Sign up
View stargazersSign up

Keep Corrosion running across daemon stops#1491

merged8
main
dns-split/retain-corrosion
openedOct 9, 2026byNNick
13 files changed
View on GitHubGitHub import enabledPR last imported 21d ago

Summary

Keep Corrosion running when the daemon stops, crashes, or restarts. Managed containers carry a digest of their configuration and mounted files, so a matching container is reused on startup. Unregistry uses the same convergence path.

diff
1 daemon stop
2- stop Corrosion
3+ retain Corrosion until Reset or uninstall

This is the Corrosion layer of native stack #1501. Complete membership continuity also requires the mesh layer in #1504.

Evidence

  • Refreshed onto current main without force-push. Independent review returned SHIP for each updated layer. The combined refreshed tree passed 607 Rust unit tests, the multipart kernel regression, Clippy with warnings denied, the uninstall contract, formatting, and whitespace checks. Fix round 1 then changed the mesh firewall and WireGuard reset in #1504, so the mesh source no longer matches the live-tested version. The two-Machine live runs below predate that round.
  • Independent exact-head review returned SHIP. The targeted managed-container and Corrosion checks passed.
  • The combined two-Machine stack retained Corrosion identity through restarts, SIGKILL, and 12-second daemon stops. All 280 raw membership samples were Alive.
  • A live frozen-Corrosion recovery replaced the wedged container while DNS served 4,335 queries without loss.

Merge danger

Door: Two-way. No persisted format changes.

Blast radius: Lifecycle. The first startup replaces older Corrosion containers that lack a digest. Reset waits for Docker cleanup before deleting Machine state; failed cleanup preserves Resetting for retry.

Checks

6 successful Ā· 4 skipped
All checks passed
ff4d12e

Added 4 commits

  • Document that stopping ployz keeps the server in the cluster02f3a4e
  • Remove Corrosion before finishing an interrupted reset1d44c8d
  • Drop a comment that restates InterruptedReset::complete4036a50
  • Converge managed containers on a spec digest and keep Corrosion across daemon stopsd12f676
Cchatgpt-codex-connectorBotOct 9, 2026
Synced from GitHub

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

ReviewStatusCommitReview trigger
šŸ“ Code Reviewāœ… Completed 2026-10-10T06:09:17.674633Zff4d12eNew commits
ā„¹ļø About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with šŸ‘€ while any review is running, comments if it has suggestions, and reacts with šŸ‘ once all reviews finish with no findings.

Cchatgpt-codex-connectorBotreviewed Ā· 1 inline threadOct 9, 2026
Synced from GitHub

šŸ’” Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4036a50658

ā„¹ļø About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with šŸ‘.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

docs/user/servers/manage-servers.mdlines 180ā€“181Outdated Ā· 4036a50Open thread
ā€¦ā€¦@@ -177,6 +177,9 @@ If the server is unreachable, remove it without resetting it. This is CLI-only f
178178```
179179
180+`sudo systemctl stop ployz` stops Ployz's control of the server; your services and the server's
181+place in the cluster keep running. To stop everything, run `sudo ployz-uninstall`.
Cchatgpt-codex-connectorBoton lines 180ā€“181Oct 9, 2026

P2 Badge Stop the activation socket in the documented command

On an installed systemd host, this command deactivates only ployz.service; ployz.socket remains listening, so the next local CLI connection socket-activates the daemon and resumes Ployz's control. The repository's lifecycle contract explicitly rejects stopping the service before its socket (core/scripts/test-daemon-lifecycle.sh:64-67), and the generated socket unit listens on the CLI socket (core/crates/ployzd/src/installer/host.rs:252-267). Document stopping ployz.socket before ployz.service if control is meant to remain stopped.

AGENTS.md reference: AGENTS.md:L6-L6

Useful? React with šŸ‘Ā / šŸ‘Ž.

NNickOct 10, 2026

Fixed in ff4d12e1a: the docs now give sudo systemctl stop ployz.socket ployz, explain why the socket has to stop too, and drop the ployz-uninstall advice.

Added 3 commits

  • Keep a live reset's data dir when Corrosion removal fails86d3095
  • Replace a kept Corrosion that never answers75b1489
  • Merge main into Corrosion retention2d9538d

Added 1 commit

  • Document stopping Ployz with its socket and what keeps runningff4d12e