funman300
1e8d46b258
Recreating the Docker anchor left the supervised Core and host stranded in the dead namespace while systemd still reported them active — serving nobody, invisible to any monitoring that trusts unit state. Reproduced on staging: netns 4026539938 -> 4026540033, both pids unchanged in the old one, both units "active", traffic ConnectionResetError. There is no systemd-native edge signal to bind to. Containers do appear as units, but the scope name embeds the container ID (docker-<id>.scope), which changes on every recreate, so BindsTo= has no stable target; NetworkNamespacePath= resolves once at start; a .path unit on /run/netns would watch the file this tooling maintains. So: a level-triggered reconcile on a 10s timer, comparing the namespace the services are ACTUALLY in against the anchor's CURRENT one, acting only on a real difference. That cannot miss an event while the watcher restarts or dockerd is down, and needs no debounce — a burst of three recreations produced exactly one rebind. The trigger stays separable: a docker-events unit could invoke the same script. Anchor absent stops the dependants rather than falling back to host networking; docker unavailable logs once and retries on the next tick. Two defects found while testing and fixed here: - mount --bind STACKS when the old mount is busy, silently leaking nsfs entries; the bind helper now drains stale mounts in a loop. - reconcile must stop -> rebind -> start, not rebind -> restart: a running service holds the old namespace open and makes the umount fail busy. Staging also gained a faithful anchor container so the reproduction is structural rather than mocked. Economy state was byte-identical across every lifecycle test. Production units are templates only and remain uninstalled.
15 lines
421 B
SYSTEMD
15 lines
421 B
SYSTEMD
[Unit]
|
|
Description=OpenFUT: periodic anchor-namespace reconcile
|
|
Documentation=file:///home/alex/OpenFUT/scripts/systemd/README.md
|
|
# PRODUCTION TEMPLATE — NOT INSTALLED.
|
|
|
|
[Timer]
|
|
# 10s. Anchor recreation is rare and already an outage; converging inside ~10s
|
|
# is ample. Measured cost per tick: one `docker inspect` plus two readlinks.
|
|
OnBootSec=15s
|
|
OnUnitInactiveSec=10s
|
|
AccuracySec=1s
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|