Skip to content

Conversation

@sethboyles
Copy link
Member

@sethboyles sethboyles commented Jan 26, 2026

This PR fixes two issues with the process syncer:

Docker App LRPs are not deleted from Diego when diego_docker is disabled

This was a feature that was broken in this PR: #3503

Originally, disabling diego_docker was meant to stop all docker apps from being included in the process sync query, resulting them in being removed by the syncer.

This feature is documented here: https://docs.cloudfoundry.org/adminguide/docker.html#feature-flag

Deactivating the diego_docker feature flag stops all Docker-image-based apps in your deployment within a few convergence cycles, on the order of a one minute.

During #3503's performance improvement, this clause was moved out of the main query into the new subquery that happens when fetching processes for updates/desires. This meant the docker processes were never added to the array of LRPs to_delete, although they still were not considered for update/desire syncs.

ensure CNB apps are still synced if diego_docker is disabled

If diego_docker was disabled, then the query selected 'non_docker_type' processes. This queried for Buildpack processes, but excluded CNB processes.

  • I have reviewed the contributing guide

  • I have viewed, signed, and submitted the Contributor License Agreement

  • I have made this pull request to the main branch

  • I have run all the unit tests using bundle exec rake

  • I have run CF Acceptance Tests

unless FeatureFlag.enabled?(:diego_docker)
non_docker_app_guids = BuildpackLifecycleDataModel.select(:app_guid).
union(CNBLifecycleDataModel.select(:app_guid))
processes = processes.where(Sequel.qualify(ProcessModel.table_name, :app_guid) => non_docker_app_guids)
Copy link
Member Author

@sethboyles sethboyles Jan 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure if a this subquery or two left joins like this would be more efficient:

left_join(BuildpackLifecycleDataModel.table_name, app_guid: :app_guid).
left_join(CNBLifecycleDataModel.table_name, app_guid: :app_guid).
)).

* Exclude docker apps from sync if diego_docker is disabled
* ensure CNB apps are still synced if diego_docker is disabled
@sethboyles sethboyles force-pushed the diego_docker_processes_sync_fix branch from 589765e to 87cee50 Compare January 26, 2026 23:17
@philippthun
Copy link
Member

Should we do the same for the feature flag docker_cnb? So that we end up with something like this?

app_guids = if !FeatureFlag.enabled?(:diego_docker) && !FeatureFlag.enabled?(:diego_cnb)
              BuildpackLifecycleDataModel.select(:app_guid)
            elsif !FeatureFlag.enabled?(:diego_docker)
              BuildpackLifecycleDataModel.select(:app_guid).union(CNBLifecycleDataModel.select(:app_guid))
            elsif !FeatureFlag.enabled?(:diego_cnb)
              BuildpackLifecycleDataModel.select(:app_guid).union(DockerLifecycleDataModel.select(:app_guid))
            end

processes = processes.where(Sequel.qualify(ProcessModel.table_name, :app_guid) => app_guids) unless app_guids.nil?

@sethboyles
Copy link
Member Author

Should we do the same for the feature flag docker_cnb? So that we end up with something like this?

I considered that, but figured it would be best to keep this PR limited to restoring the intended behavior.

Another reason I didn't implement that is I wasn't sure of the intent behind the behavior and if we should treat CNBs the same--I believe some platform admins don't want to allow Docker apps for security reasons. Is that also true for CNBs? To me, it seemed like it was more likely we would eventually enable CNBs by default, but again I don't have a lot of context there.

@sethboyles sethboyles merged commit fa1a139 into main Feb 4, 2026
16 of 17 checks passed
ari-wg-gitbot added a commit to cloudfoundry/capi-release that referenced this pull request Feb 4, 2026
Changes in cloud_controller_ng:

- Fix issues with processes_sync:
    PR: cloudfoundry/cloud_controller_ng#4809
    Author: Seth Boyles <seth.boyles@broadcom.com>

- Add buildpack upload audit event
    PR: cloudfoundry/cloud_controller_ng#4791
    Author: Sam Gunaratne <385176+Samze@users.noreply.github.com>
@moleske moleske deleted the diego_docker_processes_sync_fix branch February 4, 2026 23:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants