From 1928b0a3f328c83e67c75a7151df9ffea0d431a3 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 15 May 2026 07:49:42 +0000
Subject: [PATCH] fix: ensure mastercontainer is updated before sibling
 containers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When watchtower updates the mastercontainer there is a Docker stop grace
period during which the old mastercontainer's daily-backup.sh can still
execute StartAndUpdateContainers.php.  That old PHP process uses the old
containers.json (which lacks AIO_LOG_LEVEL) while the freshly pulled
sibling images already require that variable — causing redis/postgres to
fail with an empty log-level.

Add a guard in startTopContainer(): when pullImage=true, check
IsMastercontainerUpdateAvailable().  During the grace period the old
container's image digest still differs from the remote digest, so the
check returns true and the function returns early.  The new mastercontainer
will re-run the full update with the correct containers.json.

Fixes: https://github.com/nextcloud/all-in-one/issues/8101

Agent-Logs-Url: https://github.com/nextcloud/all-in-one/sessions/cbe966e6-1731-480e-a359-b98d9510844f

Co-authored-by: szaimen <42591237+szaimen@users.noreply.github.com>
---
 php/src/Controller/DockerController.php | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/php/src/Controller/DockerController.php b/php/src/Controller/DockerController.php
index 66e8a3e2..5cd7a332 100644
--- a/php/src/Controller/DockerController.php
+++ b/php/src/Controller/DockerController.php
@@ -258,6 +258,16 @@ readonly class DockerController {
     }
 
     public function startTopContainer(bool $pullImage, ?\Closure $addToStreamingResponseBody = null) : void {
+        if ($pullImage && $this->dockerActionManager->IsMastercontainerUpdateAvailable()) {
+            // The mastercontainer must always be updated before the sibling containers.
+            // If a mastercontainer update is still available at this point it means we are likely
+            // running inside the old mastercontainer during its Docker stop grace period while
+            // watchtower has already started the new mastercontainer. Skip the update here —
+            // the new mastercontainer will re-run this process and perform the update correctly.
+            error_log('Not updating sibling containers because a mastercontainer update is available. The mastercontainer must be updated first.');
+            return;
+        }
+
         $this->configurationManager->aioToken = bin2hex(random_bytes(24));
 
         // Stop domaincheck since apache would not be able to start otherwise