Keep restart policy at create time for Podman

commit: 482a736a0192287b19375d335d8ea7987d7e900b
author: brice · 5mo ago · 2026-05-05 18:13 UTC
parent: 3751047
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email
refs: tag: v2.31.0-dev15

2 files · +20 -82

M internal/usecase/container/service.go +17 -35


@@ -275,18 +275,19 @@ func (s Service) buildContainerConfig(in containerConfigInput) domain.Containe
275	275		}
276	276
277	277		containerConfig := &domain.ContainerConfig{
278		-	Image: in.ImageRef,
279		-	Name: containerName,
280		-	Ports: ports,
281		-	Env: in.EnvVars,
282		-	Volumes: in.Volumes,
283		-	NetworkMode: in.NetworkName,
284		-	Hostname: in.Domain,
285		-	Labels: labels,
286		-	AutoRemove: false,
287		-	MemoryLimit: cfg.DefaultMemoryLimit,
288		-	NanoCPUs: cfg.DefaultNanoCPUs,
289		-	PidsLimit: cfg.DefaultPidsLimit,
	278	+	Image: in.ImageRef,
	279	+	Name: containerName,
	280	+	Ports: ports,
	281	+	Env: in.EnvVars,
	282	+	Volumes: in.Volumes,
	283	+	NetworkMode: in.NetworkName,
	284	+	Hostname: in.Domain,
	285	+	Labels: labels,
	286	+	AutoRemove: false,
	287	+	RestartPolicy: domain.RestartPolicyAlways,
	288	+	MemoryLimit: cfg.DefaultMemoryLimit,
	289	+	NanoCPUs: cfg.DefaultNanoCPUs,
	290	+	PidsLimit: cfg.DefaultPidsLimit,
290	291		}
291	292		applySecurityProfile(containerConfig, cfg)
292	293		return containerConfig

@@ -654,10 +655,6 @@ func (s *Service) createStartedContainer(ctx context.Context, route domain.Route
654	655		return nil, deployErr
655	656		}
656	657		}
657		-	if err := s.runtime.EnsureContainerRestartPolicy(ctx, newContainer.ID, domain.RestartPolicyAlways); err != nil {
658		-	s.cleanupFailedContainer(ctx, newContainer.ID)
659		-	return nil, log.WrapErr(err, "failed to set container restart policy")
660		-	}
661	658
662	659		inspected, err := s.runtime.InspectContainer(ctx, newContainer.ID)
663	660		if err != nil {

@@ -2646,10 +2643,6 @@ func (s *Service) deployAttachedService(ctx context.Context, ownerDomain, servic
2646	2643		s.runtime.RemoveContainer(ctx, container.ID, true)
2647	2644		return fmt.Errorf("attachment %q not ready: %w", serviceName, err)
2648	2645		}
2649		-	if err := s.ensureAttachmentRestartPolicy(ctx, container.ID); err != nil {
2650		-	return err
2651		-	}
2652		-
2653	2646		// Track attachment
2654	2647		s.mu.Lock()
2655	2648		s.attachments[ownerDomain] = append(s.attachments[ownerDomain], container.ID)

@@ -2702,26 +2695,15 @@ func (s *Service) buildAttachmentContainerConfig(ctx context.Context, ownerDomai
2702	2695		domain.LabelEnvHash: hashEnvironment(envVars),
2703	2696		domain.LabelImage: serviceImage,
2704	2697		},
2705		-	MemoryLimit: cfg.DefaultMemoryLimit,
2706		-	NanoCPUs: cfg.DefaultNanoCPUs,
2707		-	PidsLimit: cfg.DefaultPidsLimit,
	2698	+	MemoryLimit: cfg.DefaultMemoryLimit,
	2699	+	NanoCPUs: cfg.DefaultNanoCPUs,
	2700	+	PidsLimit: cfg.DefaultPidsLimit,
	2701	+	RestartPolicy: domain.RestartPolicyAlways,
2708	2702		}
2709	2703		applySecurityProfile(config, cfg)
2710	2704		return config, nil
2711	2705		}
2712	2706
2713		-	func (s *Service) ensureAttachmentRestartPolicy(ctx context.Context, containerID string) error {
2714		-	log := zerowrap.FromCtx(ctx)
2715		-	if err := s.runtime.EnsureContainerRestartPolicy(ctx, containerID, domain.RestartPolicyAlways); err != nil {
2716		-	if stopErr := s.runtime.StopContainer(ctx, containerID); stopErr != nil {
2717		-	log.Warn().Err(stopErr).Str(zerowrap.FieldEntityID, containerID).Msg("failed to stop attachment after restart policy update failure")
2718		-	}
2719		-	s.runtime.RemoveContainer(ctx, containerID, true)
2720		-	return log.WrapErr(err, "failed to set attachment restart policy")
2721		-	}
2722		-	return nil
2723		-	}
2724		-
2725	2707		func (s *Service) attachmentExposedPorts(ctx context.Context, imageRef string) []int {
2726	2708		log := zerowrap.FromCtx(ctx)
2727	2709		exposedPorts, err := s.runtime.GetImageExposedPorts(ctx, imageRef)

