@underpostnet/cyberia 3.2.90 → 3.3.0

package/src/api/cyberia-server-defaults/cyberia-server-defaults.js

@@ -909,7 +909,6 @@ export const ENTITY_TYPE_DEFAULTS = Object.freeze([
       { itemId: 'anon', active: true, quantity: 1 },
       { itemId: 'atlas_pistol_mk2', active: true, quantity: 1 },
       { itemId: 'coin', active: false, quantity: 0 },
-      { itemId: 'eiri', active: false, quantity: 1 },
     ],
   },
   {
@@ -939,8 +938,18 @@ export const ENTITY_TYPE_DEFAULTS = Object.freeze([
   { entityType: ENTITY_TYPES.bot, liveItemIds: ['alex'], deadItemIds: [DEFAULT_DEAD_ITEM_ID], behavior: 'provider' },
   { entityType: ENTITY_TYPES.bot, liveItemIds: ['agent'], deadItemIds: [DEFAULT_DEAD_ITEM_ID], behavior: 'provider' },
   { entityType: ENTITY_TYPES.bot, liveItemIds: ['punk'], deadItemIds: [DEFAULT_DEAD_ITEM_ID], behavior: 'provider' },
-  { entityType: ENTITY_TYPES.bot, liveItemIds: ['eiri'], deadItemIds: [DEFAULT_DEAD_ITEM_ID], behavior: 'provider-static' },
-  { entityType: ENTITY_TYPES.bot, liveItemIds: ['kaneki'], deadItemIds: [DEFAULT_DEAD_ITEM_ID], behavior: 'provider-static' },
+  {
+    entityType: ENTITY_TYPES.bot,
+    liveItemIds: ['eiri'],
+    deadItemIds: [DEFAULT_DEAD_ITEM_ID],
+    behavior: 'provider-static',
+  },
+  {
+    entityType: ENTITY_TYPES.bot,
+    liveItemIds: ['kaneki'],
+    deadItemIds: [DEFAULT_DEAD_ITEM_ID],
+    behavior: 'provider-static',
+  },
   {
     entityType: ENTITY_TYPES.bot,
     liveItemIds: ['lain'],
@@ -1027,6 +1036,10 @@ export const CYBERIA_INSTANCE_CONF_DEFAULTS = {
   defaultPlayerHeight: 2,
   playerBaseLifeRegenMin: 0.5,
   playerBaseLifeRegenMax: 1.5,
+  // Movement speed for the player entity only, in grid cells per second. Bots,
+  // projectiles and every other entity keep entityBaseSpeed. 0 falls back to
+  // entityBaseSpeed.
+  playerBaseSpeed: 8,
   sumStatsLimit: 500,
   maxActiveLayers: 4,
   initialLifeFraction: 1.0,

