Update ghcr.io/finsys/hawser Docker tag to v0.2.53

v0.2.53

Compare Source

Changelog

• bd12829 README: arm archive name, extract only the binary, up has no no-cache, metrics are Edge-only, TLS health check is Standard-only, token header applies when TOKEN is set, REQUEST_TIMEOUT in both modes, INSTALL_DIR, STACKS_DIR on existing installs, OpenRC upgrade; ansible README: PrivateTmp is writable too
• 86db705 README: settings come from env vars (no --port/--server/--token flags), Standard examples carry a TOKEN, units match the installer, upgrading and read-only notes, installer options, working download URL, armv7, compose ops, auth header, token storage
• 9ce9fd6 ansible README: the role creates the stacks directory; which paths the unit leaves writable
• c61ae59 ansible tests: check the service with the systemd module, mark the by-path role import as intended; ansible-lint clean
• 7042fe6 ansible: StartLimitIntervalSec and StartLimitBurst belong in [Unit]; systemd ignored the interval in [Service]
• 60d968e ansible: create the stacks directory and allow it in the unit (ReadOnlyPaths=/ left STACKS_DIR read-only); hawser_stacks_dir variable
• 9c85dcc ansible: set owner and mode only when creating the stacks directory, leave an existing one alone
• 099bd90 compose: a no-cache up runs build --no-cache and then up; docker compose up has no --no-cache
• 247e830 compose: preserve the executable bit when writing stack files
• df57cda compose: the up after a no-cache build keeps --build, so a pull policy cannot replace the fresh image with the registry tag; tests pin the deletion before the build, its report and the merged output
• ac8f3f0 config: a unix:// DOCKER_HOST names the socket, any other DOCKER_HOST is reported as unsupported and no longer skips the socket check; help no longer advertises the no-op standard subcommand
• 86fe1cd config: test that a tcp DOCKER_HOST is kept for the warning; validate comment back above validate()
• 0af8381 install.sh: the systemd unit and the OpenRC wrapper run the binary from INSTALL_DIR, and INSTALL_DIR is created
• b929e17 installer writes the same unit as scripts/hawser.service (journal, resource limits); ansible runs plain hawser; README: units, DOCKER_HOST, no-cache up; health check comment in the generated config

v0.2.52

Compare Source

Private registries and compose builds now work under systemd. The systemd unit's hardening left docker login without a writable config directory and /tmp read-only, so pulls from private registries were unauthorized and docker compose build failed with mkdir /root/.docker: read-only file system. The unit now sets RuntimeDirectory=hawser and points DOCKER_CONFIG and TMPDIR at /run/hawser (tmpfs: logins never reach the disk), and compose now honours DOCKER_CONFIG. A failed registry login is logged as a warning.

systemd users: re-run the installer to get the new unit; swapping only the binary keeps the old unit and the old behaviour:

curl -fsSL -o install.sh https://raw.githubusercontent.com/Finsys/hawser/main/scripts/install.sh
bash install.sh

${TMPDIR} and ${DOCKER_CONFIG} in a compose file now resolve to /run/hawser

Changelog

• 81e529a docker login and compose share one writable config dir: DOCKER_CONFIG and TMPDIR reach compose, systemd units point them at /run/hawser (tmpfs); a failed login is a warning
• dcba146 gofmt deniedEnvKeys alignment
• 0bc320d test that compose gets DOCKER_CONFIG and TMPDIR from Execute; README: ${TMPDIR} and ${DOCKER_CONFIG} in a compose file resolve to /run/hawser