[gaius-qi]

Description

dfinit now reports whether the container runtime configuration actually changed and creates a sentinel file, /var/run/dragonfly/dfinit/restart-required by default and overridable with --restart-sentinel, only in that case. The restart-container-runtime init container of the Helm chart will restart the runtime only when this sentinel exists and consume it before restarting, so an unchanged runtime is never restarted and the restart can never loop.

• Add dragonfly_client_util::fs::write_if_changed, which skips the write when the contents are identical and returns whether the file was written, modelled on cargo's paths::write_if_changed.
• The containerd, docker, cri-o and podman runners return whether a configuration file the runtime does not reload (config.toml, daemon.json, registries.conf) was rewritten. Writing hosts.toml under an existing containerd registry.config_path never requires a restart.
• ContainerRuntime owns the sentinel path and creates the file when a restart is required, like /run/reboot-required on Debian and the --reboot-sentinel of kured.
• Bump the workspace version to 1.5.10.

Related Issue

Fixes #2115

Related: dragonflyoss/helm-charts#539 reports the same loop on Flatcar with containerd 2.2.5, dragonflyoss/helm-charts#541 proposes systemctl --no-block restart, which narrows the race but does not remove it. The chart change that consumes the sentinel and removes client.dfinit.restartContainerRuntime follows in dragonflyoss/helm-charts.

Motivation and Context

The chart's restart-container-runtime init container restarts containerd unconditionally from inside a container that containerd manages. On Type=simple units such as Azure Linux 3.0 and the Flatcar containerd sysext, systemctl restart returns before the new containerd has reloaded its shims, the init container's shell exits in that window, the new containerd cleans its task up as a leaked shim and records exit code 255, and kubelet re-runs the init container forever, restarting containerd roughly every five minutes.

On AKS, GKE and every other node image that already sets registry.config_path, dfinit only writes hosts.toml, which containerd reloads without a restart, so the restart was never needed there. With this change the decision moves into dfinit: the runtime is restarted only when a file it does not reload was actually rewritten, which for containerd happens once, on the first install of nodes without config_path. As a side effect, cri-o, podman and docker are no longer restarted on every pod start when their generated configuration is unchanged.

Screenshots (if appropriate)

N/A

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 97.24771% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.71%. Comparing base (a553242) to head (8f15338).

Files with missing lines	Patch %	Lines
dragonfly-client-init/src/bin/main.rs	0.00%	2 Missing ⚠️
dragonfly-client-util/src/fs/mod.rs	96.29%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2116      +/-   ##
==========================================
+ Coverage   65.63%   65.71%   +0.07%     
==========================================
  Files         102      102              
  Lines       31141    31231      +90     
==========================================
+ Hits        20439    20522      +83     
- Misses      10702    10709       +7     

Files with missing lines	Coverage Δ
dragonfly-client-config/src/dfinit.rs	97.59% <100.00%> (+0.06%)	⬆️
...ly-client-init/src/container_runtime/containerd.rs	100.00% <100.00%> (ø)
...ragonfly-client-init/src/container_runtime/crio.rs	100.00% <100.00%> (ø)
...gonfly-client-init/src/container_runtime/docker.rs	100.00% <100.00%> (ø)
dragonfly-client-init/src/container_runtime/mod.rs	100.00% <100.00%> (ø)
...gonfly-client-init/src/container_runtime/podman.rs	100.00% <100.00%> (ø)
dragonfly-client-util/src/fs/mod.rs	94.47% <96.29%> (+0.31%)	⬆️
dragonfly-client-init/src/bin/main.rs	0.00% <0.00%> (ø)

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.