Skip to content

Headless systemd: self-update handover kills the whole stack (cgroup) — comment claims it survives #278

Description

@SecureCloudGroup

Audit finding. Under the shipped unit (install-linux.sh: Restart=always, default KillMode=control-group), the launcher's exit at handover kills app+gateway with it — 'the running stack … outlives the handover' (main.go:398-399) is false there. Bookkeeping stays sound (dead pids → records dropped, clean restart brings up the new version), but it is a brief stack outage the code comment denies, and a longer one than needed.

Decide: accept + fix the comment and document the blip; or KillMode=process (children survive, new launcher adopts) with the tradeoffs thought through (orphan risk if the relaunch fails).

Status (re-triaged 2026-08-28)

Narrowed by v0.9.26 (underSystemd now requires the cgroup to name smartbrain.service, so GNOME sessions never take this branch). Still true for real headless units: installer/install-linux.sh writes Restart=always with no KillMode=, so the default control-group kill takes the app and gateway down with the launcher on a self-update; the comment in main.go claiming the stack outlives the handover is false there. Maintainer-side release seam; input welcome on the orphan risk of KillMode=process.

Done means: Either KillMode=process ships with the failed-relaunch orphan case reasoned through, or the comment is corrected and the brief blip is documented in the headless docs.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workinghelp wantedExtra attention is needed

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions