signalk-container 1.25.1 → 1.25.3

package/AGENTS.md

@@ -61,6 +61,14 @@ Every managed container, one-shot job container, and job label carries a **names
 - The **label keys** are namespaced too (`<ns>-charts-job`, `<ns>-job-owner`, `<ns>-job-label`, `<ns>-requested-resources`), so a dev instance's reap query doesn't even _list_ production's jobs. The name-prefix guard in `orphanFromContainer` (`name.startsWith(jobPrefix())`) remains the unspoofable-by-label trait — and being namespaced, it can never match a foreign-namespace helper.
 - The devcontainer sets `SIGNALK_CONTAINER_NAMESPACE=devpod` (in the installer repo's `dev/dev.sh`), so its containers are `devpod-<name>`. Note the prefix isolates **names and reaping**, not host **ports** — a consumer plugin that publishes a fixed host port still collides port-wise with its production twin; that is handled separately (pick non-colliding ports for dev).
 
+### nofile ulimits: rootless podman < 5.5.0 drops the API request
+
+Rootless podman below 5.5.0 silently ignores `HostConfig.Ulimits` on the docker-compat create endpoint (containers/podman#25881, fixed by #25908) — verified live on 5.4.2: the created container inherits the **podman service's** limits and inspect echoes those effective values back as `RLIMIT_NOFILE`, not the request. Three consequences baked into the code:
+
+- `readContainerNofile` treats the inspect echo as "asked" and `/proc/<pid>/limits` as "live"; on broken podman the two sources agree on the effective value, so the probe stays truthful even though the request was dropped.
+- The `ensureRunning` nofile regrant bounds recreates two ways: against the previous create's _ask_ (daemon-capped Docker, where re-asking can't help) **and** against a per-observed-limit attempt map (`nofileRegrantAttempts`) — required because on broken podman the echo is not the ask, so the ask-bound alone cannot detect a failed attempt. Never remove either bound in isolation.
+- The integration canary `src/test/integration/nofileProbe.test.ts` asserts probe-vs-/proc agreement and stopped-echo consistency on every runtime, and pins the requested value only where the runtime honors the API request (docker, podman ≥ 5.5.0).
+
 ### Podman SELinux flag
 
 `volumeArg(hostPath, containerPath, runtime)` adds `:Z` for podman bind mounts (Fedora/RHEL SELinux relabel). Named volumes — host strings without a leading `/` or `.` — MUST NOT receive `:Z`; podman rejects them with `"invalid option z for named volume"`. Always go through `volumeArg`, never build `-v host:container[:flags]` strings inline.

package/README.md

@@ -324,13 +324,29 @@ sudo systemctl daemon-reload
 The new limit only applies once the **user manager itself restarts** — and
 `daemon-reload` does **not** restart an already-running `user@<uid>.service`.
 On a headless boat the SK user has linger enabled (`loginctl enable-linger`),
-so logging out and back in does not tear it down. Force a fresh user manager,
-then restart the container:
+so logging out and back in does not tear it down. Force a fresh user manager:
 
 ```bash
 sudo systemctl restart user@$(id -u <sk-user>).service   # or just reboot
 ```
 
+Note that restarting the **container** is not enough on its own: a restart
+re-applies the nofile value stored when the container was created, so a
+container created under the old ceiling keeps the lower limit. Since
+signalk-container 1.25.3 this resolves itself — on the next Signal K start,
+`ensureRunning` compares the limit the container actually runs with against
+what the host can now grant and recreates the container to apply the raise.
+On older versions, remove the container (`podman rm -f sk-<name>`) so the
+next plugin start recreates it with the raised limit.
+
+> **Rootless Podman < 5.5.0**: the docker-compat API silently drops the
+> ulimit request at container create
+> ([containers/podman#25881](https://github.com/containers/podman/issues/25881),
+> fixed in 5.5.0) — containers instead **inherit the podman service's own
+> limits**. The user-manager drop-in above is then not just the ceiling but
+> the actual source of the container's limit, and the recreate described
+> above is what picks it up.
