fix: reverse shutdown order — stop ingress before registry backend

Prevents 503 on manifest push during Gordon restart. Previously
registrySrv was shut down first, leaving the proxy alive and forwarding
registry traffic to a dying backend. Now TLS and proxy frontends are
stopped first, then the registry backend drains.

commit: c8b7fd097902c0cd4b310802bcb8d36dabb78743
author: brice · 7mo ago · 2026-03-01 11:01 UTC
committer: brice · 7mo ago · 2026-03-01 11:03 UTC
parent: d786451
signature: unsigned

1 file · +5 -1

M internal/app/run.go +5 -1


@@ -1956,7 +1956,11 @@ func gracefulShutdown(registrySrv, proxySrv, tlsSrv http.Server, containerSvc
1956	1956		shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 30*time.Second)
1957	1957		defer shutdownCancel()
1958	1958
1959		-	for _, srv := range []*http.Server{registrySrv, proxySrv, tlsSrv} {
	1959	+	// Shutdown order matters: stop ingress frontends (TLS, proxy) before the
	1960	+	// registry backend. If the backend stops first, the proxy—still alive—will
	1961	+	// forward registry traffic to a dead backend and return 503 on in-flight
	1962	+	// manifest pushes. Drain order: tlsSrv → proxySrv → registrySrv.
	1963	+	for _, srv := range []*http.Server{tlsSrv, proxySrv, registrySrv} {
1960	1964		if srv == nil {
1961	1965		continue
1962	1966		}

 	shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer shutdownCancel()
-	for _, srv := range []*http.Server{registrySrv, proxySrv, tlsSrv} {
+	// Shutdown order matters: stop ingress frontends (TLS, proxy) before the
+	// registry backend. If the backend stops first, the proxy—still alive—will
+	// forward registry traffic to a dead backend and return 503 on in-flight
+	// manifest pushes. Drain order: tlsSrv → proxySrv → registrySrv.
+	for _, srv := range []*http.Server{tlsSrv, proxySrv, registrySrv} {
 		if srv == nil {
 			continue
 		}