Publish curated Unraid-AppOps-Gateway source from 4e5a8f24881de4bde2ef649d3bf3817715241e9d

backend/tests/test_runner_fleet_specialize.py

@@ -3397,14 +3397,14 @@ def test_specialization_stage_fixture_quiesces_old_before_registering_and_never_
         },
     )
 
-    def ensure_cgroup_family(**kwargs):
-        assert kwargs["allow_existing"] is recovering_cgroup_intent
+    def ensure_cgroup_family(current_journal):
+        assert current_journal["cgroupEnsurePending"] is True
+        assert "compose:runner-dind" in events
         events.append("cgroup-ensured")
-        return not recovering_cgroup_intent
 
     monkeypatch.setattr(
         specialize,
-        "_ensure_cgroup_family",
+        "_bind_owned_dind_family",
         ensure_cgroup_family,
     )
     monkeypatch.setattr(specialize, "_prepare_profile_state", lambda _revision: None)
@@ -3422,6 +3422,8 @@ def test_specialization_stage_fixture_quiesces_old_before_registering_and_never_
     monkeypatch.setattr(specialize, "_run", lambda *_args, **_kwargs: "")
     monkeypatch.setattr(specialize, "_wait_healthy", lambda *_args, **_kwargs: None)
     monkeypatch.setattr(specialize, "_inspect", lambda _name: {"State": {"Running": True}})
+    monkeypatch.setattr(specialize, "_validate_dind_outer", lambda *_args: False)
+    monkeypatch.setattr(specialize, "_is_captured_original_dind", lambda *_args: True)
     monkeypatch.setattr(specialize, "_require_dind_resource_support", lambda _model: None)
     monkeypatch.setattr(specialize, "_captured_compose_mapping", lambda *_args, **_kwargs: {"services": {}})
     monkeypatch.setattr(specialize, "_load_images_into_dind", lambda *_args: None)
@@ -3452,6 +3454,7 @@ def test_specialization_stage_fixture_quiesces_old_before_registering_and_never_
         if current_journal.get("cgroupEnsurePending") is True:
             events.append("cgroup-intent-durable")
         if current_journal.get("cgroupCreated") is True:
+            assert current_journal["stage"] not in {"prepared", "state_prepared", "legacy_removed"}
             events.append("cgroup-result-durable")
         if current_journal.get("status") == "active":
             events.append("journal-active-durable")
@@ -3563,6 +3566,9 @@ def test_specialization_stage_fixture_quiesces_old_before_registering_and_never_
 
     assert maximum_running == 2
     assert events.index("cgroup-intent-durable") < events.index("cgroup-ensured")
+    assert events.index("cgroup-intent-durable") < events.index("compose:runner-dind")
+    assert events.index("compose:runner-dind") < events.index("cgroup-ensured")
+    assert events.index("cgroup-ensured") < events.index("registrations-created")
     assert events.index("cgroup-ensured") < events.index("cgroup-result-durable")
     assert batches == [
         tuple(specialize.PROFILE_IDS[0:2]),
@@ -3578,6 +3584,49 @@ def test_specialization_stage_fixture_quiesces_old_before_registering_and_never_
     assert not running
 
 
+@pytest.mark.parametrize("defect", [None, "resume_same", "resume_wrong_pid", "foreign_cid", "restarted", "foreign_model", "workload", "bad_top", "duplicate_pid", "wrong_pid", "wrong_controls", "helper_refusal", "bad_result"])
+def test_owned_dind_family_binding_requires_fresh_exact_identity(specialize, monkeypatch, defect):
+    cid = "a" * 64
+    state = {"Running": True, "Pid": 1234, "StartedAt": "2026-10-11T00:00:00Z"}
+    before = {"Id": cid, "State": state, "Image": specialize._DIND_IMAGE_ID}
+    after = copy.deepcopy(before)
+    if defect == "foreign_cid":
+        after["Id"] = "b" * 64
+    if defect == "restarted":
+        after["State"]["StartedAt"] = "2026-10-11T00:01:00Z"
+    snapshots = iter([before, after])
+    monkeypatch.setattr(specialize, "_inspect", lambda _name: next(snapshots))
+    monkeypatch.setattr(specialize, "_write_journal", lambda _journal: None)
+    monkeypatch.setattr(specialize, "_captured_compose_mapping", lambda *_args, **_kwargs: {})
+    monkeypatch.setattr(specialize, "_validate_dind_outer", lambda *_args: defect != "foreign_model")
+    monkeypatch.setattr(specialize, "_run_dind_docker", lambda *_args, **_kwargs: cid if defect == "workload" else "")
+    monkeypatch.setattr(specialize, "_run", lambda *_args, **_kwargs: "PID\ninvalid" if defect == "bad_top" else "PID\n1234\n1234" if defect == "duplicate_pid" else "PID\n9999" if defect == "wrong_pid" else "PID\n1234\n1235")
+    calls = []
+    controls = ["cpu", "memory", "pids"]
+
+    def bind(**kwargs):
+        calls.append(kwargs)
+        if defect == "helper_refusal":
+            raise RuntimeError("resource_cgroup_foreign_process")
+        if defect == "bad_result":
+            return None
+        return {"created": False, "rootSubtreeBefore": [] if defect == "wrong_controls" else controls}
+
+    monkeypatch.setattr(specialize, "ensure_owned_dind_cgroup_family", bind)
+    journal = {"cgroupRootSubtree": controls, "cgroupEnsurePending": True, "cgroupFamilyInitiallyPresent": False, "cgroupDindBinding": None}
+    if defect in {"resume_same", "resume_wrong_pid"}:
+        journal["cgroupDindBinding"] = {"containerId": cid, "hostPid": 9999 if defect == "resume_wrong_pid" else 1234, "startedAt": state["StartedAt"], "imageId": specialize._DIND_IMAGE_ID}
+    if defect in {None, "resume_same"}:
+        specialize._bind_owned_dind_family(journal)
+        assert calls == [{"expected_container_id": cid, "expected_host_pid": 1234, "expected_process_ids": [1234, 1235], "allow_owned_partial": defect == "resume_same"}]
+        assert journal["cgroupDindBinding"] == {"containerId": cid, "hostPid": 1234, "startedAt": state["StartedAt"], "imageId": specialize._DIND_IMAGE_ID}
+    else:
+        with pytest.raises(specialize.RunnerFleetSpecializeError):
+            specialize._bind_owned_dind_family(journal)
+        if defect in {"foreign_model", "workload", "bad_top", "duplicate_pid", "wrong_pid", "resume_wrong_pid"}:
+            assert calls == []
+
+
 @pytest.mark.parametrize("original_running", [False, True])
 def test_migration_failure_restores_captured_dind_state_before_cgroup_cleanup(
     specialize, tmp_path, monkeypatch, original_running