+
 **2. System-wide default (Raspberry Pi OS / openplotter, and the reliable
 fallback).** Stock Debian / Pi OS ships `/etc/systemd/system.conf` with a
 commented `#DefaultLimitNOFILE=1024:524288` — that 524288 _hard_ default is
@@ -785,6 +801,7 @@ See [doc/plugin-developer-guide.md](doc/plugin-developer-guide.md) for the full
 | `stop(name)`                                    | Stop a running container                                                                                                                                                                                                                                                                                             |
 | `remove(name)`                                  | Stop and remove a container                                                                                                                                                                                                                                                                                          |
 | `getState(name)`                                | Returns `running`, `stopped`, `missing`, or `no-runtime`                                                                                                                                                                                                                                                             |
+| `getContainerNofile(name)`                      | Read the `nofile` limits the container actually runs with (live `/proc` probe, falling back to the create-time inspect echo); `null` = unknown. Use it to verify a reported ulimit clamp against reality (1.25.3+)                                                                                                   |
 | `runJob(config)`                                | Execute a one-shot container job. Pass `config.signal` (an `AbortSignal`) to cancel a job mid-run — aborting force-removes the container and resolves with status `cancelled` (1.16.0+)                                                                                                                              |
 | `cleanupOrphanedJobs(filter)`                   | Reap this namespace's job containers (`<ns>-job-*`, `sk-job-*` by default) leaked by a previous server lifecycle, filtered by the caller's `ownerPluginId`. Idempotent — returns `{ reaped: OrphanJobInfo[] }` so the plugin can roll back any per-job state it had written                                          |
 | `getLogs(name, options?)`                       | One-shot fetch of the last N lines of a container's combined stdout+stderr log. `tail` defaults to 200, max 10000; `since` is unix-epoch seconds                                                                                                                                                                     |

package/dist/containers.d.ts

@@ -1,8 +1,8 @@
 import type Docker from "dockerode";
-import { ContainerConfig, ContainerInfo, ContainerRuntimeInfo, ContainerState, DeviceIssue, EnsureRunningOptions, LocalImageSummary, ManagedImageRef, PruneResult, UlimitClamp, VolumeIssue, VolumeSpec } from "./types.js";
+import { ContainerConfig, ContainerInfo, ContainerRuntimeInfo, ContainerState, DeviceIssue, EnsureRunningOptions, LocalImageSummary, ManagedImageRef, NofileLimits, PruneResult, UlimitClamp, VolumeIssue, VolumeSpec } from "./types.js";
 import { StreamingProcessHandle } from "./runtime.js";
 import { type ContainerClient } from "./client.js";
-import type { ErrorKind } from "./errors.js";
+import { type ErrorKind } from "./errors.js";
 import { type DeviceNodeSpec } from "./devices.js";
 export declare function prefixedName(name: string): string;
 /**
@@ -527,6 +527,27 @@ export declare function diffContainerConfig(requested: ContainerConfig, live: Li
  * unclamped, preserving today's behaviour on those platforms.
  */
 export declare function readNofileHardCeiling(runtime: ContainerRuntimeInfo): number | null;
+/**
+ * Parse the `Max open files` row out of a `/proc/<pid>/limits` file:
+ * `Max open files   <soft>   <hard>   files`. Returns null on any shape
+ * surprise — callers treat null as "unknown", never as a limit.
+ */
+export declare function parseProcLimitsNofile(content: string): NofileLimits | null;
+export declare function _setProcLimitsReaderForTesting(fn: ((path: string) => string) | null): void;
+export declare function _setNofileCeilingForTesting(fn: ((runtime: ContainerRuntimeInfo) => number | null) | null): void;
+/**
+ * Read the nofile limits a managed container is ACTUALLY running with —
+ * as opposed to the value that was requested when it was created.
+ *
+ * Primary source is the live `/proc/<container-pid>/limits`; where that
+ * is not readable (containerized Signal K, rootful runtimes), fall back
+ * to the create-time request echoed through inspect, which the runtime
+ * applied verbatim or refused, so it equals the live value whenever it
+ * is present. Null means "unknown": no such container, or neither
+ * source available.
+ */
+export declare function readContainerNofile(name: string, client?: ContainerClient): Promise<NofileLimits | null>;
+export declare function _clearNofileRegrantAttemptsForTesting(): void;
 /**
  * Translate `ContainerConfig.ulimits` into the dockerode
  * `HostConfig.Ulimits` array (`{ Name, Soft, Hard }`). A bare number sets
@@ -675,6 +696,20 @@ export interface PruneRunLogger {
  * so the scheduler leaves the run unrecorded and retries it instead of
  * waiting out a full interval — both phases are idempotent.
  */
+/**
+ * Build the reaper's view of managed images: every container recorded in a
+ * manifest, paired with the immutable image-ID it is currently running (or
+ * null when that cannot be determined). A per-container probe failure (e.g.
