16 @@ services:
 :::
 
 Common filters are `name` or `label` to limit Dozzle's access to containers.
+
+## UI, Agents, and User Filters <Badge type="tip" text="New" />
+
+Dozzle supports multiple filters to limit the containers it can see. Filters can be set at the UI, agent, or user level.
+
+1. **UI Filters**: These filters are applied to the Dozzle UI instance and sent to Docker to restrict the visible containers. They affect all agents and users who do not have their own filters.
+2. **Agent Filters**: These filters are set at the agent level and sent to Docker to limit the containers exposed by that agent. Agent filters and UI filters work together to restrict the containers.
+3. **User Filters**: These filters are set at the user level and determine which containers the user can see. If user filters are not defined, Dozzle defaults to using the UI filters.
+
+For more information on setting filters for specific users, see [user filters](/guide/authentication#setting-specific-filters-for-users). For details on setting filters for agents, see [agent filters](/guide/agent#setting-up-filters).
+
+> [!WARNING]
+> It is important to understand that multiple filters are combined to limit the containers. For example, if you set `--filter label=color` at the UI level and `--filter label=type` at the agent level, Dozzle will only display containers that have both the `color` and `type` labels.