package/src/api/object-layer/object-layer.model.js

@@ -3,6 +3,8 @@
  * @module src/api/object-layer/object-layer.model.js
  * @namespace CyberiaObjectLayerModel
  */
+import crypto from 'crypto';
+import stringify from 'fast-json-stable-stringify';
 import { Schema, model } from 'mongoose';
 /**
  * @typedef {Object} Stats
@@ -132,8 +134,19 @@ const ObjectLayerSchema = new Schema(
     toObject: { virtuals: true },
   },
 );
-// Index for faster querying
-ObjectLayerSchema.index({ 'data.item.id': 1 });
+/**
+ * Name of the `data.item.id` index. Kept stable across the non-unique → unique
+ * upgrade so {@link ObjectLayerModel.ensureUniqueItemIdIndex} can detect and
+ * replace the legacy definition instead of leaving two overlapping indexes.
+ * @memberof CyberiaObjectLayerModel
+ */
+const ITEM_ID_INDEX_NAME = 'data.item.id_1';
+// `data.item.id` is the natural key: exactly one document per item id.
+// autoIndex runs at model-compile time, so on a collection that still holds
+// legacy duplicates (or a legacy non-unique index) this build fails and is
+// logged by the model's `error` listener. ensureUniqueItemIdIndex() then
+// dedupes and rebuilds it, after which autoIndex agrees and stays quiet.
+ObjectLayerSchema.index({ 'data.item.id': 1 }, { name: ITEM_ID_INDEX_NAME, unique: true });
 ObjectLayerSchema.index({ 'data.item.type': 1 });
 // Add text index for searchable fields
 ObjectLayerSchema.index(
@@ -158,6 +171,186 @@ ObjectLayerSchema.pre('save', function () {
   }
   // cid (object layer data JSON) and data.render.cid (atlas PNG) are optional – default to ''
 });
+
+/**
+ * Computes the canonical SHA-256 of an object layer `data` sub-document using
+ * deterministic JSON serialisation. Single source of truth for the hash;
+ * `ObjectLayerEngine.computeSha256` delegates here.
+ *
+ * @param {Object} data - The `data` sub-document (item, stats, ledger, render).
+ * @returns {string} Hex-encoded SHA-256 hash.
+ * @memberof CyberiaObjectLayerModel
+ */
+const computeObjectLayerSha256 = (data) => crypto.createHash('sha256').update(stringify(data)).digest('hex');
+
+const isMergeableObject = (value) => {
+  if (value === null || typeof value !== 'object') return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+
+/**
+ * An incoming attribute only wins when it actually carries a value. `null`,
+ * `undefined` and `''` mean "not provided by this writer" — importers emit them
+ * whenever a stage is skipped or degraded (IPFS unreachable, atlas not
+ * generated, saga metadata with no render yet), and they must never erase a
+ * value another writer already persisted. `false` and `0` are real values.
+ *
+ * @param {*} value - Candidate attribute value.
+ * @returns {boolean} Whether the value should override the stored one.
+ * @memberof CyberiaObjectLayerModel
+ */
+const hasValue = (value) => value !== null && value !== undefined && value !== '';
+
+/**
+ * Deep-merges `incoming` over `existing`, keeping the last attribute that
+ * actually carries a value. Plain objects merge key by key; every other value
+ * (scalars, arrays, ObjectIds, Dates, Buffers) is replaced atomically.
+ *
+ * @param {*} existing - Currently persisted value.
+ * @param {*} incoming - Value received from the writer.
+ * @returns {*} The merged value.
+ * @memberof CyberiaObjectLayerModel
+ */
+function mergeObjectLayerData(existing, incoming) {