 	}
 	containerConfig := &domain.ContainerConfig{
-		Image:       in.ImageRef,
+		Image:         in.ImageRef,
-		Name:        containerName,
+		Name:          containerName,
-		Ports:       ports,
+		Ports:         ports,
-		Env:         in.EnvVars,
+		Env:           in.EnvVars,
-		Volumes:     in.Volumes,
+		Volumes:       in.Volumes,
-		NetworkMode: in.NetworkName,
+		NetworkMode:   in.NetworkName,
-		Hostname:    in.Domain,
+		Hostname:      in.Domain,
-		Labels:      labels,
+		Labels:        labels,
-		AutoRemove:  false,
+		AutoRemove:    false,
-		MemoryLimit: cfg.DefaultMemoryLimit,
+		RestartPolicy: domain.RestartPolicyAlways,
-		NanoCPUs:    cfg.DefaultNanoCPUs,
+		MemoryLimit:   cfg.DefaultMemoryLimit,
-		PidsLimit:   cfg.DefaultPidsLimit,
+		NanoCPUs:      cfg.DefaultNanoCPUs,
+		PidsLimit:     cfg.DefaultPidsLimit,
 	}
 	applySecurityProfile(containerConfig, cfg)
 	return containerConfig
 			return nil, deployErr
 		}
 	}
-	if err := s.runtime.EnsureContainerRestartPolicy(ctx, newContainer.ID, domain.RestartPolicyAlways); err != nil {
-		s.cleanupFailedContainer(ctx, newContainer.ID)
-		return nil, log.WrapErr(err, "failed to set container restart policy")
-	}
 	inspected, err := s.runtime.InspectContainer(ctx, newContainer.ID)
 	if err != nil {
 		s.runtime.RemoveContainer(ctx, container.ID, true)
 		return fmt.Errorf("attachment %q not ready: %w", serviceName, err)
 	}
-	if err := s.ensureAttachmentRestartPolicy(ctx, container.ID); err != nil {
-		return err
-	}
 	// Track attachment
 	s.mu.Lock()
 	s.attachments[ownerDomain] = append(s.attachments[ownerDomain], container.ID)
 			domain.LabelEnvHash:    hashEnvironment(envVars),
 			domain.LabelImage:      serviceImage,
 		},
-		MemoryLimit: cfg.DefaultMemoryLimit,
+		MemoryLimit:   cfg.DefaultMemoryLimit,
-		NanoCPUs:    cfg.DefaultNanoCPUs,
+		NanoCPUs:      cfg.DefaultNanoCPUs,
-		PidsLimit:   cfg.DefaultPidsLimit,
+		PidsLimit:     cfg.DefaultPidsLimit,
+		RestartPolicy: domain.RestartPolicyAlways,
 	}
 	applySecurityProfile(config, cfg)
 	return config, nil
 }
-func (s *Service) ensureAttachmentRestartPolicy(ctx context.Context, containerID string) error {
-	log := zerowrap.FromCtx(ctx)
-	if err := s.runtime.EnsureContainerRestartPolicy(ctx, containerID, domain.RestartPolicyAlways); err != nil {
-		if stopErr := s.runtime.StopContainer(ctx, containerID); stopErr != nil {
-			log.Warn().Err(stopErr).Str(zerowrap.FieldEntityID, containerID).Msg("failed to stop attachment after restart policy update failure")
-		}
-		s.runtime.RemoveContainer(ctx, containerID, true)
-		return log.WrapErr(err, "failed to set attachment restart policy")
-	}
-	return nil
-}
 func (s *Service) attachmentExposedPorts(ctx context.Context, imageRef string) []int {
 	log := zerowrap.FromCtx(ctx)
 	exposedPorts, err := s.runtime.GetImageExposedPorts(ctx, imageRef)

M internal/usecase/container/service_test.go +3 -47


@@ -57,11 +57,6 @@ func testMinDelayConfig() Config {
57	57		}
58	58		}
59	59
60		-	func allowRestartPolicyEnsure(t testing.T, runtime mocks.MockContainerRuntime) {
61		-	t.Helper()
62		-	runtime.EXPECT().EnsureContainerRestartPolicy(mock.Anything, mock.Anything, domain.RestartPolicyAlways).Return(nil).Maybe()
63		-	}
64		-
65	60		func setupMetricsTest(t testing.T) (telemetry.Metrics, *sdkmetric.ManualReader) {
66	61		t.Helper()
67	62

@@ -382,8 +377,6 @@ func TestService_Deploy_Success(t *testing.T) {
382	377		// Wait for ready: IsContainerRunning (first check returns true) + verify after delay
383	378		runtime.EXPECT().IsContainerRunning(mock.Anything, "container-123").Return(true, nil).Times(2)
384	379
385		-	runtime.EXPECT().EnsureContainerRestartPolicy(mock.Anything, "container-123", domain.RestartPolicyAlways).Return(nil).Once()
386		-
387	380		// Re-inspect after start
388	381		runningContainer := &domain.Container{
389	382		ID: "container-123",

