Porting queue hardening: rootless/runtime fixes and strict TCP/HTTP health checks for passing containers

porting/queues/passing/daapd/Dockerfile

@@ -84,13 +84,16 @@ RUN \
   echo "**** install runtime packages ****" && \
   apt-get update && \
   apt-get install -y --no-install-recommends \
+    libavahi-client3 \
+    libavahi-common3 \
     avahi-daemon \
     libconfuse2 \
     dbus \
     ffmpeg \
     libgnutls30 \
     libjson-c5 \
     libevent-2.1-7t64 \
+    libevent-pthreads-2.1-7t64 \
     libgcrypt20 \
     libplist-2.0-4 \
     libsodium23 \

porting/queues/passing/daapd/SWEEP_STATUS.md

@@ -0,0 +1,43 @@
+# Sweep Status
+
+- Timestamp (UTC): 2026-02-19T14:03:26Z
+- Build: ok
+- Forgetool test: fail
+- Run status: not running
+- Timeout for build/test: 120 seconds
+- Forgetool path: /tmp/forgetool-bin/forgetool
+
+## Last test log tail
+```
+
+
+
+  _______              ______                   
+ |__   __|            |  ____|                  
+    | |_ __ _   _  ___| |__ ___  _ __ __ _  ___ 
+    | | '__| | | |/ _ \  __/ _ \| '__/ _` |/ _ \
+    | | |  | |_| |  __/ | | (_) | | | (_| |  __/
+    |_|_|   \__,_|\___|_|  \___/|_|  \__, |\___|
+                                      __/ |     
+        ____                ______   |___/  __      
+       / __/__  _______ ___/_  __/__  ___  / /
+      / _// _ \/ __/ _ `/ -_) / / _ \/ _ \/ / 
+     /_/  \___/_/  \_, /\__/_/  \___/\___/_/  
+                  /___/                       
+
+
+---
+Forgetool Version: dev
+---
+2026-02-19T14:03:24Z WRN Failed to cache cluster-template release; verify FORGETOOL_CLUSTER_TEMPLATE_VERSION is a valid release tag or check network connectivity to GitHub error="unexpected status for latest release: 403 Forbidden"
+2026-02-19T14:03:24Z INF Checking if System Time is correct...
+2026-02-19T14:03:24Z INF Failed to get NTP time: lookup pool.ntp.org on 127.0.0.53:53: server misbehaving
+2026-02-19T14:03:24Z INF Cluster name: main
+
+14:03:24 ℹ️ [INFO] 🧪 Wait checks: image=daapd:28.10 http=0 tcp=1
+14:03:24 ℹ️ [INFO] Wait checks container config: env=none
+14:03:24 ℹ️ [INFO] 🚀 Starting container: image=daapd:28.10 customizers=2
+14:03:26 ❌ [ERROR] Container start failed for image=daapd:28.10: generic container: start container: started hook: wait until ready: internal check: container exited with code 1
+check failed: generic container: start container: started hook: wait until ready: internal check: container exited with code 1
+2026-02-19T14:03:26Z FTL Failed to execute command error="check failed: generic container: start container: started hook: wait until ready: internal check: container exited with code 1"
+```

porting/queues/passing/daapd/start.sh

@@ -3,68 +3,26 @@
 
 # make our folders
 mkdir -p \
-    /var/run/dbus \
-    /run/dbus \
-    /config/dbase_and_logs \
-    /daapd-pidfolder
+    /config/dbase_and_logs
 
-
-if [[ -e /var/run/dbus.pid ]]; then
-    rm -f /var/run/dbus.pid
-fi
-
-if [[ -e /run/dbus/dbus.pid ]]; then
-    rm -f /run/dbus/dbus.pid
-fi
-
-dbus-uuidgen --ensure
-sleep 1
-
-# configure defaults copy of conf
-if [[ ! -e "/defaults/owntone.conf" ]]; then
-cp /etc/owntone.conf.orig /defaults/owntone.conf
-sed -i \
-    -e '/cache_path\ =/ s/# *//' \
-    -e '/db_path\ =/ s/# *//' \
-    -e s#ipv6\ =\ yes#ipv6\ =\ no#g \
-    -e s#My\ Music\ on\ %h#LS.IO\ Music#g \
-    -e s#/srv/music#/music#g \
-    -e 's/\(uid.*=\).*/\1 \"apps\"/g' \
-    -e s#/var/cache/owntone/cache.db#/config/dbase_and_logs/cache.db#g \
-    -e s#/var/cache/owntone/songs3.db#/config/dbase_and_logs/songs3.db#g \
-    -e s#/var/log/owntone.log#/config/dbase_and_logs/owntone.log#g \
-    -e '/trusted_networks\ =/ s/# *//' \
-    -e 's#trusted_networks = {.*#trusted_networks = { "lan" }#' \
-    -e '/admin_password\ =/ s/# *//' \
-    -e 's#admin_password = .*#admin_password = "changeme"#' \
-    /defaults/owntone.conf
-fi
-
-# symlink conf to /conf
 if [[ ! -f /config/owntone.conf ]]; then
-    cp /defaults/owntone.conf /config/owntone.conf
+    cp /etc/owntone.conf.orig /config/owntone.conf
+    sed -i \
+        -e '/cache_path\ =/ s/# *//' \
+        -e '/db_path\ =/ s/# *//' \
+        -e s#ipv6\ =\ yes#ipv6\ =\ no#g \
+        -e s#My\ Music\ on\ %h#LS.IO\ Music#g \
+        -e s#/srv/music#/music#g \
+        -e 's/\(uid.*=\).*/\1 \"apps\"/g' \
+        -e s#/var/cache/owntone/cache.db#/config/dbase_and_logs/cache.db#g \
+        -e s#/var/cache/owntone/songs3.db#/config/dbase_and_logs/songs3.db#g \
+        -e s#/var/log/owntone.log#/config/dbase_and_logs/owntone.log#g \
+        -e '/trusted_networks\ =/ s/# *//' \
+        -e 's#trusted_networks = {.*#trusted_networks = { "lan" }#' \
+        -e '/admin_password\ =/ s/# *//' \
+        -e 's#admin_password = .*#admin_password = "changeme"#' \
+        /config/owntone.conf
 fi
 
-if [[ ! -L /etc/owntone.conf && -f /etc/owntone.conf ]]; then
-    rm /etc/owntone.conf
-fi
-
-if [[ ! -L /etc/owntone.conf ]]; then
-    ln -s /config/owntone.conf /etc/owntone.conf
-fi
-
-until [[ -e /var/run/dbus/system_bus_socket ]]; do
-    sleep 1s
-done
-
-## TODO: we need to deal differently with multi-exec or not include this container
-## AVAHI in docker is an issue
-exec avahi-daemon --no-chroot
-
-exec dbus-daemon --system --nofork
-
-exec /usr/sbin/owntone -f \
-    -P /daapd-pidfolder/owntone.pid
-
-exed librespot --backend pipe --device /music/spotify -n forked-daapd --cache /tmp
-
+exec /usr/sbin/owntone -f -c /config/owntone.conf -P /config/owntone.pid \
+    --mdns-no-rsp --mdns-no-daap --mdns-no-cname --mdns-no-web

porting/queues/passing/limnoria/Dockerfile

@@ -22,9 +22,9 @@ RUN \
     /app/venv/bin/pip install -U --no-cache-dir \
         pip \
         wheel && \
-    /app/venv/bin/pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/ubuntu/ \
+    /app/venv/bin/pip install -U --no-cache-dir \
         -r https://raw.githubusercontent.com/ProgVal/Limnoria/master/requirements.txt && \
-    /app/venv/bin/pip install -U --no-cache-dir --find-links https://wheel-index.linuxserver.io/ubuntu/ \
+    /app/venv/bin/pip install -U --no-cache-dir \
         limnoria=="${VERSION}" && \
     echo "**** cleanup ****" && \
     apt-get purge -y --auto-remove \

