Two fixes this round.
Self-update no longer bricks containers with backticks or $ in their labels/env (#49, thanks @LeeNX). The self-update helper builds a docker run line and runs it through sh -c. I was double-quoting the args, which doesn't protect backticks or $ from the shell — so a Traefik rule like Host(host.example.com) made sh try to execute the hostname, the recreate failed, and the update rolled back and left the container dead. Everything's quoted with shlex.quote now, so labels reach Docker verbatim. This affected the current version too, so worth updating if you run behind Traefik. (The RLIMIT_NOFILE line in Lee's log was #48, already fixed in v1.47.4.)
Flappy healthchecks don't spam anymore (#2, @famewolf). A healthy→unhealthy flip now waits one monitor pass before alerting. Still unhealthy on the next pass? You get the alert as before. Already back to healthy? Total silence — no unhealthy, no recovery. This is aimed at things like gluetun's ICMP-mismatch blip that clears itself within a minute. Exits, OOM kills and crash-restarts stay immediate.