alexandr 0.3.1 → 0.3.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alexandr",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Run the alexandr workspace runtime locally (npx alexandr up), and develop alexandr apps against a workspace (alexandr app link | dev | build | deploy).",
   "type": "module",
   "bin": {

package/src/commands.js

@@ -15,7 +15,7 @@ import {
 } from "./docker.js";
 import {
   resolveInstance, isMaterialized, materialize, readEnv, envHas, setEnv,
-  unsetEnv, kernelPort, pruneSnapshots,
+  unsetEnv, kernelPort, pruneSnapshots, dockerConfigDir,
 } from "./instance.js";
 export { updater } from "./updater.js";
 import { kernelUrl, health, version as kVersion, waitHealthy, waitPosture } from "./probe.js";
@@ -111,7 +111,12 @@ function profileArgs(dir) {
 function stampUpdaterEnv(inst) {
   setEnv(inst.dir, "ALEXANDR_INSTANCE_DIR", hostPath(inst.dir));
   setEnv(inst.dir, "ALEXANDR_COMPOSE_PROJECT", inst.projectName);
-  if (process.env.ALEXANDR_UPDATER_INSIDE !== "1") setEnv(inst.dir, "ALEXANDR_UPDATER_IMAGE_TAG", pkgVersion());
+  if (process.env.ALEXANDR_UPDATER_INSIDE !== "1") {
+    setEnv(inst.dir, "ALEXANDR_UPDATER_IMAGE_TAG", pkgVersion());
+    // The host's docker config, so the sidecar's pulls carry this box's registry login
+    // (found on the first real press: an anonymous pull of the private image → `unauthorized`).
+    setEnv(inst.dir, "ALEXANDR_DOCKER_CONFIG", hostPath(dockerConfigDir()));
+  }
 }
 
 /**
@@ -611,6 +616,9 @@ export async function update(flags) {
     stampUpdaterEnv(inst);
   }
   const prevImage = readEnv(inst.dir).ALEXANDR_IMAGE || `${IMAGE_BASE}:latest`;
+  // What `.previous-image` said BEFORE this run — restored if the pull fails (see below).
+  const pointerPath = path.join(inst.dir, ".previous-image");
+  const priorPointer = fs.existsSync(pointerPath) ? fs.readFileSync(pointerPath, "utf8") : null;
   const base = kernelUrl(kernelPort(inst.dir));
   const before = (await kVersion(base))?.version ?? "?";
 
@@ -657,6 +665,21 @@ export async function update(flags) {
       pull = compose(inst.dir, inst.projectName, ["pull", "kernel"]);
     }
     if (pull.status !== 0) {
+      // ⚠ PUT THE PIN BACK. The new tag was written into .env before the pull so compose would
+      // pull it; a failed pull must not leave the box pointing at an image it does not have —
+      // the next `up` would then boot the new version behind the operator's back, which is
+      // exactly what the first sidecar press on aos did (2026-09-08). `.previous-image` is
+      // restored too, so a later `--rollback` still means what it says.
+      setEnv(inst.dir, "ALEXANDR_IMAGE", prevImage);
+      if (priorPointer === null) {
+        try {
+          fs.unlinkSync(pointerPath);
+        } catch {
+          /* nothing was recorded before this run either */
+        }
+      } else {
+        fs.writeFileSync(pointerPath, priorPointer);
+      }
       fail("Pull failed — check your network / the image tag.", EXIT.RUNTIME);
     }
   }

package/src/instance.js

@@ -128,6 +128,18 @@ export function pruneSnapshots(dir, keep = 3) {
   return removed;
 }
 
+/**
+ * Where THIS host's Docker CLI keeps its config — the registry login `alexandr up`/`login`
+ * wrote (`docker login` honours `DOCKER_CONFIG`, else `~/.docker`). The updater sidecar mounts
+ * it read-only: a pull's credential is sent by the client, not held by the daemon, so a docker
+ * CLI inside the sidecar with no config pulls anonymously and the private kernel image answers
+ * `unauthorized` — exactly what the first real press did (aos, 2026-09-08).
+ */
+export function dockerConfigDir(env = process.env, home = os.homedir()) {
+  const explicit = (env.DOCKER_CONFIG || "").trim();
+  return explicit || path.join(home, ".docker");
+}
+
 export function kernelPort(dir) {
   const v = readEnv(dir).ALEXANDR_KERNEL_PORT;
   const n = v ? Number(v) : 3030;

package/src/probe.js

@@ -1,7 +1,17 @@
 // Health/version probing of a running kernel over its loopback port. Uses the
 // global fetch (Node 18+). All probes are best-effort and never throw.
 
-export const kernelUrl = (port = 3030) => `http://127.0.0.1:${port}`;
+/**
+ * Where the kernel answers from HERE. On the host that is the loopback port compose mapped;
+ * inside the updater sidecar 127.0.0.1 is the sidecar itself, so the compose file sets
+ * `ALEXANDR_KERNEL_URL=http://kernel:3030` (the service name on the project network) — without
+ * it the recipe's health wait could not see the kernel from inside and reported `? → ?`
+ * (the first sidecar press on aos, 2026-09-08).
+ */
+export const kernelUrl = (port = 3030, env = process.env) => {
+  const explicit = (env.ALEXANDR_KERNEL_URL || "").trim();
+  return explicit ? explicit.replace(/\/+$/, "") : `http://127.0.0.1:${port}`;
+};
 
 async function getJson(url, timeoutMs = 2500) {
   const ctrl = new AbortController();

package/templates/docker-compose.yml

@@ -48,12 +48,20 @@ services:
       ALEXANDR_INSTANCE_DIR: ${ALEXANDR_INSTANCE_DIR:-/nonexistent}
       ALEXANDR_COMPOSE_PROJECT: ${ALEXANDR_COMPOSE_PROJECT:-alexandr}
       ALEXANDR_UPDATER_SOCKET: /run/alexandr/updater.sock
+      # The kernel, by its service name: from inside this container 127.0.0.1 is the sidecar
+      # itself, and the recipe's health wait must see the kernel come back.
+      ALEXANDR_KERNEL_URL: http://kernel:3030
     env_file:
       - path: ./.env
         required: false            # ALEXANDR_CP_URL / ALEXANDR_RELEASES_URL → the feed it reads
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock                 # THE socket. Only here.
       - ${ALEXANDR_INSTANCE_DIR:-/nonexistent}:${ALEXANDR_INSTANCE_DIR:-/nonexistent}
+      # The host's Docker CONFIG, read-only — the registry login `alexandr up`/`login` wrote
+      # lives there, and a pull's credential is sent by the CLIENT, not held by the daemon:
+      # without this the sidecar's own docker CLI pulls anonymously and the private kernel
+      # image answers `unauthorized` (found on the first real press, aos, 2026-09-08).
+      - ${ALEXANDR_DOCKER_CONFIG:-/nonexistent}:/root/.docker:ro
       - updater_run:/run/alexandr
     restart: unless-stopped
 

package/templates/env.example

@@ -19,6 +19,7 @@
 # ALEXANDR_INSTANCE_DIR=        # this directory, at its host path (mounted at the same path)
 # ALEXANDR_COMPOSE_PROJECT=     # the compose project the sidecar drives (the host's, verbatim)
 # ALEXANDR_UPDATER_IMAGE_TAG=   # the CLI version that installed it (= the sidecar's version)
+# ALEXANDR_DOCKER_CONFIG=       # this host's docker config dir (its registry login), mounted read-only
 
 # ---- account link (REQUIRED — the runtime refuses to serve unlinked) --------
 # Every runtime must be linked to an alexandr account before it serves anyone