From 91f01ece1bc37eebc1a0238e43823f4ebe822789 Mon Sep 17 00:00:00 2001
From: Donal McBreen <donal@37signals.com>
Date: Thu, 17 Apr 2025 13:31:18 +0100
Subject: [PATCH] Ensure that the restart policy is unless-stopped

No other restart policy makes sense to don't let it be changed.

Fixes: https://github.com/basecamp/kamal/issues/749
---
 lib/kamal/configuration/validator.rb           | 6 ++++++
 lib/kamal/configuration/validator/accessory.rb | 2 ++
 lib/kamal/configuration/validator/role.rb      | 1 +
 test/configuration/accessory_test.rb           | 8 ++++++++
 test/configuration/role_test.rb                | 8 ++++++++
 5 files changed, 25 insertions(+)

diff --git a/lib/kamal/configuration/validator.rb b/lib/kamal/configuration/validator.rb
index 0d46e4ae..e67a4579 100644
--- a/lib/kamal/configuration/validator.rb
+++ b/lib/kamal/configuration/validator.rb
@@ -168,4 +168,10 @@ class Kamal::Configuration::Validator
       unknown_keys.reject! { |key| extension?(key) } if allow_extensions?
       unknown_keys_error unknown_keys if unknown_keys.present?
     end
+
+    def validate_docker_options!(options)
+      if options
+        error "Cannot set restart policy in docker options, unless-stopped is required" if options["restart"]
+      end
+    end
 end
diff --git a/lib/kamal/configuration/validator/accessory.rb b/lib/kamal/configuration/validator/accessory.rb
index 33245e24..8b3d5b71 100644
--- a/lib/kamal/configuration/validator/accessory.rb
+++ b/lib/kamal/configuration/validator/accessory.rb
@@ -5,5 +5,7 @@ class Kamal::Configuration::Validator::Accessory < Kamal::Configuration::Validat
     if (config.keys & [ "host", "hosts", "roles" ]).size != 1
       error "specify one of `host`, `hosts` or `roles`"
     end
+
+    validate_docker_options!(config["options"])
   end
 end
diff --git a/lib/kamal/configuration/validator/role.rb b/lib/kamal/configuration/validator/role.rb
index de7a1969..e631746a 100644
--- a/lib/kamal/configuration/validator/role.rb
+++ b/lib/kamal/configuration/validator/role.rb
@@ -6,6 +6,7 @@ class Kamal::Configuration::Validator::Role < Kamal::Configuration::Validator
       validate_servers!(config)
     else
       super
+      validate_docker_options!(config["options"])
     end
   end
 end
diff --git a/test/configuration/accessory_test.rb b/test/configuration/accessory_test.rb
index fc01dc90..a652c2ac 100644
--- a/test/configuration/accessory_test.rb
+++ b/test/configuration/accessory_test.rb
@@ -187,4 +187,12 @@ class ConfigurationAccessoryTest < ActiveSupport::TestCase
     assert @config.accessory(:monitoring).running_proxy?
     assert_equal [ "monitoring.example.com" ], @config.accessory(:monitoring).proxy.hosts
   end
+
+  test "can't set restart in options" do
+    @deploy[:accessories]["mysql"]["options"] = { "restart" => "always" }
+
+    assert_raises Kamal::ConfigurationError, "servers/workers: Cannot set restart policy in docker options, unless-stopped is required" do
+      Kamal::Configuration.new(@deploy)
+    end
+  end
 end
diff --git a/test/configuration/role_test.rb b/test/configuration/role_test.rb
index c7a94de0..c7b650b7 100644
--- a/test/configuration/role_test.rb
+++ b/test/configuration/role_test.rb
@@ -258,6 +258,14 @@ class ConfigurationRoleTest < ActiveSupport::TestCase
     assert_equal "18s", config_with_roles.role(:workers).proxy.deploy_options[:"target-timeout"]
   end
 
+  test "can't set restart in options" do
+    @deploy_with_roles[:servers]["workers"]["options"] = { "restart" => "always" }
+
+    assert_raises Kamal::ConfigurationError, "servers/workers: Cannot set restart policy in docker options, unless-stopped is required" do
+      Kamal::Configuration.new(@deploy_with_roles)
+    end
+  end
+
   private
     def config
       Kamal::Configuration.new(@deploy)