Revert D-Bus usage, use systemctl commands only

- Remove zbus dependency from agent - Replace D-Bus Connection calls with systemctl show commands - Fix agent hang by eliminating blocking D-Bus operations - get_unit_property now uses systemctl show with property flags - Memory, disk usage, and nginx config queries use systemctl - Simpler, more reliable service monitoring
Fix agent hang by reverting service discovery to systemctl
2025-11-28 12:15:04 +01:00 · 2025-11-28 11:57:31 +01:00 · 2025-11-28 11:46:28 +01:00 · 2025-11-28 11:27:33 +01:00 · 2025-11-27 23:16:40 +01:00 · 2025-11-27 23:12:08 +01:00
22 changed files with 1280 additions and 563 deletions
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -156,6 +156,56 @@ Complete migration from string-based metrics to structured JSON data. Eliminates
 - ✅ Backward compatibility via bridge conversion to existing UI widgets
 - ✅ All string parsing bugs eliminated

+### Cached Collector Architecture (🚧 PLANNED)
+
+**Problem:** Blocking collectors prevent timely ZMQ transmission, causing false "host offline" alerts.
+
+**Previous (Sequential Blocking):**
+```
+Every 1 second:
+  └─ collect_all_data() [BLOCKS for 2-10+ seconds]
+      ├─ CPU (fast: 10ms)
+      ├─ Memory (fast: 20ms)
+      ├─ Disk SMART (slow: 3s per drive × 4 drives = 12s)
+      ├─ Service disk usage (slow: 2-8s per service)
+      └─ Docker (medium: 500ms)
+  └─ send_via_zmq()  [Only after ALL collection completes]
+
+Result: If any collector takes >10s → "host offline" false alert
+```
+
+**New (Cached Independent Collectors):**
+```
+Shared Cache: Arc<RwLock<AgentData>>
+
+Background Collectors (independent async tasks):
+├─ Fast collectors (CPU, RAM, Network)
+│   └─ Update cache every 1 second
+├─ Medium collectors (Services, Docker)
+│   └─ Update cache every 5 seconds
+└─ Slow collectors (Disk usage, SMART data)
+    └─ Update cache every 60 seconds
+
+ZMQ Sender (separate async task):
+Every 1 second:
+  └─ Read current cache
+  └─ Send via ZMQ [Always instant, never blocked]
+```
+
+**Benefits:**
+- ✅ ZMQ sends every 1 second regardless of collector speed
+- ✅ No false "host offline" alerts from slow collectors
+- ✅ Different update rates for different metrics (CPU=1s, SMART=60s)
+- ✅ System stays responsive even with slow operations
+- ✅ Slow collectors can use longer timeouts without blocking
+
+**Implementation:**
+- Shared `AgentData` cache wrapped in `Arc<RwLock<>>`
+- Each collector spawned as independent tokio task
+- Collectors update their section of cache at their own rate
+- ZMQ sender reads cache every 1s and transmits
+- Stale data acceptable for slow-changing metrics (disk usage, SMART)
+
 ### Maintenance Mode

 - Agent checks for `/tmp/cm-maintenance` file before sending notifications
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1,6 +1,5 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-# This file is automatically generated by Cargo.
 version = 4

 [[package]]
@@ -115,6 +114,12 @@ dependencies = [
 "syn",
 ]

+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
 [[package]]
 name = "autocfg"
 version = "1.5.0"
@@ -145,12 +150,62 @@ version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"

+[[package]]
+name = "bollard"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d41711ad46fda47cd701f6908e59d1bd6b9a2b7464c0d0aeab95c6d37096ff8a"
+dependencies = [
+ "base64 0.22.1",
+ "bollard-stubs",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "http 1.4.0",
+ "http-body-util",
+ "hyper 1.8.1",
+ "hyper-named-pipe",
+ "hyper-util",
+ "hyperlocal",
+ "log",
+ "pin-project-lite",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "serde_repr",
+ "serde_urlencoded",
+ "thiserror 1.0.69",
+ "tokio",
+ "tokio-util",
+ "tower-service",
+ "url",
+ "winapi",
+]
+
+[[package]]
+name = "bollard-stubs"
+version = "1.45.0-rc.26.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d7c5415e3a6bc6d3e99eff6268e488fd4ee25e7b28c10f08fa6760bd9de16e4"
+dependencies = [
+ "serde",
+ "serde_repr",
+ "serde_with",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"

+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
 [[package]]
 name = "bytes"
 version = "1.11.0"
@@ -165,9 +220,9 @@ checksum = "df8670b8c7b9dae1793364eafadf7239c40d669904660c5960d74cfd80b46a53"

 [[package]]
 name = "cc"
-version = "1.2.46"
+version = "1.2.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b97463e1064cb1b1c1384ad0a0b9c8abd0988e2a91f52606c80ef14aadb63e36"
+checksum = "cd405d82c84ff7f35739f175f67d8b9fb7687a0e84ccdc78bd3568839827cf07"
 dependencies = [
 "find-msvc-tools",
 "jobserver",
@@ -191,6 +246,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"

+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
 [[package]]
 name = "chrono"
 version = "0.4.42"
@@ -239,9 +300,9 @@ dependencies = [

 [[package]]
 name = "clap"
-version = "4.5.52"
+version = "4.5.53"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa8120877db0e5c011242f96806ce3c94e0737ab8108532a76a3300a01db2ab8"
+checksum = "c9e340e012a1bf4935f5282ed1436d1489548e8f72308207ea5df0e23d2d03f8"
 dependencies = [
 "clap_builder",
 "clap_derive",
@@ -249,9 +310,9 @@ dependencies = [

 [[package]]
 name = "clap_builder"
-version = "4.5.52"
+version = "4.5.53"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02576b399397b659c26064fbc92a75fede9d18ffd5f80ca1cd74ddab167016e1"
+checksum = "d76b5d13eaa18c901fd2f7fca939fefe3a0727a953561fefdf3b2922b8569d00"
 dependencies = [
 "anstream",
 "anstyle",
@@ -279,7 +340,7 @@ checksum = "a1d728cc89cf3aee9ff92b05e62b19ee65a02b5702cff7d5a377e32c6ae29d8d"

 [[package]]
 name = "cm-dashboard"
-version = "0.1.172"
+version = "0.1.200"
 dependencies = [
 "anyhow",
 "chrono",
@@ -290,7 +351,7 @@ dependencies = [
 "ratatui",
 "serde",
 "serde_json",
- "thiserror",
+ "thiserror 1.0.69",
 "tokio",
 "toml",
 "tracing",
@@ -301,20 +362,26 @@ dependencies = [

 [[package]]
 name = "cm-dashboard-agent"
-version = "0.1.172"
+version = "0.1.200"
 dependencies = [
 "anyhow",
 "async-trait",
+ "bollard",
 "chrono",
 "chrono-tz",
 "clap",
 "cm-dashboard-shared",
+ "futures",
 "gethostname",
 "lettre",
+ "libc",
+ "netlink-packet-route",
+ "nix 0.29.0",
 "reqwest",
+ "rtnetlink",
 "serde",
 "serde_json",
- "thiserror",
+ "thiserror 1.0.69",
 "tokio",
 "toml",
 "tracing",
@@ -324,12 +391,12 @@ dependencies = [

 [[package]]
 name = "cm-dashboard-shared"
-version = "0.1.172"
+version = "0.1.200"
 dependencies = [
 "chrono",
 "serde",
 "serde_json",
- "thiserror",
+ "thiserror 1.0.69",
 ]

 [[package]]
@@ -435,6 +502,16 @@ dependencies = [
 "winapi",
 ]

+[[package]]
+name = "deranged"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ececcb659e7ba858fb4f10388c250a7252eb0a27373f1a72b8748afdd248e587"
+dependencies = [
+ "powerfmt",
+ "serde_core",
+]
+
 [[package]]
 name = "dircpy"
 version = "0.3.19"
@@ -457,6 +534,12 @@ dependencies = [
 "syn",
 ]

+[[package]]
+name = "dyn-clone"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
+
 [[package]]
 name = "either"
 version = "1.15.0"
@@ -552,6 +635,21 @@ dependencies = [
 "percent-encoding",
 ]

+[[package]]
+name = "futures"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65bc07b1a8bc7c85c5f2e110c476c7389b4554ba72af57d8445ea63a576b0876"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
 [[package]]
 name = "futures-channel"
 version = "0.3.31"
@@ -559,6 +657,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
 dependencies = [
 "futures-core",
+ "futures-sink",
 ]

 [[package]]
@@ -567,12 +666,34 @@ version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"

+[[package]]
+name = "futures-executor"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
 [[package]]
 name = "futures-io"
 version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"

+[[package]]
+name = "futures-macro"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "futures-sink"
 version = "0.3.31"
@@ -591,8 +712,11 @@ version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
 dependencies = [
+ "futures-channel",
 "futures-core",
 "futures-io",
+ "futures-macro",
+ "futures-sink",
 "futures-task",
 "memchr",
 "pin-project-lite",
@@ -633,14 +757,20 @@ dependencies = [
 "futures-core",
 "futures-sink",
 "futures-util",
- "http",
- "indexmap",
+ "http 0.2.12",
+ "indexmap 2.12.1",
 "slab",
 "tokio",
 "tokio-util",
 "tracing",
 ]

+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
 [[package]]
 name = "hashbrown"
 version = "0.14.5"
@@ -664,9 +794,9 @@ dependencies = [

 [[package]]
 name = "hashbrown"
-version = "0.16.0"
+version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5419bdc4f6a9207fbeba6d11b604d481addf78ecd10c11ad51e76c2f6482748d"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"

 [[package]]
 name = "heck"
@@ -680,6 +810,12 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"

+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
 [[package]]
 name = "http"
 version = "0.2.12"
@@ -691,6 +827,16 @@ dependencies = [
 "itoa",
 ]

+[[package]]
+name = "http"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
 [[package]]
 name = "http-body"
 version = "0.4.6"
@@ -698,7 +844,30 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
 dependencies = [
 "bytes",
- "http",
+ "http 0.2.12",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http 1.4.0",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http 1.4.0",
+ "http-body 1.0.1",
 "pin-project-lite",
 ]

@@ -725,8 +894,8 @@ dependencies = [
 "futures-core",
 "futures-util",
 "h2",
- "http",
- "http-body",
+ "http 0.2.12",
+ "http-body 0.4.6",
 "httparse",
 "httpdate",
 "itoa",
@@ -738,6 +907,43 @@ dependencies = [
 "want",
 ]

+[[package]]
+name = "hyper"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "http 1.4.0",
+ "http-body 1.0.1",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "pin-utils",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-named-pipe"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73b7d8abf35697b81a825e386fc151e0d503e8cb5fcb93cc8669c376dfd6f278"
+dependencies = [
+ "hex",
+ "hyper 1.8.1",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+ "winapi",
+]
+
 [[package]]
 name = "hyper-tls"
 version = "0.5.0"
@@ -745,12 +951,48 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
 dependencies = [
 "bytes",
- "hyper",
+ "hyper 0.14.32",
 "native-tls",
 "tokio",
 "tokio-native-tls",
 ]

+[[package]]
+name = "hyper-util"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52e9a2a24dc5c6821e71a7030e1e14b7b632acac55c40e9d2e082c621261bb56"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "http 1.4.0",
+ "http-body 1.0.1",
+ "hyper 1.8.1",
+ "libc",
+ "pin-project-lite",
+ "socket2 0.6.1",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "hyperlocal"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "986c5ce3b994526b3cd75578e62554abd09f0899d6206de48b3e96ab34ccc8c7"
+dependencies = [
+ "hex",
+ "http-body-util",
+ "hyper 1.8.1",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
 [[package]]
 name = "iana-time-zone"
 version = "0.1.64"
@@ -879,12 +1121,25 @@ dependencies = [

 [[package]]
 name = "indexmap"
-version = "2.12.0"
+version = "1.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6717a8d2a5a929a1a2eb43a12812498ed141a0bcfb7e8f7844fbdbe4303bba9f"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ad4bb2b565bca0645f4d68c5c9af97fba094e9791da685bf83cb5f3ce74acf2"
 dependencies = [
 "equivalent",
- "hashbrown 0.16.0",
+ "hashbrown 0.16.1",
+ "serde",
+ "serde_core",
 ]

 [[package]]
@@ -1084,6 +1339,93 @@ dependencies = [
 "tempfile",
 ]

+[[package]]
+name = "netlink-packet-core"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72724faf704479d67b388da142b186f916188505e7e0b26719019c525882eda4"
+dependencies = [
+ "anyhow",
+ "byteorder",
+ "netlink-packet-utils",
+]
+
+[[package]]
+name = "netlink-packet-route"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74c171cd77b4ee8c7708da746ce392440cb7bcf618d122ec9ecc607b12938bf4"
+dependencies = [
+ "anyhow",
+ "byteorder",
+ "libc",
+ "log",
+ "netlink-packet-core",
+ "netlink-packet-utils",
+]
+
+[[package]]
+name = "netlink-packet-utils"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ede8a08c71ad5a95cdd0e4e52facd37190977039a4704eb82a283f713747d34"
+dependencies = [
+ "anyhow",
+ "byteorder",
+ "paste",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "netlink-proto"
+version = "0.11.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72452e012c2f8d612410d89eea01e2d9b56205274abb35d53f60200b2ec41d60"
+dependencies = [
+ "bytes",
+ "futures",
+ "log",
+ "netlink-packet-core",
+ "netlink-sys",
+ "thiserror 2.0.17",
+]
+
+[[package]]
+name = "netlink-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16c903aa70590cb93691bf97a767c8d1d6122d2cc9070433deb3bbf36ce8bd23"
+dependencies = [
+ "bytes",
+ "futures",
+ "libc",
+ "log",
+ "tokio",
+]
+
+[[package]]
+name = "nix"
+version = "0.27.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
+dependencies = [
+ "bitflags 2.10.0",
+ "cfg-if",
+ "libc",
+]
+
+[[package]]
+name = "nix"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
+dependencies = [
+ "bitflags 2.10.0",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "nom"
 version = "8.0.0"
@@ -1102,6 +1444,12 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -1285,6 +1633,12 @@ dependencies = [
 "zerovec",
 ]

