Skip to content

v1.18.0 — boot resilience and watchdog remediation

Choose a tag to compare

View all tags
@wrxck wrxck released this 06 Sep 13:29
· 6 commits to main since this release
v1.18.0
7168bfd
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release 1.18.0.

This PR was opened on 2026-08-14 and never merged, so it also carries the unreleased 1.17.1 work — the vault fix that routes compose-declared file entries into the bundled store. There is no v1.17.1 tag, so 1.18.0 is the first release to ship it.

Boot resilience

A production site was down for 14 hours after a reboot. The generated unit ran docker compose down before every start, which destroyed the container dockerd had already restarted from its own restart policy. fleet boot-start then exited 1 and nothing recreated it.

  • The unit template no longer emits an ExecStartPre teardown. compose up -d reconciles a running container on its own, so a start that fails now leaves the previous container serving.
  • Units gain Requires=/After=fleet-unseal.service where that unit is installed. The runtime env directory is a tmpfs and is empty after every reboot; an ordering edge alone let an app start with no env file.
  • StartLimitIntervalSec/StartLimitBurst move into [Unit]. systemd reads the interval only there, so every unit was running against the 10s default window.
  • patch-systemd also repairs a missing docker-databases dependency, backs each unit up write-once, and skips a malformed file instead of aborting the run.
  • compose up -d gained --remove-orphans, the one job the removed teardown did.

Watchdog

  • Restarts an app that is down with a failed unit, at most twice per rolling hour and five times per run, then re-checks it. A degraded app is never restarted, and neither are the shared databases.
  • Alerts when the failure set changes, plus a daily digest. It previously resent an identical message every 15 minutes, which is why the outage went unnoticed.
  • Separates down from degraded, and reports restart attempts.
  • Exits non-zero only when the alert cannot be sent.
  • New flags: --no-remediate, --force-alert.

Dependencies

fast-uri 3.1.5 → 3.1.7 and qs 6.15.2 → 6.16.0, both inside the current major. New advisories had been published against the pinned overrides, which failed audit:prod and would have blocked this release.

Verification

tsc --noEmit clean. 253 assertions pass across the 13 test files touching the changed modules. CI green on Node 20, 22 and 24.

Assets 2
Loading