Thanks, good to know! I had no idea about the tags. Looks like there's a lot more variables available.
I just reread the docs on the log drivers - they mentioned that as of docker 20.x local logs now work with all drivers as it buffers the logs locally as well. I think this is probably why I hadn't explored the other drivers before - couldn't use docker-compose logs.
If lenny-ui is already using a JSX based library (InfernoJS), why not use it? I can't believe they construct HTML manually like that without a hint of escaping or stripping. Sure, many markdown renderers tell you to just slap it in __html or dangerouslySetInnerHtml but there are many that just parse the MD and let you render it with JSX!
I also can't believe there's no CSP that stopped this. Sure, it's a pain in the ass to configure with a nonce but this is literally the kind of thing it's made to block!