+ * corrupt storage making inspect 500 — issue #219) must not abort the whole
+ * list: the ref is kept with `runningImageId: null`, which
+ * `selectImagesToReap` treats as unanchored and keeps every version of that
+ * image — fail-safe.
+ */
+export declare function collectManagedImageRefs(runtime: ContainerRuntimeInfo, manifests: ReadonlyArray<{
+    containers: Record<string, {
+        image: string;
+    }>;
+}>, debug: (msg: string) => void, client?: ContainerClient): Promise<ManagedImageRef[]>;
 export declare function runScheduledPrune(runtime: ContainerRuntimeInfo, collectManaged: () => Promise<ManagedImageRef[]>, keepImageVersions: number, log: PruneRunLogger, client?: ContainerClient): Promise<void>;
 export declare function execInContainer(runtime: ContainerRuntimeInfo, name: string, command: string[], client?: ContainerClient): Promise<{
     exitCode: number;

package/dist/containers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"containers.d.ts","sourceRoot":"","sources":["../src/containers.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,WAAW,CAAC;AAGpC,OAAO,EACL,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,oBAAoB,EAEpB,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,WAAW,EACX,WAAW,EACX,UAAU,EACX,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EAIvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAML,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EASL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAOtB,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,GAAE,OAAe,GACxB,MAAM,CAOR;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAE7E;AAcD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACvC,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAIpC;AAsBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,GAAE,MAAM,MACgC,GACjD,MAAM,GAAG,SAAS,CAGpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAIpC;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG,SAAS,EACxD,KAAK,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAoB,GAC5C;IACD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D,CAuCA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EACD;IACE,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D,GACD,SAAS,EACb,cAAc,EAAE,KAAK,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EAChE,cAAc,EAAE,KAAK,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EAChE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,KAAK,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBlD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACnE,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAUN;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACnE,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EAC7D,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACnE,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EAC7E,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC9B,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvC,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B,GACA,sBAAsB,CAuDxB;AAED,kEAAkE;AAClE,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAe9B;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,GACZ;IAAE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAqB/C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3C,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,EAAE,CAAC,CAgCnB;AAiBD,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAmCR;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,MAAM,EAAE,CAYV;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,oBAAoB,EAC7B,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAUD;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAqBlC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUxB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,MAAM,EACrB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAexB;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAClC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,cAAc,CAAC,CA4BzB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,OAAO,YAAY,EAAE,uBAAuB,CAAC,CAwEvD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,OAAO,YAAY,EAAE,uBAAuB,GAAG,SAAS,CAAC,CAWnE;AAmBD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GACxD,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CA2C5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAOrC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACzC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;;OAKG;IACH,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,qEAAqE;IACrE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAwKrC;AA6HD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,eAAe,EAC1B,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,oBAAoB,EAC7B,KAAK,CAAC,EAAE,eAAe,GACtB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CA2OvB;AAiGD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,GAC5B,MAAM,GAAG,IAAI,CAyBf;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,EACnC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,EAC7B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,GACrD,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,CAsC7B;AAqOD;;;;;GAKG;AACH,KAAK,MAAM,GAAG,CACZ,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,KAC/B,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAE5B,OAAO,CAAC,EAAE,oBAAoB,EAC9B,MAAM,GAAE,eAA6B;AACrC;;;;;;;GAOG;AACH,KAAK,CAAC,EAAE,eAAe,EACvB,aAAa,GAAE,OAAe,EAC9B,KAAK,GAAE,MAAkB,GACxB,OAAO,CAAC,IAAI,CAAC,CAiWf;AA6ED,wBAAsB,cAAc,CAClC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAEf;AA2CD,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAG5C,QAAQ,CAAC,IAAI,EAAE,SAAS;gBADxB,OAAO,EAAE,MAAM,EACN,IAAI,EAAE,SAAS;CAK3B;AAqBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAiBxD;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,EACxE,MAAM,GAAE,eAA6B,EAKrC,SAAS,GAAE,MAAM,IAAe,GAC/B,OAAO,CAAC,IAAI,CAAC,CAkDf;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,oBAAa,CAAC;AAE1C,wBAAsB,cAAc,CAClC,OAAO,EAAE,oBAAoB,EAC7B,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,aAAa,EAAE,CAAC,CAwC1B;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,oBAAoB,EAC7B,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAe5D;AAiED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,iBAAiB,EAAE,EAC3B,OAAO,EAAE,eAAe,EAAE,EAC1B,iBAAiB,EAAE,MAAM,GACxB,MAAM,EAAE,CAiDV;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,eAAe,EAAE,EAC1B,iBAAiB,EAAE,MAAM,EACzB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,WAAW,CAAC,CA0DtB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;CAC5C;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,cAAc,EAAE,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,EAChD,iBAAiB,EAAE,MAAM,EACzB,GAAG,EAAE,cAAc,EACnB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAuCD,wBAAsB,eAAe,CACnC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EAAE,EACjB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAE/D;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CASf;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAW7E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,8BAA8B,IAAI,MAAM,EAAE,CAQzD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA2B5E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iCAAiC,IAAI,MAAM,EAAE,CAQ5D;AA8BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsDxB;AAuBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,CAAC,CA2DjB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,cAAc,EAAE,GACvB,wBAAwB,GAAG,IAAI,CAgCjC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAgC1C;AAcD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEtD;AAeD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS1E;AASD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAEvE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CA8C1B;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,MAAc,EACzB,UAAU,GAAE,MAAY,GACvB,OAAO,CAAC,IAAI,CAAC,CAYf"}
+{"version":3,"file":"containers.d.ts","sourceRoot":"","sources":["../src/containers.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,WAAW,CAAC;AAGpC,OAAO,EACL,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,oBAAoB,EAEpB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,WAAW,EACX,WAAW,EACX,WAAW,EACX,UAAU,EACX,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EAIvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAML,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AACrB,OAAO,EASL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAOtB,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,GAAE,OAAe,GACxB,MAAM,CAOR;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAE7E;AAcD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACvC,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAIpC;AAsBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,GAAE,MAAM,MACgC,GACjD,MAAM,GAAG,SAAS,CAGpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAIpC;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG,SAAS,EACxD,KAAK,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAoB,GAC5C;IACD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D,CAuCA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EACD;IACE,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D,GACD,SAAS,EACb,cAAc,EAAE,KAAK,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EAChE,cAAc,EAAE,KAAK,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EAChE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,KAAK,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBlD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACnE,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAUN;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACnE,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EAC7D,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACnE,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EAC7E,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC9B,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvC,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B,GACA,sBAAsB,CAuDxB;AAED,kEAAkE;AAClE,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAe9B;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,GACZ;IAAE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAqB/C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3C,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,EAAE,CAAC,CAgCnB;AAiBD,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAmCR;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,MAAM,EAAE,CAYV;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,oBAAoB,EAC7B,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAUD;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAqBlC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUxB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,MAAM,EACrB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAexB;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAClC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,cAAc,CAAC,CA4BzB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,OAAO,YAAY,EAAE,uBAAuB,CAAC,CAwEvD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,OAAO,YAAY,EAAE,uBAAuB,GAAG,SAAS,CAAC,CAWnE;AAmBD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GACxD,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CA2C5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAOrC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACzC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;;OAKG;IACH,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,qEAAqE;IACrE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAwKrC;AA6HD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,eAAe,EAC1B,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,oBAAoB,EAC7B,KAAK,CAAC,EAAE,eAAe,GACtB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CA2OvB;AAiGD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,GAC5B,MAAM,GAAG,IAAI,CAsBf;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAY1E;AAKD,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,GAAG,IAAI,GACpC,IAAI,CAEN;AAOD,wBAAgB,2BAA2B,CACzC