If beta.27 left you unable to self-update, this one collects you. Nothing to do: your next update lands here, and the one after that puts your container back on the normal entrypoint.
Same fix as v2.17.12.
Fixed
A container created by beta.27 could not self-update at all. It asks the next image for /sbin/tini, which beta.28 took back out, so the recreate failed on exec: "/sbin/tini": no such file or directory and rolled back — every time, forever. Both testers hit it on every host they run.
The image carries a small compatibility shim at that path now: with no arguments it starts Docksentry, which is exactly what the broken recreate is asking for.
And those containers then find their way back on their own. The self-update now forgets that pinned path when the target image does not ask for it — one ordinary update and the container is back to python3 /app/main.py, with nobody doing anything.
The failure message now says what to do instead of quoting Docker at you.
Verified
Against the published 2.17.9 and 2.17.10 images with real named volumes: eleven state files bit-identical, all ten settings read back, restart policy, label, environment and mounts unchanged, zero restarts — at both hops of 2.17.10 → shim → normal entrypoint.
Still open
The ssh process leak. Fixing it by changing the entrypoint is what started this whole sequence, so it will be fixed from inside the process instead.