vm: update, open and prune for docker containers

Update runs `docker compose -p <project> -f <files> up -d --pull always`
with the files read from the com.docker.compose.project.config_files label,
so only stacks compose itself made get the button: a plain `docker run`
container has no recipe to recreate it from, and the supabase CLI labels
the project and nothing else. It has its own Process because a pull runs
for minutes and must not be clobbered by a start or stop meanwhile.

Published TCP ports become localhost:<port> buttons opened by the default
browser. Docker cannot say which port is a web UI, so every published one
gets a button and a port ending in 443 is guessed https.

Prune images runs `docker image prune -a -f` behind a confirm step, since a
re-pull can be gigabytes. The images it would delete are listed under the
header from `docker image ls`'s {{.Containers}} count, which docker 29
fills in; images of stopped containers are kept. That count reads 0 for
images only used by `--rm` containers, such as the test-build ones, so the
list is the warning.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 20 insertions, 0 deletions

diff --git a/desktop/modules/vm/README.md b/desktop/modules/vm/README.md
index 1f8481e..ad3eb17 100644
--- a/desktop/modules/vm/README.md
+++ b/desktop/modules/vm/README.md
@@ -95,6 +95,26 @@ turn the stream into a poll. It dies with the daemon, so it is retried every
 whole group by id, so no compose file is needed; nothing removes a
 container.
 
+Update is `docker compose -p <project> -f <files> up -d --pull always`, with
+the files read from the `com.docker.compose.project.config_files` label. It
+recreates only containers whose image changed, and also starts any stopped
+service of the stack. Only stacks carrying that label get the button: a
+plain `docker run` container has no recipe to recreate it from, and stacks
+made by other tools (the supabase CLI labels the project and nothing else)
+are updated by those tools.
+
+Prune images runs `docker image prune -a -f` after a confirm step: every
+image no container uses, running or stopped, so a stopped stack keeps its
+images. Docker's reclaimed-space line shows beside the button. The images it
+would delete are listed under the header, from `docker image ls`'s
+`{{.Containers}}` count (docker 29), refreshed with the container list.
+
+Each running container lists its published TCP ports as `localhost:<port>`
+buttons, opened with `Qt.openUrlExternally`, so the default browser takes them
+(a new tab in a running Firefox). Docker cannot say which port serves a web
+UI, so every published port gets a button, and a port ending in 443 is guessed
+https; Portainer's 8000 is its agent tunnel and opens nothing useful.
+
 ## Two things that bite
 
 **A config with no visible window exits.** The drawer is closed most of the