ops(ana-docker): docker-ce from bookworm repo (29.8.2); live-restore stale-socket lesson; docs

2026-10-05 13:31:30 -07:00
parent 258a3eea68
commit 5301ede9d2
3 changed files with 11 additions and 0 deletions
@@ -7,6 +7,14 @@ General-purpose Docker host for the Anaheim colo. Runs everything at `10.250.0.0
 - **LAN IP:** 10.250.50.70
 - **FQDN:** `ana-docker.phasefinal.com`
 - **SSH:** standard port 22
+- **Docker CE from the bookworm repo since 2026-10-05** (29.8.2). Until then `/etc/apt/sources.list.d/docker.list` said
+  `bullseye` on this bookworm host. Pre-change copy: `/root/docker.list.pre-bookworm-20261005`.
+- ⚠ **`live-restore: true` + bind-mounted `/var/run/docker.sock` = stale sockets after any engine upgrade WITHOUT a
+  reboot.** Containers keep running through the dockerd restart, but dockerd recreates the socket, so every container that
+  bind-mounts the socket file still points at the old, deleted inode ("Cannot connect to the Docker daemon"). After an
+  engine bump, restart them: crowdsec FIRST, then traefik, dozzle, beszel-agent, dockge, gitea-runner (find them with
+  `docker inspect` Mounts Source=/var/run/docker.sock). Found 2026-10-05 when dozzle went unhealthy and traefik's
+  docker provider stopped seeing changes.
 - **Traefik entrypoints:** 80/443 terminate here; cert resolver `anaprod` (Let's Encrypt)
  - ⚠ **`readTimeout: 10m` on both entrypoints since 2026-10-05.** Traefik v3 defaults it to 60s, which cut every
    request body slower than 60 s. Measured: skaldsong's 2.5 GB registry blob PUTs died at exactly 60.0 s (504, then 499),