Fix v19 first-boot races, live lockouts, and startup delay - #380
Open
lirazsiri wants to merge 3 commits into
Open
Fix v19 first-boot races, live lockouts, and startup delay#380lirazsiri wants to merge 3 commits into
lirazsiri wants to merge 3 commits into
Conversation
The v19 MySQL helper treated systemd activating state as an inactive service. A first-boot hook racing MariaDB startup would therefore mark the service as self-started and stop it when the helper exited, causing later application hooks such as WordPress initialization to fail. Record the unit state before waiting for startup and only stop MariaDB when the helper actually initiated an inactive service. Build-time temporary startup behavior remains unchanged. Verified with focused active, activating, and inactive state tests, plus a live AWS boot-race reproduction that left MariaDB active and allowed the WordPress hook to complete.
Skip fail2ban when the kernel command line identifies a live ISO session, where a ban cannot provide durable protection and can lock an evaluator out of the appliance. Installed systems continue to run fail2ban, but now allow ten retries within ten minutes and limit a ban to ten minutes. Add focused policy tests for both the live-boot conditions and the installed system thresholds. The fail2ban and MariaDB service-state tests pass together.
lirazsiri
changed the title
Inithooks 2.3.6 waits up to ten seconds before every firstboot hook numbered 30 or later. Because the inithooks service keeps systemd in the starting state, a Hub-launched WordPress appliance spent 150 seconds in repeated waits while its security update hook needed only three seconds. Overlay the upstream wait-once correction into v19 appliance roots until the fixed inithooks package reaches the archive. This applies the acceleration to ISO boots and to cloud images built from those ISOs.
lirazsiri
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This v19 release branch fixes three defects reproduced on the release path:
The startup defect was measured on a Hub-launched WordPress image:
inithooks.servicetook 3 minutes 14 seconds and logged 150 artificial wait seconds, while95secupdatesitself took 3 seconds.Verification:
git diff --checkpass