@@ -412,7 +405,6 @@ func TestService_Deploy_Success(t *testing.T) {
412	405
413	406		func TestService_Deploy_ReadinessRecoveryWindow_AllowsTransientFlap(t *testing.T) {
414	407		runtime := mocks.NewMockContainerRuntime(t)
415		-	allowRestartPolicyEnsure(t, runtime)
416	408		envLoader := mocks.NewMockEnvLoader(t)
417	409		eventBus := mocks.NewMockEventPublisher(t)
418	410

@@ -479,7 +471,6 @@ func TestService_Deploy_ReadinessRecoveryWindow_AllowsTransientFlap(t *testing.T
479	471
480	472		func TestService_Deploy_ImagePullFailure(t *testing.T) {
481	473		runtime := mocks.NewMockContainerRuntime(t)
482		-	allowRestartPolicyEnsure(t, runtime)
483	474		envLoader := mocks.NewMockEnvLoader(t)
484	475		eventBus := mocks.NewMockEventPublisher(t)
485	476

@@ -522,7 +513,6 @@ func TestIsPullFailure_ErrImagePullFailed(t *testing.T) {
522	513
523	514		func TestService_Deploy_DoesNotMisclassifyUnauthorizedEnvLoadFailure(t *testing.T) {
524	515		runtime := mocks.NewMockContainerRuntime(t)
525		-	allowRestartPolicyEnsure(t, runtime)
526	516		envLoader := mocks.NewMockEnvLoader(t)
527	517		eventBus := mocks.NewMockEventPublisher(t)
528	518

@@ -563,7 +553,6 @@ func TestService_CaptureRecentContainerLogs_SkipsCanceledContext(t *testing.T) {
563	553
564	554		func TestService_Deploy_ReadinessFailureReturnsDeployFailureWithLogs(t *testing.T) {
565	555		runtime := mocks.NewMockContainerRuntime(t)
566		-	allowRestartPolicyEnsure(t, runtime)
567	556		envLoader := mocks.NewMockEnvLoader(t)
568	557		eventBus := mocks.NewMockEventPublisher(t)
569	558

@@ -623,7 +612,6 @@ func TestService_Deploy_ReadinessFailureReturnsDeployFailureWithLogs(t *testing.
623	612
624	613		func TestService_Deploy_StrictHealthModeWithoutHealthcheckReturnsHint(t *testing.T) {
625	614		runtime := mocks.NewMockContainerRuntime(t)
626		-	allowRestartPolicyEnsure(t, runtime)
627	615		envLoader := mocks.NewMockEnvLoader(t)
628	616		eventBus := mocks.NewMockEventPublisher(t)
629	617

@@ -735,7 +723,6 @@ func TestService_PullImage_InternalRetriesOnConnectionRefused(t *testing.T) {
735	723
736	724		func TestService_Deploy_ReplacesExistingContainer(t *testing.T) {
737	725		runtime := mocks.NewMockContainerRuntime(t)
738		-	allowRestartPolicyEnsure(t, runtime)
739	726		envLoader := mocks.NewMockEnvLoader(t)
740	727		eventBus := mocks.NewMockEventPublisher(t)
741	728		cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)

@@ -819,7 +806,6 @@ func TestService_Deploy_ReplacesExistingContainer(t *testing.T) {
819	806		// from killing the real active container after a Gordon restart.
820	807		func TestService_Deploy_ResolvesExistingFromRuntime_WhenMemoryStale(t *testing.T) {
821	808		runtime := mocks.NewMockContainerRuntime(t)
822		-	allowRestartPolicyEnsure(t, runtime)
823	809		envLoader := mocks.NewMockEnvLoader(t)
824	810		eventBus := mocks.NewMockEventPublisher(t)
825	811		cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)

@@ -919,7 +905,6 @@ func TestService_Deploy_ResolvesExistingFromRuntime_WhenMemoryStale(t *testing.T
919	905
920	906		func TestService_Deploy_SkipRedundantDeploy_GetImageIDError(t *testing.T) {
921	907		runtime := mocks.NewMockContainerRuntime(t)
922		-	allowRestartPolicyEnsure(t, runtime)
923	908		envLoader := mocks.NewMockEnvLoader(t)
924	909		eventBus := mocks.NewMockEventPublisher(t)
925	910

@@ -982,7 +967,6 @@ func TestService_Deploy_SkipRedundantDeploy_GetImageIDError(t *testing.T) {
982	967
983	968		func TestService_Deploy_WithNetworkIsolation(t *testing.T) {
984	969		runtime := mocks.NewMockContainerRuntime(t)
985		-	allowRestartPolicyEnsure(t, runtime)
986	970		envLoader := mocks.NewMockEnvLoader(t)
987	971		eventBus := mocks.NewMockEventPublisher(t)
988	972

