From 0a5035ae83b407d1e74f6ce4cbbd0c8a5244d891 Mon Sep 17 00:00:00 2001
From: jklein <github@justin-klein.de>
Date: Sun, 23 Aug 2026 00:38:41 +0200
Subject: [PATCH] Clean stale VPN state synchronously before gluetun starts

Replace the upstream-recommended postStart hook, which runs
concurrently with the entrypoint and loses the race (observed: it
deleted the ip rule the restarted gluetun had just created, leaving the
container in a permanent CrashLoop behind the kill switch). A command
wrapper now removes stale table-51820 rules and the leftover tun
device deterministically before exec'ing /gluetun-entrypoint, covering
container restarts after unclean exits.
---
 freesailarr/templates/freesailarr.sfs.yaml | 23 +++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/freesailarr/templates/freesailarr.sfs.yaml b/freesailarr/templates/freesailarr.sfs.yaml
index 3bf1335..af740f9 100644
--- a/freesailarr/templates/freesailarr.sfs.yaml
+++ b/freesailarr/templates/freesailarr.sfs.yaml
@@ -27,17 +27,18 @@ spec:
         - name: gluetun
           image: "qmcgaw/gluetun:{{ .Chart.AppVersion }}"
           imagePullPolicy: IfNotPresent
-          # An uncleanly exited gluetun (crash, OOM, node issue) leaves its ip
-          # rule behind in the shared pod network namespace, and the restarted
-          # container then fails forever with "ip rule 101 ... file exists".
-          # Upstream-recommended fix for Kubernetes: drop stale rules on start.
-          lifecycle:
-            postStart:
-              exec:
-                command:
-                  - /bin/sh
-                  - -c
-                  - (ip rule del table 51820; ip -6 rule del table 51820) || true
+          # An uncleanly exited gluetun (crash, OOM killer, node issue) leaves
+          # its ip rule, routing table and tun device behind in the shared pod
+          # network namespace, and the restarted container then fails forever
+          # ("adding ip rule 101 ... file exists" / silent tunnel breakage)
+          # while the kill switch blocks all egress. The upstream-recommended
+          # postStart hook is racy (it runs concurrently with the entrypoint
+          # and can delete the rule the new instance just created), so the
+          # stale state is cleaned synchronously before gluetun starts.
+          command:
+            - /bin/sh
+            - -c
+            - 'while ip rule del table 51820 2>/dev/null; do :; done; while ip -6 rule del table 51820 2>/dev/null; do :; done; ip link del tun0 2>/dev/null; exec /gluetun-entrypoint'
           env:
             - name: TZ
               value: {{ .Values.timezone | quote }}