+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.103"
@@ -1387,6 +1741,26 @@ dependencies = [
 "bitflags 2.10.0",
 ]

+[[package]]
+name = "ref-cast"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "regex"
 version = "1.12.2"
@@ -1428,9 +1802,9 @@ dependencies = [
 "futures-core",
 "futures-util",
 "h2",
- "http",
- "http-body",
- "hyper",
+ "http 0.2.12",
+ "http-body 0.4.6",
+ "hyper 0.14.32",
 "hyper-tls",
 "ipnet",
 "js-sys",
@@ -1456,6 +1830,24 @@ dependencies = [
 "winreg",
 ]

+[[package]]
+name = "rtnetlink"
+version = "0.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b684475344d8df1859ddb2d395dd3dac4f8f3422a1aa0725993cb375fc5caba5"
+dependencies = [
+ "futures",
+ "log",
+ "netlink-packet-core",
+ "netlink-packet-route",
+ "netlink-packet-utils",
+ "netlink-proto",
+ "netlink-sys",
+ "nix 0.27.1",
+ "thiserror 1.0.69",
+ "tokio",
+]
+
 [[package]]
 name = "rustix"
 version = "1.1.2"
@@ -1508,6 +1900,30 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "schemars"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9558e172d4e8533736ba97870c4b2cd63f84b382a3d6eb063da41b91cce17289"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
@@ -1580,6 +1996,17 @@ dependencies = [
 "serde_core",
 ]

+[[package]]
+name = "serde_repr"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "serde_spanned"
 version = "0.6.9"
@@ -1601,6 +2028,24 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "serde_with"
+version = "3.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fa237f2807440d238e0364a218270b98f767a00d3dada77b1c53ae88940e2e7"
+dependencies = [
+ "base64 0.22.1",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.12.1",
+ "schemars 0.9.0",
+ "schemars 1.1.0",
+ "serde_core",
+ "serde_json",
+ "time",
+]
+
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -1639,9 +2084,9 @@ dependencies = [

 [[package]]
 name = "signal-hook-registry"
-version = "1.4.6"
+version = "1.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2a4719bff48cee6b39d12c020eeb490953ad2443b7055bd0b21fca26bd8c28b"
+checksum = "7664a098b8e616bdfcc2dc0e9ac44eb231eedf41db4e9fe95d8d32ec728dedad"
 dependencies = [
 "libc",
 ]
@@ -1733,9 +2178,9 @@ dependencies = [

 [[package]]
 name = "syn"
-version = "2.0.110"
+version = "2.0.111"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a99801b5bd34ede4cf3fc688c5919368fea4e4814a4664359503e6015b280aea"
+checksum = "390cc9a294ab71bdb1aa2e99d13be9c753cd2d7bd6560c77118597410c4d2e87"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -1818,7 +2263,16 @@ version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
 dependencies = [
- "thiserror-impl",
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8"
+dependencies = [
+ "thiserror-impl 2.0.17",
 ]

 [[package]]
@@ -1832,6 +2286,17 @@ dependencies = [
 "syn",
 ]

+[[package]]
+name = "thiserror-impl"
+version = "2.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "thread_local"
 version = "1.1.9"
@@ -1841,6 +2306,37 @@ dependencies = [
 "cfg-if",
 ]

+[[package]]
+name = "time"
+version = "0.3.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e7d9e3bb61134e77bde20dd4825b97c010155709965fedf0f49bb138e52a9d"
+dependencies = [
+ "deranged",
+ "itoa",
+ "num-conv",
+ "powerfmt",
+ "serde",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40868e7c1d2f0b8d73e4a8c7f0ff63af4f6d19be117e90bd73eb1d62cf831c6b"
+
+[[package]]
+name = "time-macros"
+version = "0.2.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30cfb0125f12d9c277f35663a0a33f8c30190f4e4574868a330595412d34ebf3"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
 [[package]]
 name = "tinystr"
 version = "0.8.2"
@@ -1929,7 +2425,7 @@ version = "0.22.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
 dependencies = [
- "indexmap",
+ "indexmap 2.12.1",
 "serde",
 "serde_spanned",
 "toml_datetime",
@@ -1962,9 +2458,9 @@ dependencies = [

 [[package]]
 name = "tracing-attributes"
-version = "0.1.30"
+version = "0.1.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81383ab64e72a7a8b8e13130c49e3dab29def6d0c7d76a03087b3cf71c5c6903"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -1973,9 +2469,9 @@ dependencies = [

 [[package]]
 name = "tracing-core"
-version = "0.1.34"
+version = "0.1.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d12581f227e93f094d3af2ae690a574abb8a2b9b7a96e7cfe9647b2b617678"
+checksum = "7a04e24fab5c89c6a36eb8558c9656f30d81de51dfa4d3b45f26b21d61fa0a6c"
 dependencies = [
 "once_cell",
 "valuable",
@@ -2513,9 +3009,9 @@ checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"

 [[package]]
 name = "winnow"
-version = "0.7.13"
+version = "0.7.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21a0236b59786fed61e2a80582dd500fe61f18b5dca67a4a067d0bc9039339cf"
+checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"
 dependencies = [
 "memchr",
 ]
@@ -2567,18 +3063,18 @@ dependencies = [

 [[package]]
 name = "zerocopy"
-version = "0.8.27"
+version = "0.8.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0894878a5fa3edfd6da3f88c4805f4c8558e2b996227a3d864f47fe11e38282c"
+checksum = "4ea879c944afe8a2b25fef16bb4ba234f47c694565e97383b36f3a878219065c"
 dependencies = [
 "zerocopy-derive",
 ]

 [[package]]
 name = "zerocopy-derive"
-version = "0.8.27"
+version = "0.8.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88d2b8d9c68ad2b9e4340d7832716a4d21a22a1154777ad56ea55c51a9cf3831"
+checksum = "cf955aa904d6040f70dc8e9384444cb1030aed272ba3cb09bbc4ab9e7c1f34f5"
 dependencies = [
 "proc-macro2",
 "quote",
--- a/agent/Cargo.toml
+++ b/agent/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cm-dashboard-agent"
-version = "0.1.172"
+version = "0.1.200"
 edition = "2021"

 [dependencies]
@@ -20,4 +20,14 @@ gethostname = { workspace = true }
 chrono-tz = "0.8"
 toml = { workspace = true }
 async-trait = "0.1"
-reqwest = { version = "0.11", features = ["json", "blocking"] }
+reqwest = { version = "0.11", features = ["json", "blocking"] }
+
+# Native system APIs
+nix = { version = "0.29", features = ["fs"] }
+rtnetlink = "0.14"
+netlink-packet-route = "0.19"
+futures = "0.3"
+libc = "0.2"
+
+# Docker API client
+bollard = "0.17"
--- a/agent/src/agent.rs
+++ b/agent/src/agent.rs
@@ -4,7 +4,7 @@ use std::time::Duration;
 use tokio::time::interval;
 use tracing::{debug, error, info};

-use crate::communication::{AgentCommand, ZmqHandler};
+use crate::communication::ZmqHandler;
 use crate::config::AgentConfig;
 use crate::collectors::{
    Collector,
@@ -134,12 +134,6 @@ impl Agent {
                    // NOTE: With structured data, we might need to implement status tracking differently
                    // For now, we skip this until status evaluation is migrated
                }
-                // Handle incoming commands (check periodically)
-                _ = tokio::time::sleep(Duration::from_millis(100)) => {
-                    if let Err(e) = self.handle_commands().await {
-                        error!("Error handling commands: {}", e);
-                    }
-                }
                _ = &mut shutdown_rx => {
                    info!("Shutdown signal received, stopping agent loop");
                    break;
@@ -259,36 +253,4 @@ impl Agent {
        Ok(())
    }

-    /// Handle incoming commands from dashboard
-    async fn handle_commands(&mut self) -> Result<()> {
-        // Try to receive a command (non-blocking)
-        if let Ok(Some(command)) = self.zmq_handler.try_receive_command() {
-            info!("Received command: {:?}", command);
-
-            match command {
-                AgentCommand::CollectNow => {
-                    info!("Received immediate collection request");
-                    if let Err(e) = self.collect_and_broadcast().await {
-                        error!("Failed to collect on demand: {}", e);
-                    }
-                }
-                AgentCommand::SetInterval { seconds } => {
-                    info!("Received interval change request: {}s", seconds);
-                    // Note: This would require more complex handling to update the interval
-                    // For now, just acknowledge
-                }
-                AgentCommand::ToggleCollector { name, enabled } => {
-                    info!("Received collector toggle request: {} -> {}", name, enabled);
-                    // Note: This would require more complex handling to enable/disable collectors
-                    // For now, just acknowledge
-                }
-                AgentCommand::Ping => {
-                    info!("Received ping command");
-                    // Maybe send back a pong or status
-                }
-            }
-        }
-        Ok(())
-    }
-
 }
--- a/agent/src/collectors/cpu.rs
+++ b/agent/src/collectors/cpu.rs
@@ -1,22 +1,25 @@
 use async_trait::async_trait;
-use cm_dashboard_shared::{AgentData, Status, HysteresisThresholds};
+use cm_dashboard_shared::{AgentData, Status, HysteresisThresholds, CpuData};
+use std::sync::RwLock;
+use std::time::Instant;

 use tracing::debug;

 use super::{utils, Collector, CollectorError};
 use crate::config::CpuConfig;

-/// Extremely efficient CPU metrics collector
-///
-/// EFFICIENCY OPTIMIZATIONS:
-/// - Single /proc/loadavg read for all load metrics
-/// - Single /proc/stat read for CPU usage
-/// - Minimal string allocations
-/// - No process spawning
-/// - <0.1ms collection time target
+/// Extremely efficient CPU metrics collector with interval-based caching
 pub struct CpuCollector {
    load_thresholds: HysteresisThresholds,
    temperature_thresholds: HysteresisThresholds,
+    config: CpuConfig,
+    state: RwLock<CpuCacheState>,
+}
+
+#[derive(Debug, Clone)]
+struct CpuCacheState {
+    last_collection: Option<Instant>,
+    cached_data: CpuData,
 }

 impl CpuCollector {
@@ -26,15 +29,39 @@ impl CpuCollector {
            config.load_warning_threshold,
            config.load_critical_threshold,
        );
-        
+
        let temperature_thresholds = HysteresisThresholds::new(
            config.temperature_warning_threshold,
            config.temperature_critical_threshold,
        );
-        
+
        Self {
            load_thresholds,
            temperature_thresholds,
+            config,
+            state: RwLock::new(CpuCacheState {
+                last_collection: None,
+                cached_data: CpuData {
+                    load_1min: 0.0,
+                    load_5min: 0.0,
+                    load_15min: 0.0,
+                    frequency_mhz: 0.0,
+                    temperature_celsius: None,
+                    load_status: Status::Unknown,
+                    temperature_status: Status::Unknown,
+                },
+            }),
+        }
+    }
+
+    fn should_update_cache(&self) -> bool {
+        let state = self.state.read().unwrap();
+        match state.last_collection {
+            None => true,
+            Some(last) => {
+                let cache_duration = std::time::Duration::from_secs(self.config.interval_seconds);
+                last.elapsed() > cache_duration
+            }
        }
    }

@@ -156,6 +183,14 @@ impl CpuCollector {
 #[async_trait]
 impl Collector for CpuCollector {
    async fn collect_structured(&self, agent_data: &mut AgentData) -> Result<(), CollectorError> {
+        // Check if cache is valid
+        if !self.should_update_cache() {
+            let state = self.state.read().unwrap();
+            agent_data.system.cpu = state.cached_data.clone();
+            debug!("Using cached CPU data (interval: {}s)", self.config.interval_seconds);
+            return Ok(());
+        }
+
        debug!("Collecting CPU metrics");
        let start = std::time::Instant::now();

@@ -187,6 +222,11 @@ impl Collector for CpuCollector {
            Status::Unknown
        };

+        // Update cache
+        let mut state = self.state.write().unwrap();
+        state.last_collection = Some(Instant::now());
+        state.cached_data = agent_data.system.cpu.clone();
+
        Ok(())
    }
 }
--- a/agent/src/collectors/disk.rs
+++ b/agent/src/collectors/disk.rs
@@ -6,6 +6,7 @@ use crate::config::DiskConfig;
 use std::process::Command;
 use std::time::Instant;
 use std::collections::HashMap;
+use std::sync::RwLock;
 use tracing::debug;

 use super::{Collector, CollectorError};
@@ -14,6 +15,19 @@ use super::{Collector, CollectorError};
 pub struct DiskCollector {
    config: DiskConfig,
    temperature_thresholds: HysteresisThresholds,
+    /// Cached state with thread-safe interior mutability
+    state: RwLock<DiskCacheState>,
+}
+
+/// Internal state for disk caching
+#[derive(Debug, Clone)]
+struct DiskCacheState {
+    /// Last collection time for performance tracking
+    last_collection: Option<Instant>,
+    /// Cached drive data
+    cached_drives: Vec<DriveData>,
+    /// Cached pool data
+    cached_pools: Vec<PoolData>,
 }