+  if (isMergeableObject(incoming)) {
+    if (!isMergeableObject(existing)) return incoming;
+    const merged = { ...existing };
+    for (const key of Object.keys(incoming)) merged[key] = mergeObjectLayerData(existing[key], incoming[key]);
+    return merged;
+  }
+  return hasValue(incoming) ? incoming : existing;
+}
+
+/**
+ * Document fields an upsert may carry. `sha256` is excluded on purpose: it is
+ * always recomputed from the merged `data`, so it can never drift from the
+ * payload the writer hashed before merging.
+ * @memberof CyberiaObjectLayerModel
+ */
+const UPSERTABLE_FIELDS = ['data', 'cid', 'objectLayerRenderFramesId', 'atlasSpriteSheetId'];
+
+/**
+ * Collapses any pre-existing duplicates of a given `data.item.id` down to a
+ * single document, keeping the oldest one so `_id` references held elsewhere
+ * (instances, inventories, atlas metadata) stay valid.
+ *
+ * @param {import('mongoose').Model} Model - The bound ObjectLayer model.
+ * @param {string} itemId - The item id to collapse.
+ * @returns {Promise<{ survivor: Object|null, removedIds: Array }>} Survivor and removed document ids.
+ * @memberof CyberiaObjectLayerModel
+ */
+async function collapseItemIdDuplicates(Model, itemId) {
+  const [survivor, ...duplicates] = await Model.find({ 'data.item.id': itemId }).sort({ createdAt: 1, _id: 1 });
+  if (!survivor || duplicates.length === 0) return { survivor: survivor || null, removedIds: [] };
+
+  const removedIds = duplicates.map((duplicate) => duplicate._id);
+  await Model.deleteMany({ _id: { $in: removedIds } });
+
+  // Orphaned render frames have no other cleanup path once their owner is gone.
+  const renderFramesIds = duplicates.map((duplicate) => duplicate.objectLayerRenderFramesId).filter(Boolean);
+  if (renderFramesIds.length > 0 && Model.db.models.ObjectLayerRenderFrames) {
+    await Model.db.models.ObjectLayerRenderFrames.deleteMany({ _id: { $in: renderFramesIds } });
+  }
+
+  return { survivor, removedIds };
+}
+
+/**
+ * Resolves the canonical document for an item id. While a legacy collection can
+ * still hold duplicates, an unsorted `findOne` may hand back a document that the
+ * next upsert collapses away, so readers and writers must agree on the same
+ * survivor: the oldest one.
+ *
+ * @param {string} itemId - The `data.item.id` to look up.
+ * @returns {import('mongoose').Query} Query resolving to the canonical document or `null`.
+ * @memberof CyberiaObjectLayerModel
+ */
+ObjectLayerSchema.statics.findByItemId = function (itemId) {
+  return this.findOne({ 'data.item.id': itemId }).sort({ createdAt: 1, _id: 1 });
+};
+
+/**
+ * Dedupes the whole collection by `data.item.id`.
+ *
+ * @returns {Promise<Array>} Ids of the removed duplicate documents.
+ * @memberof CyberiaObjectLayerModel
+ */
+ObjectLayerSchema.statics.dedupeByItemId = async function () {
+  const duplicated = await this.aggregate([
+    { $group: { _id: '$data.item.id', count: { $sum: 1 } } },
+    { $match: { count: { $gt: 1 } } },
+  ]);
+  const removedIds = [];
+  for (const { _id: itemId } of duplicated) {
+    if (itemId === null || itemId === undefined) continue;
+    const { removedIds: removed } = await collapseItemIdDuplicates(this, itemId);
+    removedIds.push(...removed);
+  }
+  return removedIds;
+};
+
+/**
+ * Idempotent migration that enforces the one-document-per-`data.item.id`