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,oBAAoB,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,GAC5D,IAAI,CAEN;AAwDD;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAG9B;AAwBD,wBAAgB,qCAAqC,IAAI,IAAI,CAE5D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,EACnC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,EAC7B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,GACrD,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,CAsC7B;AAqOD;;;;;GAKG;AACH,KAAK,MAAM,GAAG,CACZ,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,KAC/B,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAE5B,OAAO,CAAC,EAAE,oBAAoB,EAC9B,MAAM,GAAE,eAA6B;AACrC;;;;;;;GAOG;AACH,KAAK,CAAC,EAAE,eAAe,EACvB,aAAa,GAAE,OAAe,EAC9B,KAAK,GAAE,MAAkB,GACxB,OAAO,CAAC,IAAI,CAAC,CAqef;AA6ED,wBAAsB,cAAc,CAClC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAEf;AA2CD,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAG5C,QAAQ,CAAC,IAAI,EAAE,SAAS;gBADxB,OAAO,EAAE,MAAM,EACN,IAAI,EAAE,SAAS;CAK3B;AAqBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAiBxD;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,EACxE,MAAM,GAAE,eAA6B,EAKrC,SAAS,GAAE,MAAM,IAAe,GAC/B,OAAO,CAAC,IAAI,CAAC,CAkDf;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,oBAAa,CAAC;AAE1C,wBAAsB,cAAc,CAClC,OAAO,EAAE,oBAAoB,EAC7B,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,aAAa,EAAE,CAAC,CAwC1B;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,oBAAoB,EAC7B,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAe5D;AAiED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,iBAAiB,EAAE,EAC3B,OAAO,EAAE,eAAe,EAAE,EAC1B,iBAAiB,EAAE,MAAM,GACxB,MAAM,EAAE,CAiDV;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,eAAe,EAAE,EAC1B,iBAAiB,EAAE,MAAM,EACzB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,WAAW,CAAC,CA0DtB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;CAC5C;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,oBAAoB,EAC7B,SAAS,EAAE,aAAa,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,EAC3E,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAC5B,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,eAAe,EAAE,CAAC,CAuB5B;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,cAAc,EAAE,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,EAChD,iBAAiB,EAAE,MAAM,EACzB,GAAG,EAAE,cAAc,EACnB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAuCD,wBAAsB,eAAe,CACnC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EAAE,EACjB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAE/D;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CASf;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAW7E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,8BAA8B,IAAI,MAAM,EAAE,CAQzD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA2B5E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iCAAiC,IAAI,MAAM,EAAE,CAQ5D;AA8BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsDxB;AAuBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,CAAC,CA2DjB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,cAAc,EAAE,GACvB,wBAAwB,GAAG,IAAI,CAgCjC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAgC1C;AAcD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEtD;AAeD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS1E;AASD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAEvE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CA8C1B;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,MAAc,EACzB,UAAU,GAAE,MAAY,GACvB,OAAO,CAAC,IAAI,CAAC,CAYf"}

package/dist/containers.js

@@ -5,6 +5,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { rm } from "node:fs/promises";
 import { isContainerized, makeLineSplitter, userMappingFlags, } from "./runtime.js";
 import { demuxToText, demuxBufferToText, getClient, safe, safeInspect, } from "./client.js";
+import { describeError, isStorageCorruptError, } from "./errors.js";
 import { DEVICES_UNRESOLVED_LABEL, filterUnresolvedDeviceEntries, KEEP_ORIGINAL_GROUPS_ANNOTATION, parseUnresolvedDevicesLabel, presentLiveDeviceNodes, resolveDeviceRequests, resolveGroupAdd, unresolvedGroupNames, } from "./devices.js";
 import { parseResourceLimits, resourcePayloadForRun } from "./resources.js";
 import { containerPrefix, requestedResourcesLabel } from "./namespace.js";
@@ -1559,14 +1560,9 @@ export function readNofileHardCeiling(runtime) {
         }
     };
     if (runtime.isRootless) {
-        // "Max open files   <soft>   <hard>   files" — the third column.
         try {
-            const line = readFileSync("/proc/self/limits", "utf8")
-                .split("\n")
-                .find((l) => l.startsWith("Max open files"));
-            const hard = line?.trim().split(/\s+/)[4];
-            const n = hard === "unlimited" ? Infinity : Number(hard);
-            return Number.isFinite(n) && n > 0 ? n : null;
+            return (parseProcLimitsNofile(readFileSync("/proc/self/limits", "utf8"))
+                ?.hard ?? null);
         }
         catch {
             return null;
@@ -1574,6 +1570,104 @@ export function readNofileHardCeiling(runtime) {
     }
     return read("/proc/sys/fs/nr_open");
 }
+/**
+ * Parse the `Max open files` row out of a `/proc/<pid>/limits` file:
+ * `Max open files   <soft>   <hard>   files`. Returns null on any shape
+ * surprise — callers treat null as "unknown", never as a limit.
+ */
+export function parseProcLimitsNofile(content) {
+    const line = content.split("\n").find((l) => l.startsWith("Max open files"));
+    if (!line)
+        return null;
+    const toLimit = (raw) => {
+        if (raw === "unlimited")
+            return Infinity;
+        const n = Number(raw);
+        return Number.isSafeInteger(n) && n > 0 ? n : null;
+    };
+    const cols = line.trim().split(/\s+/);
+    const soft = toLimit(cols[3]);
+    const hard = toLimit(cols[4]);
+    return soft !== null && hard !== null ? { soft, hard } : null;
+}
+// Injection seam for tests: the /proc/<pid>/limits reader used by
+// readContainerNofile. Production always uses readFileSync.
