build(deps-dev): bump ruff from 0.16.10 to 0.17.0 (#11)

Bumps [ruff](https://github.com/astral-sh/ruff) from 0.16.10 to 0.17.0.
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](https://github.com/astral-sh/ruff/compare/0.16.10...0.17.0)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

CHANGELOG.md

@@ -1,44 +1,5 @@
 # Changelog
 
-## [7.1.2] - 2026-10-18
-
-Fixed:
-
-- Backup: *--snapshot zfs* found no snapshot inside a container; now mounts it
-- Tests: e2e zfs pool now sits on a loop device; a file vdev never worked
-
-Upgrade notes:
-
-- Backup: zfs snapshots mount at *.baudolo-TAG* in the subject, not *.zfs*
-- Image: first ghcr image since 3.1.2; the 4.0.0 to 7.1.1 notes apply
-
-## [7.1.1] - 2026-10-17
-
-Fixed:
-
-- Tests: e2e MariaDB probe ran root passwordless and timed out at random
-- Tests: probe now logs in with the root password, skips the temp server
-- Tests: anonymous-preemption bootstrap now uses the root password too
-
-Upgrade notes:
-
-- 7.1.0 never reached stable: its CI failed, no image was published
-- 7.1.1 is the first published -aHAX build; 7.1.0 upgrade notes apply
-
-## [7.1.0] - 2026-10-17
-
-Fixed:
-
-- Backup: rsync -a stored no xattrs, ACLs or hardlinks; now -aHAX
-- Restore: restore_volume_files had the same gap; now -aHAX too
-- An OpenCloud volume lost its storage metadata through a DR drill
-
-Upgrade notes:
-
-- First backup re-copies every attribute-carrying volume once in full
-- A destination without xattr support now fails the backup run outright
-- exFAT, xattr-less NFS and object-storage FUSE mounts must move first
-
 ## [7.0.2] - 2026-09-23
 
 * Backup: failed live pre-copy no longer aborts when a stopped copy follows

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "backup-docker-to-local"
-version = "7.1.2"
+version = "7.0.2"
 description = "Backup Docker volumes to local with rsync and optional DB dumps."
 readme = "README.md"
 requires-python = ">=3.9"
@@ -19,7 +19,7 @@ dependencies = [
 [project.optional-dependencies]
 # Pinned: a ruff minor bump changes which rules fire, and `make test` gates on
 # a clean run, so an unpinned lint would fail the suite on an unrelated day.
-lint = ["ruff==0.16.7"]
+lint = ["ruff==0.17.0"]
 
 [project.scripts]
 baudolo = "baudolo.backup.__main__:main"

src/baudolo/backup/snapshot.py

@@ -58,50 +58,27 @@ def _resolver(subject: str, root: str) -> Callable[[str], str]:
     return resolve
 
 
-def _remove(
-    root: str, commands: list[list[str]], run: Callable[[list[str]], list[str]]
-) -> None:
-    try:
-        for command in commands:
-            run(command)
-    except BackupError as error:
-        # Raising here would also mask whatever the body raised.
-        print(f"WARNING: {root} could not be removed: {error}", flush=True)
-
-
 def _btrfs(
     subject: str, name: str, run: Callable[[list[str]], list[str]]
-) -> tuple[str, list[list[str]]]:
+) -> tuple[str, list[str]]:
     # The snapshot goes inside the subject, never beside it: the kernel rejects
     # a snapshot whose destination is on another filesystem, which is exactly
     # what the parent directory is when the subject is a mountpoint of its own.
     target = str(Path(os.path.abspath(subject)) / f".{name}")  # noqa: PTH100 - see _resolver
     run(["btrfs", "subvolume", "snapshot", "-r", subject, target])
-    return target, [["btrfs", "subvolume", "delete", target]]
+    return target, ["btrfs", "subvolume", "delete", target]
 
 
 def _zfs(
     subject: str, name: str, run: Callable[[list[str]], list[str]]
-) -> tuple[str, list[list[str]]]:
+) -> tuple[str, list[str]]:
     output = run(["zfs", "list", "-H", "-o", "name", subject])
     dataset = (output[0] if output else "").strip()
     if not dataset:
         raise SnapshotError(f"no zfs dataset is mounted at {subject}")
-    snapshot = f"{dataset}@{name}"
-    # Exception: mounted here rather than read through .zfs/snapshot, which the
-    # kernel automounts via a usermode helper in the host's mount namespace,
-    # so a containerised run never sees it.
-    root = str(Path(os.path.abspath(subject)) / f".{name}")  # noqa: PTH100 - see _resolver
-    run(["zfs", "snapshot", snapshot])
-    remove = [["zfs", "destroy", snapshot]]
-    try:
-        run(["mkdir", root])
-        remove.insert(0, ["rmdir", root])
-        run(["mount", "-t", "zfs", snapshot, root])
-    except BaseException:
-        _remove(root, remove, run)
-        raise
-    return root, [["umount", root], *remove]
+    run(["zfs", "snapshot", f"{dataset}@{name}"])
+    root = str(Path(subject) / ".zfs" / "snapshot" / name)
+    return root, ["zfs", "destroy", f"{dataset}@{name}"]
 
