Tell what a container inherits from what it overrides

Checked against a real stalwartlabs/stalwart image, `docker inspect` on an
ordinary container reports User "stalwart", Entrypoint
["/usr/local/bin/stalwart"] and Cmd ["--config",
"/etc/stalwart/config.json"] — all three inherited, none of them given.

Two things followed from reading those as the operator's.

A container user was listed as configuration a recreate would drop, so
every container off the official image was refused as unrecreatable. That
refusal lived in cutover, downstream of the stop, the settings conversion
and the store migration: it arrived with mail down and data already
moved, which is the failure issue #1 was filed for. Each of the three is
now compared against `docker image inspect` of the image the container is
on. Inherited values are left to the new image, whose own defaults are
the ones that go with it. Overrides are carried: --user, --entrypoint,
and the rest of an entrypoint as leading argv. Cmd and Entrypoint were
not being read at all, so an overridden one was silently dropped — the
exact loss the unsupported list exists to prevent.

The recreatability question also moved into preflight, while the server
is still running. Cutover asks it again, since the two are separated by
the whole migration, but only one of them can refuse without cost.

The other half: the recreated container is now started with `--config`
pointing at the migrated config in the data volume. Left to the image's
default command it came up on /etc/stalwart/config.json — a different
volume, holding whatever the old version left there — so cutover would
have produced a running server with nothing to do with the migration that
preceded it. An overridden command and that --config are the same argv
and cannot be merged honestly, so a container with one is refused and
told why.

The config is also chowned to whatever owns the data directory, before
the recovery cycle opens it. The image runs as uid 2000 and this tool
writes as root; §4.8 is the standing reminder that byte-perfect and
unreadable is a way to report success.

Found while checking @kaya-eu's field report in #1 against a real image.
Their three manual migrations are where the config step comes from.

internal/cutover/container.go

@@ -36,6 +36,18 @@ type ContainerOptions struct {
 	// PreserveDir is where the inspected definition is written.
 	PreserveDir string
 
+	// ConfigPath is the migrated v0.16 config, named as the *container*
+	// sees it - the path inside a mount the container already has, since a
+	// recreate carries the mounts it had and cannot invent a new one.
+	//
+	// Without this the recreated container falls back to its image's own
+	// default command, which on the official image is
+	// `--config /etc/stalwart/config.json`. That path is a different
+	// volume from the data directory and holds whatever the old version
+	// left there, so the new container would come up on a config that has
+	// nothing to do with the migration that just happened.
+	ConfigPath string
+
 	DockerBinary string
 }
 
@@ -96,6 +108,11 @@ func runContainerCutover(ctx context.Context, rs *checkpoint.RunState, step step
 		return err
 	}
 
+	// Preflight asked this too, before anything stopped (§4.1). It is
+	// asked again here because the two are separated by the whole
+	// migration, and a container can be reconfigured in between - but by
+	// the time this refuses, the answer has cost an outage, which is why
+	// preflight is where it is meant to be caught.
 	if err := step("container-is-recreatable", func() (checkpoint.StepOutcome, error) {
 		if len(facts.Unsupported) > 0 {
 			return checkpoint.StepOutcome{}, fmt.Errorf(
@@ -104,6 +121,19 @@ func runContainerCutover(ctx context.Context, rs *checkpoint.RunState, step step
 					"the definition is preserved as %s, and the staged image is %s",
 				strings.Join(facts.Unsupported, "; "), rs.Artifacts[ArtifactContainerDefinition].Path, opts.StagedImage)
 		}
+		// A command of the operator's own and a config this tool has to
+		// hand over are the same argv, and there is no honest way to merge
+		// them: their command may point at another config, or at something
+		// that is not the server at all. Refusing names both rather than
+		// picking one and being quietly wrong about which server came up.
+		if opts.ConfigPath != "" && len(facts.Cmd) > 0 {
+			return checkpoint.StepOutcome{}, fmt.Errorf(
+				"this container overrides its image's command (%s), and cutting over has to start the new one with "+
+					"`--config %s` - the migrated configuration. Both are the container's argv and this tool will not guess at "+
+					"a merge. Recreate it by hand from the preserved definition at %s, on image %s, with your command adjusted "+
+					"to that config",
+				strings.Join(facts.Cmd, " "), opts.ConfigPath, rs.Artifacts[ArtifactContainerDefinition].Path, opts.StagedImage)
+		}
 		return checkpoint.StepOutcome{Detail: "the container's definition is entirely within what a recreate carries across"}, nil
 	}); err != nil {
 		return err
@@ -130,6 +160,17 @@ func runContainerCutover(ctx context.Context, rs *checkpoint.RunState, step step
 		if facts.RestartPolicy != "" && facts.RestartPolicy != "no" {
 			args = append(args, "--restart", facts.RestartPolicy)
 		}
+		// Only what the container overrode on its old image is carried.
+		// An inherited value belongs to the image, and the new image's own
+		// default is the one that goes with the new image - pinning the
+		// old image's USER or ENTRYPOINT onto it would be carrying across
+		// a decision nobody made.
+		if facts.User != "" {
+			args = append(args, "--user", facts.User)
+		}
+		if len(facts.Entrypoint) > 0 {
+			args = append(args, "--entrypoint", facts.Entrypoint[0])
+		}
 		for _, e := range facts.Env {
 			// Recovery-mode variables must never survive into a normal
 			// start: leaving STALWART_RECOVERY_MODE set would recovery-boot
@@ -164,12 +205,29 @@ func runContainerCutover(ctx context.Context, rs *checkpoint.RunState, step step
 		}
 		args = append(args, opts.StagedImage)
 
+		// Everything after the image is the container's argv. `docker run`
+		// takes only the first word of an entrypoint as --entrypoint, so
+		// the rest of it leads here.
+		if len(facts.Entrypoint) > 1 {
+			args = append(args, facts.Entrypoint[1:]...)
+		}
+		switch {
+		case opts.ConfigPath != "":
+			args = append(args, "--config", opts.ConfigPath)
+		case len(facts.Cmd) > 0:
+			args = append(args, facts.Cmd...)
+		}
+
 		if out, err := dockerOut(ctx, opts.docker(), args...); err != nil {
 			return checkpoint.StepOutcome{}, fmt.Errorf(
 				"create %s from %s: %w (%s). The previous container is still here as %s",
 				opts.ContainerName, opts.StagedImage, err, out, retired)
 		}
-		return checkpoint.StepOutcome{Detail: fmt.Sprintf("recreated %s on image %s", opts.ContainerName, opts.StagedImage)}, nil
+		detail := fmt.Sprintf("recreated %s on image %s", opts.ContainerName, opts.StagedImage)
+		if opts.ConfigPath != "" {
+			detail += ", started with --config " + opts.ConfigPath
+		}
+		return checkpoint.StepOutcome{Detail: detail}, nil
 	})
 }