+let procLimitsReader = (p) => readFileSync(p, "utf8");
+export function _setProcLimitsReaderForTesting(fn) {
+    procLimitsReader = fn ?? ((p) => readFileSync(p, "utf8"));
+}
+// Injection seam for tests: the host nofile ceiling probe used by the
+// create-time clamp and the regrant check. Production always uses
+// readNofileHardCeiling (real /proc reads), which tests can't control.
+let nofileCeilingFn = readNofileHardCeiling;
+export function _setNofileCeilingForTesting(fn) {
+    nofileCeilingFn = fn ?? readNofileHardCeiling;
+}
+async function readContainerNofileState(name, client) {
+    const inspect = (await safeInspect(() => client.getContainer(prefixedName(name)).inspect()));
+    if (!inspect)
+        return null;
+    let live = null;
+    const pid = inspect.State?.Running ? inspect.State?.Pid : undefined;
+    if (typeof pid === "number" && pid > 0) {
+        try {
+            live = parseProcLimitsNofile(procLimitsReader(`/proc/${pid}/limits`));
+        }
+        catch {
+            // unreadable (different pidns/uid) — the inspect echo remains
+        }
+    }
+    let asked = null;
+    for (const entry of inspect.HostConfig?.Ulimits ?? []) {
+        // podman's libpod shape spells it RLIMIT_NOFILE; docker/compat use nofile.
+        const entryName = entry.Name?.toLowerCase().replace(/^rlimit_/, "");
+        if (entryName === "nofile" &&
+            typeof entry.Soft === "number" &&
+            typeof entry.Hard === "number") {
+            asked = { soft: entry.Soft, hard: entry.Hard };
+            break;
+        }
+    }
+    return { live, asked };
+}
+/**
+ * Read the nofile limits a managed container is ACTUALLY running with —
+ * as opposed to the value that was requested when it was created.
+ *
+ * Primary source is the live `/proc/<container-pid>/limits`; where that
+ * is not readable (containerized Signal K, rootful runtimes), fall back
+ * to the create-time request echoed through inspect, which the runtime
+ * applied verbatim or refused, so it equals the live value whenever it
+ * is present. Null means "unknown": no such container, or neither
+ * source available.
+ */
+export async function readContainerNofile(name, client = getClient()) {
+    const state = await readContainerNofileState(name, client);
+    return state ? (state.live ?? state.asked) : null;
+}
+/** The hard nofile limit a `ContainerConfig.ulimits` request asks for, if any. */
+function requestedNofileHard(ulimits) {
+    const nofile = ulimits?.["nofile"];
+    if (nofile === undefined)
+        return null;
+    return typeof nofile === "number" ? nofile : nofile.hard;
+}
+// The live nofile hard limit observed the last time a regrant recreate was
+// attempted, per (prefixed) container name. Rootless podman < 5.5.0 ignores
+// the compat API's ulimit request entirely (containers/podman#25881, fixed
+// by #25908) and echoes the EFFECTIVE limits back through inspect — there
+// the asked-vs-grantable comparison cannot detect that a recreate already
+// failed to lift the limit, so without this guard a host whose Signal K
+// process carries a higher limit than its podman service would recreate the
+// container on every ensureRunning. Value-keyed on the observed limit: a
+// retry unlocks by itself as soon as the observed limit actually changes
+// (e.g. the operator raised the podman service's limit and the next
+// recreate would inherit it). In-memory by design — at worst one recreate
+// attempt per Signal K process lifetime per observed value.
+const nofileRegrantAttempts = new Map();
+export function _clearNofileRegrantAttemptsForTesting() {
+    nofileRegrantAttempts.clear();
+}
 /**
  * Translate `ContainerConfig.ulimits` into the dockerode
  * `HostConfig.Ulimits` array (`{ Name, Soft, Hard }`). A bare number sets
@@ -1767,7 +1861,7 @@ function buildCreateOptions(name, config, runtime, healthcheck, debug = () => {
     // rootless container asking for more than the calling user's hard limit
     // is rejected by crun and never starts, so we lower it (and log) rather
     // than let the container fail.
-    const ulimits = ulimitsForRun(config.ulimits, readNofileHardCeiling(runtime), (requested, granted) => {
+    const ulimits = ulimitsForRun(config.ulimits, nofileCeilingFn(runtime), (requested, granted) => {
         const reason = `nofile ulimit ${requested} exceeds this host's hard limit; clamped to ${granted}. ` +
             `Raise the limit for the user running the container runtime to use a higher value.`;
         debug(reason);
@@ -1823,8 +1917,32 @@ export async function ensureRunning(runtime, name, config, debug, options, clien
  * will be undefined and only positive drift is detected.
  */
 prior, _postRecreate = false, _pull = pullImage) {
-    const state = await getContainerState(runtime, name, client);
     const fullName = prefixedName(name);
+    let state;
+    try {
+        state = await getContainerState(runtime, name, client);
+    }
+    catch (err) {
+        if (_postRecreate || !isStorageCorruptError(err))
+            throw err;
+        // Storage corruption (issue #219): inspect 500s but force-remove still
+        // works, and managed containers keep their state in bind mounts, so
+        // remove + recreate is the recovery. Bounded: if removal or the re-read
+        // fails we throw, and the _postRecreate re-entry never retries.
+        debug(`Container ${fullName} has corrupt storage (${describeError(err)}); removing and recreating`);
+        try {
+            await removeContainer(runtime, name, client);
+            state = await getContainerState(runtime, name, client);
+        }
+        catch (recoveryErr) {
+            throw new Error(`Container ${fullName} has corrupt storage and automatic recovery failed. ` +
+                `Remove it manually (\`${runtime.runtime} rm -f ${fullName}\`)` +
+                (runtime.runtime === "podman"
+                    ? " or repair the store (`podman system check --repair --force`)"
+                    : "") +
+                ` and retry. Underlying error: ${describeError(recoveryErr)}`, { cause: recoveryErr });
+        }
+    }
     const imageRef = qualifyImage(config.digest
         ? `${config.image}@${config.digest}`
         : `${config.image}:${config.tag}`, runtime);
@@ -1939,6 +2057,89 @@ prior, _postRecreate = false, _pull = pullImage) {
         debug(`Container ${fullName} floating-tag digest drift detected (${liveId.slice(0, 19)}… → ${remoteId.slice(0, 19)}…); recreating`);
         return recreateUnlessWedged(`digest ${liveId.slice(0, 19)}… → ${remoteId.slice(0, 19)}…`);
     };
+    // Emit the still-capped advisory so consumers keep showing the true live
+    // state; `granted` is the limit the container actually runs with.
+    const adviseNofileCapped = (grantedHard, requestedHard) => safeInvokeUlimitClamped(options?.onUlimitClamped, {
+        ulimit: "nofile",
+        requested: requestedHard,
+        granted: grantedHard,
+        reason: `${fullName} is running with a nofile limit of ${grantedHard}, ` +
+            `below the requested ${requestedHard}, and a recreate cannot ` +
+            `currently do better. Raise the limit of the host service that ` +
+            `runs the containers to lift it.`,
+    }, (err) => debug(`ensureRunning(${name}): onUlimitClamped handler threw: ${err instanceof Error ? err.message : String(err)}`));
+    // ulimits sit outside drift detection (changing one doesn't justify the
+    // recreate downtime), which leaves one gap: after an operator raises the
+    // host nofile ceiling, the existing container keeps the lower limit it was
+    // created with forever — a restart re-applies the stored value. Close the
+    // gap here: when the host would now ask for MORE nofile than the previous
+    // create asked, recreate to apply it (completing the documented "raise the
+    // host limit" fix without manual container surgery). When it can't do
+    // better, re-emit the clamp advisory so consumers reflect the live capped
+    // state across Signal K restarts — the create-time event alone would
+    // vanish on the next plugin start while the container stayed capped. A
+    // null probe means "unknown", never capped: no recreate, no advisory.
+    const checkNofileRegrant = async () => {
+        const requestedHard = requestedNofileHard(config.ulimits);
+        if (requestedHard === null)
+            return false;
+        const state = await readContainerNofileState(name, client);
+        const live = state ? (state.live ?? state.asked) : null;
+        if (!state || !live)
+            return false;
+        const ceiling = nofileCeilingFn(runtime);
+        const grantable = ceiling !== null && Number.isFinite(ceiling)
+            ? Math.min(requestedHard, ceiling)
+            : requestedHard;
+        // Compare against what the previous create ASKED for, not what the
+        // container got: a recreate re-asks with `grantable`, so it can only
+        // improve on a smaller previous ask. When the runtime granted less
+        // than asked (a daemon whose own unit limit caps what it hands out —
+        // asking again cannot help), recreating would thrash the container on
+        // every ensureRunning without ever lifting the limit.
