admin/felhom-controller
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v0.293.0: the controller heals itself after the guest's Docker socket is re-created (R-860)
gates / gates (push) Successful in 29s
Details

Browse Source 
internal/sockheal: 60 s of refusals (never a timeout, only after Docker answered once) → exit 75 so
Docker's restart policy brings the controller back on the current socket; every 5 min it restarts any
other socket user (traefik) holding an older inode. Measured on 9202: only a docker.socket restart
re-creates the file; dockerd crash / docker.service restart keep it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
This commit is contained in:
authentik Default Admin
2026-10-04 19:48:29 +02:00
parent 09e634de31
commit 2a7f6c6c42
5 changed files with 480 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
controller/README.md
+9
View File
@@ -1040,6 +1040,15 @@ hard **404** at its URL even though the container is running. The `routeUnpublis
(`funcmap.go`) drives a distinct "URL nem elérhető – útvonal nincs publikálva" indicator on the dashboard
and stacks cards for such apps, so a dead URL isn't mistaken for a merely-degraded-but-reachable one.
#### Docker socket self-heal (`internal/sockheal/`, v0.293.0, R-860)
The controller and traefik bind-mount the Docker socket FILE. When `docker.socket` restarts (a docker-ce upgrade by any
route, or by hand), the file is re-created and a running container keeps the deleted one: with live-restore nothing
restarts, and both are blind to Docker. Every 15 s the controller pings the socket; after 60 s of "connection refused"
(never a timeout, and only after Docker had answered in this process) it exits, and Docker's restart policy brings it
back on the current socket. Every 5 min (and 30 s after start) it restarts any other container that mounts the socket
and still sees an older inode (traefik). Logs: `[sockheal]`.
#### Controller-side Health Probes (`internal/stacks/healthprobe.go`)
For apps that declare a `healthcheck:` section in `.felhom.yml`, the controller probes the container directly over the Docker network (both are on `traefik-public`). This complements Docker-level healthchecks and is the **only** health mechanism for distroless/scratch images that lack shell utilities.