Second deploy attempt died at Failed to restart blackbox-exporter.service: Unit blackbox-exporter.service not found. Root cause: a .container file without Image= is never generated by quadlet - and the shipped unit had no Image= line at all, plus no Network=host despite its own header arguing for it.
blackbox.ymllisten_address: 127.0.0.1:9115 + claimed "gateway reaches loopback" on faith
Exec --listen-address=192.168.0.143:9115,169.254.1.2:9115 - gateway for the scrape (hairpin gap bars Prometheus from its own host LAN IP), LAN for healthcheck; blackbox.yml holds modules only so the sources cannot disagree
comfyui probe target
http://comfyui:8188 (unresolvable in host netns)
http://127.0.0.1:8188 (published 0.0.0.0:8188 answers on loopback)
docs
"loopback bind" claims
real topology on Prometheus/Observability/Provisioning pages
Seam (the class)
New: every observability unit must declare Image= - red on the shipped file by name (blackbox-exporter.container has no Image= - quadlet will not generate it), green after. The eight-unit loops covered persistence/self-healing but never the one key quadlet needs to emit a unit at all.
Verification
./tests/run.sh - ALL TESTS PASSED (twice; final tree)
red proof of the new seam against the shipped unit
Post-merge: rerun the five-service deploy; first boot proves the gateway bind empirically via the services job health.
Second deploy attempt died at `Failed to restart blackbox-exporter.service: Unit blackbox-exporter.service not found.` Root cause: **a `.container` file without `Image=` is never generated by quadlet** - and the shipped unit had no `Image=` line at all, plus no `Network=host` despite its own header arguing for it.
## Fix
| Piece | Before | After |
|---|---|---|
| `[Container] Image` | **absent** -> no generated unit | `docker.io/prom/blackbox-exporter@sha256:ea1c7aa3...` (digest-pinned) |
| `Network=` | absent (comments claimed host netns) | `Network=host` |
| listen bind | `blackbox.yml` `listen_address: 127.0.0.1:9115` + claimed "gateway reaches loopback" on faith | `Exec --listen-address=192.168.0.143:9115,169.254.1.2:9115` - gateway for the scrape (hairpin gap bars Prometheus from its own host LAN IP), LAN for healthcheck; `blackbox.yml` holds modules only so the sources cannot disagree |
| comfyui probe target | `http://comfyui:8188` (unresolvable in host netns) | `http://127.0.0.1:8188` (published `0.0.0.0:8188` answers on loopback) |
| docs | "loopback bind" claims | real topology on Prometheus/Observability/Provisioning pages |
## Seam (the class)
New: **every observability unit must declare `Image=`** - red on the shipped file by name (`blackbox-exporter.container has no Image= - quadlet will not generate it`), green after. The eight-unit loops covered persistence/self-healing but never the one key quadlet needs to emit a unit at all.
## Verification
- `./tests/run.sh` - ALL TESTS PASSED (twice; final tree)
- red proof of the new seam against the shipped unit
Post-merge: rerun the five-service deploy; first boot proves the gateway bind empirically via the `services` job health.
---
cwd: /home/blank/Projects/serverAppConfig · session: 11fbd58f-35a5-413c-a31f-16d87f7a774a
The deploy died at 'Unit blackbox-exporter.service not found': a
.container without Image= is not generated at all, and the header
argued for Network=host it never declared. Completes the unit (digest
pinned prom/blackbox-exporter, Network=host) and fixes the bind
topology the first cut got wrong:
- Prometheus is bridge-networked and the netavark hairpin gap bars it
from its own host's LAN IP, so a LAN-only prober bind is unscrapable
and a loopback-only bind was claimed to ride the gateway on faith.
The prober now binds 9115 on the podman gateway (scrape path) AND
the LAN (healthcheck/diagnostics); the listen_address line leaves
blackbox.yml so config and Exec cannot disagree.
- comfyui probe target http://comfyui:8188 -> http://127.0.0.1:8188:
bridge container names do not resolve in the host netns; the
published 0.0.0.0:8188 answers on loopback there.
- New seam: every observability unit must declare Image= (red on the
shipped file by name); copier test pinned module presence instead
of the removed listen line. Docs updated to the real topology.
dank
merged commit 7de343c171 into main2026-10-21 15:52:30 -07:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Second deploy attempt died at
Failed to restart blackbox-exporter.service: Unit blackbox-exporter.service not found.Root cause: a.containerfile withoutImage=is never generated by quadlet - and the shipped unit had noImage=line at all, plus noNetwork=hostdespite its own header arguing for it.Fix
[Container] Imagedocker.io/prom/blackbox-exporter@sha256:ea1c7aa3...(digest-pinned)Network=Network=hostblackbox.ymllisten_address: 127.0.0.1:9115+ claimed "gateway reaches loopback" on faithExec --listen-address=192.168.0.143:9115,169.254.1.2:9115- gateway for the scrape (hairpin gap bars Prometheus from its own host LAN IP), LAN for healthcheck;blackbox.ymlholds modules only so the sources cannot disagreehttp://comfyui:8188(unresolvable in host netns)http://127.0.0.1:8188(published0.0.0.0:8188answers on loopback)Seam (the class)
New: every observability unit must declare
Image=- red on the shipped file by name (blackbox-exporter.container has no Image= - quadlet will not generate it), green after. The eight-unit loops covered persistence/self-healing but never the one key quadlet needs to emit a unit at all.Verification
./tests/run.sh- ALL TESTS PASSED (twice; final tree)Post-merge: rerun the five-service deploy; first boot proves the gateway bind empirically via the
servicesjob health.cwd: /home/blank/Projects/serverAppConfig · session: 11fbd58f-35a5-413c-a31f-16d87f7a774a