@@ -1041,7 +1025,6 @@ func TestService_Deploy_WithNetworkIsolation(t *testing.T) {
1041	1025
1042	1026		func TestService_Deploy_WithVolumeAutoCreate(t *testing.T) {
1043	1027		runtime := mocks.NewMockContainerRuntime(t)
1044		-	allowRestartPolicyEnsure(t, runtime)
1045	1028		envLoader := mocks.NewMockEnvLoader(t)
1046	1029		eventBus := mocks.NewMockEventPublisher(t)
1047	1030

@@ -2055,7 +2038,6 @@ func TestRewriteToLocalRegistry(t *testing.T) {
2055	2038
2056	2039		func TestService_Deploy_InternalDeployForcesPull(t *testing.T) {
2057	2040		runtime := mocks.NewMockContainerRuntime(t)
2058		-	allowRestartPolicyEnsure(t, runtime)
2059	2041		envLoader := mocks.NewMockEnvLoader(t)
2060	2042		eventBus := mocks.NewMockEventPublisher(t)
2061	2043

@@ -2136,7 +2118,6 @@ func TestService_Deploy_InternalDeployForcesPull(t *testing.T) {
2136	2118
2137	2119		func TestService_AutoStart_StartsNewContainers(t *testing.T) {
2138	2120		runtime := mocks.NewMockContainerRuntime(t)
2139		-	allowRestartPolicyEnsure(t, runtime)
2140	2121		envLoader := mocks.NewMockEnvLoader(t)
2141	2122		eventBus := mocks.NewMockEventPublisher(t)
2142	2123

@@ -2186,7 +2167,6 @@ func TestService_AutoStart_StartsNewContainers(t *testing.T) {
2186	2167
2187	2168		func TestService_AutoStart_SkipsExistingContainers(t *testing.T) {
2188	2169		runtime := mocks.NewMockContainerRuntime(t)
2189		-	allowRestartPolicyEnsure(t, runtime)
2190	2170		envLoader := mocks.NewMockEnvLoader(t)
2191	2171		eventBus := mocks.NewMockEventPublisher(t)
2192	2172

@@ -2236,7 +2216,6 @@ func TestService_AutoStart_SkipsExistingContainers(t *testing.T) {
2236	2216
2237	2217		func TestService_AutoStart_HandlesDeployErrors(t *testing.T) {
2238	2218		runtime := mocks.NewMockContainerRuntime(t)
2239		-	allowRestartPolicyEnsure(t, runtime)
2240	2219		envLoader := mocks.NewMockEnvLoader(t)
2241	2220		eventBus := mocks.NewMockEventPublisher(t)
2242	2221

@@ -2265,7 +2244,6 @@ func TestService_AutoStart_HandlesDeployErrors(t *testing.T) {
2265	2244
2266	2245		func TestService_AutoStart_UsesInternalDeployContext(t *testing.T) {
2267	2246		runtime := mocks.NewMockContainerRuntime(t)
2268		-	allowRestartPolicyEnsure(t, runtime)
2269	2247		envLoader := mocks.NewMockEnvLoader(t)
2270	2248		eventBus := mocks.NewMockEventPublisher(t)
2271	2249

@@ -2318,7 +2296,6 @@ func TestService_AutoStart_UsesInternalDeployContext(t *testing.T) {
2318	2296		// until the new container is ready and traffic is switched.
2319	2297		func TestService_Deploy_OrphanCleanupSkipsTrackedContainer(t *testing.T) {
2320	2298		runtime := mocks.NewMockContainerRuntime(t)
2321		-	allowRestartPolicyEnsure(t, runtime)
2322	2299		envLoader := mocks.NewMockEnvLoader(t)
2323	2300		eventBus := mocks.NewMockEventPublisher(t)
2324	2301		cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)

@@ -2415,7 +2392,6 @@ func TestService_Deploy_OrphanCleanupSkipsTrackedContainer(t *testing.T) {
2415	2392		// Running canonical containers are preserved (see NeverKillsRunningCanonical test).
2416	2393		func TestService_Deploy_OrphanCleanupRemovesTrueOrphans(t *testing.T) {
2417	2394		runtime := mocks.NewMockContainerRuntime(t)
2418		-	allowRestartPolicyEnsure(t, runtime)
2419	2395		envLoader := mocks.NewMockEnvLoader(t)
2420	2396		eventBus := mocks.NewMockEventPublisher(t)
2421	2397

@@ -2496,7 +2472,6 @@ func TestService_Deploy_OrphanCleanupRemovesTrueOrphans(t *testing.T) {
2496	2472
2497	2473		func TestService_Deploy_OrphanCleanupRemovesStaleNewContainer(t *testing.T) {
2498	2474		runtime := mocks.NewMockContainerRuntime(t)
2499		-	allowRestartPolicyEnsure(t, runtime)
2500	2475		envLoader := mocks.NewMockEnvLoader(t)
2501	2476		eventBus := mocks.NewMockEventPublisher(t)
2502	2477		cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)

@@ -2569,7 +2544,6 @@ func TestService_Deploy_OrphanCleanupRemovesStaleNewContainer(t *testing.T) {
2569	2544
2570	2545		func TestService_Deploy_TrackedTempContainerUsesAlternateTempName(t *testing.T) {
2571	2546		runtime := mocks.NewMockContainerRuntime(t)
2572		-	allowRestartPolicyEnsure(t, runtime)
2573	2547		envLoader := mocks.NewMockEnvLoader(t)
2574	2548		eventBus := mocks.NewMockEventPublisher(t)
2575	2549		cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)

@@ -2759,7 +2733,6 @@ func TestService_Deploy_ConcurrentSameDomain(t *testing.T) {
2759	2733		// Verify that concurrent Deploy calls for the same domain are serialized
2760	2734		// and both succeed without container name conflicts.
2761	2735		runtime := mocks.NewMockContainerRuntime(t)
2762		-	allowRestartPolicyEnsure(t, runtime)
2763	2736		envLoader := mocks.NewMockEnvLoader(t)
2764	2737		eventBus := mocks.NewMockEventPublisher(t)
2765	2738		cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)

@@ -2870,7 +2843,6 @@ func TestService_Deploy_ConcurrentSameDomain(t *testing.T) {
2870	2843		func TestService_Deploy_ContextCancellation(t *testing.T) {
2871	2844		// Verify that deploy lock acquisition respects context cancellation.
2872	2845		runtime := mocks.NewMockContainerRuntime(t)
2873		-	allowRestartPolicyEnsure(t, runtime)
2874	2846		envLoader := mocks.NewMockEnvLoader(t)
2875	2847		eventBus := mocks.NewMockEventPublisher(t)
2876	2848

@@ -2901,7 +2873,6 @@ func TestService_Deploy_ContextCancellation(t *testing.T) {
2901	2873		// BEFORE the old container is stopped, preventing 503 errors during deployment.
2902	2874		func TestService_Deploy_CacheInvalidationBeforeOldContainerStop(t *testing.T) {
2903	2875		runtime := mocks.NewMockContainerRuntime(t)
2904		-	allowRestartPolicyEnsure(t, runtime)
2905	2876		envLoader := mocks.NewMockEnvLoader(t)
2906	2877		eventBus := mocks.NewMockEventPublisher(t)
2907	2878		cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)

@@ -2982,7 +2953,6 @@ func TestService_Deploy_CacheInvalidationBeforeOldContainerStop(t *testing.T) {
2982	2953		// when no cache invalidator is set (e.g., in tests or minimal configurations).
2983	2954		func TestService_Deploy_NilCacheInvalidator(t *testing.T) {
2984	2955		runtime := mocks.NewMockContainerRuntime(t)
2985		-	allowRestartPolicyEnsure(t, runtime)
2986	2956		envLoader := mocks.NewMockEnvLoader(t)
2987	2957		eventBus := mocks.NewMockEventPublisher(t)
2988	2958

@@ -3032,7 +3002,6 @@ func TestService_Deploy_NilCacheInvalidator(t *testing.T) {
3032	3002
3033	3003		func TestService_Deploy_SkipsRedundantDeploy(t *testing.T) {
3034	3004		runtime := mocks.NewMockContainerRuntime(t)
3035		-	allowRestartPolicyEnsure(t, runtime)
3036	3005		envLoader := mocks.NewMockEnvLoader(t)
3037	3006		eventBus := mocks.NewMockEventPublisher(t)
3038	3007

@@ -3093,7 +3062,6 @@ func TestService_Deploy_SkipsRedundantDeploy(t *testing.T) {
3093	3062
3094	3063		func TestService_Deploy_SkipsRedundantDeploy_WhenTrackedImageIDMissing(t *testing.T) {
3095	3064		runtime := mocks.NewMockContainerRuntime(t)
3096		-	allowRestartPolicyEnsure(t, runtime)
3097	3065		envLoader := mocks.NewMockEnvLoader(t)
3098	3066		eventBus := mocks.NewMockEventPublisher(t)
3099	3067

@@ -3155,7 +3123,6 @@ func TestService_Deploy_SkipsRedundantDeploy_WhenTrackedImageIDMissing(t *testin
3155	3123
3156	3124		func TestService_Deploy_DoesNotSkipWhenImageIDDiffers(t *testing.T) {
3157	3125		runtime := mocks.NewMockContainerRuntime(t)
3158		-	allowRestartPolicyEnsure(t, runtime)
3159	3126		envLoader := mocks.NewMockEnvLoader(t)
3160	3127		eventBus := mocks.NewMockEventPublisher(t)
3161	3128		cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)

@@ -3258,7 +3225,6 @@ func TestSyncContainersRebuildsAttachmentMap(t *testing.T) {
3258	3225
3259	3226		func TestService_Deploy_SkipRedundantDeploy_ContainerNotRunning(t *testing.T) {
3260	3227		runtime := mocks.NewMockContainerRuntime(t)
3261		-	allowRestartPolicyEnsure(t, runtime)
3262	3228		envLoader := mocks.NewMockEnvLoader(t)
3263	3229		eventBus := mocks.NewMockEventPublisher(t)
3264	3230