+        const asked = state.asked ?? live;
+        if (grantable > asked.hard &&
+            nofileRegrantAttempts.get(fullName) !== live.hard) {
+            nofileRegrantAttempts.set(fullName, live.hard);
+            debug(`Container ${fullName} was created asking nofile ${asked.hard} but ` +
+                `the host now grants ${grantable}; recreating to apply it`);
+            if (await recreateUnlessWedged(`nofile ${asked.hard} → ${grantable}`)) {
+                // Verify the recreate actually lifted the limit. On rootless podman
+                // < 5.5.0 the re-ask is dropped like the original ask (see
+                // nofileRegrantAttempts), so a skewed host — Signal K process limit
+                // above the podman service's — recreates once and lands back on the
+                // old value. Without this post-check that session would show no
+                // advisory at all: the create emits no clamp (the ceiling looks
+                // fine) and this path returned before the still-capped check below.
+                // Best-effort telemetry: the recreate itself succeeded, so a probe
+                // failure here must degrade to "no advisory", never fail the start.
+                // A container that landed exactly on `grantable` got what the create
+                // asked after clamping — the create-time clamp event (if any) already
+                // reported that value, so advising again would duplicate it. A
+                // container that landed anywhere else (a runtime that dropped the
+                // ask) makes the create-time event wrong, and this advisory is the
+                // correction.
+                try {
+                    const after = await readContainerNofileState(name, client);
+                    const afterLive = after ? (after.live ?? after.asked) : null;
+                    if (afterLive &&
+                        requestedHard > afterLive.hard &&
+                        afterLive.hard !== grantable) {
+                        adviseNofileCapped(afterLive.hard, requestedHard);
+                    }
+                }
+                catch (err) {
+                    debug(`ensureRunning(${name}): post-regrant nofile verify failed: ${err instanceof Error ? err.message : String(err)}`);
+                }
+                return true;
+            }
+            // Wedged — kept running on the old limit; fall through to advise.
+        }
+        if (requestedHard > live.hard) {
+            adviseNofileCapped(live.hard, requestedHard);
+        }
+        return false;
+    };
     switch (state) {
         case "running": {
             if (_postRecreate) {
@@ -1951,6 +2152,8 @@ prior, _postRecreate = false, _pull = pullImage) {
                 return;
             if (await checkAndRecreateOnDigestDrift())
                 return;
+            if (await checkNofileRegrant())
+                return;
             debug(`Container ${fullName} already running`);
             return;
         }
@@ -1966,6 +2169,8 @@ prior, _postRecreate = false, _pull = pullImage) {
                 return;
             if (await checkAndRecreateOnDigestDrift())
                 return;
+            if (await checkNofileRegrant())
+                return;
             debug(`Starting stopped container ${fullName}`);
             await startByFullName(client, fullName);
             return;
@@ -2570,6 +2775,36 @@ export async function reapSupersededImages(runtime, managed, keepImageVersions,
  * so the scheduler leaves the run unrecorded and retries it instead of
  * waiting out a full interval — both phases are idempotent.
  */
+/**
+ * Build the reaper's view of managed images: every container recorded in a
+ * manifest, paired with the immutable image-ID it is currently running (or
+ * null when that cannot be determined). A per-container probe failure (e.g.
+ * corrupt storage making inspect 500 — issue #219) must not abort the whole
+ * list: the ref is kept with `runningImageId: null`, which
+ * `selectImagesToReap` treats as unanchored and keeps every version of that
+ * image — fail-safe.
+ */
+export async function collectManagedImageRefs(runtime, manifests, debug, client = getClient()) {
+    const refs = [];
+    for (const manifest of manifests) {
+        for (const [containerName, entry] of Object.entries(manifest.containers)) {
+            let runningImageId = null;
+            try {
+                // Inspect the container directly — going through getImageDigest
+                // would try an image-name lookup first, so a local image tagged
+                // with the container's name would shadow the container's .Image.
+                const info = await safeInspect(() => client.getContainer(prefixedName(containerName)).inspect());
+                runningImageId = info?.Image ?? null;
+            }
+            catch (err) {
+                debug(`Image reaper: cannot read the running image of ${prefixedName(containerName)} ` +
+                    `(${describeError(err)}); keeping all versions of ${entry.image} this run`);
+            }
+            refs.push({ image: entry.image, runningImageId });
+        }
+    }
+    return refs;
+}
 export async function runScheduledPrune(runtime, collectManaged, keepImageVersions, log, client = getClient()) {
     let firstError = null;
     try {