+ * invariant at the storage layer: dedupes first, then upgrades the legacy
+ * non-unique index to a unique one. Safe to rerun; a no-op once applied.
+ *
+ * @returns {Promise<{ removedIds: Array, indexUpgraded: boolean }>} Migration outcome.
+ * @memberof CyberiaObjectLayerModel
+ */
+ObjectLayerSchema.statics.ensureUniqueItemIdIndex = async function () {
+  const removedIds = await this.dedupeByItemId();
+
+  const indexes = await this.collection.indexes().catch(() => []);
+  const current = indexes.find((index) => index.name === ITEM_ID_INDEX_NAME);
+  if (current?.unique) return { removedIds, indexUpgraded: false };
+
+  if (current) await this.collection.dropIndex(ITEM_ID_INDEX_NAME);
+  await this.collection.createIndex({ 'data.item.id': 1 }, { name: ITEM_ID_INDEX_NAME, unique: true });
+  return { removedIds, indexUpgraded: true };
+};
+
+/**
+ * The single write path for object layers keyed by item id.
+ *
+ * Guarantees that exactly one document exists per `data.item.id`: pre-existing
+ * duplicates are collapsed onto the oldest document, which is then updated in
+ * place. Attributes are merged with {@link mergeObjectLayerData}, so a writer
+ * that omits a value (or sends `null` / `''` because a stage was skipped) keeps
+ * whatever a previous writer stored instead of erasing it. `sha256` is always
+ * recomputed from the merged result.
+ *
+ * @param {Object} payload - Document payload; `data.item.id` is required.
+ * @param {Object} payload.data - Object layer data (item, stats, ledger, render).
+ * @param {Object} [options] - Upsert options.
+ * @param {Object} [options.setOnInsert=null] - Partial document applied only when the item is new,
+ *   for fields a writer wants to seed but never refresh (mirrors Mongo's `$setOnInsert`).
+ * @returns {Promise<Object>} The single surviving ObjectLayer document.
+ * @memberof CyberiaObjectLayerModel
+ */
+ObjectLayerSchema.statics.upsertByItemId = async function (payload, { setOnInsert = null } = {}) {
+  const itemId = payload?.data?.item?.id;
+  if (!itemId) throw new Error('ObjectLayer.upsertByItemId requires data.item.id');
+
+  const { survivor } = await collapseItemIdDuplicates(this, itemId);
+
+  if (!survivor) {
+    const inserted = setOnInsert ? mergeObjectLayerData(setOnInsert, payload) : payload;
+    return await this.create({ ...inserted, sha256: computeObjectLayerSha256(inserted.data) });
+  }
+
+  const existing = survivor.toObject({ virtuals: false, depopulate: true });
+  const update = {};
+  for (const field of UPSERTABLE_FIELDS) {
+    if (!(field in payload)) continue;
+    const merged = mergeObjectLayerData(existing[field], payload[field]);
+    if (merged !== undefined) update[field] = merged;
+  }
+  update.sha256 = computeObjectLayerSha256(update.data ?? existing.data);
+
+  return await this.findByIdAndUpdate(survivor._id, { $set: update }, { returnDocument: 'after' });
+};
+
 // Create and export the model
 const ObjectLayerModel = model('ObjectLayer', ObjectLayerSchema);
 const ProviderSchema = ObjectLayerSchema;
@@ -197,4 +390,12 @@ class ObjectLayerDto {
     },
   };
 }
-export { ObjectLayerSchema, ObjectLayerModel, ProviderSchema, ObjectLayerDto };
+export {
+  ObjectLayerSchema,
+  ObjectLayerModel,
+  ProviderSchema,
+  ObjectLayerDto,
+  computeObjectLayerSha256,
+  mergeObjectLayerData,
+  ITEM_ID_INDEX_NAME,
+};

