signalk-container 1.35.0 → 1.35.2

package/dist/index.js

@@ -1,6 +1,6 @@
 import path from "node:path";
 import { existsSync, promises as fsp } from "node:fs";
-import { clampCpusToHost, fieldsRequiringRecreateForUnset, filterUnsupportedLimits, mergeResourceLimits, minimizeOverride, resourceLimitsEqual, tryLiveUpdate, } from "./resources.js";
+import { clampCpusToHost, fieldsRequiringRecreateForUnset, filterUnsupportedLimits, mergeResourceLimits, minimizeOverride, resourceLimitsEqual, tryLiveUpdate, withoutDefaultMemorySwap, withoutInjectedResources, } from "./resources.js";
 import { detectRuntime, isContainerized, setDisableUserns } from "./runtime.js";
 import { setNamespace } from "./namespace.js";
 import { makeDegradationEmitter, } from "./notifications.js";
@@ -1443,7 +1443,38 @@ export default (app) => {
             // detection in ensureRunning recreates the container with
             // filteredMerged already applied) does not trigger a spurious
             // tryLiveUpdate against an already-correct container.
-            const postLimits = await getLiveResources(runtimeInfo, name);
+            //
+            // Provenance ladder — what was actually *requested*, so a field
+            // present in the live limits that never appeared in any request is
+            // recognized as a runtime artifact, not a user unset (notably the
+            // `oom_score_adj` rootless Podman clamps onto a child container
+            // when signalk-server's own oom_score_adj is non-zero):
+            //
+            //   1. Warm cache: the PRIOR ensureRunning's post-filter
+            //      `filteredMerged` (cached in `lastConfigs`, read into
+            //      `priorConfig` above before this call overwrote it). Using
+            //      the prior request (not the current `filteredMerged`) still
+            //      flags a genuine unset: when a user removes a `memory` cap
+            //      from `containerOverrides`, the field was in the prior
+            //      request and the recreate warning fires.
+            //   2. Cold cache (fresh server process): the requested-resources
+            //      label stamped on the container at create time — durable
+            //      provenance that survives restarts.
+            //   3. Neither (container predates the label): `undefined`, NOT
+            //      `{}` — an empty object would assert "nothing was ever
+            //      requested" and silently suppress a real stale
+            //      `memory`/`memorySwap` cap the current config removes.
+            //      `undefined` falls back to the plain current-vs-live check
+            //      minus runtime-injected fields, so a genuine memory unset
+            //      is still surfaced and an inherited oom_score_adj is not
+            //      treated as an unset.
+            //
+            // The runtime-injected fields nobody requested are left out of
+            // `postLimits` altogether, so an inherited oom_score_adj alone does
+            // not count as a difference and send a live update on every start.
+            const createdWith = await getRequestedResources(name);
+            const priorRequested = priorConfig?.resources ?? createdWith;
+            const postLimits = withoutInjectedResources(withoutDefaultMemorySwap(await getLiveResources(runtimeInfo, name), filteredMerged, createdWith), filteredMerged, priorRequested);
             if (!resourceLimitsEqual(postLimits, filteredMerged)) {
                 const fullName = prefixedName(name);
                 // Bug E: if any field is being UNSET and it can't be unset
@@ -1452,32 +1483,6 @@ export default (app) => {
                 // ensureRunning's "already running" branch — that would
                 // surprise the consumer plugin. Instead, log a clear warning
                 // pointing the user to the explicit recreate path.
-                //
-                // Provenance ladder — what was actually *requested*, so a field
-                // present in `postLimits` that never appeared in any request is
-                // recognized as a runtime artifact, not a user unset (notably the
-                // `oom_score_adj` rootless Podman clamps onto a child container
-                // when signalk-server's own oom_score_adj is non-zero):
-                //
-                //   1. Warm cache: the PRIOR ensureRunning's post-filter
-                //      `filteredMerged` (cached in `lastConfigs`, read into
-                //      `priorConfig` above before this call overwrote it). Using
-                //      the prior request (not the current `filteredMerged`) still
-                //      flags a genuine unset: when a user removes a `memory` cap
-                //      from `containerOverrides`, the field was in the prior
-                //      request and the recreate warning fires.
-                //   2. Cold cache (fresh server process): the requested-resources
-                //      label stamped on the container at create time — durable
-                //      provenance that survives restarts.
-                //   3. Neither (container predates the label): `undefined`, NOT
-                //      `{}` — an empty object would assert "nothing was ever
-                //      requested" and silently suppress a real stale
-                //      `memory`/`memorySwap` cap the current config removes.
-                //      `undefined` falls back to the plain current-vs-live check
-                //      minus runtime-injected fields, so a genuine memory unset
-                //      is still surfaced while the inherited oom_score_adj no
-                //      longer warns on every server start (#216).
-                const priorRequested = priorConfig?.resources ?? (await getRequestedResources(name));
                 const cannotUnset = fieldsRequiringRecreateForUnset(postLimits, filteredMerged, priorRequested);
                 if (cannotUnset.length > 0) {
                     app.error(`ensureRunning(${name}): cannot live-unset fields ${cannotUnset.join(", ")} on already-running container. ` +
@@ -1485,12 +1490,6 @@ export default (app) => {
                         `Use POST /plugins/signalk-container/api/containers/${name}/resources to force a recreate.`);
                     // Still try to apply the OTHER (settable) fields via live update.
