Audit fixes ahead of v2.19.0. Nothing here is a new feature — it is the
list the pre-release audit turned up, each one reproduced before it was
changed and each one now driven by a procedure that goes red without it.
A damaged settings.json no longer opens the Web UI. Quarantining the
file left the password behind with it and reset the first-run flag, so
the next visitor was handed the setup wizard on an instance that runs as
root on the Docker socket. An empty password now means "open" only on an
instance that never had one; WEB_PASSWORD from the environment is the
way back in. One Latin-1 byte was enough to get there, because
UnicodeDecodeError is neither a JSON error nor an I/O error and escaped
the boot guard outright.
A typo in an environment variable no longer kills the boot.
PULL_TIMEOUT=30m, WEB_PORT= or MONITOR_INTERVAL=1m raised out of
Config.from_env(), which main() calls on its first line with nothing
around it — the container exited with a traceback and restarted into the
same one. All eleven numeric variables are clamped now, and the ranges
the Settings form has always enforced apply to the environment too:
DISK_WARN_PERCENT=200 used to be accepted, and the warning could then
never fire.
A maintenance.json of the wrong shape no longer stops the updates.
null, [], "on" and 5 all parse as valid JSON and all answered
.get with an AttributeError — asked on every scheduler tick, from
eleven call sites across six modules. Both readers now answer "no
maintenance" instead.
A damaged pin list no longer lets updates through. It read back as
"nothing is pinned", so the one thing a pin exists to prevent is what a
broken file caused. It now counts as "everything is pinned", which is the
same reversal ContainerStore made a month ago.
Clicking Update in the Web UI says what happened. The click started a
thread and redirected, and everything the worker had to say went to
Telegram — so on a Telegram-less install, a click during another update
was answered with nothing at all. The page now reports started, busy, or
nothing-to-do.
A refused image lookup is no longer read as "no digests". A
docker-socket-proxy that answers an image lookup by ID with 403 made a
container look locally built, and the update was reported without the
registry ever being consulted — then failed on pull access denied.
Not knowing is a failed check now.
CLEANUP_GRACE_HOURS=0 means no grace. It read int(value or 24),
and 0 is falsy, so the one value that switches the grace off became the
default instead — while the docs promised otherwise and the form accepted
it.
Every file is read and written with an explicit encoding — 45 places,
including the single writer behind sixty call sites. Without it the
decoder follows the process locale, so the same file loads on one host
and raises on another.
Also: the image's own start_period is driven for the first time (the
procedure used to stand in for the function it was checking, so the whole
branch was dead and a healthy container could be rolled back); eight
procedures that could not fail were replaced with ones that can; and
docs/notifications.md no longer names the wrong channels as the ones
that lose a message — the split is between plain-text alerts, which all
nine channels hold, and the two rich update messages, which none of the
eight notification channels do.
Suite: 220 procedures, 5542 named checks. Mutation ratchet: 197 promises,
nothing unguarded.