* fix(compose): strip and resolve pre-deploy hook secrets like service env (fixes#422)
normaliseContainerForStore only cleared Config.Env and
ServiceSpec.Container.Env before writing a container record to the
replicated Corrosion store, leaving ServiceSpec.PreDeploy.Env in place.
A secret set via x-pre_deploy.environment therefore replicated to
every machine in the cluster, unlike the same value set via
environment.
ResolveSecrets had the same asymmetry in the other direction: it only
resolved secret://name references in service.Environment, so a
reference placed in the pre-deploy hook's environment passed through
unresolved as a literal string. HasCommandSecretRefs is extended the
same way for consistency.
Add tests pinning both behaviours.
* update docs that secret references are available for pre-deploy hooks
---------
Co-authored-by: Pasha Sviderski <me@psviderski.name>
* fix(store): debounce container change notifications to avoid reconcile storms
SubscribeContainers forwarded every raw row-level change event from
Corrosion as its own signal, with no coalescing. Each signal triggers
a full reconcile (ListContainers + regenerate) in every independent
subscriber (caddy-controller, DNS resolver) on every machine in the
cluster. With enough container/health-check churn across services,
this produces a sustained stream of events (observed ~1.6-1.7/sec
cluster-wide on a 45-service, 7-machine cluster) and burns meaningful
CPU on every machine continuously, regardless of whether that machine
runs Caddy locally. On a resource-constrained node this escalated into
kernel RCU stall warnings and a full freeze.
Coalesce bursts of events into a single signal per debounce window
instead of forwarding one per event.
* bound debounced changes by the window
---------
Co-authored-by: Pasha Sviderski <me@psviderski.name>