 /// A physical drive with its filesystems
@@ -58,10 +72,17 @@ impl DiskCollector {
            config.temperature_warning_celsius,
            config.temperature_critical_celsius,
        );
-        
+
+        let state = DiskCacheState {
+            last_collection: None,
+            cached_drives: Vec::new(),
+            cached_pools: Vec::new(),
+        };
+
        Self {
            config,
            temperature_thresholds,
+            state: RwLock::new(state),
        }
    }

@@ -104,37 +125,70 @@ impl DiskCollector {
        self.populate_drives_data(&physical_drives, &smart_data, agent_data)?;
        self.populate_pools_data(&mergerfs_pools, &smart_data, agent_data)?;

+        // Step 7: Update cache with fresh data
+        {
+            let mut state = self.state.write().unwrap();
+            state.cached_drives = agent_data.system.storage.drives.clone();
+            state.cached_pools = agent_data.system.storage.pools.clone();
+            state.last_collection = Some(Instant::now());
+        }
+
        let elapsed = start_time.elapsed();
        debug!("Storage collection completed in {:?}", elapsed);

        Ok(())
    }

-    /// Get block devices and their mount points using lsblk
+    /// Check if disk collection cache should be updated
+    fn should_update_cache(&self) -> bool {
+        let state = self.state.read().unwrap();
+
+        match state.last_collection {
+            None => true,
+            Some(last) => {
+                let cache_duration = std::time::Duration::from_secs(self.config.interval_seconds);
+                last.elapsed() > cache_duration
+            }
+        }
+    }
+
+    /// Get cached disk data if available and fresh
+    fn get_cached_data(&self) -> Option<(Vec<DriveData>, Vec<PoolData>)> {
+        if !self.should_update_cache() {
+            let state = self.state.read().unwrap();
+            Some((state.cached_drives.clone(), state.cached_pools.clone()))
+        } else {
+            None
+        }
+    }
+
+    /// Get block devices and their mount points by reading /proc/mounts
    async fn get_mount_devices(&self) -> Result<HashMap<String, String>, CollectorError> {
-        let output = Command::new("lsblk")
-            .args(&["-rn", "-o", "NAME,MOUNTPOINT"])
-            .output()
+        let content = std::fs::read_to_string("/proc/mounts")
            .map_err(|e| CollectorError::SystemRead {
-                path: "block devices".to_string(),
+                path: "/proc/mounts".to_string(),
                error: e.to_string(),
            })?;

        let mut mount_devices = HashMap::new();
-        for line in String::from_utf8_lossy(&output.stdout).lines() {
+
+        for line in content.lines() {
            let parts: Vec<&str> = line.split_whitespace().collect();
-            if parts.len() >= 2 {
-                let device_name = parts[0];
+            if parts.len() >= 3 {
+                let device = parts[0];
                let mount_point = parts[1];
-                
-                // Skip swap partitions and unmounted devices
-                if mount_point == "[SWAP]" || mount_point.is_empty() {
+                let fs_type = parts[2];
+
+                // Skip pseudo filesystems and fuse mounts
+                if fs_type.starts_with("fuse") ||
+                   matches!(fs_type, "proc" | "sysfs" | "tmpfs" | "devtmpfs" |
+                           "devpts" | "cgroup" | "cgroup2" | "pstore" | "bpf" |
+                           "tracefs" | "debugfs" | "securityfs" | "hugetlbfs" |
+                           "mqueue" | "configfs" | "autofs") {
                    continue;
                }
-                
-                // Convert device name to full path
-                let device_path = format!("/dev/{}", device_name);
-                mount_devices.insert(mount_point.to_string(), device_path);
+
+                mount_devices.insert(mount_point.to_string(), device.to_string());
            }
        }

@@ -184,44 +238,20 @@ impl DiskCollector {
        Ok(())
    }

-    /// Get filesystem info for a single mount point
+    /// Get filesystem info for a single mount point using statvfs syscall
    fn get_filesystem_info(&self, mount_point: &str) -> Result<(u64, u64), CollectorError> {
-        let output = Command::new("df")
-            .args(&["--block-size=1", mount_point])
-            .output()
-            .map_err(|e| CollectorError::SystemRead {
-                path: format!("df {}", mount_point),
-                error: e.to_string(),
-            })?;
+        use nix::sys::statvfs::statvfs;

-        let output_str = String::from_utf8_lossy(&output.stdout);
-        let lines: Vec<&str> = output_str.lines().collect();
-        
-        if lines.len() < 2 {
-            return Err(CollectorError::Parse {
-                value: output_str.to_string(),
-                error: "Expected at least 2 lines from df output".to_string(),
-            });
-        }
-
-        // Parse the data line (skip header)
-        let parts: Vec<&str> = lines[1].split_whitespace().collect();
-        if parts.len() < 4 {
-            return Err(CollectorError::Parse {
-                value: lines[1].to_string(),
-                error: "Expected at least 4 fields in df output".to_string(),
-            });
-        }
-
-        let total_bytes: u64 = parts[1].parse().map_err(|e| CollectorError::Parse {
-            value: parts[1].to_string(),
-            error: format!("Failed to parse total bytes: {}", e),
+        let stat = statvfs(mount_point).map_err(|e| CollectorError::SystemRead {
+            path: mount_point.to_string(),
+            error: format!("statvfs failed: {}", e),
        })?;

-        let used_bytes: u64 = parts[2].parse().map_err(|e| CollectorError::Parse {
-            value: parts[2].to_string(),
-            error: format!("Failed to parse used bytes: {}", e),
-        })?;
+        // Calculate total and used bytes
+        let block_size = stat.fragment_size() as u64;
+        let total_bytes = stat.blocks() as u64 * block_size;
+        let available_bytes = stat.blocks_available() as u64 * block_size;
+        let used_bytes = total_bytes - available_bytes;

        Ok((total_bytes, used_bytes))
    }
@@ -386,7 +416,7 @@ impl DiskCollector {
    /// Get SMART data for drives
    async fn get_smart_data_for_drives(&self, physical_drives: &[PhysicalDrive], mergerfs_pools: &[MergerfsPool]) -> HashMap<String, SmartData> {
        let mut smart_data = HashMap::new();
-        
+
        // Collect all drive names
        let mut all_drives = std::collections::HashSet::new();
        for drive in physical_drives {
@@ -413,23 +443,26 @@ impl DiskCollector {

    /// Get SMART data for a single drive
    async fn get_smart_data(&self, drive_name: &str) -> Result<SmartData, CollectorError> {
-        let output = Command::new("sudo")
-            .args(&["smartctl", "-a", &format!("/dev/{}", drive_name)])
-            .output()
+        use super::run_command_with_timeout;
+
+        // Use direct smartctl (no sudo) - service has CAP_SYS_RAWIO and CAP_SYS_ADMIN capabilities
+        // For NVMe drives, specify device type explicitly
+        let mut cmd = Command::new("smartctl");
+        if drive_name.starts_with("nvme") {
+            cmd.args(&["-d", "nvme", "-a", &format!("/dev/{}", drive_name)]);
+        } else {
+            cmd.args(&["-a", &format!("/dev/{}", drive_name)]);
+        }
+
+        let output = run_command_with_timeout(cmd, 3).await
            .map_err(|e| CollectorError::SystemRead {
                path: format!("SMART data for {}", drive_name),
                error: e.to_string(),
            })?;

        let output_str = String::from_utf8_lossy(&output.stdout);
-        let error_str = String::from_utf8_lossy(&output.stderr);
-        
-        // Debug logging for SMART command results
-        debug!("SMART output for {}: status={}, stdout_len={}, stderr={}", 
-            drive_name, output.status, output_str.len(), error_str);
-        
+
        if !output.status.success() {
-            debug!("SMART command failed for {}: {}", drive_name, error_str);
            // Return unknown data rather than failing completely
            return Ok(SmartData {
                health: "UNKNOWN".to_string(),
@@ -754,32 +787,29 @@ impl DiskCollector {
        Ok((data_drives, parity_drives))
    }

-    /// Get drive information for a mount path
+    /// Get drive information for a mount path by reading /proc/mounts
    fn get_drive_info_for_path(&self, path: &str) -> anyhow::Result<PoolDrive> {
-        // Use lsblk to find the backing device
-        let output = Command::new("lsblk")
-            .args(&["-rn", "-o", "NAME,MOUNTPOINT"])
-            .output()
-            .map_err(|e| anyhow::anyhow!("Failed to run lsblk: {}", e))?;
-            
-        let output_str = String::from_utf8_lossy(&output.stdout);
+        // Read /proc/mounts to find the backing device
+        let content = std::fs::read_to_string("/proc/mounts")
+            .map_err(|e| anyhow::anyhow!("Failed to read /proc/mounts: {}", e))?;
+
        let mut device = String::new();
-        
-        for line in output_str.lines() {
+
+        for line in content.lines() {
            let parts: Vec<&str> = line.split_whitespace().collect();
            if parts.len() >= 2 && parts[1] == path {
                device = parts[0].to_string();
                break;
            }
        }
-        
+
        if device.is_empty() {
            return Err(anyhow::anyhow!("Could not find device for path {}", path));
        }
-        
-        // Extract base device name (e.g., "sda1" -> "sda")
-        let base_device = self.extract_base_device(&format!("/dev/{}", device));
-        
+
+        // Extract base device name (e.g., "/dev/sda1" -> "sda")
+        let base_device = self.extract_base_device(&device);
+
        // Get temperature from SMART data if available
        let temperature = if let Ok(smart_data) = tokio::task::block_in_place(|| {
            tokio::runtime::Handle::current().block_on(self.get_smart_data(&base_device))
@@ -788,7 +818,7 @@ impl DiskCollector {
        } else {
            None
        };
-        
+
        Ok(PoolDrive {
            name: base_device,
            mount_point: path.to_string(),
@@ -832,7 +862,15 @@ impl DiskCollector {
 #[async_trait]
 impl Collector for DiskCollector {
    async fn collect_structured(&self, agent_data: &mut AgentData) -> Result<(), CollectorError> {
-        self.collect_storage_data(agent_data).await
+        // Use cached data if available and fresh
+        if let Some((cached_drives, cached_pools)) = self.get_cached_data() {
+            agent_data.system.storage.drives = cached_drives;
+            agent_data.system.storage.pools = cached_pools;
+            Ok(())
+        } else {
+            // Collect fresh data
+            self.collect_storage_data(agent_data).await
+        }
    }
 }

--- a/agent/src/collectors/memory.rs
+++ b/agent/src/collectors/memory.rs
@@ -95,62 +95,47 @@ impl MemoryCollector {
        Ok(())
    }

-    /// Populate tmpfs data into AgentData
+    /// Populate tmpfs data into AgentData using statvfs syscall
    async fn populate_tmpfs_data(&self, agent_data: &mut AgentData) -> Result<(), CollectorError> {
+        use nix::sys::statvfs::statvfs;
+
        // Discover all tmpfs mount points
        let tmpfs_mounts = self.discover_tmpfs_mounts()?;
-        
+
        if tmpfs_mounts.is_empty() {
            debug!("No tmpfs mounts found to monitor");
            return Ok(());
        }

-        // Get usage data for all tmpfs mounts at once using df
-        let mut df_args = vec!["df", "--output=target,size,used", "--block-size=1"];
-        df_args.extend(tmpfs_mounts.iter().map(|s| s.as_str()));
+        // Get usage data for each tmpfs mount using statvfs syscall
+        for mount_point in tmpfs_mounts {
+            match statvfs(mount_point.as_str()) {
+                Ok(stat) => {
+                    let block_size = stat.fragment_size() as u64;
+                    let total_bytes = stat.blocks() as u64 * block_size;
+                    let available_bytes = stat.blocks_available() as u64 * block_size;
+                    let used_bytes = total_bytes - available_bytes;

-        let df_output = std::process::Command::new(df_args[0])
-            .args(&df_args[1..])
-            .output()
-            .map_err(|e| CollectorError::SystemRead {
-                path: "tmpfs mounts".to_string(),
-                error: e.to_string(),
-            })?;
+                    if total_bytes == 0 {
+                        continue;
+                    }

-        let df_str = String::from_utf8_lossy(&df_output.stdout);
-        let df_lines: Vec<&str> = df_str.lines().skip(1).collect(); // Skip header
+                    let total_gb = total_bytes as f32 / (1024.0 * 1024.0 * 1024.0);
+                    let used_gb = used_bytes as f32 / (1024.0 * 1024.0 * 1024.0);
+                    let usage_percent = (used_bytes as f32 / total_bytes as f32) * 100.0;

-        // Process each tmpfs mount
-        for (i, mount_point) in tmpfs_mounts.iter().enumerate() {
-            if i >= df_lines.len() {
-                debug!("Not enough df output lines for tmpfs mount: {}", mount_point);
-                continue;
+                    // Add to tmpfs list
+                    agent_data.system.memory.tmpfs.push(TmpfsData {
+                        mount: mount_point.clone(),
+                        usage_percent,
+                        used_gb,
+                        total_gb,
+                    });
+                }
+                Err(e) => {
+                    debug!("Failed to get stats for tmpfs mount {}: {}", mount_point, e);
+                }
            }
-
-            let parts: Vec<&str> = df_lines[i].split_whitespace().collect();
-            if parts.len() < 3 {
-                debug!("Invalid df output for tmpfs mount: {}", mount_point);
-                continue;
-            }
-
-            let total_bytes: u64 = parts[1].parse().unwrap_or(0);
-            let used_bytes: u64 = parts[2].parse().unwrap_or(0);
-
-            if total_bytes == 0 {
-                continue;
-            }
-
-            let total_gb = total_bytes as f32 / (1024.0 * 1024.0 * 1024.0);
-            let used_gb = used_bytes as f32 / (1024.0 * 1024.0 * 1024.0);
-            let usage_percent = (used_bytes as f32 / total_bytes as f32) * 100.0;
-
-            // Add to tmpfs list
-            agent_data.system.memory.tmpfs.push(TmpfsData {
-                mount: mount_point.clone(),
-                usage_percent,
-                used_gb,
-                total_gb,
-            });
        }

        // Sort tmpfs mounts by mount point for consistent display order
--- a/agent/src/collectors/mod.rs
+++ b/agent/src/collectors/mod.rs
@@ -1,6 +1,8 @@
 use async_trait::async_trait;
 use cm_dashboard_shared::{AgentData};
-
+use std::process::{Command, Output};
+use std::time::Duration;
+use tokio::time::timeout;

 pub mod backup;
 pub mod cpu;
@@ -13,6 +15,20 @@ pub mod systemd;

 pub use error::CollectorError;

+/// Run a command with a timeout to prevent blocking
+pub async fn run_command_with_timeout(mut cmd: Command, timeout_secs: u64) -> std::io::Result<Output> {
+    let timeout_duration = Duration::from_secs(timeout_secs);
+
+    match timeout(timeout_duration, tokio::task::spawn_blocking(move || cmd.output())).await {
+        Ok(Ok(result)) => result,
+        Ok(Err(e)) => Err(std::io::Error::new(std::io::ErrorKind::Other, e)),
+        Err(_) => Err(std::io::Error::new(
+            std::io::ErrorKind::TimedOut,
+            format!("Command timed out after {} seconds", timeout_secs)
+        )),
+    }
+}
+

 /// Base trait for all collectors with direct structured data output
 #[async_trait]
--- a/agent/src/collectors/network.rs
+++ b/agent/src/collectors/network.rs
@@ -1,7 +1,12 @@
 use async_trait::async_trait;
 use cm_dashboard_shared::{AgentData, NetworkInterfaceData, Status};
-use std::process::Command;
 use tracing::debug;
+use futures::stream::TryStreamExt;
+use rtnetlink::{new_connection, IpVersion};
+use netlink_packet_route::link::LinkAttribute;
+use netlink_packet_route::address::AddressAttribute;
+use netlink_packet_route::route::RouteAttribute;
+use std::net::IpAddr;

 use super::{Collector, CollectorError};
 use crate::config::NetworkConfig;
@@ -49,36 +54,52 @@ impl NetworkCollector {
        }
    }

-    /// Get the primary physical interface (the one with default route)
-    fn get_primary_physical_interface() -> Option<String> {
-        match Command::new("ip").args(["route", "show", "default"]).output() {
-            Ok(output) if output.status.success() => {
-                let output_str = String::from_utf8_lossy(&output.stdout);
-                // Parse: "default via 192.168.1.1 dev eno1 ..."
-                for line in output_str.lines() {
-                    if line.starts_with("default") {
-                        if let Some(dev_pos) = line.find(" dev ") {
-                            let after_dev = &line[dev_pos + 5..];
-                            if let Some(space_pos) = after_dev.find(' ') {
-                                let interface = &after_dev[..space_pos];
-                                // Only return if it's a physical interface
-                                if Self::is_physical_interface(interface) {
-                                    return Some(interface.to_string());
-                                }
+    /// Get the primary physical interface (the one with default route) using rtnetlink
+    async fn get_primary_physical_interface() -> Option<String> {
+        let (connection, handle, _) = match new_connection() {
+            Ok(conn) => conn,
+            Err(e) => {
+                debug!("Failed to create netlink connection: {}", e);
+                return None;
+            }
+        };
+
+        tokio::spawn(connection);
+
+        // Get default route
+        let mut routes = handle.route().get(IpVersion::V4).execute();
+
+        while let Ok(Some(route)) = routes.try_next().await {
+            // Check if this is a default route (destination is 0.0.0.0/0)
+            if route.header.destination_prefix_length == 0 {
+                // Find the output interface (OIF) attribute
+                if let Some(oif) = route.attributes.iter().find_map(|attr| {
+                    if let RouteAttribute::Oif(index) = attr {
+                        Some(*index)
+                    } else {
+                        None
+                    }
+                }) {
+                    // Get interface name from index
+                    let mut link = handle.link().get().match_index(oif).execute();
+                    if let Ok(Some(link_msg)) = link.try_next().await {
+                        if let Some(name) = link_msg.attributes.iter().find_map(|attr| {
+                            if let LinkAttribute::IfName(n) = attr {
+                                Some(n.to_string())
                            } else {
-                                // No space after interface name (end of line)
-                                let interface = after_dev.trim();
-                                if Self::is_physical_interface(interface) {
-                                    return Some(interface.to_string());
-                                }
+                                None
+                            }
+                        }) {
+                            if Self::is_physical_interface(&name) {
+                                return Some(name);
                            }
                        }
                    }
                }
-                None
            }
-            _ => None,
        }
+
+        None
    }

    /// Parse VLAN configuration from /proc/net/vlan/config
@@ -103,102 +124,105 @@ impl NetworkCollector {
        vlan_map
    }

-    /// Collect network interfaces using ip command
+    /// Collect network interfaces using rtnetlink
    async fn collect_interfaces(&self) -> Vec<NetworkInterfaceData> {
        let mut interfaces = Vec::new();

        // Parse VLAN configuration
        let vlan_map = Self::parse_vlan_config();

-        match Command::new("ip").args(["-j", "addr"]).output() {
-            Ok(output) if output.status.success() => {
-                let json_str = String::from_utf8_lossy(&output.stdout);
+        // Create netlink connection
+        let (connection, handle, _) = match new_connection() {
+            Ok(conn) => conn,
+            Err(e) => {
+                debug!("Failed to create netlink connection: {}", e);
+                return interfaces;
+            }
+        };

-                if let Ok(json_data) = serde_json::from_str::<serde_json::Value>(&json_str) {
-                    if let Some(ifaces) = json_data.as_array() {
-                        for iface in ifaces {
-                            let name = iface["ifname"].as_str().unwrap_or("").to_string();
+        tokio::spawn(connection);

-                            // Skip loopback, empty names, and ifb* interfaces
-                            if name.is_empty() || name == "lo" || name.starts_with("ifb") {
-                                continue;
-                            }
+        // Get all links
+        let mut links = handle.link().get().execute();

-                            // Parse parent interface from @parent notation (e.g., lan@enp0s31f6)
-                            let (interface_name, parent_interface) = if let Some(at_pos) = name.find('@') {
-                                let (child, parent) = name.split_at(at_pos);
-                                (child.to_string(), Some(parent[1..].to_string()))
-                            } else {
-                                (name.clone(), None)
-                            };
+        while let Ok(Some(link)) = links.try_next().await {
+            // Get interface name
+            let name = match link.attributes.iter().find_map(|attr| {
+                if let LinkAttribute::IfName(n) = attr {
+                    Some(n.to_string())
+                } else {
+                    None
+                }
+            }) {
+                Some(n) => n,
+                None => continue,
+            };

-                            let mut ipv4_addresses = Vec::new();
-                            let mut ipv6_addresses = Vec::new();
+            // Skip loopback and ifb interfaces
+            if name == "lo" || name.starts_with("ifb") {
+                continue;
+            }

-                            // Extract IP addresses
-                            if let Some(addr_info) = iface["addr_info"].as_array() {
-                                for addr in addr_info {
-                                    if let Some(family) = addr["family"].as_str() {
-                                        if let Some(local) = addr["local"].as_str() {
-                                            match family {
-                                                "inet" => ipv4_addresses.push(local.to_string()),
-                                                "inet6" => {
-                                                    // Skip link-local IPv6 addresses (fe80::)
-                                                    if !local.starts_with("fe80:") {
-                                                        ipv6_addresses.push(local.to_string());
-                                                    }
-                                                }
-                                                _ => {}
-                                            }
-                                        }
-                                    }
+            // Parse parent interface from @parent notation (e.g., lan@enp0s31f6)
+            let (interface_name, parent_interface) = if let Some(at_pos) = name.find('@') {
+                let (child, parent) = name.split_at(at_pos);
+                (child.to_string(), Some(parent[1..].to_string()))
+            } else {
+                (name.clone(), None)
+            };
+
+            // Get IP addresses for this interface
+            let mut ipv4_addresses = Vec::new();
+            let mut ipv6_addresses = Vec::new();
+
+            let mut addrs = handle.address().get().set_link_index_filter(link.header.index).execute();
+            while let Ok(Some(addr)) = addrs.try_next().await {
+                for nla in &addr.attributes {
+                    if let AddressAttribute::Address(ip) = nla {
+                        match ip {
+                            IpAddr::V4(ipv4) => ipv4_addresses.push(ipv4.to_string()),
+                            IpAddr::V6(ipv6) => {
+                                // Skip link-local IPv6 addresses (fe80::)
+                                if !ipv6.to_string().starts_with("fe80:") {
+                                    ipv6_addresses.push(ipv6.to_string());
                                }
                            }
-
-                            // Determine if physical and get status
-                            let is_physical = Self::is_physical_interface(&interface_name);
-
-                            // Only filter out virtual interfaces without IPs
-                            // Physical interfaces should always be shown even if down/no IPs
-                            if !is_physical && ipv4_addresses.is_empty() && ipv6_addresses.is_empty() {
-                                continue;
-                            }
-
-                            let link_status = if is_physical {
-                                Self::get_link_status(&name)
-                            } else {
-                                Status::Unknown  // Virtual interfaces don't have meaningful link status
-                            };
-
-                            // Look up VLAN ID from the map (use original name before @ parsing)
-                            let vlan_id = vlan_map.get(&name).copied();
-
-                            interfaces.push(NetworkInterfaceData {
-                                name: interface_name,
-                                ipv4_addresses,
-                                ipv6_addresses,
-                                is_physical,
-                                link_status,
-                                parent_interface,
-                                vlan_id,
-                            });
                        }
                    }
                }
            }
-            Err(e) => {
-                debug!("Failed to execute ip command: {}", e);
-            }
-            Ok(output) => {
-                debug!("ip command failed with status: {}", output.status);
+
+            // Determine if physical
+            let is_physical = Self::is_physical_interface(&interface_name);
+
+            // Only filter out virtual interfaces without IPs
+            if !is_physical && ipv4_addresses.is_empty() && ipv6_addresses.is_empty() {
+                continue;
            }
+
+            let link_status = if is_physical {
+                Self::get_link_status(&name)
+            } else {
+                Status::Unknown
+            };
+
+            // Look up VLAN ID
+            let vlan_id = vlan_map.get(&name).copied();
+
+            interfaces.push(NetworkInterfaceData {
+                name: interface_name,
+                ipv4_addresses,
+                ipv6_addresses,
+                is_physical,
+                link_status,
+                parent_interface,
+                vlan_id,
+            });
        }

-        // Assign primary physical interface as parent to virtual interfaces without explicit parent
-        let primary_interface = Self::get_primary_physical_interface();
-        if let Some(primary) = primary_interface {
+        // Assign primary physical interface as parent to virtual interfaces
+        if let Some(primary) = Self::get_primary_physical_interface().await {
            for interface in interfaces.iter_mut() {
-                // Only assign parent to virtual interfaces that don't already have one
                if !interface.is_physical && interface.parent_interface.is_none() {
                    interface.parent_interface = Some(primary.clone());
                }
--- a/agent/src/collectors/nixos.rs
+++ b/agent/src/collectors/nixos.rs
@@ -43,8 +43,8 @@ impl NixOSCollector {
        match fs::read_to_string("/etc/hostname") {
            Ok(hostname) => Some(hostname.trim().to_string()),
            Err(_) => {
-                // Fallback to hostname command
-                match Command::new("hostname").output() {
+                // Fallback to hostname command (with 2 second timeout)
+                match Command::new("timeout").args(["2", "hostname"]).output() {
                    Ok(output) => Some(String::from_utf8_lossy(&output.stdout).trim().to_string()),
                    Err(_) => None,
                }
--- a/agent/src/collectors/systemd.rs
+++ b/agent/src/collectors/systemd.rs
@@ -4,7 +4,9 @@ use cm_dashboard_shared::{AgentData, ServiceData, SubServiceData, SubServiceMetr
 use std::process::Command;
 use std::sync::RwLock;
 use std::time::Instant;
-use tracing::debug;
+use tracing::{debug, warn};
+use bollard::Docker;
+use bollard::container::ListContainersOptions;

 use super::{Collector, CollectorError};
 use crate::config::SystemdConfig;
@@ -74,7 +76,7 @@ impl SystemdCollector {
        debug!("Collecting systemd services metrics");