package/src/api/object-layer/object-layer.service.js

@@ -215,9 +215,6 @@ class ObjectLayerService {
       }
     }
 
-    // Compute final SHA-256 with all CIDs
-    bodyData.sha256 = ObjectLayerEngine.computeSha256(bodyData.data);
-
     // Pin data JSON to IPFS
     try {
       const itemId = bodyData.data.item.id;
@@ -232,17 +229,7 @@ class ObjectLayerService {
     }
 
     // Atomic create/replace – ObjectLayer is fully populated with all CIDs
-    let newObjectLayer;
-    const existingByItemId = await ObjectLayer.findOne({ 'data.item.id': bodyData.data.item.id });
-    if (existingByItemId) {
-      newObjectLayer = await ObjectLayer.findByIdAndUpdate(existingByItemId._id, bodyData, {
-        returnDocument: 'after',
-      }).populate('objectLayerRenderFramesId');
-    } else {
-      newObjectLayer = await (await new ObjectLayer(bodyData).save()).populate('objectLayerRenderFramesId');
-    }
-
-    return newObjectLayer;
+    return await (await ObjectLayer.upsertByItemId(bodyData)).populate('objectLayerRenderFramesId');
   };
 
   /**

package/src/cli/baremetal.js

@@ -5,9 +5,8 @@
  */
 
 import { fileURLToPath } from 'url';
-import { getNpmRootPath, getUnderpostRootPath } from '../server/conf.js';
+import { getNpmRootPath } from '../server/environment.js';
 import { pbcopy, shellExec } from '../server/process.js';
-import dotenv from 'dotenv';
 import { loggerFactory, loggerMiddleware } from '../server/logger.js';
 import fs from 'fs-extra';
 import path from 'path';

package/src/cli/cloud-init.js

@@ -8,7 +8,7 @@
 import { shellExec } from '../server/process.js';
 import fs from 'fs-extra';
 import { loggerFactory } from '../server/logger.js';
-import { getNpmRootPath } from '../server/conf.js';
+import { getNpmRootPath } from '../server/environment.js';
 import Underpost from '../index.js';
 
 const logger = loggerFactory(import.meta);

package/src/cli/cluster.js

@@ -4,10 +4,18 @@
  * @namespace UnderpostCluster
  */
 
-import { clusterTypeFactory, gatewayApiEnabledFactory, getNpmRootPath, resolveReplicaCount } from '../server/conf.js';
+import { clusterTypeFactory, gatewayApiEnabledFactory, resolveReplicaCount } from '../server/conf.js';
+import { getNpmRootPath, HOST_VOLUME_ROOT } from '../server/environment.js';
 import { loggerFactory } from '../server/logger.js';
 import { shellExec } from '../server/process.js';
 import { crictlCommandFactory, resolveCriSocket } from '../server/cri.js';
+import {
+  runSELinuxCommands,
+  selinuxContainerSharedContextCommandsFactory,
+  selinuxEnforcingCommandsFactory,
+  selinuxPackagesCommandFactory,
+  selinuxRestoreconCommandFactory,
+} from '../server/selinux.js';
 import { UNDERPOST_GATEWAY, seedDefaultStatusPage } from '../server/underpost-gateway.js';
 import {
   UNDERPOST_INGRESS,
@@ -24,17 +32,31 @@ import Underpost from '../index.js';
 
 const logger = loggerFactory(import.meta);
 
-// Pinned Gateway API control plane. The CRD release and the implementation are
-// upgraded together, and the pairing is not free choice: Envoy Gateway builds
-// against one `sigs.k8s.io/gateway-api` version (v1.8.3 -> v1.5.1) and reads
-// fields the older CRD schemas do not define, which the API
-// server silently strips. Check the implementation's go.mod before moving
-// either pin.
 const GATEWAY_API_RELEASE = 'v1.5.1';
 const ENVOY_GATEWAY_VERSION = 'v1.8.3';
-// Namespace the upstream Contour render deploys into, and the only one where an
-// `app=envoy` selector resolves to its DaemonSet.
 const CONTOUR_NAMESPACE = 'projectcontour';
+const KUBEADM_CONTAINER_MOUNT_PATHS = ['/etc/kubernetes', '/var/lib/etcd', '/var/lib/calico'];
+const HOST_VOLUME_PATHS = ['/data', '/opt/local-path-provisioner', HOST_VOLUME_ROOT];
+const K3S_SELINUX_PATHS = [
+  '/usr/local/bin/k3s',
+  '/etc/rancher',
+  '/var/lib/rancher',
+  '/var/lib/kubelet',
+  '/var/lib/cni',
+];
+
+const shareWithContainers = (paths = []) => {
+  for (const path of paths) shellExec(`sudo mkdir -p ${path}`);
+  runSELinuxCommands(selinuxContainerSharedContextCommandsFactory(paths), { execute: shellExec });
+};
+
+const enforceSELinux = (paths = []) => {
+  shellExec(
+    `if [ -f /etc/redhat-release ] && command -v dnf >/dev/null 2>&1 && { ! command -v restorecon >/dev/null 2>&1 || ! command -v semanage >/dev/null 2>&1; }; then ${selinuxPackagesCommandFactory()}; fi`,
+  );
+  const commands = selinuxEnforcingCommandsFactory({ restorePaths: paths });
+  runSELinuxCommands(commands, { execute: shellExec });
+};
 