@@ -3322,7 +3288,6 @@ func TestService_Deploy_SkipRedundantDeploy_ContainerNotRunning(t *testing.T) {
3322	3288
3323	3289		func TestService_Deploy_DoesNotSkip_WhenEnvHashDiffers(t *testing.T) {
3324	3290		runtime := mocks.NewMockContainerRuntime(t)
3325		-	allowRestartPolicyEnsure(t, runtime)
3326	3291		envLoader := mocks.NewMockEnvLoader(t)
3327	3292		eventBus := mocks.NewMockEventPublisher(t)
3328	3293

@@ -3381,7 +3346,6 @@ func TestService_Deploy_DoesNotSkip_WhenEnvHashDiffers(t *testing.T) {
3381	3346
3382	3347		func TestService_Deploy_DoesNotSkip_WhenEnvHashMissing(t *testing.T) {
3383	3348		runtime := mocks.NewMockContainerRuntime(t)
3384		-	allowRestartPolicyEnsure(t, runtime)
3385	3349		envLoader := mocks.NewMockEnvLoader(t)
3386	3350		eventBus := mocks.NewMockEventPublisher(t)
3387	3351

@@ -3508,7 +3472,6 @@ func TestService_attachmentEnvDrifted_ReturnsTrueWhenHashMissing(t *testing.T) {
3508	3472		// disallows creating a container with the same name as an existing running container.
3509	3473		func TestService_Deploy_OrphanCleanup_NeverKillsRunningCanonical(t *testing.T) {
3510	3474		runtime := mocks.NewMockContainerRuntime(t)
3511		-	allowRestartPolicyEnsure(t, runtime)
3512	3475		envLoader := mocks.NewMockEnvLoader(t)
3513	3476		eventBus := mocks.NewMockEventPublisher(t)
3514	3477

@@ -3605,7 +3568,6 @@ func TestService_Deploy_OrphanCleanup_NeverKillsRunningCanonical(t *testing.T) {
3605	3568		// and the failed new container is cleaned up.
3606	3569		func TestService_Deploy_RollbackOnPostSwitchCrash(t *testing.T) {
3607	3570		runtime := mocks.NewMockContainerRuntime(t)
3608		-	allowRestartPolicyEnsure(t, runtime)
3609	3571		envLoader := mocks.NewMockEnvLoader(t)
3610	3572		eventBus := mocks.NewMockEventPublisher(t)
3611	3573		cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)

@@ -3700,7 +3662,6 @@ func TestService_Deploy_RollbackOnPostSwitchCrash(t *testing.T) {
3700	3662		// container is finalized (stopped and removed).
3701	3663		func TestService_Deploy_StabilizationSuccess(t *testing.T) {
3702	3664		runtime := mocks.NewMockContainerRuntime(t)
3703		-	allowRestartPolicyEnsure(t, runtime)
3704	3665		envLoader := mocks.NewMockEnvLoader(t)
3705	3666		eventBus := mocks.NewMockEventPublisher(t)
3706	3667		cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)

@@ -3789,7 +3750,6 @@ func TestService_Deploy_StabilizationSuccess(t *testing.T) {
3789	3750		// Uses testify's NotBefore() to enforce mock call ordering.
3790	3751		func TestService_Deploy_ZeroDowntime_OldNeverStoppedBeforeNewReady(t *testing.T) {
3791	3752		runtime := mocks.NewMockContainerRuntime(t)
3792		-	allowRestartPolicyEnsure(t, runtime)
3793	3753		envLoader := mocks.NewMockEnvLoader(t)
3794	3754		eventBus := mocks.NewMockEventPublisher(t)
3795	3755		cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)

@@ -3886,7 +3846,6 @@ func TestService_Deploy_ZeroDowntime_OldNeverStoppedBeforeNewReady(t *testing.T)
3886	3846		// the old container remains as the tracked container.
3887	3847		func TestService_Deploy_ZeroDowntime_ReadinessFailure_OldUntouched(t *testing.T) {
3888	3848		runtime := mocks.NewMockContainerRuntime(t)
3889		-	allowRestartPolicyEnsure(t, runtime)
3890	3849		envLoader := mocks.NewMockEnvLoader(t)
3891	3850		eventBus := mocks.NewMockEventPublisher(t)
3892	3851

@@ -3977,7 +3936,6 @@ func TestService_Deploy_ZeroDowntime_ReadinessFailure_OldUntouched(t *testing.T)
3977	3936		// finalize/drain logic being triggered.
3978	3937		func TestService_Deploy_ZeroDowntime_NoExisting_FirstDeploy(t *testing.T) {
3979	3938		runtime := mocks.NewMockContainerRuntime(t)
3980		-	allowRestartPolicyEnsure(t, runtime)
3981	3939		envLoader := mocks.NewMockEnvLoader(t)
3982	3940		eventBus := mocks.NewMockEventPublisher(t)
3983	3941