        // Get cached services (discovery only happens when needed)
-        let monitored_services = match self.get_monitored_services() {
+        let monitored_services = match self.get_monitored_services().await {
            Ok(services) => services,
            Err(e) => {
                debug!("Failed to get monitored services: {}", e);
@@ -94,7 +96,7 @@ impl SystemdCollector {

                    // Sub-service metrics for specific services (always include cached results)
                    if service_name.contains("nginx") && active_status == "active" {
-                        let nginx_sites = self.get_nginx_site_metrics();
+                        let nginx_sites = self.get_nginx_site_metrics().await;
                        for (site_name, latency_ms) in nginx_sites {
                            let site_status = if latency_ms >= 0.0 && latency_ms < self.config.nginx_latency_critical_ms {
                                "active"
@@ -113,12 +115,44 @@ impl SystemdCollector {
                                name: site_name.clone(),
                                service_status: self.calculate_service_status(&site_name, &site_status),
                                metrics,
+                                service_type: "nginx_site".to_string(),
                            });
                        }
                    }

-                    // Docker containers are now collected as top-level services below
-                    // Keeping nginx as sub-services for now
+                    if service_name.contains("docker") && active_status == "active" {
+                        let docker_containers = self.get_docker_containers().await;
+                        for (container_name, container_status) in docker_containers {
+                            // For now, docker containers have no additional metrics
+                            // Future: could add memory_mb, cpu_percent, restart_count, etc.
+                            let metrics = Vec::new();
+
+                            sub_services.push(SubServiceData {
+                                name: container_name.clone(),
+                                service_status: self.calculate_service_status(&container_name, &container_status),
+                                metrics,
+                                service_type: "container".to_string(),
+                            });
+                        }
+
+                        // Add Docker images
+                        let docker_images = self.get_docker_images().await;
+                        for (image_name, image_status, image_size_mb) in docker_images {
+                            let mut metrics = Vec::new();
+                            metrics.push(SubServiceMetric {
+                                label: "size".to_string(),
+                                value: image_size_mb,
+                                unit: Some("MB".to_string()),
+                            });
+
+                            sub_services.push(SubServiceData {
+                                name: image_name.to_string(),
+                                service_status: self.calculate_service_status(&image_name, &image_status),
+                                metrics,
+                                service_type: "image".to_string(),
+                            });
+                        }
+                    }

                    // Create complete service data
                    let service_data = ServiceData {
@@ -140,20 +174,9 @@ impl SystemdCollector {
            }
        }

-        // Collect Docker containers as top-level services
-        let docker_containers = self.get_docker_containers();
-        for (container_name, container_status) in docker_containers {
-            let service_data = ServiceData {
-                name: container_name.clone(),
-                memory_mb: 0.0, // TODO: Could add container memory via docker stats
-                disk_gb: 0.0,   // TODO: Could add container disk usage
-                user_stopped: false,
-                service_status: self.calculate_service_status(&container_name, &container_status),
-                sub_services: Vec::new(),
-            };
-            agent_data.services.push(service_data.clone());
-            complete_service_data.push(service_data);
-        }
+        // Sort services alphabetically by name
+        agent_data.services.sort_by(|a, b| a.name.cmp(&b.name));
+        complete_service_data.sort_by(|a, b| a.name.cmp(&b.name));

        // Update cached state
        {
@@ -169,7 +192,7 @@ impl SystemdCollector {
    }

    /// Get monitored services, discovering them if needed or cache is expired
-    fn get_monitored_services(&self) -> Result<Vec<String>> {
+    async fn get_monitored_services(&self) -> Result<Vec<String>> {
        // Check if we need discovery without holding the lock
        let needs_discovery = {
            let state = self.state.read().unwrap();
@@ -184,7 +207,7 @@ impl SystemdCollector {

        if needs_discovery {
            debug!("Discovering systemd services (cache expired or first run)");
-            match self.discover_services_internal() {
+            match self.discover_services_internal().await {
                Ok((services, status_cache)) => {
                    if let Ok(mut state) = self.state.write() {
                        state.monitored_services = services.clone();
@@ -207,44 +230,52 @@ impl SystemdCollector {
    }

    /// Get nginx site metrics, checking them if cache is expired (like old working version)
-    fn get_nginx_site_metrics(&self) -> Vec<(String, f32)> {
-        let mut state = self.state.write().unwrap();
-
-        // Check if we need to refresh nginx site metrics
-        let needs_refresh = match state.last_nginx_check_time {
-            None => true, // First time
-            Some(last_time) => {
-                let elapsed = last_time.elapsed().as_secs();
-                elapsed >= state.nginx_check_interval_seconds
+    async fn get_nginx_site_metrics(&self) -> Vec<(String, f32)> {
+        // Check if we need to refresh (read lock)
+        let needs_refresh = {
+            let state = self.state.read().unwrap();
+            match state.last_nginx_check_time {
+                None => true,
+                Some(last_time) => {
+                    let elapsed = last_time.elapsed().as_secs();
+                    elapsed >= state.nginx_check_interval_seconds
+                }
            }
        };

        if needs_refresh {
-            // Only check nginx sites if nginx service is active
-            if state.monitored_services.iter().any(|s| s.contains("nginx")) {
-                let fresh_metrics = self.get_nginx_sites_internal();
+            // Check if nginx is active (read lock)
+            let has_nginx = {
+                let state = self.state.read().unwrap();
+                state.monitored_services.iter().any(|s| s.contains("nginx"))
+            };
+
+            if has_nginx {
+                let fresh_metrics = self.get_nginx_sites_internal().await;
+                let mut state = self.state.write().unwrap();
                state.nginx_site_metrics = fresh_metrics;
                state.last_nginx_check_time = Some(Instant::now());
            }
        }

+        let state = self.state.read().unwrap();
        state.nginx_site_metrics.clone()
    }

-    /// Auto-discover interesting services to monitor
-    fn discover_services_internal(&self) -> Result<(Vec<String>, std::collections::HashMap<String, ServiceStatusInfo>)> {
-        // First: Get all service unit files
-        let unit_files_output = Command::new("systemctl")
-            .args(&["list-unit-files", "--type=service", "--no-pager", "--plain"])
+    /// Auto-discover interesting services to monitor using systemctl
+    async fn discover_services_internal(&self) -> Result<(Vec<String>, std::collections::HashMap<String, ServiceStatusInfo>)> {
+        // First: Get all service unit files (with 3 second timeout)
+        let unit_files_output = Command::new("timeout")
+            .args(&["3", "systemctl", "list-unit-files", "--type=service", "--no-pager", "--plain"])
            .output()?;

        if !unit_files_output.status.success() {
            return Err(anyhow::anyhow!("systemctl list-unit-files command failed"));
        }

-        // Second: Get runtime status of all units
-        let units_status_output = Command::new("systemctl")
-            .args(&["list-units", "--type=service", "--all", "--no-pager", "--plain"])
+        // Second: Get runtime status of all units (with 3 second timeout)
+        let units_status_output = Command::new("timeout")
+            .args(&["3", "systemctl", "list-units", "--type=service", "--all", "--no-pager", "--plain"])
            .output()?;

        if !units_status_output.status.success() {
@@ -324,9 +355,9 @@ impl SystemdCollector {
        Ok((services, status_cache))
    }

-    /// Get service status from cache (if available) or fallback to systemctl
+    /// Get service status from D-Bus cache
    fn get_service_status(&self, service: &str) -> Result<(String, String)> {
-        // Try to get status from cache first
+        // Get status from D-Bus cache (populated by discover_services_internal)
        if let Ok(state) = self.state.read() {
            if let Some(cached_info) = state.service_status_cache.get(service) {
                let active_status = cached_info.active_state.clone();
@@ -340,20 +371,25 @@ impl SystemdCollector {
            }
        }

-        // Fallback to systemctl if not in cache
+        // Service not found in D-Bus cache - treat as inactive
+        Ok(("inactive".to_string(), "LoadState=not-found\nActiveState=inactive\nSubState=dead".to_string()))
+    }
+
+    /// Get a unit property via systemctl show
+    fn get_unit_property(&self, service_name: &str, property: &str) -> Option<String> {
        let output = Command::new("systemctl")
-            .args(&["is-active", &format!("{}.service", service)])
-            .output()?;
+            .args(&["show", &format!("{}.service", service_name), &format!("--property={}", property)])
+            .output()
+            .ok()?;

-        let active_status = String::from_utf8(output.stdout)?.trim().to_string();
+        if !output.status.success() {
+            return None;
+        }

-        // Get more detailed info
-        let output = Command::new("systemctl")
-            .args(&["show", &format!("{}.service", service), "--property=LoadState,ActiveState,SubState"])
-            .output()?;
-
-        let detailed_info = String::from_utf8(output.stdout)?;
-        Ok((active_status, detailed_info))
+        let output_str = String::from_utf8(output.stdout).ok()?;
+        // Parse "PropertyName=value" format
+        let value = output_str.trim().strip_prefix(&format!("{}=", property))?;
+        Some(value.to_string())
    }

    /// Check if service name matches pattern (supports wildcards like nginx*)
@@ -401,7 +437,7 @@ impl SystemdCollector {
        if let Some(dirs) = self.config.service_directories.get(service_name) {
            // Service has configured paths - use the first accessible one
            for dir in dirs {
-                if let Some(size) = self.get_directory_size(dir) {
+                if let Some(size) = self.get_directory_size(dir).await {
                    return Ok(size);
                }
            }
@@ -410,39 +446,32 @@ impl SystemdCollector {
        }

        // No configured path - try to get WorkingDirectory from systemctl
-        let output = Command::new("systemctl")
-            .args(&["show", &format!("{}.service", service_name), "--property=WorkingDirectory"])
-            .output()
-            .map_err(|e| CollectorError::SystemRead {
-                path: format!("WorkingDirectory for {}", service_name),
-                error: e.to_string(),
-            })?;
-
-        let output_str = String::from_utf8_lossy(&output.stdout);
-        for line in output_str.lines() {
-            if line.starts_with("WorkingDirectory=") && !line.contains("[not set]") {
-                let dir = line.strip_prefix("WorkingDirectory=").unwrap_or("");
-                if !dir.is_empty() && dir != "/" {
-                    return Ok(self.get_directory_size(dir).unwrap_or(0.0));
-                }
+        if let Some(dir_str) = self.get_unit_property(service_name, "WorkingDirectory") {
+            if !dir_str.is_empty() && dir_str != "/" && dir_str != "[not set]" {
+                return Ok(self.get_directory_size(&dir_str).await.unwrap_or(0.0));
            }
        }

        Ok(0.0)
    }
    
-    /// Get size of a directory in GB
-    fn get_directory_size(&self, path: &str) -> Option<f32> {
-        let output = Command::new("sudo")
-            .args(&["du", "-sb", path])
-            .output()
-            .ok()?;
+    /// Get size of a directory in GB (with 2 second timeout)
+    async fn get_directory_size(&self, path: &str) -> Option<f32> {
+        use super::run_command_with_timeout;
+
+        // Use -s (summary) and --apparent-size for speed, 2 second timeout
+        let mut cmd = Command::new("sudo");
+        cmd.args(&["du", "-s", "--apparent-size", "--block-size=1", path]);
+
+        let output = run_command_with_timeout(cmd, 2).await.ok()?;

        if !output.status.success() {
            // Log permission errors for debugging but don't spam logs
            let stderr = String::from_utf8_lossy(&output.stderr);
            if stderr.contains("Permission denied") {
                debug!("Permission denied accessing directory: {}", path);
+            } else if stderr.contains("timed out") {
+                warn!("Directory size check timed out for {}", path);
            } else {
                debug!("Failed to get size for directory {}: {}", path, stderr);
            }
@@ -481,27 +510,13 @@ impl SystemdCollector {
        }
    }

-    /// Get memory usage for a specific service
+    /// Get memory usage for a specific service via systemctl
    async fn get_service_memory_usage(&self, service_name: &str) -> Result<f32, CollectorError> {
-        let output = Command::new("systemctl")
-            .args(&["show", &format!("{}.service", service_name), "--property=MemoryCurrent"])
-            .output()
-            .map_err(|e| CollectorError::SystemRead {
-                path: format!("memory usage for {}", service_name),
-                error: e.to_string(),
-            })?;
-
-        let output_str = String::from_utf8_lossy(&output.stdout);
-        
-        for line in output_str.lines() {
-            if line.starts_with("MemoryCurrent=") {
-                if let Some(mem_str) = line.strip_prefix("MemoryCurrent=") {
-                    if mem_str != "[not set]" {
-                        if let Ok(memory_bytes) = mem_str.parse::<u64>() {
-                            return Ok(memory_bytes as f32 / (1024.0 * 1024.0)); // Convert to MB
-                        }
-                    }
-                }
+        // Get MemoryCurrent property from systemctl
+        if let Some(value_str) = self.get_unit_property(service_name, "MemoryCurrent") {
+            // MemoryCurrent is in bytes or could be "[not set]"
+            if let Ok(memory_bytes) = value_str.parse::<u64>() {
+                return Ok(memory_bytes as f32 / (1024.0 * 1024.0)); // Convert to MB
            }
        }