 /**
  * @class UnderpostCluster
@@ -227,8 +249,11 @@ class UnderpostCluster {
           // balancer. The platform exposes services explicitly via Project
           // Contour / Envoy and NodePort services (see --node-port); leaving the
           // K3s built-ins enabled would bind the same host ports and conflict.
-          shellExec(`curl -sfL https://get.k3s.io | sh -s - --disable=traefik --disable=servicelb`);
+          shellExec(
+            `curl -sfL https://get.k3s.io | sh -s - $(if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled; then printf '%s' '--selinux'; fi) --disable=traefik --disable=servicelb`,
+          );
           logger.info('K3s installation completed.');
+          runSELinuxCommands([selinuxRestoreconCommandFactory(K3S_SELINUX_PATHS)], { execute: shellExec });
 
           Underpost.cluster.chown('k3s');
 
@@ -240,6 +265,7 @@ class UnderpostCluster {
         } else if (options.kubeadm) {
           Underpost.cluster.config();
           Underpost.cluster.natSetup({ underpostRoot });
+          shareWithContainers([...KUBEADM_CONTAINER_MOUNT_PATHS, ...HOST_VOLUME_PATHS]);
           logger.info('Initializing Kubeadm control plane...');
           // Set default values if not provided
           const podNetworkCidr = options.podNetworkCidr || '192.168.0.0/16';
@@ -272,6 +298,13 @@ class UnderpostCluster {
           shellExec(
             `kubectl apply -f https://cdn.jsdelivr.net/gh/rancher/local-path-provisioner@master/deploy/local-path-storage.yaml`,
           );
+
+          // The CNI lands asynchronously, and the node stays NotReady until it
+          // does. Block here so the deploy steps that follow (MongoDB and the
+          // application workloads) schedule onto a node that can actually run
+          // them, instead of racing the Calico rollout.
+          logger.info('Waiting for the node to become Ready (Calico rollout)...');
+          shellExec(`kubectl wait --for=condition=Ready node --all --timeout=300s`);
         } else {
           Underpost.cluster.config();
           Underpost.cluster.natSetup({ underpostRoot });
@@ -1198,11 +1231,13 @@ EOF
         }
       }
       const liveConf = canHotReload
-        ? `${execIngress('cat /tmp/nginx.conf', {
-            stdout: true,
-            silent: true,
-            silentOnError: true,
-          }) || ''}`
+        ? `${
+            execIngress('cat /tmp/nginx.conf', {
+              stdout: true,
+              silent: true,
+              silentOnError: true,
+            }) || ''
+          }`
         : '';
       const shouldHotReload = canHotReload && liveConf.trimEnd() !== `${conf}`.trimEnd();
 
