funman300
1e8d46b258
Recreating the Docker anchor left the supervised Core and host stranded in the dead namespace while systemd still reported them active — serving nobody, invisible to any monitoring that trusts unit state. Reproduced on staging: netns 4026539938 -> 4026540033, both pids unchanged in the old one, both units "active", traffic ConnectionResetError. There is no systemd-native edge signal to bind to. Containers do appear as units, but the scope name embeds the container ID (docker-<id>.scope), which changes on every recreate, so BindsTo= has no stable target; NetworkNamespacePath= resolves once at start; a .path unit on /run/netns would watch the file this tooling maintains. So: a level-triggered reconcile on a 10s timer, comparing the namespace the services are ACTUALLY in against the anchor's CURRENT one, acting only on a real difference. That cannot miss an event while the watcher restarts or dockerd is down, and needs no debounce — a burst of three recreations produced exactly one rebind. The trigger stays separable: a docker-events unit could invoke the same script. Anchor absent stops the dependants rather than falling back to host networking; docker unavailable logs once and retries on the next tick. Two defects found while testing and fixed here: - mount --bind STACKS when the old mount is busy, silently leaking nsfs entries; the bind helper now drains stale mounts in a loop. - reconcile must stop -> rebind -> start, not rebind -> restart: a running service holds the old namespace open and makes the umount fail busy. Staging also gained a faithful anchor container so the reproduction is structural rather than mocked. Economy state was byte-identical across every lifecycle test. Production units are templates only and remain uninstalled.
17 lines
548 B
SYSTEMD
17 lines
548 B
SYSTEMD
[Unit]
|
|
Description=OpenFUT STAGING: periodic anchor-namespace reconcile
|
|
Documentation=file:///home/alex/OpenFUT/scripts/systemd/README.md
|
|
|
|
[Timer]
|
|
# 10s cadence. Container recreation is rare and already an outage; converging
|
|
# within ~10s is ample, and a level-triggered check at this rate costs one
|
|
# `docker inspect` plus two readlinks.
|
|
OnBootSec=15s
|
|
OnUnitInactiveSec=10s
|
|
AccuracySec=1s
|
|
# Not Persistent=: there is nothing to catch up on. The check is stateless and
|
|
# the next tick after boot is authoritative.
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|