Bound image pulls and make no-pull fail closed #1554

New issue

Closed

opened 2026-07-24 21:50:06 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-07-24 21:50:06 +00:00

Member

Problem

A live redispatch attempt for ward#1550 proved two launch-control defects.

First, the detached prelaunch docker pull has a heartbeat but no timeout. It emitted progress heartbeats for more than five minutes with no layer progress and would have waited indefinitely without operator interruption.

Second, --no-pull only skips the explicit prelaunch pull. When the selected image is absent locally, the later docker run performs its own implicit registry pull. The operator asked for cached-image-only behavior but Ward silently re-entered the same unbounded network path.

The #1550 issue became reserved during this failed prelaunch, so this correction is captured separately per the reserved-thread rule.

Change

Put a bounded, configurable deadline around the explicit detached image pull.
On timeout or registry failure, classify the pull as recovered only when the selected image is already present locally and usable.
Implement --no-pull as a real fail-closed cached-image contract. Preflight local image presence and run Docker with implicit pulling disabled.
If no cached image exists, fail before container creation with one actionable message. Do not let docker run contact the registry.
Release the issue reservation automatically on pull timeout, cached-image miss, or any failure before container creation.
Keep heartbeat output, but add a terminal classification with elapsed time and whether cached fallback was selected.
Expose stable friction fingerprints for pull timeout, recovered cached fallback, and cached-image miss.
Update docs and docs/FEATURES.md.

Acceptance

A fake or stalled pull returns within the configured deadline.
A timed-out pull plus a valid cached image continues exactly once and reports recovered fallback.
--no-pull with a cached image performs no registry call.
--no-pull without a cached image fails before docker create or docker run and performs no registry call.
Every pre-container failure releases local and remote reservation state.
Tests cover timeout, registry error, cache hit, cache miss, and reservation cleanup.
Ward validation and pre-commit pass.

## Problem A live redispatch attempt for [ward#1550](https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/1550) proved two launch-control defects. First, the detached prelaunch `docker pull` has a heartbeat but no timeout. It emitted progress heartbeats for more than five minutes with no layer progress and would have waited indefinitely without operator interruption. Second, `--no-pull` only skips the explicit prelaunch pull. When the selected image is absent locally, the later `docker run` performs its own implicit registry pull. The operator asked for cached-image-only behavior but Ward silently re-entered the same unbounded network path. The #1550 issue became reserved during this failed prelaunch, so this correction is captured separately per the reserved-thread rule. ## Change * Put a bounded, configurable deadline around the explicit detached image pull. * On timeout or registry failure, classify the pull as recovered only when the selected image is already present locally and usable. * Implement `--no-pull` as a real fail-closed cached-image contract. Preflight local image presence and run Docker with implicit pulling disabled. * If no cached image exists, fail before container creation with one actionable message. Do not let `docker run` contact the registry. * Release the issue reservation automatically on pull timeout, cached-image miss, or any failure before container creation. * Keep heartbeat output, but add a terminal classification with elapsed time and whether cached fallback was selected. * Expose stable friction fingerprints for pull timeout, recovered cached fallback, and cached-image miss. * Update docs and `docs/FEATURES.md`. ## Acceptance * A fake or stalled pull returns within the configured deadline. * A timed-out pull plus a valid cached image continues exactly once and reports recovered fallback. * `--no-pull` with a cached image performs no registry call. * `--no-pull` without a cached image fails before `docker create` or `docker run` and performs no registry call. * Every pre-container failure releases local and remote reservation state. * Tests cover timeout, registry error, cache hit, cache miss, and reservation cleanup. * Ward validation and pre-commit pass.

coilyco-ops added the

autonomy

async-consult

priority

labels

2026-07-29 03:47:16 +00:00

coilyco-ops closed this issue

2026-07-29 05:59:15 +00:00