118 lines
5.3 KiB
Go
118 lines
5.3 KiB
Go
package backup
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"strings"
|
|
"time"
|
|
|
|
"gitea.dooplex.hu/admin/felhom-controller/internal/dockerexec"
|
|
"gitea.dooplex.hu/admin/felhom-controller/internal/util"
|
|
)
|
|
|
|
// ── D48 (operator ruling 2026-10-25 08:38; `09` §3 decision 257): a restore downloads first ─────────────────────────
|
|
//
|
|
// BEFORE: every restore stopped the app and moved its data first; the first pull was inside the database-only start
|
|
// (`docker compose up -d <db>`), after the stop. A version that could not be downloaded then ended in the D22 put-back —
|
|
// the whole stop, copy and pour-back for nothing, and an app that was down the while.
|
|
//
|
|
// THE RULE. After the existing refusals and before the first stop or change, every image the definition that will RUN
|
|
// names is resolved: present on the box, or pulled now. Under the image-work lock held SHARED from the first check
|
|
// until the restore's last start (R-863: the image clean-up cannot delete a pulled image before the start — its pass
|
|
// takes the lock exclusively with TryLock and simply does not run meanwhile). A failed pull is a REFUSAL: the app is
|
|
// not stopped and its data is not moved. The household reads which version could not be downloaded, and why — a
|
|
// version its maker deleted (Docker answers „manifest unknown", „not found", „pull access denied") reads differently
|
|
// from a registry that is busy or unreachable (anything else, „toomanyrequests" and timeouts included).
|
|
|
|
// ErrRestoreImageUnavailable is the KIND of the refusal: an image of the backup's version could not be downloaded.
|
|
var ErrRestoreImageUnavailable = errors.New("an image of the backup's version cannot be downloaded")
|
|
|
|
// restorePullTimeout bounds one image pull of a restore.
|
|
const restorePullTimeout = 15 * time.Minute
|
|
|
|
// imagePresentDefault / imagePullDefault are the production probe and pull (tests replace them in TestMain, so no test
|
|
// in this package reaches Docker — R-650; a test that needs a missing image sets m.imagePresentFn / m.imagePullFn).
|
|
var (
|
|
imagePresentDefault = func(ref string) bool {
|
|
return dockerexec.Command("docker", "image", "inspect", "--format", "{{.Id}}", ref).Run() == nil
|
|
}
|
|
imagePullDefault = func(ctx context.Context, ref string) (string, error) {
|
|
out, err := dockerexec.CommandContext(ctx, "docker", "pull", ref).CombinedOutput()
|
|
return string(out), err
|
|
}
|
|
)
|
|
|
|
func (m *Manager) imagePresent(ref string) bool {
|
|
if m.imagePresentFn != nil {
|
|
return m.imagePresentFn(ref)
|
|
}
|
|
return imagePresentDefault(ref)
|
|
}
|
|
|
|
func (m *Manager) imagePull(ctx context.Context, ref string) (string, error) {
|
|
if m.imagePullFn != nil {
|
|
return m.imagePullFn(ctx, ref)
|
|
}
|
|
return imagePullDefault(ctx, ref)
|
|
}
|
|
|
|
// pullGone reports whether Docker's answer says the version does not exist (deleted by its maker, a wrong name) rather
|
|
// than that the registry could not be reached or is busy.
|
|
func pullGone(out string) bool {
|
|
low := strings.ToLower(out)
|
|
for _, s := range []string{"manifest unknown", "not found", "repository does not exist", "pull access denied", "name unknown", "no such manifest"} {
|
|
if strings.Contains(low, s) {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
// prepareRestoreImages resolves every image composePath names and pulls the absent ones, holding the image-work lock
|
|
// until release(). err = the refusal (the household's sentence); the lock is released already then.
|
|
func (m *Manager) prepareRestoreImages(stack, composePath string) (release func(), err error) {
|
|
refs := ParseComposeImages(composePath)
|
|
end := dockerexec.HoldImageWork()
|
|
for _, ref := range refs {
|
|
if m.imagePresent(ref) {
|
|
continue
|
|
}
|
|
start := time.Now()
|
|
ctx, cancel := context.WithTimeout(context.Background(), restorePullTimeout)
|
|
out, perr := m.imagePull(ctx, ref)
|
|
cancel()
|
|
if perr != nil {
|
|
end()
|
|
tail := strings.TrimSpace(out)
|
|
if len(tail) > 300 {
|
|
tail = tail[len(tail)-300:]
|
|
}
|
|
key := "err.backup.restore_image_unreachable"
|
|
why := "the registry did not answer or is busy"
|
|
if pullGone(out) {
|
|
key, why = "err.backup.restore_image_gone", "the version does not exist any more"
|
|
}
|
|
m.logger.Printf("[ERROR] [backup] Restore REFUSED for %s before anything was touched: the image %s could not be downloaded (%s; after %s): %v — %s (D48)",
|
|
stack, ref, why, time.Since(start).Round(time.Second), perr, tail)
|
|
if m.restorePullRefusedNotify != nil {
|
|
m.restorePullRefusedNotify(stack, ref, fmt.Errorf("%s: %v", why, perr))
|
|
}
|
|
return func() {}, util.MsgErrorf(ErrRestoreImageUnavailable, key, PinsVersion([]string{ref}))
|
|
}
|
|
m.logger.Printf("[INFO] [backup] Restore %s: downloaded %s before anything was touched (%s, D48)", stack, ref, time.Since(start).Round(time.Second))
|
|
}
|
|
return end, nil
|
|
}
|
|
|
|
// PrepareRestoreImages is prepareRestoreImages for a caller outside this package — the `.fab` import (R-1279), wired in
|
|
// main.go so the import refuses before it removes anything, in the restores' own words.
|
|
func (m *Manager) PrepareRestoreImages(stack, composePath string) (func(), error) {
|
|
return m.prepareRestoreImages(stack, composePath)
|
|
}
|
|
|
|
// SetRestorePullRefusedNotify wires the operator notice for a restore refused because an image could not be downloaded.
|
|
func (m *Manager) SetRestorePullRefusedNotify(fn func(stack, ref string, cause error)) {
|
|
m.restorePullRefusedNotify = fn
|
|
}
|