flan
0fc994f676
Patching at PREINIT and restarting minutes later is only sound while the patched files are still on the live path when middlewared re-imports them, and PREINIT cannot guarantee that. The overlay sits inside /usr, so anything that remounts that hierarchy detaches it — a systemd-sysext merge/refresh from another PREINIT hook, or middlewared's own docker.configure_nvidia at runtime. Init scripts run sequentially in id order, so a hook registered after this one always wins, and reordering them would not help because docker.configure_nvidia fires long after PREINIT is done. Observed on 25.10.6: the overlay was mounted at 16:41:56, a sysext refresh unmerged and remerged /usr four seconds later, and the deferred restart at 16:47:24 loaded stock modules. Every B2 cloud_backup task then failed with NotImplementedError for nineteen hours across four scheduled runs while apply.log and hook_status.json both reported the patch active. wait_restart.sh now re-applies immediately before restarting — after boot has settled, which is also after every sysext merge and docker nvidia configuration — verifies the marker is on the live path, restarts, and verifies again, retrying once. It is no longer exec'd, so something can run after the restart to find out what it loaded. apply.sh records the resolved middlewared directory in .mw_dir for that check, and honours TRUECLOUD_REAPPLY so the re-apply pass does not schedule a second restart. _ensure_writable treated "one of our overlays is listed here" as "already done", but it only reaches that check when the directory is not writable, and a live overlay of ours always is — a shadowed overlay was indistinguishable from a healthy one. It is now detached and re-mounted, reusing the upperdir so files patched earlier in the boot survive, with a fresh workdir and a retry on a private one, since overlayfs refuses a workdir a detached mount still holds. Add a CRITICAL hourly alert for the case none of this can prevent: the patch being on disk but not in the running process. apply.log can only report the first. The alert asks the second question from inside middlewared, where the patch's own stamps make it exact, and checks both halves since either can go missing alone. It stays quiet when the kill switch is set or the providers module has been retired as native, and is not muted by update_alerts_disabled. wait_restart.sh also logs to apply.log now: journald retention on a busy box is easily shorter than the interval between reboots, and the boot that caused this had already rotated away by the time it was investigated.
24 lines
624 B
Plaintext
24 lines
624 B
Plaintext
# Runtime files written to the repo root by apply.sh and sitecustomize.py
|
|
/apply.log
|
|
/apply.log.1
|
|
/apply.log.2
|
|
/hook_status.json
|
|
# The resolved middlewared directory, recorded by apply.sh so wait_restart.sh can
|
|
# check whether the patched modules are still on the live path without
|
|
# re-deriving site-packages.
|
|
/.mw_dir
|
|
/disabled
|
|
/nested_snapshots_enabled
|
|
# Written by apply.sh when a module's assumptions no longer fit the installed
|
|
# middlewared (see tools/compat.py). Evidence for the alert; not source.
|
|
/incompatible.json
|
|
|
|
# Python
|
|
__pycache__/
|
|
*.py[cod]
|
|
.pytest_cache/
|
|
.ruff_cache/
|
|
.venv/
|
|
venv/
|
|
/update_alerts_disabled
|