Per-release metadata store (F14) + rollback/recreate/port family - #2
Merged
Merged
Conversation
docker run commands were rebuilt inline from a partial inspect struct, so recreation silently dropped everything the struct did not happen to list: log rotation (every recreated container lost max-size=10m), entrypoint overrides, stop timeout/signal, extra hosts, sysctls, tmpfs, capabilities, security opts, read-only/privileged flags, and secondary networks. InspectRecreate captures a complete RecreateSpec from one inspect; the pure RenderRecreateArgs renders it (values quoted exactly once at the shell boundary, TCL-11); Recreate applies the avoidPorts reallocation and force-removes + reruns. Restart is now InspectRecreate + Recreate with the same signature, so rollback/heal/displaced-workload restore all gain the full spec. A multi-element entrypoint that differs from the image's own fails closed (the docker CLI cannot represent argv there) instead of being joined into a wrong single string; one matching the image is dropped — the recreated container inherits it from the immutable image ID (F19 rule). HostPortFor resolves the host binding for a named CONTAINER port — the primary-port lookup fields[0] reads cannot do for multi-port containers (TCL-14); rollback consumes it via the F14 record.
…get+release One JSON record per (app, release id) at /deployments/<app>/meta/<hash>.json, written atomically at 0600 (backfills embed resolved env), following the file-per-target convention of state.json and pins: the server a command talks to IS the target, so the app directory is the target key. The record captures the full resolved spec a rollback or recreate needs and state.json never retained: image ref + digest, env references (server-side env-file paths; resolved values only for backfills), volumes, labels, ports with the TCL-14 primary designation and a fixed/ephemeral flag, replicas/processes/cmd, resource limits, stop timeout, bind address, the deploy health gate, the Caddy edge config (TLS/extra/cache/firewall/access), and for static apps the serving config (SPA/headers/cache). The primary web container's full RecreateSpec (F20) is embedded from docker's own view. Writers are the deploy paths only; readers never mutate. A same-version redeploy is the one allowed rewrite (the live containers just got that config — an unchanged record would lie). Rollback never writes for its target: a release does not change by being rolled back to. Migration: pre-F14 releases get a 'release-0' record backfilled from the live containers the first time a consumer needs one (flagged Backfilled) — existing installs converge without a redeploy. Backfill is honest about what inspect cannot recover (--env-file references, health gate, Caddy config) and leaves those empty for the legacy fallbacks. Read keeps the F15 discipline: confirmed-absent is (nil, nil); transport/parse/schema failures are errors. state.ReadRemoteFile exported for the same framed absence-vs-failure read.
…from the recorded release Deploy records every release (F14 store) right after the state commit: ports with the primary designation and fixed/ephemeral flags, publish specs, env-file references, health gate, Caddy edge config, and the primary web container's RecreateSpec. Record failures warn — the containers are live and routed by then; the store must never turn a successful deploy into an outage. Rollback now restores FROM the record, not from the current teploy.yml or reverse-engineered container state: recorded health gate, domain, TLS / caddy_extra / cache / firewall / access, and the recorded ingress mode. A confirmed-missing record backfills from the live containers (release-0 convergence); an unreadable record degrades to the historical inspect-driven path with a warning — the store is an overlay, never a new way for rollback to refuse. TCL-14: the recorded primary container port decides which binding the health check probes (HostPortFor) and which port Caddy dials — a multi-port container's auxiliary listener can no longer steal either. Without a record, the old first-port behavior remains. F21: publish apps take the explicit recreate strategy on both paths. Deploy displaces the current web container before the replacement starts (the same restore-on-failure contract host ingress has) instead of dying mid-deploy on 'port is already allocated'; rollback likewise frees the fixed ports first and stops avoiding the live ports for fixed-port targets. F13: 'teploy rollback --app <static-app> --host ...' is now complete — StaticDeployer.RollbackStateOnly flips the release symlink and rebuilds the Caddy block from the recorded serving config (SPA/headers/cache/ extra/domain). No record means an explicit redeploy-first request; a static release's serving config is unrecoverable from disk. The directory-based static rollback also prefers the record when one exists.
F14 (store), F13 (state-only rollback incl. static serving), F20 (full RecreateSpec), F21 (publish recreate strategy), TCL-09/TCL-13/TCL-14 resolved with their commits. F04/TCL-10/TCL-15 annotated 'unblocked by F14, design remains'; F08 notes the record as its keying surface; F60 annotated largely-delivered with the access-contract residual; TCL-39's F13 half landed, F48 remains. F48/F49/F16/F57 untouched.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
F14 immutable per-release metadata with release-0 backfill; F13 full-spec rollback, F20 faithful recreation, F21 publish recreate strategy, TCL-14 recorded primary port. Race suite green.