@@ -1222,10 +1257,10 @@ EOF
             { silent: true },
           );
         } catch (error) {
-          execIngress(
-            `sh -c 'cp /tmp/nginx.previous.conf /tmp/nginx.conf && nginx -s reload -c /tmp/nginx.conf'`,
-            { silent: true, silentOnError: true },
-          );
+          execIngress(`sh -c 'cp /tmp/nginx.previous.conf /tmp/nginx.conf && nginx -s reload -c /tmp/nginx.conf'`, {
+            silent: true,
+            silentOnError: true,
+          });
           throw error;
         }
       }
@@ -1241,10 +1276,10 @@ EOF
 `);
       } catch (error) {
         if (shouldHotReload)
-          execIngress(
-            `sh -c 'cp /tmp/nginx.previous.conf /tmp/nginx.conf && nginx -s reload -c /tmp/nginx.conf'`,
-            { silent: true, silentOnError: true },
-          );
+          execIngress(`sh -c 'cp /tmp/nginx.previous.conf /tmp/nginx.conf && nginx -s reload -c /tmp/nginx.conf'`, {
+            silent: true,
+            silentOnError: true,
+          });
         throw error;
       }
       if (shouldHotReload)
@@ -1257,18 +1292,16 @@ EOF
       // ready replica that made canHotReload true. Do not let the caller delete
       // the old route kind until the replacement edge is actually Available.
       if (!canHotReload || changesNode)
-        shellExec(
-          `kubectl rollout status deployment/${UNDERPOST_INGRESS.name} -n ${namespace} --timeout=5m`,
-          { silent: true },
-        );
+        shellExec(`kubectl rollout status deployment/${UNDERPOST_INGRESS.name} -n ${namespace} --timeout=5m`, {
+          silent: true,
+        });
       else if (shouldHotReload)
         // `nginx -s reload` returns after signalling the master. Give it one
         // scheduling turn to start the new workers before the caller removes
         // the old stack's route object.
         shellExec('sleep 1', { silent: true });
       shellExec(
-        `kubectl wait --for=condition=Available deployment/${UNDERPOST_INGRESS.name} ` +
-          `-n ${namespace} --timeout=5m`,
+        `kubectl wait --for=condition=Available deployment/${UNDERPOST_INGRESS.name} ` + `-n ${namespace} --timeout=5m`,
         { silent: true },
       );
       execIngress('nginx -t -c /tmp/nginx.conf', { silent: true });
@@ -1350,26 +1383,17 @@ EOF
     config(options = { underpostRoot: '.' }) {
       const { underpostRoot } = options;
       console.log('Applying host configuration: SELinux, Docker, Containerd, and Sysctl settings.');
-      // Disable SELinux (permissive mode)
-      shellExec(`sudo setenforce 0`, {
-        silentOnError: true,
-      });
-      shellExec(`sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config`, {
-        silentOnError: true,
-      });
+      enforceSELinux(['/var/lib/kubelet', '/var/lib/containerd']);
 
       // Enable and start Docker and Kubelet services
       shellExec(`sudo systemctl enable --now docker`); // Docker might not be needed for K3s
       shellExec(`sudo systemctl enable --now kubelet`); // Kubelet might not be needed for K3s (K3s uses its own agent)
 
-      // Configure containerd for SystemdCgroup and explicitly disable SELinux
-      // This is crucial for kubelet/k3s to interact correctly with containerd
+      // Configure containerd for systemd cgroups and SELinux labeling.
       shellExec(`containerd config default | sudo tee /etc/containerd/config.toml > /dev/null`);
       shellExec(`sudo sed -i -e "s/SystemdCgroup = false/SystemdCgroup = true/g" /etc/containerd/config.toml`);
-      // Add a new line to disable SELinux for the runc runtime
-      // shellExec(
-      //   `sudo sed -i '/SystemdCgroup = true/a       selinux_disabled = true' /etc/containerd/config.toml`,
-      // );
+      shellExec(`sudo sed -i -e "s/enable_selinux = false/enable_selinux = true/g" /etc/containerd/config.toml`);
+      runSELinuxCommands([selinuxRestoreconCommandFactory('/etc/containerd')], { execute: shellExec });
       // Restart docker after containerd config changes. Rocky 9 uses systemctl,
       // not the legacy service command.
       shellExec(`sudo systemctl restart docker || sudo service docker restart || true`);
@@ -1400,7 +1424,7 @@ EOF
      * This applies only what K3s genuinely requires, and every step is guarded
      * so it is a no-op when the relevant tooling is absent (e.g. minimal images
      * without SELinux userspace):
-     *   - SELinux → permissive (only if SELinux tooling is present).
+     *   - SELinux remains Enforcing.
      *   - swap off (Kubernetes best practice).
      *   - br_netfilter + bridge/forward sysctls (pod networking).
      *   - inotify limits.
@@ -1415,16 +1439,8 @@ EOF
       // forever (the upstream unit ships TimeoutStartSec=0).
       shellExec(`if systemctl is-active --quiet firewalld; then sudo systemctl disable --now firewalld; fi`);
 
