fix: concurrent update-core and update-module runs

core/imageroot/usr/local/agent/actions/update-module/05pullimages

@@ -26,6 +26,20 @@ import sys
 import os
 import signal
 import subprocess
+import fcntl
+
+# Protect update-module from multiple concurrent runs. If the lock cannot
+# be acquired the action fails immediately.
+LOCK_FILE = ".update-module.lock"
+try:
+    # This lock is released by the OS when the process completes (no
+    # matter its exit code):
+    fcntl.flock(os.open(LOCK_FILE, os.O_WRONLY | os.O_CREAT, 0o644), fcntl.LOCK_EX | fcntl.LOCK_NB)
+except OSError as ex:
+    print(agent.SD_ERR + f"Action already running. Failed to acquire lock on {LOCK_FILE}:", ex, file=sys.stderr)
+    agent.set_status('validation-failed')
+    json.dump([{'field':'','parameter':'','value':'','error':'action_already_running'}],fp=sys.stdout)
+    sys.exit(2)
 
 agent_id = os.environ['AGENT_ID']
 

core/imageroot/usr/local/agent/actions/update-module/50run_scriptdir

@@ -23,6 +23,13 @@
 set -e
 exec 1>&2
 
+# Prevent concurrent execution of this script with a lock file opened with
+# an arbitrary high FD number, like 201.
+exec 201>.update-module.lock
+# This lock is released by the OS when the process completes (no matter
+# its exit code). Execution is blocked until lock is acquired:
+flock --verbose 201
+
 # B1-UPGRADE: clean up legacy log_tag.conf before restarting the module
 # containers. A system reboot is recommended, anyway.
 if [[ $EUID != 0 ]]; then

core/imageroot/var/lib/nethserver/cluster/actions/update-core/50update_core

@@ -10,6 +10,20 @@ import agent
 import agent.tasks
 import sys, os
 import cluster.modules
+import fcntl
+
+# Protect update-core from multiple concurrent runs. If the lock cannot be
+# acquired the action fails immediately.
+LOCK_FILE = ".update-core.lock"
+try:
+    # This lock is released by the OS when the process completes (no
+    # matter its exit code):
+    fcntl.flock(os.open(LOCK_FILE, os.O_WRONLY | os.O_CREAT, 0o644), fcntl.LOCK_EX | fcntl.LOCK_NB)
+except OSError as ex:
+    print(agent.SD_ERR + f"Action already running. Failed to acquire lock on {LOCK_FILE}:", ex, file=sys.stderr)
+    agent.set_status('validation-failed')
+    json.dump([{'field':'','parameter':'','value':'','error':'action_already_running'}],fp=sys.stdout)
+    sys.exit(2)
 
 request = json.load(sys.stdin)
 core_url = request.get('core_url', '')