@@ -4054,7 +4012,6 @@ func TestService_Deploy_ZeroDowntime_NoExisting_FirstDeploy(t *testing.T) {
4054	4012
4055	4013		func TestService_Deploy_PropagatesImageLabelsToContainerConfig(t *testing.T) {
4056	4014		runtime := mocks.NewMockContainerRuntime(t)
4057		-	allowRestartPolicyEnsure(t, runtime)
4058	4015		envLoader := mocks.NewMockEnvLoader(t)
4059	4016		eventBus := mocks.NewMockEventPublisher(t)
4060	4017

@@ -4312,7 +4269,7 @@ func TestDeployAttachedService_SetsAliasOnContainerConfig(t *testing.T) {
4312	4269		assert.Equal(t, []string{"postgres"}, cfg.Aliases, "attachment container must have network aliases for DNS resolution")
4313	4270		assert.Equal(t, "postgres", cfg.Hostname)
4314	4271		assert.Equal(t, networkName, cfg.NetworkMode)
4315		-	assert.Empty(t, cfg.RestartPolicy)
	4272	+	assert.Equal(t, domain.RestartPolicyAlways, cfg.RestartPolicy)
4316	4273		}).
4317	4274		Return(&domain.Container{ID: "pg-container-1", Name: containerName}, nil)
4318	4275

@@ -4325,7 +4282,6 @@ func TestDeployAttachedService_SetsAliasOnContainerConfig(t *testing.T) {
4325	4282		runtime.EXPECT().GetContainerHealthStatus(mock.Anything, "pg-container-1").Return("", false, nil)
4326	4283		// TCP probe: resolve endpoint fails -> falls back to delay
4327	4284		runtime.EXPECT().GetContainerNetworkInfo(mock.Anything, "pg-container-1").Return("", 0, errors.New("no network"))
4328		-	runtime.EXPECT().EnsureContainerRestartPolicy(mock.Anything, "pg-container-1", domain.RestartPolicyAlways).Return(nil).Once()
4329	4285
4330	4286		err := svc.deployAttachedService(ctx, ownerDomain, serviceImage, networkName)
4331	4287		require.NoError(t, err)

@@ -4451,10 +4407,10 @@ func TestService_BuildContainerConfig_CompatSecurityProfileDefault(t *testing.T)
4451	4407		assert.Nil(t, cfg.CapAdd)
4452	4408		}
4453	4409
4454		-	func TestService_BuildContainerConfig_OmitsRestartPolicyBeforeReadiness(t *testing.T) {
	4410	+	func TestService_BuildContainerConfig_SetsRestartPolicyAlways(t *testing.T) {
4455	4411		svc := NewService(nil, nil, nil, nil, Config{}, nil)
4456	4412
4457	4413		cfg := svc.buildContainerConfig(containerConfigInput{Domain: "app.example.com", Image: "app:latest", ImageRef: "app:latest"})
4458	4414
4459		-	assert.Empty(t, cfg.RestartPolicy)
	4415	+	assert.Equal(t, domain.RestartPolicyAlways, cfg.RestartPolicy)
4460	4416		}

