Stray-copy fix: the copy container runs with --no-healthcheck (the image's controller health check showed it as starting on the 9202 proof); unreleased

CHANGELOG.md

@@ -12,7 +12,8 @@
   while any second-drive copy runs, capped or in-process, or while a leftover may still run („Éppen fut a második
   meghajtóra készülő mentési másolat…"). The same night's review also moved the capped copy to `--mount` (a path the
   Docker daemon does not see is refused — exit 125, the in-process copy — instead of created empty, where `--delete`
-  would empty the copy) and to the controller's image ID with `--pull never`. Tests `TestStrayCopy_*` (backup, web,
+  would empty the copy) and to the controller's image ID with `--pull never`; the copy container runs with `--no-healthcheck` (the image's
+  controller health check showed it as „starting" on the 9202 proof). Tests `TestStrayCopy_*` (backup, web,
   wiring; Docker-free seams), each red-proved; 9202 proof in felhom.eu `audits/night-2026-10-23/P1-straycopy/`.
 
 ## Unreleased — the second-drive copy no longer squeezes the apps' memory (R-1214), 2026-10-22 night

controller/internal/backup/r1214_capped_copy_test.go

@@ -48,7 +48,7 @@ func TestR1214_MntPathsAreCopiedCapped(t *testing.T) {
 		t.Fatalf("docker calls = %d, want 1", len(rec.calls))
 	}
 	got := strings.Join(rec.calls[0], " ")
-	for _, want := range []string{"run --rm", "--memory 512m", "--memory-swap 512m", "--network none", "--pull never",
+	for _, want := range []string{"run --rm", "--memory 512m", "--memory-swap 512m", "--network none", "--pull never", "--no-healthcheck",
 		"--mount type=bind,src=" + src + ",dst=" + src + ",readonly", "--mount type=bind,src=" + dst + ",dst=" + dst + " ",
 		"--entrypoint rsync gitea.dooplex.hu/admin/felhom-controller:9.9.9 -a --delete " + src + "/ " + dst + "/"} {
 		if !strings.Contains(got, want) {

controller/internal/backup/tier2.go

@@ -808,7 +808,7 @@ func rsyncMirror(src, dst string) error {
 			args := append([]string{"run", "--rm", "--name", name, "--label", tier2CopyLabel + "=1",
 				"--label", tier2CopyAppLabel + "=" + tier2DockerSafe(app),
 				"--memory", tier2CopyMemCap, "--memory-swap", tier2CopyMemCap,
-				"--network", "none", "--pull", "never",
+				"--network", "none", "--pull", "never", "--no-healthcheck", // the image's controller health check means nothing here
 				// --mount (not -v): a path the daemon does not see is REFUSED (exit 125 → the in-process copy) instead of
 				// created empty — an empty source would let `--delete` empty the copy (review 2026-10-22 night, C4).
 				"--mount", "type=bind,src=" + s + ",dst=" + s + ",readonly", "--mount", "type=bind,src=" + d + ",dst=" + d,