@@ -515,7 +530,7 @@ impl SystemdCollector {
        match state.last_collection {
            None => true,
            Some(last) => {
-                let cache_duration = std::time::Duration::from_secs(30);
+                let cache_duration = std::time::Duration::from_secs(self.config.interval_seconds);
                last.elapsed() > cache_duration
            }
        }
@@ -532,11 +547,11 @@ impl SystemdCollector {
    }

    /// Get nginx sites with latency checks (internal - no caching)
-    fn get_nginx_sites_internal(&self) -> Vec<(String, f32)> {
+    async fn get_nginx_sites_internal(&self) -> Vec<(String, f32)> {
        let mut sites = Vec::new();

        // Discover nginx sites from configuration
-        let discovered_sites = self.discover_nginx_sites();
+        let discovered_sites = self.discover_nginx_sites().await;

        // Always add all discovered sites, even if checks fail (like old version)
        for (site_name, url) in &discovered_sites {
@@ -555,9 +570,9 @@ impl SystemdCollector {
    }

    /// Discover nginx sites from configuration
-    fn discover_nginx_sites(&self) -> Vec<(String, String)> {
+    async fn discover_nginx_sites(&self) -> Vec<(String, String)> {
        // Use the same approach as the old working agent: get nginx config from systemd
-        let config_content = match self.get_nginx_config_from_systemd() {
+        let config_content = match self.get_nginx_config_from_systemd().await {
            Some(content) => content,
            None => {
                debug!("Could not get nginx config from systemd, trying nginx -T fallback");
@@ -590,30 +605,16 @@ impl SystemdCollector {
        Some(String::from_utf8_lossy(&output.stdout).to_string())
    }

-    /// Get nginx config from systemd service definition (NixOS compatible)
-    fn get_nginx_config_from_systemd(&self) -> Option<String> {
-        let output = Command::new("systemctl")
-            .args(&["show", "nginx", "--property=ExecStart", "--no-pager"])
-            .output()
-            .ok()?;
+    /// Get nginx config from systemd service definition via systemctl (NixOS compatible)
+    async fn get_nginx_config_from_systemd(&self) -> Option<String> {
+        // Get ExecStart property from systemctl
+        let exec_start_str = self.get_unit_property("nginx", "ExecStart")?;
+        debug!("nginx ExecStart from systemctl: {}", exec_start_str);

-        if !output.status.success() {
-            debug!("Failed to get nginx ExecStart from systemd");
-            return None;
-        }
-
-        let stdout = String::from_utf8_lossy(&output.stdout);
-        debug!("systemctl show nginx output: {}", stdout);
-
-        // Parse ExecStart to extract -c config path
-        for line in stdout.lines() {
-            if line.starts_with("ExecStart=") {
-                debug!("Found ExecStart line: {}", line);
-                if let Some(config_path) = self.extract_config_path_from_exec_start(line) {
-                    debug!("Extracted config path: {}", config_path);
-                    return std::fs::read_to_string(&config_path).ok();
-                }
-            }
+        // Extract config path from ExecStart structure
+        if let Some(config_path) = self.extract_config_path_from_exec_start(&exec_start_str) {
+            debug!("Extracted config path: {}", config_path);
+            return std::fs::read_to_string(&config_path).ok();
        }

        None
@@ -755,50 +756,99 @@ impl SystemdCollector {
        }
    }

-    /// Get docker containers as sub-services
-    fn get_docker_containers(&self) -> Vec<(String, String)> {
+    /// Get docker containers as sub-services using bollard API
+    async fn get_docker_containers(&self) -> Vec<(String, String)> {
        let mut containers = Vec::new();

-        // Check if docker is available (use sudo for permissions)
-        // Use -a to show ALL containers (running and stopped)
-        let output = Command::new("sudo")
-            .args(&["docker", "ps", "-a", "--format", "{{.Names}},{{.Status}}"])
-            .output();
-
-        let output = match output {
-            Ok(out) if out.status.success() => out,
-            _ => return containers, // Docker not available or failed
+        // Connect to Docker daemon
+        let docker = match Docker::connect_with_local_defaults() {
+            Ok(d) => d,
+            Err(e) => {
+                debug!("Failed to connect to Docker daemon: {}", e);
+                return containers;
+            }
        };

-        let output_str = match String::from_utf8(output.stdout) {
-            Ok(s) => s,
-            Err(_) => return containers,
+        // List all containers (running and stopped)
+        let list_options = Some(ListContainersOptions::<String> {
+            all: true,
+            ..Default::default()
+        });
+
+        let container_list = match docker.list_containers(list_options).await {
+            Ok(list) => list,
+            Err(e) => {
+                debug!("Failed to list Docker containers: {}", e);
+                return containers;
+            }
        };

-        for line in output_str.lines() {
-            if line.trim().is_empty() {
-                continue;
-            }
+        for container in container_list {
+            // Get container name (remove leading slash if present)
+            let container_name = container.names
+                .and_then(|names| names.first().map(|n| n.trim_start_matches('/').to_string()))
+                .unwrap_or_else(|| container.id.clone().unwrap_or_default());

-            let parts: Vec<&str> = line.split(',').collect();
-            if parts.len() >= 2 {
-                let container_name = parts[0].trim();
-                let status_str = parts[1].trim();
+            // Map container state to service status
+            let container_status = match container.state.as_deref() {
+                Some("running") => "active",
+                Some("exited") | Some("created") => "inactive",
+                _ => "failed", // restarting, paused, dead, etc.
+            };

-                let container_status = if status_str.contains("Up") {
-                    "active"
-                } else if status_str.contains("Exited") || status_str.contains("Created") {
-                    "inactive" // Stopped/created containers are inactive
-                } else {
-                    "failed" // Other states (restarting, paused, dead) → failed
-                };
-                
-                containers.push((format!("docker_{}", container_name), container_status.to_string()));
-            }
+            containers.push((format!("docker_{}", container_name), container_status.to_string()));
        }

        containers
    }
+
+    /// Get docker images as sub-services using bollard API
+    async fn get_docker_images(&self) -> Vec<(String, String, f32)> {
+        let mut images = Vec::new();
+
+        // Connect to Docker daemon
+        let docker = match Docker::connect_with_local_defaults() {
+            Ok(d) => d,
+            Err(e) => {
+                debug!("Failed to connect to Docker daemon: {}", e);
+                return images;
+            }
+        };
+
+        // List all images
+        let image_list = match docker.list_images::<String>(None).await {
+            Ok(list) => list,
+            Err(e) => {
+                debug!("Failed to list Docker images: {}", e);
+                return images;
+            }
+        };
+
+        for image in image_list {
+            // Get image name from repo tags
+            let image_names: Vec<String> = image.repo_tags
+                .into_iter()
+                .filter(|tag| !tag.contains("<none>"))
+                .collect();
+
+            if image_names.is_empty() {
+                continue; // Skip untagged images
+            }
+
+            // Get size in MB
+            let size_mb = image.size as f32 / (1024.0 * 1024.0);
+
+            for image_name in image_names {
+                images.push((
+                    image_name,
+                    "inactive".to_string(), // Images are informational - use inactive for neutral display
+                    size_mb
+                ));
+            }
+        }
+
+        images
+    }
 }

 #[async_trait]
--- a/agent/src/communication/mod.rs
+++ b/agent/src/communication/mod.rs
@@ -5,10 +5,9 @@ use zmq::{Context, Socket, SocketType};

 use crate::config::ZmqConfig;

-/// ZMQ communication handler for publishing metrics and receiving commands
+/// ZMQ communication handler for publishing metrics
 pub struct ZmqHandler {
    publisher: Socket,
-    command_receiver: Socket,
 }

 impl ZmqHandler {
@@ -26,20 +25,8 @@ impl ZmqHandler {
        publisher.set_sndhwm(1000)?; // High water mark for outbound messages
        publisher.set_linger(1000)?; // Linger time on close

-        // Create command receiver socket (PULL socket to receive commands from dashboard)
-        let command_receiver = context.socket(SocketType::PULL)?;
-        let cmd_bind_address = format!("tcp://{}:{}", config.bind_address, config.command_port);
-        command_receiver.bind(&cmd_bind_address)?;
-
-        info!("ZMQ command receiver bound to {}", cmd_bind_address);
-
-        // Set non-blocking mode for command receiver
-        command_receiver.set_rcvtimeo(0)?; // Non-blocking receive
-        command_receiver.set_linger(1000)?;
-
        Ok(Self {
            publisher,
-            command_receiver,
        })
    }

@@ -65,36 +52,4 @@ impl ZmqHandler {
        Ok(())
    }

-    /// Try to receive a command (non-blocking)
-    pub fn try_receive_command(&self) -> Result<Option<AgentCommand>> {
-        match self.command_receiver.recv_bytes(zmq::DONTWAIT) {
-            Ok(bytes) => {
-                debug!("Received command message ({} bytes)", bytes.len());
-
-                let command: AgentCommand = serde_json::from_slice(&bytes)
-                    .map_err(|e| anyhow::anyhow!("Failed to deserialize command: {}", e))?;
-
-                debug!("Parsed command: {:?}", command);
-                Ok(Some(command))
-            }
-            Err(zmq::Error::EAGAIN) => {
-                // No message available (non-blocking)
-                Ok(None)
-            }
-            Err(e) => Err(anyhow::anyhow!("ZMQ receive error: {}", e)),
-        }
-    }
-}
-
-/// Commands that can be sent to the agent
-#[derive(Debug, Clone, serde::Deserialize, serde::Serialize)]
-pub enum AgentCommand {
-    /// Request immediate metric collection
-    CollectNow,
-    /// Change collection interval
-    SetInterval { seconds: u64 },
-    /// Enable/disable a collector
-    ToggleCollector { name: String, enabled: bool },
-    /// Request status/health check
-    Ping,
 }
--- a/agent/src/config/mod.rs
+++ b/agent/src/config/mod.rs
@@ -20,7 +20,6 @@ pub struct AgentConfig {
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ZmqConfig {
    pub publisher_port: u16,
-    pub command_port: u16,
    pub bind_address: String,
    pub transmission_interval_seconds: u64,
    /// Heartbeat transmission interval in seconds for host connectivity detection
--- a/agent/src/config/validation.rs
+++ b/agent/src/config/validation.rs
@@ -7,14 +7,6 @@ pub fn validate_config(config: &AgentConfig) -> Result<()> {
        bail!("ZMQ publisher port cannot be 0");
    }

-    if config.zmq.command_port == 0 {
-        bail!("ZMQ command port cannot be 0");
-    }
-
-    if config.zmq.publisher_port == config.zmq.command_port {
-        bail!("ZMQ publisher and command ports cannot be the same");
-    }
-
    if config.zmq.bind_address.is_empty() {
        bail!("ZMQ bind address cannot be empty");
    }
--- a/dashboard/Cargo.toml
+++ b/dashboard/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cm-dashboard"
-version = "0.1.172"
+version = "0.1.200"
 edition = "2021"

 [dependencies]
--- a/dashboard/src/app.rs
+++ b/dashboard/src/app.rs
@@ -215,7 +215,7 @@ impl Dashboard {

                    // Update TUI with new metrics (only if not headless)
                    if let Some(ref mut tui_app) = self.tui_app {
-                        tui_app.update_metrics(&self.metric_store);
+                        tui_app.update_metrics(&mut self.metric_store);
                    }
                }
                
--- a/dashboard/src/metrics/store.rs
+++ b/dashboard/src/metrics/store.rs
@@ -5,6 +5,14 @@ use tracing::{debug, info, warn};

 use super::MetricDataPoint;

+/// ZMQ communication statistics per host
+#[derive(Debug, Clone)]
+pub struct ZmqStats {
+    pub packets_received: u64,
+    pub last_packet_time: Instant,
+    pub last_packet_age_secs: f64,
+}
+
 /// Central metric storage for the dashboard
 pub struct MetricStore {
    /// Current structured data: hostname -> AgentData
@@ -13,6 +21,8 @@ pub struct MetricStore {
    historical_metrics: HashMap<String, Vec<MetricDataPoint>>,
    /// Last heartbeat timestamp per host
    last_heartbeat: HashMap<String, Instant>,
+    /// ZMQ communication statistics per host
+    zmq_stats: HashMap<String, ZmqStats>,
    /// Configuration
    max_metrics_per_host: usize,
    history_retention: Duration,
@@ -24,6 +34,7 @@ impl MetricStore {
            current_agent_data: HashMap::new(),
            historical_metrics: HashMap::new(),
            last_heartbeat: HashMap::new(),
+            zmq_stats: HashMap::new(),
            max_metrics_per_host,
            history_retention: Duration::from_secs(history_retention_hours * 3600),
        }
@@ -44,6 +55,16 @@ impl MetricStore {
        self.last_heartbeat.insert(hostname.clone(), now);
        debug!("Updated heartbeat for host {}", hostname);

+        // Update ZMQ stats
+        let stats = self.zmq_stats.entry(hostname.clone()).or_insert(ZmqStats {
+            packets_received: 0,
+            last_packet_time: now,
+            last_packet_age_secs: 0.0,
+        });
+        stats.packets_received += 1;
+        stats.last_packet_time = now;
+        stats.last_packet_age_secs = 0.0; // Just received
+
        // Add to history
        let host_history = self
            .historical_metrics
@@ -65,6 +86,15 @@ impl MetricStore {
        self.current_agent_data.get(hostname)
    }

