Extend stopped-container protection to an explicit lease contract
(org.oblachno.lease-until / org.oblachno.owner) honored by every cleanup
path. Consolidate the duplicated inline prune logic from docker-prune
and the healthcheck into a single tiered runner-cleanup.sh; remove the
unfiltered `system prune -af --volumes` / `volume prune` paths that could
wipe a job's volumes mid-run, and keep warm base images under pressure.
At critical disk usage the healthcheck now stops admitting new work
(stops gitea-runner.service once no CI job is in flight) and resumes it
automatically after recovery. The runner config declares capacity, and
the role refuses to install on production-marked hosts.
`docker images` has no label formatter — check leases via image inspect
per candidate. `label!=` is invalid on volume/network ls but valid on
prune; `until=` is unsupported for volumes — drop it. Expired-lease
volumes/networks are reclaimed by an explicit inspect pass; anonymous
volumes only at routine/pressure, all unused volumes at critical.
emil
dismissed emil's review 2026-09-22 16:48:47 +00:00
Reason:
New commits pushed, approval review dismissed automatically according to repository settings
Issues found: 3 (all auto-fixed during development, verified against a live Docker daemon)
Fixed during review pass:
docker images has no .Label/.Labels formatter — the image lease check now uses docker image inspect per candidate (previous version would have silently pruned nothing).
label!= is invalid on volume ls/network ls but valid on the prune endpoints; until= is unsupported for volume prune (dropped — silent-failure risk).
Expired-lease volumes/networks needed an explicit reclaim pass (reclaim_expired_leases), since label!= protects all leased objects including expired ones.
A valid lease pins its object indefinitely — producers must set bounded lease-until values (consumer-side contract, devx follow-up).
Producer-side lease emission (molecule/CI jobs) is out of scope here; until then guards degrade to the existing name-prefix/age behavior.
Outcome: No blocking issues remain. Awaiting CI before ready-to-merge.
## Deep Review Summary
- **Files reviewed:** 10 (spec, 4 templates, 2 task files, defaults, verify.yml, historical-spec rename)
- **Issues found:** 3 (all auto-fixed during development, verified against a live Docker daemon)
**Fixed during review pass:**
1. `docker images` has no `.Label`/`.Labels` formatter — the image lease check now uses `docker image inspect` per candidate (previous version would have silently pruned nothing).
2. `label!=` is invalid on `volume ls`/`network ls` but valid on the prune endpoints; `until=` is unsupported for `volume prune` (dropped — silent-failure risk).
3. Expired-lease volumes/networks needed an explicit reclaim pass (`reclaim_expired_leases`), since `label!=` protects all leased objects including expired ones.
**Verified:**
- molecule `template-content`: converge + idempotence + verify green (lease labels, tiers, capacity, admission marker assertions)
- `bash -n` + shellcheck on rendered templates
- lint-all + pytest-cov green; PR size 10 files / 495 lines
**Non-blocking notes:**
- A valid lease pins its object indefinitely — producers must set bounded `lease-until` values (consumer-side contract, devx follow-up).
- Producer-side lease emission (molecule/CI jobs) is out of scope here; until then guards degrade to the existing name-prefix/age behavior.
**Outcome:** No blocking issues remain. Awaiting CI before `ready-to-merge`.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
emil
Auto-approved: all CI checks passed (validate, molecule-tests).
New commits pushed, approval review dismissed automatically according to repository settings
Deep Review Summary
Fixed during review pass:
docker imageshas no.Label/.Labelsformatter — the image lease check now usesdocker image inspectper candidate (previous version would have silently pruned nothing).label!=is invalid onvolume ls/network lsbut valid on the prune endpoints;until=is unsupported forvolume prune(dropped — silent-failure risk).reclaim_expired_leases), sincelabel!=protects all leased objects including expired ones.Verified:
template-content: converge + idempotence + verify green (lease labels, tiers, capacity, admission marker assertions)bash -n+ shellcheck on rendered templatesNon-blocking notes:
lease-untilvalues (consumer-side contract, devx follow-up).Outcome: No blocking issues remain. Awaiting CI before
ready-to-merge.Auto-approved: all CI checks passed (validate, molecule-tests).