-      // SELinux → permissive, but only when the tooling exists. Rocky has it;
-      // minimal LXD images may not. K3s also installs k3s-selinux for enforcing
-      // mode, so this is a best-effort dev convenience, not a hard requirement.
-      shellExec(`if command -v setenforce >/dev/null 2>&1; then sudo setenforce 0; fi`, {
-        silentOnError: true,
-      });
-      shellExec(
-        `if [ -f /etc/selinux/config ]; then sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config; fi`,
-        { silentOnError: true },
-      );
+      enforceSELinux(K3S_SELINUX_PATHS);
+      shareWithContainers(HOST_VOLUME_PATHS);
 
       // Disable swap. `swapoff -a` is a no-op without swap; the sed only edits
       // fstab when a swap line is present.
@@ -1697,17 +1713,8 @@ fi`);
       if (options.removeVolumeHostPaths) Underpost.cluster._cleanHostPathPvs();
       else logger.info('  -> Skipping (pass --remove-volume-host-paths to enable).');
 
-      logger.info('Phase 2/7: SELinux permissive + restore contexts (when present)...');
-      shellExec(`if command -v setenforce >/dev/null 2>&1; then sudo setenforce 0; fi`);
-      shellExec(
-        `if [ -f /etc/selinux/config ]; then sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config; fi`,
-      );
-      shellExec(
-        `if command -v restorecon >/dev/null 2>&1 && [ -d /var/lib/kubelet ]; then sudo restorecon -Rv /var/lib/kubelet; fi`,
-      );
-      shellExec(
-        `if command -v restorecon >/dev/null 2>&1 && [ -d /var/lib/containerd ]; then sudo restorecon -Rv /var/lib/containerd; fi`,
-      );
+      logger.info('Phase 2/7: Enforcing SELinux and restoring runtime contexts...');
+      enforceSELinux(['/var/lib/kubelet', '/var/lib/containerd']);
 
       logger.info('Phase 3/7: Stopping host kubelet and container runtimes (kubeadm-scope only)...');
       shellExec(`if systemctl is-active --quiet kubelet; then sudo systemctl stop kubelet; fi`);
@@ -1981,10 +1988,8 @@ EOF`);
       shellExec(`sudo rm -f /etc/sysctl.d/99-k8s-ipforward.conf`);
       shellExec(`sudo rm -f /etc/sysctl.d/99-k8s.conf`);
 
-      // Restore SELinux to enforcing
-      console.log('Restoring SELinux to enforcing mode...');
-      // shellExec(`sudo setenforce 1`);
-      // shellExec(`sudo sed -i 's/^SELINUX=permissive$/SELINUX=enforcing/' /etc/selinux/config`);
+      console.log('Keeping SELinux in enforcing mode...');
+      enforceSELinux();
 
       console.log('Uninstall process completed.');
     },

package/src/cli/db.js

@@ -6,12 +6,19 @@
  * Supports MariaDB and MongoDB with import/export capabilities, Git integration, and multi-pod operations.
  */
 
-import { mergeFile, splitFileFactory, loadConfServerJson, resolveConfSecrets, loadConfInstances } from '../server/conf.js';
+import {
+  loadConfInstances,
+  loadConfServerJson,
+  loadReplicas,
+  mergeFile,
+  pathPortAssignmentFactory,
+  splitFileFactory,
+} from '../server/conf.js';
 import { loggerFactory } from '../server/logger.js';
 import { shellExec } from '../server/process.js';
 import fs from 'fs-extra';
 import { DataBaseProviderService } from '../db/DataBaseProvider.js';
-import { loadReplicas, pathPortAssignmentFactory, loadCronDeployEnv } from '../server/conf.js';
+import { loadCronDeployEnv } from '../server/cron.js';
 import { MongoBootstrap } from '../db/mongo/MongoBootstrap.js';
 import Underpost from '../index.js';
 import { timer } from '../client/components/core/CommonJs.js';