                 }
-                else if (priorRequested === undefined &&
-                    postLimits.oomScoreAdj != null &&
-                    filteredMerged.oomScoreAdj == null) {
-                    app.debug(`ensureRunning(${name}): ignoring live oomScoreAdj=${postLimits.oomScoreAdj} with no provenance — ` +
-                        `runtime-injected (rootless podman inherits the server's oom_score_adj), not a consumer request`);
-                }
                 const live = await tryLiveUpdate(runtimeInfo, fullName, filteredMerged, restartPolicyFor(effectiveConfig));
                 if (!live.ok) {
                     // Live update failed (e.g. cpuset on a host that doesn't
@@ -1609,15 +1608,21 @@ export default (app) => {
             if (!runtimeInfo)
                 throw new Error("No container runtime available");
             // Always attempt remove. `removeContainer` is idempotent on truly-
-            // missing containers (stop errors are swallowed, `rm -f` returns 0),
-            // and api.remove's cache evictions / broker teardown are no-ops on
-            // a name nobody registered. No need to precondition on getState —
-            // that would only add a TOCTOU window before the actual remove.
-            // If the runtime does report a real failure, re-check state: a
-            // benign disappearance (someone else removed it concurrently) is
-            // acceptable; anything else propagates.
+            // missing containers (a failed stop of a container that is gone is
+            // tolerated, and `rm -f` treats not-found as success), and
+            // afterContainerRemoved's cache evictions / broker teardown are
+            // no-ops on a name nobody registered. No need to precondition on
+            // getState — that would only add a TOCTOU window before the actual
+            // remove. If the runtime does report a real failure, re-check state:
+            // a benign disappearance (someone else removed it concurrently) is
+            // acceptable; anything else propagates, including a graceful stop
+            // the runtime refused while the container kept running. The stop is
+            // graceful because the new container takes over the old one's data.
             try {
-                await api.remove(name);
+                await removeContainer(runtimeInfo, name, undefined, {
+                    graceful: true,
+                });
+                afterContainerRemoved(name);
             }
             catch (err) {
                 const now = await getContainerState(runtimeInfo, name);
@@ -1921,7 +1926,16 @@ export default (app) => {
             //     the user's intent but the container has the old value
             //   - manual `podman update` from outside Signal K isn't tracked
             // Always compare against truth.
-            const liveBefore = await getLiveResources(runtimeInfo, name);
+            //
+            // Provenance guard: only force a recreate for a field the consumer
+            // actually requested before this update (plugin default ⊕ the
+            // stored override). A field that shows up live purely because the
+            // runtime injected it (a rootless-Podman-inherited oom_score_adj)
+            // was never the user's to unset, so it is left out of `liveBefore`:
+            // it neither breaks the no-op check below nor triggers a (futile,
+            // on rootless) recreate when the override is cleared.
+            const priorRequested = mergeResourceLimits(pluginDefault, currentOverrides[name]);
+            const liveBefore = withoutInjectedResources(withoutDefaultMemorySwap(await getLiveResources(runtimeInfo, name), filteredLimits, await getRequestedResources(name)), filteredLimits, priorRequested);
             // No-op when the live container already matches what's being
             // requested. Verify existence by way of getLiveResources returning
             // an empty object — if liveBefore is {}, either the container is
@@ -1946,14 +1960,6 @@ export default (app) => {
             // update". Memory limits and oom-score-adj are the offenders —
             // podman/docker can lower or raise them, but not return them to
             // the unlimited/default state without a recreate.
-            //
-            // Provenance guard: only force a recreate for a field the consumer
-            // actually requested before this update (plugin default ⊕ the
-            // stored override). A field that shows up in `liveBefore` purely
-            // because the runtime injected it (a rootless-Podman-inherited
-            // oom_score_adj) was never the user's to unset, so clearing the
-            // override must not trigger a (futile, on rootless) recreate.
-            const priorRequested = mergeResourceLimits(pluginDefault, currentOverrides[name]);
             const mustRecreateForUnset = fieldsRequiringRecreateForUnset(liveBefore, filteredLimits, priorRequested);
             const forceRecreate = mustRecreateForUnset.length > 0;
             if (forceRecreate) {
@@ -2012,10 +2018,33 @@ export default (app) => {
             // target — it's what the consumer plugin most recently asked
             // for, minus our new resources. (Bug A fix.)
             try {
-                await removeContainer(runtimeInfo, name);
+                await removeContainer(runtimeInfo, name, undefined, {
+                    graceful: true,
+                });
             }
             catch (err) {
-                warnings.push(`remove during recreate: ${err instanceof Error ? err.message : String(err)}`);
+                const removeMsg = err instanceof Error ? err.message : String(err);
+                // A container that is still there keeps its old limits: resources
+                // are not a drift axis, so the ensureRunning below would leave it
+                // as it is and this would report a recreate that never happened.
+                // When the stop went through and only the remove failed, it is
+                // started again so a failed update does not leave it down.
+                const state = await getContainerState(runtimeInfo, name);
+                if (state !== "missing") {
+                    let restartNote = "";
+                    if (state === "stopped") {
+                        try {
+                            await startContainer(runtimeInfo, name);
+                        }
+                        catch (startErr) {
+                            restartNote = ` Starting it again also failed: ${startErr instanceof Error ? startErr.message : String(startErr)}`;
+                        }
+                    }
+                    throw new Error(`Failed to apply new resources for ${name}: ${removeMsg}. ` +
+                        `The container was not removed and keeps its previous limits.` +
+                        restartNote, { cause: err });
+                }
+                warnings.push(`remove during recreate: ${removeMsg}`);
             }
             // A resource-update recreate re-runs ensureRunning, which re-fires
             // device-passthrough events (a device may have been unplugged since