fix(registry): let assemble-htpasswd run again in place #11

Merged

binjovi-bot merged 2 commits from fix/htpasswd-rerun into trunk 2026-09-01 22:45:33 +00:00

Conversation 0 Commits 2 Files changed 3 +73 -6

sean commented 2026-09-01 22:37:48 +00:00

Owner

Copy link

When the kubelet restarts the zot pod in place (node reboot, kubelet restart), the assemble-htpasswd init container runs again over the emptyDir that already holds the 0440 htpasswd from the first run. The container runs as uid 902, so : > /output/htpasswd fails with Permission denied and the pod never leaves Init.

This happened today: seanfarm-worker-a40389 rebooted at 22:27 UTC (hung NVMe-oF I/O from the retired d87376 node), the init container went into CrashLoopBackOff, and the registry answered 503 until the pod was deleted by hand.

Fix: build the file next to the old one and mv -f it over. Rename needs only directory write access and is atomic.

Red-green: tests/zot-htpasswd-rerun.sh runs the real init script twice against one output directory as a non-root user. It fails on trunk (Permission denied) and passes with this change. tests/check.sh is green.

https://claude.ai/code/session_01LeVatedQ4sCA1u6LHjo7B5

When the kubelet restarts the zot pod in place (node reboot, kubelet restart), the `assemble-htpasswd` init container runs again over the emptyDir that already holds the 0440 `htpasswd` from the first run. The container runs as uid 902, so `: > /output/htpasswd` fails with `Permission denied` and the pod never leaves Init. This happened today: seanfarm-worker-a40389 rebooted at 22:27 UTC (hung NVMe-oF I/O from the retired d87376 node), the init container went into CrashLoopBackOff, and the registry answered 503 until the pod was deleted by hand. Fix: build the file next to the old one and `mv -f` it over. Rename needs only directory write access and is atomic. Red-green: `tests/zot-htpasswd-rerun.sh` runs the real init script twice against one output directory as a non-root user. It fails on trunk (`Permission denied`) and passes with this change. `tests/check.sh` is green. https://claude.ai/code/session_01LeVatedQ4sCA1u6LHjo7B5

sean added 1 commit 2026-09-01 22:37:48 +00:00

fix(registry): let assemble-htpasswd run again in place ... afa9d10a2c

When the kubelet restarts the zot pod in place, for example after a node
reboot, the assemble-htpasswd init container runs again over the emptyDir
that already holds the 0440 htpasswd from the first run. The container is
a non-root user, so the truncate fails with EACCES and the pod never leaves
Init. seanfarm-worker-a40389 rebooted at 22:27 UTC and the registry stayed
down until the pod was deleted by hand.

Build the file next to the old one and rename it over the old one. The
rename needs only directory write access, and it is atomic.

tests/zot-htpasswd-rerun.sh runs the real init script twice against one
output directory as a non-root user. It failed with the old script and
passes now. The publisher guard keeps its four-entry check on the new
path and also requires the final rename.

Claude-Session: https://claude.ai/code/session_01LeVatedQ4sCA1u6LHjo7B5

sean added 1 commit 2026-09-01 22:44:46 +00:00

test(registry): read the htpasswd mode portably ... 27911f3f6c

GNU stat -f shows filesystem status, not a file mode, so the guard failed
in the Linux validator with a false mode mismatch. The ls mode column is
the same on GNU and BSD.

Claude-Session: https://claude.ai/code/session_01LeVatedQ4sCA1u6LHjo7B5

binjovi-bot merged commit 27911f3f6c into trunk 2026-09-01 22:45:33 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/zot!11

No description provided.