fix: [sc-109762] Isolate the Linux auto-update helper from its own systemd cgroup - #104
Merged
mlataza merged 2 commits intoAug 20, 2026
Merged
Conversation
…stemd cgroup The --update helper inherited the running service's cgroup, so calling systemctl stop on its own unit let KillMode=control-group kill the helper along with the service before it could restart it, leaving the endpoint offline with no auto-recovery. The helper now runs in its own transient systemd scope (systemd-run --scope) so it survives the stop. Adds integration-test coverage that asserts the helper actually logs a restart, the service is active, and it resubscribes after a Linux auto-update, closing a gap where the existing check could pass even when the helper never restarted anything.
Remove an unused helper left over from an earlier edit and reformat a call site golines flagged. The Linux build tag meant a local darwin lint run never analyzed this file; only GOOS=linux (as CI's ubuntu-latest job runs natively) caught it.
mlataza
deleted the
bug/sc-109762/linux-auto-update-leaves-the-agent-service
branch
August 20, 2026 23:38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--updatehelper inherited the running service's systemd cgroup. Callingsvc.Stop()(systemctl stop <unit>) let the defaultKillMode=control-groupkill the helper along with the service it just stopped, before it could replace the binary or callsvc.Start()— leaving the endpoint offline with no automatic recovery (client report, v1.5.1→v1.5.2).systemd-run --scope --collect,cmd/agent_smith/run_command_linux.go) so it's never a member of the unit's cgroup and survives the stop. macOS is unaffected/unchanged (launchd kills by BSD process group, not cgroup) and was split into its own file (run_command_darwin.go)..github/actions/verify-auto-update: it only checked for "Updating agent" and that the last "Agent Smith started" line wasn't the IT version — but that line is the helper's own startup banner, logged before it stops the old service, so it already named the new version even when the helper was killed moments later and never restarted anything. Added baseline/delta assertions tointegration-test.yml(helper's own "Service started" line, service-manager active check, fresh MQTT subscription, and a real post-update command round-trip) across all three platforms.Test plan
go build/go vet/go test ./...on linux, darwin, and windows GOOS targetsgolangci-lint run ./...cleanactionlintclean on the modified workflowintegration-test.ymlon this branch withos=all— run 32398088409, green on all three platforms, headSha matches branch HEAD