[vpetersson-bot]

Issues Fixed

Fixes #3419.

Description

When the Ansible run's dist-upgrade sets /var/run/reboot-required, bin/upgrade_containers.sh exited before its docker compose up -d. install.sh has already run docker compose down --remove-orphans by then to free RAM for the dist-upgrade, and a removed container is not something restart: always can bring back. So the device was left with no containers at all, this script exited 0, and the installer reported success over a dark screen that rebooting did not fix.

Found from a user whose docker ps came back completely empty after running the installer: https://forums.screenly.io/t/sd-card-completely-full/6778

The check itself was correct when it was written in 2023. Nothing removed the containers then, so skipping the bring-up left them defined and the restart policy recovered them at the next boot. The down --remove-orphans added later in #3172 invalidated that assumption, including the comment in this very file that still described it as holding.

• Move the gate below the up -d and the wifi-connect pre-create, so the stack is running before the script defers to the reboot. Starting it costs nothing: the reboot is moments away and restart: always restores it afterwards.
• Keep it above the stale-image purge, which is the one step there is a reason to defer when the host is half-upgraded and about to go down.
• Correct the stale comment on the low-RAM stop, which claimed the reboot branch exits above the up -d.
• Add tests over the ordering. The script has no unit harness because it drives a real daemon end to end, but the ordering is cheap to assert and is precisely the thing that broke a device.

Verification

Pi 4 testbed on latest-pi4-64, replaying the exact sequence.

Before, on master:

containers after install.sh's down:  0 anthias containers
/var/run/reboot-required:            present
upgrade_containers.sh exit status:   0   (reports success)

anthias containers defined:          0
API -> 000

After, same sequence with this branch:

upgrade_containers.sh exit status:   0

anthias-anthias-viewer-1   Up 18 seconds
anthias-anthias-celery-1   Up 18 seconds
anthias-anthias-server-1   Up 19 seconds
anthias-redis-1            Up 25 seconds (healthy)
API -> 200

The purge was correctly skipped on the reboot path. Testbed restored to baseline afterwards and its lock released.

The new tests fail against master with the /var/run/reboot-required exit sits above the 'up -d' (line 259 vs 268), so they are not passing vacuously. shellcheck output is byte-identical to master's, 13 findings either side, all pre-existing.

Note for whoever merges

This touches bin/upgrade_containers.sh, as does the still-open #3415. The two edit different regions (that one the pull failure path, this one the reboot gate) but they are close enough that the second to merge may want a trivial rebase.

Checklist

• I have performed a self-review of my own code.
• New and existing unit tests pass locally and on CI with my changes.
• I have done an end-to-end test for Raspberry Pi devices.
• I have tested my changes for x86 devices.
• I added a documentation for the changes I have made (when necessary).

🤖 Generated with Claude Code

[Copilot]

Copilot encountered an error: Your billing is not configured or you have Copilot licenses from multiple standalone organizations or enterprises. To use premium requests, select a billing entity via the GitHub site, under Settings > Copilot > Features.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud