D48: a restore downloads first — every restore path resolves and pulls every image of the definition that will run before the stop, under the image-work lock held until the restore returns; a failed pull refuses with the app untouched (a deleted version and a busy registry read differently), one operator line. Red-proved. Commit only.

2026-10-25 09:38:28 +01:00
parent b680db85cb
commit 2d71270858
16 changed files with 404 additions and 3 deletions
@@ -420,6 +420,15 @@ func (m *Manager) RestoreTier2Files(stackName string) (filesRestored int, err er
 	}
 	m.logger.Printf("[INFO] [backup] Tier-2 file restore for %s: %s (v2) → %s (additive-only)", stackName, destBase, liveNsRoot)

+	// D48: the live definition's images are on the box before the stop, or the restore is refused untouched.
+	if composePath, ok := m.stackProvider.GetStackComposePath(stackName); ok && composePath != "" {
+		releaseImages, pErr := m.prepareRestoreImages(stackName, composePath)
+		if pErr != nil {
+			return 0, pErr
+		}
+		defer releaseImages()
+	}
+
 	// Stop → copy → start → health (the standard restore shape; F17: errors surface, never swallowed).
 	if stopErr := m.stackProvider.StopStack(stackName); stopErr != nil {
 		m.logger.Printf("[WARN] [backup] could not stop %s before Tier-2 file restore: %v (continuing)", stackName, stopErr)