deploy: pull missing images before the dry run, list new containers #354

Merged

mysticalsoap merged 2 commits from fix/deploy-pull-before-dry-run into trunk

2026-10-06 22:36:50 -04:00

mysticalsoap commented

2026-10-01 19:49:14 -04:00

Owner

Problem

just deploy --dry-run after merging a Renovate digest bump, before anything pulled the new image (#348):

ERROR: dry run failed for /opt/docker/infra/compose.yml:
 Image postgres:18.6-alpine@sha256:77f58511… Pulled
 Container authelia-postgres Recreate
 Container authelia-postgres Error response from daemon: No such image: postgres:18.6-alpine@sha256:77f58511…

Compose's dry run only pretends to pull, then its simulated recreate asks the daemon for the image and gets nothing. The one case the dry run exists for after a Renovate merge is the one that errors. Reproduced on the live infra stack with an override file pointing authelia-postgres at an existing but unpulled postgres:18.4-alpine digest: same error, same place.

A second gap turned up while testing: compose 5.5 prints Container x Creating for a container that does not exist yet, so the regex's Create branch never matched and a brand-new service was never listed.

Fix

Two commits:

stack_changes runs docker compose pull -q --policy missing --ignore-buildable for each stack before its dry run, next to the existing build -q. --policy missing fetches exactly the images up would and nothing else, so a floating tag is not upgraded behind the deploy's back, and a pull changes no live state. A failed pull is reported like a failed build, with the stack and compose's stderr.
The dry-run regex matches Creating instead of Create, so new containers show as (new).

Maintenance.md's just deploy row mentions the pull.

Verification

Scratch stack with one running container repointed at an unpulled busybox digest and one service added: ['t348-t348-1 (changed)', 't348-t348b-1 (new)'], and the new digest is local afterwards. Before the fix the same stack returned [].
Live infra with the postgres override: the fix's pull step pulls only the one missing image (every other line is Skipped Image is already present locally), then the dry run lists Container authelia-postgres Recreate instead of failing.
just deploy --dry-run on the live tree: No changed stacks to deploy. in 14 s.

Test containers, network and the three pulled images were removed afterwards.

🤖 Generated with Claude Code

## Problem `just deploy --dry-run` after merging a Renovate digest bump, before anything pulled the new image (#348): ``` ERROR: dry run failed for /opt/docker/infra/compose.yml: Image postgres:18.6-alpine@sha256:77f58511… Pulled Container authelia-postgres Recreate Container authelia-postgres Error response from daemon: No such image: postgres:18.6-alpine@sha256:77f58511… ``` Compose's dry run only pretends to pull, then its simulated recreate asks the daemon for the image and gets nothing. The one case the dry run exists for after a Renovate merge is the one that errors. Reproduced on the live infra stack with an override file pointing `authelia-postgres` at an existing but unpulled `postgres:18.4-alpine` digest: same error, same place. A second gap turned up while testing: compose 5.5 prints `Container x Creating` for a container that does not exist yet, so the regex's `Create` branch never matched and a brand-new service was never listed. ## Fix Two commits: - `stack_changes` runs `docker compose pull -q --policy missing --ignore-buildable` for each stack before its dry run, next to the existing `build -q`. `--policy missing` fetches exactly the images `up` would and nothing else, so a floating tag is not upgraded behind the deploy's back, and a pull changes no live state. A failed pull is reported like a failed build, with the stack and compose's stderr. - The dry-run regex matches `Creating` instead of `Create`, so new containers show as `(new)`. Maintenance.md's `just deploy` row mentions the pull. ## Verification - Scratch stack with one running container repointed at an unpulled busybox digest and one service added: `['t348-t348-1 (changed)', 't348-t348b-1 (new)']`, and the new digest is local afterwards. Before the fix the same stack returned `[]`. - Live infra with the postgres override: the fix's pull step pulls only the one missing image (every other line is `Skipped Image is already present locally`), then the dry run lists `Container authelia-postgres Recreate` instead of failing. - `just deploy --dry-run` on the live tree: `No changed stacks to deploy.` in 14 s. Test containers, network and the three pulled images were removed afterwards. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

mysticalsoap added 2 commits

2026-10-01 19:49:14 -04:00

deploy: pull missing images before the dry run 56a98bd86c

Compose's dry run only pretends to pull, so a digest merged from a Renovate
PR that nothing has pulled yet reaches the simulated recreate and fails the
whole stack with "No such image" (#348). Pull with --policy missing first:
the same images `up` would fetch and nothing else, with no change to live
state.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy: list new containers, compose prints Creating not Create

validate / validate (pull_request) Successful in 23s

Details

27a592807f

The dry run reports a container that does not exist yet as "Creating", so
the Create branch never matched and a brand-new service was left out of the
list.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

mysticalsoap merged commit 5e10537823 into trunk

2026-10-06 22:36:50 -04:00

mysticalsoap deleted branch fix/deploy-pull-before-dry-run

2026-10-06 22:36:50 -04:00

mysticalsoap referenced this pull request from a commit

2026-10-06 22:36:50 -04:00

Merge pull request 'deploy: pull missing images before the dry run, list new containers' (#354) from fix/deploy-pull-before-dry-run into trunk