porting/queues/passing/limnoria/SWEEP_STATUS.md

@@ -0,0 +1,43 @@
+# Sweep Status
+
+- Timestamp (UTC): 2026-02-20T13:26:29Z
+- Build: ok
+- Forgetool test: fail
+- Run status: not running
+- Timeout for build/test: 300/180 seconds
+- Forgetool path: /tmp/forgetool-bin/forgetool
+
+## Last test log tail
+```
+
+
+
+  _______              ______                   
+ |__   __|            |  ____|                  
+    | |_ __ _   _  ___| |__ ___  _ __ __ _  ___ 
+    | | '__| | | |/ _ \  __/ _ \| '__/ _` |/ _ \
+    | | |  | |_| |  __/ | | (_) | | | (_| |  __/
+    |_|_|   \__,_|\___|_|  \___/|_|  \__, |\___|
+                                      __/ |     
+        ____                ______   |___/  __      
+       / __/__  _______ ___/_  __/__  ___  / /
+      / _// _ \/ __/ _ `/ -_) / / _ \/ _ \/ / 
+     /_/  \___/_/  \_, /\__/_/  \___/\___/_/  
+                  /___/                       
+
+
+---
+Forgetool Version: dev
+---
+2026-02-20T13:25:28Z WRN Failed to cache cluster-template release; verify FORGETOOL_CLUSTER_TEMPLATE_VERSION is a valid release tag or check network connectivity to GitHub error="unexpected status for latest release: 403 Forbidden"
+2026-02-20T13:25:28Z INF Checking if System Time is correct...
+2026-02-20T13:25:28Z INF Failed to get NTP time: lookup pool.ntp.org on 127.0.0.53:53: server misbehaving
+2026-02-20T13:25:28Z INF Cluster name: main
+
+13:25:28 ℹ️ [INFO] 🧪 Wait checks: image=limnoria:2025.11.2 http=0 tcp=1
+13:25:28 ℹ️ [INFO] Wait checks container config: env=none
+13:25:28 ℹ️ [INFO] 🚀 Starting container: image=limnoria:2025.11.2 customizers=2
+13:26:29 ❌ [ERROR] Container start failed for image=limnoria:2025.11.2: generic container: start container: started hook: wait until ready: internal check: container exec inspect: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.48/exec/ee7a04cb96c073c784520f97ea6ace76d34aa464bc25d8bcf5ea1eda68070f32/json": context deadline exceeded, host port waiting failed
+check failed: generic container: start container: started hook: wait until ready: internal check: container exec inspect: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.48/exec/ee7a04cb96c073c784520f97ea6ace76d34aa464bc25d8bcf5ea1eda68070f32/json": context deadline exceeded, host port waiting failed
+2026-02-20T13:26:29Z FTL Failed to execute command error="check failed: generic container: start container: started hook: wait until ready: internal check: container exec inspect: Get \"http://%2Fvar%2Frun%2Fdocker.sock/v1.48/exec/ee7a04cb96c073c784520f97ea6ace76d34aa464bc25d8bcf5ea1eda68070f32/json\": context deadline exceeded, host port waiting failed"
+```

porting/queues/passing/lychee/SWEEP_STATUS.md

@@ -0,0 +1,43 @@
+# Sweep Status
+
+- Timestamp (UTC): 2026-02-19T14:08:06Z
+- Build: ok
+- Forgetool test: fail
+- Run status: not running
+- Timeout for build/test: 120 seconds
+- Forgetool path: /tmp/forgetool-bin/forgetool
+
+## Last test log tail
+```
+
+
+
+  _______              ______                   
+ |__   __|            |  ____|                  
+    | |_ __ _   _  ___| |__ ___  _ __ __ _  ___ 
+    | | '__| | | |/ _ \  __/ _ \| '__/ _` |/ _ \
+    | | |  | |_| |  __/ | | (_) | | | (_| |  __/
+    |_|_|   \__,_|\___|_|  \___/|_|  \__, |\___|
+                                      __/ |     
+        ____                ______   |___/  __      
+       / __/__  _______ ___/_  __/__  ___  / /
+      / _// _ \/ __/ _ `/ -_) / / _ \/ _ \/ / 
+     /_/  \___/_/  \_, /\__/_/  \___/\___/_/  
+                  /___/                       
+
+
+---
+Forgetool Version: dev
+---
+2026-02-19T14:07:04Z WRN Failed to cache cluster-template release; verify FORGETOOL_CLUSTER_TEMPLATE_VERSION is a valid release tag or check network connectivity to GitHub error="unexpected status for latest release: 403 Forbidden"
+2026-02-19T14:07:04Z INF Checking if System Time is correct...
+2026-02-19T14:07:04Z INF Failed to get NTP time: lookup pool.ntp.org on 127.0.0.53:53: server misbehaving
+2026-02-19T14:07:04Z INF Cluster name: main
+
+14:07:04 ℹ️ [INFO] 🧪 Wait checks: image=lychee:6.10.1 http=0 tcp=1
+14:07:04 ℹ️ [INFO] Wait checks container config: env=none
+14:07:04 ℹ️ [INFO] 🚀 Starting container: image=lychee:6.10.1 customizers=2
+14:08:06 ❌ [ERROR] Container start failed for image=lychee:6.10.1: generic container: start container: started hook: wait until ready: internal check: container exec inspect: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.51/exec/890f40d9a426844ae6f643eaca618d9f38f594103a85082773ac5bb302e6578b/json": context deadline exceeded, host port waiting failed
+check failed: generic container: start container: started hook: wait until ready: internal check: container exec inspect: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.51/exec/890f40d9a426844ae6f643eaca618d9f38f594103a85082773ac5bb302e6578b/json": context deadline exceeded, host port waiting failed
+2026-02-19T14:08:06Z FTL Failed to execute command error="check failed: generic container: start container: started hook: wait until ready: internal check: container exec inspect: Get \"http://%2Fvar%2Frun%2Fdocker.sock/v1.51/exec/890f40d9a426844ae6f643eaca618d9f38f594103a85082773ac5bb302e6578b/json\": context deadline exceeded, host port waiting failed"
+```