+    /// Get ZMQ communication statistics for a host
+    pub fn get_zmq_stats(&mut self, hostname: &str) -> Option<ZmqStats> {
+        let now = Instant::now();
+        self.zmq_stats.get_mut(hostname).map(|stats| {
+            // Update packet age
+            stats.last_packet_age_secs = now.duration_since(stats.last_packet_time).as_secs_f64();
+            stats.clone()
+        })
+    }

    /// Get connected hosts (hosts with recent heartbeats)
    pub fn get_connected_hosts(&self, timeout: Duration) -> Vec<String> {
--- a/dashboard/src/ui/mod.rs
+++ b/dashboard/src/ui/mod.rs
@@ -100,7 +100,7 @@ impl TuiApp {
    }

    /// Update widgets with structured data from store (only for current host)
-    pub fn update_metrics(&mut self, metric_store: &MetricStore) {
+    pub fn update_metrics(&mut self, metric_store: &mut MetricStore) {
        if let Some(hostname) = self.current_host.clone() {
            // Get structured data for this host
            if let Some(agent_data) = metric_store.get_agent_data(&hostname) {
@@ -110,6 +110,14 @@ impl TuiApp {
                host_widgets.system_widget.update_from_agent_data(agent_data);
                host_widgets.services_widget.update_from_agent_data(agent_data);

+                // Update ZMQ stats
+                if let Some(zmq_stats) = metric_store.get_zmq_stats(&hostname) {
+                    host_widgets.system_widget.update_zmq_stats(
+                        zmq_stats.packets_received,
+                        zmq_stats.last_packet_age_secs
+                    );
+                }
+
                host_widgets.last_update = Some(Instant::now());
            }
        }
--- a/dashboard/src/ui/widgets/services.rs
+++ b/dashboard/src/ui/widgets/services.rs
@@ -32,6 +32,7 @@ struct ServiceInfo {
    disk_gb: Option<f32>,
    metrics: Vec<(String, f32, Option<String>)>, // (label, value, unit)
    widget_status: Status,
+    service_type: String, // "nginx_site", "container", "image", or empty for parent services
 }

 impl ServicesWidget {
@@ -169,7 +170,7 @@ impl ServicesWidget {
            // Convert Status enum to display text for sub-services
            match info.widget_status {
                Status::Ok => "active",
-                Status::Inactive => "inactive", 
+                Status::Inactive => "inactive",
                Status::Critical => "failed",
                Status::Pending => "pending",
                Status::Warning => "warning",
@@ -179,32 +180,62 @@ impl ServicesWidget {
        };
        let tree_symbol = if is_last { "└─" } else { "├─" };

-        vec![
-            // Indentation and tree prefix
-            ratatui::text::Span::styled(
-                format!("  {} ", tree_symbol),
-                Typography::tree(),
-            ),
-            // Status icon
-            ratatui::text::Span::styled(
-                format!("{} ", icon),
-                Style::default().fg(status_color).bg(Theme::background()),
-            ),
-            // Service name
-            ratatui::text::Span::styled(
-                format!("{:<18} ", short_name),
-                Style::default()
-                    .fg(Theme::secondary_text())
-                    .bg(Theme::background()),
-            ),
-            // Status/latency text
-            ratatui::text::Span::styled(
-                status_str,
-                Style::default()
-                    .fg(Theme::secondary_text())
-                    .bg(Theme::background()),
-            ),
-        ]
+        // Docker images use docker whale icon
+        if info.service_type == "image" {
+            vec![
+                // Indentation and tree prefix
+                ratatui::text::Span::styled(
+                    format!("  {} ", tree_symbol),
+                    Typography::tree(),
+                ),
+                // Docker icon (simple character for performance)
+                ratatui::text::Span::styled(
+                    "D ".to_string(),
+                    Style::default().fg(Theme::highlight()).bg(Theme::background()),
+                ),
+                // Service name
+                ratatui::text::Span::styled(
+                    format!("{:<18} ", short_name),
+                    Style::default()
+                        .fg(Theme::secondary_text())
+                        .bg(Theme::background()),
+                ),
+                // Status/metrics text
+                ratatui::text::Span::styled(
+                    status_str,
+                    Style::default()
+                        .fg(Theme::secondary_text())
+                        .bg(Theme::background()),
+                ),
+            ]
+        } else {
+            vec![
+                // Indentation and tree prefix
+                ratatui::text::Span::styled(
+                    format!("  {} ", tree_symbol),
+                    Typography::tree(),
+                ),
+                // Status icon
+                ratatui::text::Span::styled(
+                    format!("{} ", icon),
+                    Style::default().fg(status_color).bg(Theme::background()),
+                ),
+                // Service name
+                ratatui::text::Span::styled(
+                    format!("{:<18} ", short_name),
+                    Style::default()
+                        .fg(Theme::secondary_text())
+                        .bg(Theme::background()),
+                ),
+                // Status/latency text
+                ratatui::text::Span::styled(
+                    status_str,
+                    Style::default()
+                        .fg(Theme::secondary_text())
+                        .bg(Theme::background()),
+                ),
+            ]
+        }
    }

    /// Move selection up
@@ -282,9 +313,10 @@ impl Widget for ServicesWidget {
                disk_gb: Some(service.disk_gb),
                metrics: Vec::new(), // Parent services don't have custom metrics
                widget_status: service.service_status,
+                service_type: String::new(), // Parent services have no type
            };
            self.parent_services.insert(service.name.clone(), parent_info);
-            
+
            // Process sub-services if any
            if !service.sub_services.is_empty() {
                let mut sub_list = Vec::new();
@@ -293,12 +325,13 @@ impl Widget for ServicesWidget {
                    let metrics: Vec<(String, f32, Option<String>)> = sub_service.metrics.iter()
                        .map(|m| (m.label.clone(), m.value, m.unit.clone()))
                        .collect();
-                    
+
                    let sub_info = ServiceInfo {
                        memory_mb: None, // Not used for sub-services
                        disk_gb: None,   // Not used for sub-services
                        metrics,
                        widget_status: sub_service.service_status,
+                        service_type: sub_service.service_type.clone(),
                    };
                    sub_list.push((sub_service.name.clone(), sub_info));
                }
@@ -342,6 +375,7 @@ impl ServicesWidget {
                                    disk_gb: None,
                                    metrics: Vec::new(),
                                    widget_status: Status::Unknown,
+                                    service_type: String::new(),
                                });

                        if metric.name.ends_with("_status") {
@@ -377,6 +411,7 @@ impl ServicesWidget {
                                    disk_gb: None,
                                    metrics: Vec::new(),
                                    widget_status: Status::Unknown,
+                                    service_type: String::new(), // Unknown type in legacy path
                                },
                            ));
                            &mut sub_service_list.last_mut().unwrap().1
--- a/dashboard/src/ui/widgets/system.rs
+++ b/dashboard/src/ui/widgets/system.rs
@@ -15,6 +15,10 @@ pub struct SystemWidget {
    nixos_build: Option<String>,
    agent_hash: Option<String>,

+    // ZMQ communication stats
+    zmq_packets_received: Option<u64>,
+    zmq_last_packet_age: Option<f64>,
+
    // Network interfaces
    network_interfaces: Vec<cm_dashboard_shared::NetworkInterfaceData>,

@@ -92,6 +96,8 @@ impl SystemWidget {
        Self {
            nixos_build: None,
            agent_hash: None,
+            zmq_packets_received: None,
+            zmq_last_packet_age: None,
            network_interfaces: Vec::new(),
            cpu_load_1min: None,
            cpu_load_5min: None,
@@ -154,6 +160,12 @@ impl SystemWidget {
    pub fn _get_agent_hash(&self) -> Option<&String> {
        self.agent_hash.as_ref()
    }
+
+    /// Update ZMQ communication statistics
+    pub fn update_zmq_stats(&mut self, packets_received: u64, last_packet_age_secs: f64) {
+        self.zmq_packets_received = Some(packets_received);
+        self.zmq_last_packet_age = Some(last_packet_age_secs);
+    }
 }

 use super::Widget;
@@ -796,6 +808,18 @@ impl SystemWidget {
            Span::styled(format!("Agent: {}", agent_version_text), Typography::secondary())
        ]));

+        // ZMQ communication stats
+        if let (Some(packets), Some(age)) = (self.zmq_packets_received, self.zmq_last_packet_age) {
+            let age_text = if age < 1.0 {
+                format!("{:.0}ms ago", age * 1000.0)
+            } else {
+                format!("{:.1}s ago", age)
+            };
+            lines.push(Line::from(vec![
+                Span::styled(format!("ZMQ: {} pkts, last {}", packets, age_text), Typography::secondary())
+            ]));
+        }
+
        // CPU section
        lines.push(Line::from(vec![
            Span::styled("CPU:", Typography::widget_title())
--- a/shared/Cargo.toml
+++ b/shared/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cm-dashboard-shared"
-version = "0.1.172"
+version = "0.1.200"
 edition = "2021"

 [dependencies]
--- a/shared/src/agent_data.rs
+++ b/shared/src/agent_data.rs
@@ -149,6 +149,9 @@ pub struct SubServiceData {
    pub name: String,
    pub service_status: Status,
    pub metrics: Vec<SubServiceMetric>,
+    /// Type of sub-service: "nginx_site", "container", "image"
+    #[serde(default)]
+    pub service_type: String,
 }

