Skip to content

Komodo periphery stale Docker socket

When dockerd restarts on infra-services, /var/run/docker.sock is a new inode. Containers that already mounted the socket keep the old path and lose Docker API access until they are recreated.

komodo-periphery is the usual victim: deploy-infra still runs, most DeployStackIfChanged calls finish quickly as "no change", but any stack that needs compose pull / compose up fails with:

Cannot connect to the Docker daemon at unix:///var/run/docker.sock.
Is the docker daemon running?

Host docker from SSH still works. Monitoring and other stacks keep running; only Komodo-driven deploys through periphery break.

Seen 2026-08-09: procedure update 6a78e8722a23b18ca11a9b3d failed on monitoring; child DeployStack showed the socket error. Host sock inode dated that morning; periphery still held the inode from 2026-08-01.

Confirm

On infra-services:

# Host OK, periphery broken
docker info >/dev/null && echo host-docker-OK
docker exec komodo-periphery docker info >/dev/null \
  && echo periphery-docker-OK \
  || echo periphery-docker-FAIL

# Stale mount: different inodes / mtimes
stat -c 'host %i %y' /var/run/docker.sock
docker exec komodo-periphery stat -c 'periphery %i %y' /var/run/docker.sock

Host success plus Periphery failure warrants investigation; mismatched socket inodes support the stale-mount diagnosis. Do not recreate containers solely on a connection-error symptom or before the maintenance gates below.

Recover

Use the canonical self-managed Komodo maintenance procedure as an authorized host operator in Bash on infra-services. First obtain the approved window and rollback plan, drain active operations, verify the reviewed checkout, render and database-credential consistency, and confirm Docker/Compose and mounts. A socket repair is not a database/secret reconciliation path; stop if those gates are unresolved.

For a confirmed socket-only fault, use only the Periphery-only command with --no-deps from that procedure. Do not use generic Compose up, which can reconcile Core/Mongo dependencies. Complete its host-side acceptance and then verify:

docker exec komodo-periphery docker info >/dev/null && echo periphery-docker-OK
stat -c '%i' /var/run/docker.sock
docker exec komodo-periphery stat -c '%i' /var/run/docker.sock
# inodes should match

Inspect the failed operation and the relay's persistent pending state before retrying. Use the approved manual workflow with explicit operator review and verify exact terminal Sync/Procedure Updates plus application health. Native GitHub environment reviewer protection is currently absent. Do not bypass the result-aware relay with direct general Procedure/UI invocation or clear pending state merely because Periphery is healthy again. A failed historical Update stays red; a new verified run is separate evidence.

After any Docker daemon restart

Check containers that bind-mount /var/run/docker.sock and were started before the restart; recover affected consumers through their reviewed maintenance procedure, not a blanket recreation. On infra-services that includes at least komodo-periphery (see SEC-017 / CA-015 for the full socket-mount list). A simple docker restart of the container is not enough if the mount still points at the old inode — prefer compose … --force-recreate.