 	}
 }
-func allowRestartPolicyEnsure(t *testing.T, runtime *mocks.MockContainerRuntime) {
-	t.Helper()
-	runtime.EXPECT().EnsureContainerRestartPolicy(mock.Anything, mock.Anything, domain.RestartPolicyAlways).Return(nil).Maybe()
-}
 func setupMetricsTest(t *testing.T) (*telemetry.Metrics, *sdkmetric.ManualReader) {
 	t.Helper()
 	// Wait for ready: IsContainerRunning (first check returns true) + verify after delay
 	runtime.EXPECT().IsContainerRunning(mock.Anything, "container-123").Return(true, nil).Times(2)
-	runtime.EXPECT().EnsureContainerRestartPolicy(mock.Anything, "container-123", domain.RestartPolicyAlways).Return(nil).Once()
 	// Re-inspect after start
 	runningContainer := &domain.Container{
 		ID:     "container-123",
 func TestService_Deploy_ReadinessRecoveryWindow_AllowsTransientFlap(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 func TestService_Deploy_ImagePullFailure(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 func TestService_Deploy_DoesNotMisclassifyUnauthorizedEnvLoadFailure(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 func TestService_Deploy_ReadinessFailureReturnsDeployFailureWithLogs(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 func TestService_Deploy_StrictHealthModeWithoutHealthcheckReturnsHint(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 func TestService_Deploy_ReplacesExistingContainer(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 	cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)
 // from killing the real active container after a Gordon restart.
 func TestService_Deploy_ResolvesExistingFromRuntime_WhenMemoryStale(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 	cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)
 func TestService_Deploy_SkipRedundantDeploy_GetImageIDError(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 func TestService_Deploy_WithNetworkIsolation(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 func TestService_Deploy_WithVolumeAutoCreate(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 func TestService_Deploy_InternalDeployForcesPull(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 func TestService_AutoStart_StartsNewContainers(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 func TestService_AutoStart_SkipsExistingContainers(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 func TestService_AutoStart_HandlesDeployErrors(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 func TestService_AutoStart_UsesInternalDeployContext(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 // until the new container is ready and traffic is switched.
 func TestService_Deploy_OrphanCleanupSkipsTrackedContainer(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 	cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)
 // Running canonical containers are preserved (see NeverKillsRunningCanonical test).
 func TestService_Deploy_OrphanCleanupRemovesTrueOrphans(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 func TestService_Deploy_OrphanCleanupRemovesStaleNewContainer(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 	cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)
 func TestService_Deploy_TrackedTempContainerUsesAlternateTempName(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 	cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)
 	// Verify that concurrent Deploy calls for the same domain are serialized
 	// and both succeed without container name conflicts.
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 	cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)
 func TestService_Deploy_ContextCancellation(t *testing.T) {
 	// Verify that deploy lock acquisition respects context cancellation.
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 // BEFORE the old container is stopped, preventing 503 errors during deployment.
 func TestService_Deploy_CacheInvalidationBeforeOldContainerStop(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 	cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)
 // when no cache invalidator is set (e.g., in tests or minimal configurations).
 func TestService_Deploy_NilCacheInvalidator(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 func TestService_Deploy_SkipsRedundantDeploy(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 func TestService_Deploy_SkipsRedundantDeploy_WhenTrackedImageIDMissing(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 func TestService_Deploy_DoesNotSkipWhenImageIDDiffers(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 	cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)
 func TestService_Deploy_SkipRedundantDeploy_ContainerNotRunning(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 func TestService_Deploy_DoesNotSkip_WhenEnvHashDiffers(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 func TestService_Deploy_DoesNotSkip_WhenEnvHashMissing(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 // disallows creating a container with the same name as an existing running container.
 func TestService_Deploy_OrphanCleanup_NeverKillsRunningCanonical(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 // and the failed new container is cleaned up.
 func TestService_Deploy_RollbackOnPostSwitchCrash(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 	cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)
 // container is finalized (stopped and removed).
 func TestService_Deploy_StabilizationSuccess(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 	cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)
 // Uses testify's NotBefore() to enforce mock call ordering.
 func TestService_Deploy_ZeroDowntime_OldNeverStoppedBeforeNewReady(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 	cacheInvalidator := mocks.NewMockProxyCacheInvalidator(t)
 // the old container remains as the tracked container.
 func TestService_Deploy_ZeroDowntime_ReadinessFailure_OldUntouched(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 // finalize/drain logic being triggered.
 func TestService_Deploy_ZeroDowntime_NoExisting_FirstDeploy(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 func TestService_Deploy_PropagatesImageLabelsToContainerConfig(t *testing.T) {
 	runtime := mocks.NewMockContainerRuntime(t)
-	allowRestartPolicyEnsure(t, runtime)
 	envLoader := mocks.NewMockEnvLoader(t)
 	eventBus := mocks.NewMockEventPublisher(t)
 			assert.Equal(t, []string{"postgres"}, cfg.Aliases, "attachment container must have network aliases for DNS resolution")
 			assert.Equal(t, "postgres", cfg.Hostname)
 			assert.Equal(t, networkName, cfg.NetworkMode)
-			assert.Empty(t, cfg.RestartPolicy)
+			assert.Equal(t, domain.RestartPolicyAlways, cfg.RestartPolicy)
 		}).
 		Return(&domain.Container{ID: "pg-container-1", Name: containerName}, nil)
 	runtime.EXPECT().GetContainerHealthStatus(mock.Anything, "pg-container-1").Return("", false, nil)
 	// TCP probe: resolve endpoint fails -> falls back to delay
 	runtime.EXPECT().GetContainerNetworkInfo(mock.Anything, "pg-container-1").Return("", 0, errors.New("no network"))
-	runtime.EXPECT().EnsureContainerRestartPolicy(mock.Anything, "pg-container-1", domain.RestartPolicyAlways).Return(nil).Once()
 	err := svc.deployAttachedService(ctx, ownerDomain, serviceImage, networkName)
 	require.NoError(t, err)
 	assert.Nil(t, cfg.CapAdd)
 }
-func TestService_BuildContainerConfig_OmitsRestartPolicyBeforeReadiness(t *testing.T) {
+func TestService_BuildContainerConfig_SetsRestartPolicyAlways(t *testing.T) {
 	svc := NewService(nil, nil, nil, nil, Config{}, nil)
 	cfg := svc.buildContainerConfig(containerConfigInput{Domain: "app.example.com", Image: "app:latest", ImageRef: "app:latest"})
-	assert.Empty(t, cfg.RestartPolicy)
+	assert.Equal(t, domain.RestartPolicyAlways, cfg.RestartPolicy)
 }