 /// Individual metric for a sub-service
Author	SHA1	Message	Date
Christoffer Martinsson	85c6c624fb	Revert D-Bus usage, use systemctl commands only All checks were successful Build and Release / build-and-release (push) Successful in 1m20s Details - Remove zbus dependency from agent - Replace D-Bus Connection calls with systemctl show commands - Fix agent hang by eliminating blocking D-Bus operations - get_unit_property now uses systemctl show with property flags - Memory, disk usage, and nginx config queries use systemctl - Simpler, more reliable service monitoring	2025-11-28 12:15:04 +01:00
Christoffer Martinsson	eab3f17428	Fix agent hang by reverting service discovery to systemctl All checks were successful Build and Release / build-and-release (push) Successful in 1m31s Details The D-Bus ListUnits call in discover_services_internal() was causing the agent to hang on startup. Root cause: - D-Bus ListUnits call with complex tuple destructuring hung indefinitely - Agent never completed first collection cycle - No collector output in logs Fix: - Revert discover_services_internal() to use systemctl list-units/list-unit-files - Keep D-Bus-based property queries (WorkingDirectory, MemoryCurrent, ExecStart) - Hybrid approach: systemctl for discovery, D-Bus for individual queries External commands still used: - systemctl list-units, list-unit-files (service discovery) - smartctl (SMART data) - sudo du (directory sizes) - nginx -T (config fallback) Version bump: 0.1.198 → 0.1.199	2025-11-28 11:57:31 +01:00
Christoffer Martinsson	7ad149bbe4	Replace all systemctl commands with zbus D-Bus API All checks were successful Build and Release / build-and-release (push) Successful in 1m31s Details Complete migration from systemctl subprocess calls to native D-Bus communication: Removed systemctl commands: - systemctl is-active (fallback) - use D-Bus cache from ListUnits - systemctl show --property=LoadState,ActiveState,SubState - use D-Bus cache - systemctl show --property=WorkingDirectory - use D-Bus Properties.Get - systemctl show --property=MemoryCurrent - use D-Bus Properties.Get - systemctl show nginx --property=ExecStart - use D-Bus Properties.Get Implementation details: - Added get_unit_property() helper for D-Bus property access - Made get_nginx_site_metrics() async to support D-Bus calls - Made get_nginx_sites_internal() async - Made discover_nginx_sites() async - Made get_nginx_config_from_systemd() async - Fixed RwLock guard Send issues by using scoped locks Remaining external commands: - smartctl (disk.rs) - No Rust alternative for SMART data - sudo du (systemd.rs) - Directory size measurement - nginx -T (systemd.rs) - Nginx config fallback - timeout hostname (nixos.rs) - Rare fallback only Version bump: 0.1.197 → 0.1.198	2025-11-28 11:46:28 +01:00
Christoffer Martinsson	b444c88ea0	Replace external commands with native Rust APIs All checks were successful Build and Release / build-and-release (push) Successful in 1m54s Details Significant performance improvements by eliminating subprocess spawning: - Replace 'ip' commands with rtnetlink for network interface discovery - Replace 'docker ps/images' with bollard Docker API client - Replace 'systemctl list-units' with zbus D-Bus for systemd interaction - Replace 'df' with statvfs() syscall for filesystem statistics - Replace 'lsblk' with /proc/mounts parsing Add interval-based caching to collectors: - DiskCollector now respects interval_seconds configuration - SystemdCollector now respects interval_seconds configuration - CpuCollector now respects interval_seconds configuration Remove unused command communication infrastructure: - Remove port 6131 ZMQ command receiver - Clean up unused AgentCommand types Dependencies added: - rtnetlink = "0.14" - netlink-packet-route = "0.19" - bollard = "0.17" - zbus = "4.0" - nix (fs features for statvfs)	2025-11-28 11:27:33 +01:00
Christoffer Martinsson	317cf76bd1	Bump version to v0.1.196 All checks were successful Build and Release / build-and-release (push) Successful in 1m19s Details	2025-11-27 23:16:40 +01:00
Christoffer Martinsson	0db1a165b9	Revert "Implement cached collector architecture with configurable timeouts" This reverts commit `2740de9b54`.	2025-11-27 23:12:08 +01:00
Christoffer Martinsson	3c2955376d	Revert "Fix ZMQ sender blocking - move to independent thread with try_read" This reverts commit `01e1f33b66`.	2025-11-27 23:10:55 +01:00
Christoffer Martinsson	f09ccabc7f	Revert "Fix data duplication in cached collector architecture" This reverts commit `14618c59c6`.	2025-11-27 23:09:40 +01:00
Christoffer Martinsson	43dd5a901a	Update CLAUDE.md with correct ZMQ sender architecture	2025-11-27 22:59:38 +01:00
Christoffer Martinsson	01e1f33b66	Fix ZMQ sender blocking - move to independent thread with try_read All checks were successful Build and Release / build-and-release (push) Successful in 1m21s Details CRITICAL FIX: The previous cached collector architecture still had ZMQ sending in the main event loop, where it could block waiting for RwLock when collectors were writing. This caused the 3-8 second delays you observed. Changes: - Move ZMQ publisher to dedicated std::thread (ZMQ sockets aren't thread-safe) - Use try_read() instead of read() to avoid blocking on write locks - Send previous data if cache is locked by collector - ZMQ now sends every 2s regardless of collector timing - Remove publisher from ZmqHandler (now only handles commands) Architecture: - Collectors: Independent tokio tasks updating shared cache - ZMQ Sender: Dedicated OS thread with its own publisher socket - Main Loop: Only handles commands and notifications This ensures ZMQ transmission is NEVER blocked by slow collectors. Bump version to v0.1.195	2025-11-27 22:56:58 +01:00
Christoffer Martinsson	ed6399b914	Bump version to v0.1.194 All checks were successful Build and Release / build-and-release (push) Successful in 1m20s Details	2025-11-27 22:46:17 +01:00
Christoffer Martinsson	14618c59c6	Fix data duplication in cached collector architecture Critical bug fix: Collectors were appending to Vecs instead of replacing them, causing duplicate entries with each collection cycle. Fixed by adding .clear() calls before populating: - Memory collector: tmpfs Vec (was showing 11+ duplicates) - Disk collector: drives and pools Vecs - Systemd collector: services Vec - Network collector: Already correct (assigns new Vec) This prevents the exponential growth of duplicate entries in the dashboard UI.	2025-11-27 22:45:44 +01:00
Christoffer Martinsson	2740de9b54	Implement cached collector architecture with configurable timeouts All checks were successful Build and Release / build-and-release (push) Successful in 1m20s Details Major architectural refactor to eliminate false "host offline" alerts: - Replace sequential blocking collectors with independent async tasks - Each collector runs at configurable interval and updates shared cache - ZMQ sender reads cache every 1-2s regardless of collector speed - Collector intervals: CPU/Memory (1-10s), Backup/NixOS (30-60s), Disk/Systemd (60-300s) All intervals now configurable via NixOS config: - collectors..interval_seconds (collection frequency per collector) - collectors..command_timeout_seconds (timeout for shell commands) - notifications.check_interval_seconds (status change detection rate) Command timeouts increased from hardcoded 2-3s to configurable 10-30s: - Disk collector: 30s (SMART operations, lsblk) - Systemd collector: 15s (systemctl, docker, du commands) - Network collector: 10s (ip route, ip addr) Benefits: - No false "offline" alerts when slow collectors take >10s - Different update rates for different metric types - Better resource management with longer timeouts - Full NixOS configuration control Bump version to v0.1.193	2025-11-27 22:37:20 +01:00
Christoffer Martinsson	37f2650200	Document cached collector architecture plan Add architectural plan for separating ZMQ sending from data collection to prevent false 'host offline' alerts caused by slow collectors. Key concepts: - Shared cache (Arc<RwLock<AgentData>>) - Independent async collector tasks with different update rates - ZMQ sender always sends every 1s from cache - Fast collectors (1s), medium (5s), slow (60s) - No blocking regardless of collector speed	2025-11-27 21:49:44 +01:00
Christoffer Martinsson	833010e270	Bump version to v0.1.192 All checks were successful Build and Release / build-and-release (push) Successful in 1m8s Details	2025-11-27 18:34:53 +01:00
Christoffer Martinsson	549d9d1c72	Replace whale emoji with ASCII 'D' for performance Emoji rendering in terminals can be very slow, especially when rendered in the hot path (every frame for every docker image). The whale emoji 🐋 was causing significant rendering delays. Temporary change to ASCII 'D' to test if emoji was the performance issue.	2025-11-27 18:34:27 +01:00
Christoffer Martinsson	9b84b70581	Bump version to v0.1.191 All checks were successful Build and Release / build-and-release (push) Successful in 1m8s Details	2025-11-27 18:16:49 +01:00
Christoffer Martinsson	92c3ee3f2a	Add Docker whale icon for docker images Docker images now display with distinctive 🐋 whale icon in blue (highlight color) instead of status icons. This provides clear visual identification that these are docker images while not implying operational status.	2025-11-27 18:16:33 +01:00
Christoffer Martinsson	1be55f765d	Bump version to v0.1.190 All checks were successful Build and Release / build-and-release (push) Successful in 1m9s Details	2025-11-27 18:09:49 +01:00
Christoffer Martinsson	2f94a4b853	Add service_type field to separate data from presentation Changes: - Add service_type field to SubServiceData: 'nginx_site', 'container', 'image' - Agent sends pure data without display formatting - Dashboard checks service_type to decide presentation - Docker images now display without status icon (service_type='image') - Remove unused image_size_str from docker images tuple Clean separation: agent provides data, dashboard handles display logic.	2025-11-27 18:09:20 +01:00
Christoffer Martinsson	ff2b43827a	Bump version to v0.1.189 All checks were successful Build and Release / build-and-release (push) Successful in 1m19s Details	2025-11-27 17:57:38 +01:00
Christoffer Martinsson	fac0188c6f	Change docker image display format and status Changes: - Rename docker images from 'image_node:18...' to 'I node:18...' for conciseness - Change image status from 'active' to 'inactive' for neutral informational display - Images now show with gray empty circle ○ instead of green filled circle ● Docker images are static artifacts without meaningful operational status, so using inactive status provides neutral gray display that won't trigger alerts or affect service status aggregation.	2025-11-27 17:57:24 +01:00
Christoffer Martinsson	6bb350f016	Bump version to v0.1.188 All checks were successful Build and Release / build-and-release (push) Successful in 1m8s Details	2025-11-27 16:39:46 +01:00
Christoffer Martinsson	374b126446	Reduce all command timeouts to 2-3 seconds max With 10-second host heartbeat timeout, all command timeouts must be significantly lower to ensure total collection time stays under 10 seconds. Changed timeouts: - smartctl: 10s → 3s (critical: multiple drives queried sequentially) - du: 5s → 2s - lsblk: 5s → 2s - systemctl list commands: 5s → 3s - systemctl show/is-active: 3s → 2s - docker commands: 5s → 3s - df, ip commands: 3s → 2s Total worst-case collection time now capped at more reasonable levels, preventing false host offline alerts from blocking operations.	2025-11-27 16:38:54 +01:00
Christoffer Martinsson	76c04633b5	Bump version to v0.1.187 All checks were successful Build and Release / build-and-release (push) Successful in 1m19s Details	2025-11-27 16:34:42 +01:00
Christoffer Martinsson	1e0510be81	Add comprehensive timeouts to all blocking system commands Fixes random host disconnections caused by blocking operations preventing timely ZMQ packet transmission. Changes: - Add run_command_with_timeout() wrapper using tokio for async command execution - Apply 10s timeout to smartctl (prevents 30+ second hangs on failing drives) - Apply 5s timeout to du, lsblk, systemctl list commands - Apply 3s timeout to systemctl show/is-active, df, ip commands - Apply 2s timeout to hostname command - Use system 'timeout' command for sync operations where async not needed Critical fixes: - smartctl: Failing drives could block for 30+ seconds per drive - du: Large directories (Docker, PostgreSQL) could block 10-30+ seconds - systemctl/docker: Commands could block indefinitely during system issues With 1-second collection interval and 10-second heartbeat timeout, any blocking operation >10s causes false "host offline" alerts. These timeouts ensure collection completes quickly even during system degradation.	2025-11-27 16:34:08 +01:00
Christoffer Martinsson	9a2df906ea	Add ZMQ communication statistics tracking and display All checks were successful Build and Release / build-and-release (push) Successful in 1m10s Details	2025-11-27 16:14:45 +01:00
Christoffer Martinsson	6d6beb207d	Parse Docker image sizes to MB and sort services alphabetically All checks were successful Build and Release / build-and-release (push) Successful in 1m18s Details	2025-11-27 15:57:38 +01:00
Christoffer Martinsson	7a68da01f5	Remove debug logging for NVMe SMART collection All checks were successful Build and Release / build-and-release (push) Successful in 1m9s Details	2025-11-27 15:40:16 +01:00
Christoffer Martinsson	5be67fed64	Add debug logging for NVMe SMART data collection All checks were successful Build and Release / build-and-release (push) Successful in 1m19s Details	2025-11-27 15:00:48 +01:00
Christoffer Martinsson	cac836601b	Add NVMe device type flag for SMART data collection All checks were successful Build and Release / build-and-release (push) Successful in 1m19s Details	2025-11-27 13:34:30 +01:00
Christoffer Martinsson	bd22ce265b	Use direct smartctl with CAP_SYS_RAWIO instead of sudo All checks were successful Build and Release / build-and-release (push) Successful in 1m9s Details	2025-11-27 13:22:13 +01:00
Christoffer Martinsson	bbc8b7b1cb	Add info-level logging for SMART data collection debugging All checks were successful Build and Release / build-and-release (push) Successful in 1m19s Details	2025-11-27 13:15:53 +01:00
Christoffer Martinsson	5dd8cadef3	Remove debug logging from Docker collection code All checks were successful Build and Release / build-and-release (push) Successful in 1m19s Details	2025-11-27 12:50:20 +01:00
Christoffer Martinsson	fefe30ec51	Remove sudo from docker commands - use docker group membership instead All checks were successful Build and Release / build-and-release (push) Successful in 1m19s Details Agent changes: - Changed docker ps and docker images commands to run without sudo - cm-agent user is already in docker group, so sudo is not needed - Fixes "unable to change to root gid: Operation not permitted" error - Systemd security restrictions were blocking sudo gid changes This fixes Docker container and image collection on systems with systemd security hardening enabled. Updated to version 0.1.178	2025-11-27 12:35:38 +01:00
Christoffer Martinsson	fb40cce748	Add stderr logging for Docker images command failure All checks were successful Build and Release / build-and-release (push) Successful in 1m9s Details Agent changes: - Log stderr output when docker images command fails - This will show the actual error message (e.g., permission denied, docker not found) - Helps diagnose why docker images collection is failing Updated to version 0.1.177	2025-11-27 12:28:55 +01:00
Christoffer Martinsson	eaa057b284	Change Docker collection logging from debug to info level All checks were successful Build and Release / build-and-release (push) Successful in 1m10s Details Agent changes: - Changed debug!() to info!() for Docker collection logs - This allows logs to show with default RUST_LOG=info setting - Added info import to tracing use statement Now logs will be visible in journalctl without needing to change log level: - "Collecting Docker sub-services for service: docker" - "Found X Docker containers" - "Found X Docker images" - "Total Docker sub-services added: X" Updated to version 0.1.176	2025-11-27 12:18:17 +01:00
Christoffer Martinsson	f23a1b5cec	Add debug logging for Docker container and image collection All checks were successful Build and Release / build-and-release (push) Successful in 1m10s Details Agent changes: - Added debug logging to Docker images collection function - Log when Docker sub-services are being collected for a service - Log count of containers and images found - Log total sub-services added - Show command failure details instead of silently returning empty vec This will help diagnose why Docker images aren't showing up as sub-services on some hosts. The logs will show if the docker commands are failing or if the collection is working but data isn't being transmitted properly. Updated to version 0.1.175	2025-11-27 12:04:51 +01:00
Christoffer Martinsson	3f98f68b51	Show Docker images as sub-services under docker service All checks were successful Build and Release / build-and-release (push) Successful in 1m23s Details Agent changes: - Added get_docker_images() function to list all Docker images - Use docker images to show stored images with repository:tag and size - Display images as sub-services under docker service with size in parentheses - Skip dangling images (<none>:<none>) - Images shown with active status (always present when listed) Example display: ● docker active 139M 1MB ├─ ● docker_gitea active ├─ ○ docker_old-app inactive ├─ ● image_nginx:latest (142MB) ├─ ● image_postgres:15 (379MB) └─ ● image_gitea:latest (256MB) Updated to version 0.1.174	2025-11-27 11:43:35 +01:00
Christoffer Martinsson	3d38a7a984	Show all Docker containers as sub-services with active/inactive status All checks were successful Build and Release / build-and-release (push) Successful in 1m9s Details Agent changes: - Use docker ps -a to show ALL containers (running and stopped) - Map container status: Up -> active, Exited/Created -> inactive, other -> failed - Display Docker containers as sub-services under the docker service - Each container shown with proper status indicator Example display: ● docker active 139M 1MB ├─ ● docker_gitea active ├─ ○ docker_old-app inactive └─ ● docker_immich active Updated to version 0.1.173	2025-11-27 10:56:15 +01:00