Hermes
a4e4b24732
The per-hour checkForUpdates() loop called Docker Hub / ghcr.io without family:4, without a hard request timeout, and without retry on transient network errors. On DNS2 (Technitium at 100.121.150.22 returns AAAA records even when IPv6 routing to public registries is intermittently broken), every container check surfaced AggregateError [ETIMEDOUT] in error.log with stack `at internalConnectMultiple (node:net:1114:18)`. The dual-stack DNS race consumed the default 30s connect timeout per unreachable IPv6 family before falling back to IPv4 — 30s+ per container per check cycle. Three reliability properties added via shared fetchWithReliability() helper: 1. family:4 — IPv4-only DNS lookup. Avoids the dual-stack race entirely. 2. Hard per-request timeout (10s) — caps total latency per attempt. 3. Retry on transient codes only (ETIMEDOUT/ENOTFOUND/ENETUNREACH/...) — HTTP 4xx/5xx are surfaced as real responses, not retried. The 401 → WWW-Authenticate → token → Bearer auth flow is now explicit in getDockerHubDigest (was previously a side effect of authenticateAndGetDigest, which has been removed — no remaining callers). Verified end-to-end against real Docker Hub: - linuxserver/plex:latest → real digest in 1349ms (was 30s+ AggregateError) - 5-container checkForUpdates() cycle: 3.6s total (was 150s+) - 86/86 update-manager tests pass; 2343/2343 full suite (4 pre-existing pdfkit module-resolution failures unrelated to this change)