1. docker events was leaking zombies.
docker_events_loop spawned the child, read its stdout to EOF and returned without
calling wait(). Dropping a Child does not reap it, so every reconnect - which happens
whenever Docker restarts or the stream ends - left a defunct process behind for the
lifetime of the daemon. The reader loop moved into its own function so the wait happens
on every exit path, and the exit status is logged rather than discarded.
2. sysctl status still decided ownership with contains().
The destructive paths were fixed earlier, but inspect_sysctl_tuning kept
first.contains(MANAGED_MARKER) in the disabled branch, so a file whose first line merely
embedded the marker was reported as managed. Diagnostic-only, but it contradicted the
rule the rest of the module follows. Now an exact match on the trimmed first line.
3. Swap was reconciled at the traffic interval.
ensure_swap ran every reconcile_interval_secs, default 15, and each run spawns
swapon --show, sysctl reads, the persistence check and the final verify. A swapfile, its
fstab entry and vm.swappiness change when an operator changes them and at no other time,
so this was process spawning for state that does not drift. Swap now runs on its own
300-second schedule; traffic and firewall keep the configured interval. The startup
reconcile is unchanged, so a fresh daemon still converges immediately.
4. The event log recorded routine success.
Every successful cycle appended a line, and appending means reading the whole file,
rewriting it and truncating. At 15 seconds that is roughly 17k entries a day, and the
entries worth reading were buried among them. Only transitions are written now: a new
failure, a failure whose message changed, and the recovery after one. set_ok and set_err
report whether the state actually changed, which is what makes that possible. journald
still has the full per-cycle picture through the tracing output.
5. Swapfile creation is one command.
mkswap --file <path> --size <N>M creates and formats the file, replacing the
fallocate → dd fallback → chmod → mkswap chain: four processes, three failure branches,
and a window where the file existed but was not yet formatted. util-linux on Debian 13
also handles filesystem-specific requirements - Btrfs in particular - that raw fallocate
does not. fallocate, dd and chmod drop out of the required host tools when swap is
enabled.
cargo test --workspace: 183 + 4 passed. clippy -D warnings clean.
founder
eea787d6f8