 
 _CREATE = {"btrfs": _btrfs, "zfs": _zfs}
@@ -192,4 +169,8 @@ def volume_snapshot(
     try:
         yield _resolver(subject, root)
     finally:
-        _remove(root, remove, run)
+        try:
+            run(remove)
+        except BackupError as error:
+            # Raising here would also mask whatever the body raised.
+            print(f"WARNING: {root} could not be removed: {error}", flush=True)

src/baudolo/backup/volume.py

@@ -75,7 +75,7 @@ def backup_volume(
     pathlib.Path(dest).mkdir(parents=True, exist_ok=True)
 
     last = get_last_backup_dir(versions_dir, volume_name, dest)
-    cmd = ["rsync", "-aHAX", "-P", "--no-D", "--delete", "--delete-excluded"]
+    cmd = ["rsync", "-aP", "--no-D", "--delete", "--delete-excluded"]
     if authoritative:
         cmd.append("--checksum")
     if last:

src/baudolo/restore/files.py

@@ -59,6 +59,6 @@ def restore_volume_files(volume_name: str, backup_files_dir: str) -> int:
     # rsync reads "dir/" as its contents and "dir" as the directory itself.
     src = f"{Path(backup_files_dir)}{os.sep}"
     dest = f"{Path(mountpoint)}{os.sep}"
-    run(["rsync", "-aHAX", "-vv", "--delete", src, dest])
+    run(["rsync", "-avv", "--delete", src, dest])
     print("File restore complete.")
     return 0

tests/e2e/helpers/process.py

@@ -96,13 +96,12 @@ def wait_for_mariadb(
     container: str, *, root_password: str, timeout_s: int = 90
 ) -> None:
     """
-    Readiness probe for MariaDB, as root over the socket.
+    Liveness probe for MariaDB.
 
-    The entrypoint drops root@127.0.0.1, so root is socket-only, and it
-    installs root@localhost without unix_socket auth: a probe without the
-    password only passes in the init window before the password is set.
-    `@@skip_networking` must be 0 so the entrypoint's temporary server,
-    which shuts down right after init, does not count as ready.
+    IMPORTANT (MariaDB 11):
+    Root TCP auth is often restricted (unix_socket auth), so a TCP ping like
+    `mariadb-admin -uroot -p... -h localhost ping` can fail even though the server is up.
+    We therefore check readiness via a socket-based query.
     """
     deadline = time.time() + timeout_s
     while time.time() < deadline:
@@ -113,15 +112,12 @@ def wait_for_mariadb(
                 container,
                 "sh",
                 "-lc",
-                (
-                    f"mariadb -uroot -p{root_password} --protocol=socket "
-                    '-N -e "SELECT @@skip_networking;"'
-                ),
+                'mariadb -uroot --protocol=socket -e "SELECT 1;"',
             ],
             capture=True,
             check=False,
         )
-        if p.returncode == 0 and p.stdout.strip() == "0":
+        if p.returncode == 0:
             return
         time.sleep(1)
     raise TimeoutError(

tests/e2e/test_e2e_mariadb_anonymous_preemption.py

@@ -100,10 +100,7 @@ class TestE2EMariaDBAnonymousPreemption(unittest.TestCase):
                 cls.db_container,
                 "sh",
                 "-lc",
-                (
-                    f"mariadb -uroot -p{cls.root_password} --protocol=socket "
-                    f'-e "{bootstrap_sql}"'
-                ),
+                f'mariadb -uroot --protocol=socket -e "{bootstrap_sql}"',
             ]
         )
 

tests/e2e/test_e2e_snapshot.py

@@ -36,14 +36,9 @@ ZFS_READY = "{ [ -c /dev/zfs ] || modprobe zfs 2>/dev/null; }; [ -c /dev/zfs ]"
 def mount_script(fstype: str) -> str:
     """Build a filesystem on a loop device and carve out the snapshot subject."""
     if fstype == "zfs":
-        # Exception: a loop device, not the /img file, because the kernel opens
-        # vdevs from a taskq thread that resolves paths in the host's root.
-        # The pool is kernel-wide, so it is destroyed on exit, but only once
-        # this script created it.
         return (
-            f"{PACKAGES} && {ZFS_READY} && truncate -s 400M /img && {ATTACH} "
-            '&& zpool create -m none baudolo "$LOOP" '
-            "&& trap 'zpool destroy -f baudolo; losetup -d \"$LOOP\"' EXIT "
+            f"{PACKAGES} && {ZFS_READY} && truncate -s 400M /img "
+            "&& zpool create -m none baudolo /img "
             "&& zfs create -o mountpoint=/subject/docker baudolo/docker"
         )
     return (

tests/unit/backup/test_snapshot.py

@@ -21,14 +21,6 @@ class Runner:
         return []
 
 
-class Unmountable(Runner):
-    def __call__(self, command: list[str]) -> list[str]:
-        result = super().__call__(command)
-        if command[0] == "mount":
-            raise BackupError("permission denied")
-        return result
-
-
 class TestBtrfs(unittest.TestCase):
     def test_it_creates_a_read_only_snapshot_inside_the_subject(self) -> None:
         run = Runner()
@@ -103,55 +95,12 @@ class TestZfs(unittest.TestCase):
             run.calls[-1], ["zfs", "destroy", "tank/docker@baudolo-20260731"]
         )
 
-    def test_it_mounts_the_snapshot_inside_the_subject(self) -> None:
-        run = self._run()
-        with volume_snapshot("zfs", "/var/lib/docker", "20260731", run=run):
-            pass
-        self.assertIn(
-            [
-                "mount",
-                "-t",
-                "zfs",
-                "tank/docker@baudolo-20260731",
-                "/var/lib/docker/.baudolo-20260731",
-            ],
-            run.calls,
-        )
-
-    def test_it_maps_a_volume_path_into_the_mounted_snapshot(self) -> None:
+    def test_it_maps_a_volume_path_through_the_dot_zfs_directory(self) -> None:
         run = self._run()
         with volume_snapshot("zfs", "/var/lib/docker", "20260731", run=run) as resolve:
             self.assertEqual(
                 resolve("/var/lib/docker/volumes/postgres_data/_data"),
-                "/var/lib/docker/.baudolo-20260731/volumes/postgres_data/_data",
-            )
-
-    def test_it_unmounts_before_it_destroys(self) -> None:
-        run = self._run()
-        with volume_snapshot("zfs", "/var/lib/docker", "20260731", run=run):
-            pass
-        self.assertEqual(
-            run.calls[-3:],
-            [
-                ["umount", "/var/lib/docker/.baudolo-20260731"],
-                ["rmdir", "/var/lib/docker/.baudolo-20260731"],
-                ["zfs", "destroy", "tank/docker@baudolo-20260731"],
-            ],
-        )
-
-    def test_a_failed_mount_leaves_no_snapshot_behind(self) -> None:
-        run = Unmountable({"zfs list": ["tank/docker"]})
-        with (
-            self.assertRaises(BackupError),
-            volume_snapshot("zfs", "/var/lib/docker", "20260731", run=run),
-        ):
-            pass
-        self.assertEqual(
-            run.calls[-2:],
-            [
-                ["rmdir", "/var/lib/docker/.baudolo-20260731"],
-                ["zfs", "destroy", "tank/docker@baudolo-20260731"],
-            ],
+                "/var/lib/docker/.zfs/snapshot/baudolo-20260731/volumes/postgres_data/_data",
             )
 
     def test_an_unmounted_dataset_is_an_error(self) -> None:

tests/unit/backup/test_volume.py

@@ -46,12 +46,9 @@ class TestBackupVolume(unittest.TestCase):
     def test_it_carries_no_kernel_objects_into_a_generation(self) -> None:
         self.assertIn("--no-D", self.copy())
 
-    def test_it_stores_the_metadata_a_restore_has_to_give_back(self) -> None:
-        self.assertIn("-aHAX", self.copy())
-
     def test_it_keeps_no_twin_of_what_the_second_pass_replaces(self) -> None:
         command = self.copy(authoritative=True)
-        self.assertEqual(command[:3], ["rsync", "-aHAX", "-P"])
+        self.assertEqual(command[:2], ["rsync", "-aP"])
         self.assertNotIn("--backup", command)
 
     def test_it_creates_the_destination(self) -> None: