I would not give programs access to the Docker socket (and unlimited root-level access over the host) just to restart if something goes wrong.
If you determine there's a problem and your program can't keep running, it can just exit (calling something like exit()
or sys.exit()
or throwing an exception that doesn't get handled). When the main container process exits, it will trigger the container restart policy, which can cause the container to restart. podman run
has an almost identical --restart
option.
podman run --restart=on-failure ... my-image
You also might think about how you'd approach this problem if a container wasn't involved. If you need to reload your configuration, or re-exec your own binary, or have a developer-oriented non-production live-reloading environment, those same approaches will work equally well in a container or not, and wouldn't require a Docker socket.