What causes "Failed to restart rspamd container: %v" in Billionmail/BillionMail?

Check `docker ps -a` for the rspamd container and start it manually if stopped (docker start rspamd)

Failed to restart rspamd container: %v

Error message

Failed to restart rspamd container: %v

What it means

Thrown when restarting the rspamd container via dk.RestartContainerByName fails after the DKIM signing config was written. Without the restart rspamd would not pick up the new DKIM key/signing block, so the function treats a failed restart as fatal.

Source

Thrown at core/internal/service/domains/domains.go:635

			// Remove old config block if it exists
			pattern := fmt.Sprintf(`(?s)#%s_DKIM_BEGIN.*?#%s_DKIM_END\s*`, domain, domain)
			signContent, err = gregex.ReplaceString(pattern, "", signContent)
			if err != nil {
				return
			}

			signContent = strings.Replace(signContent, "#BT_DOMAIN_DKIM_END", signConf+"\n#BT_DOMAIN_DKIM_END", 1)
			_, err = public.WriteFile(signConfPath, signContent)
			if err != nil {
				err = fmt.Errorf("Failed to write DKIM sign config: %v", err)
				return
			}

			// Restart rspamd service
			err = dk.RestartContainerByName(context.Background(), consts.SERVICES.Rspamd)
			if err != nil {
				err = fmt.Errorf("Failed to restart rspamd container: %v", err)
				return
			}
		}
	}

	// DKIM public key is typically stored in a specific location in the container or host
	// Assuming we use docker exec to read the DKIM public key from the rspamd container
	dkimPub, err := public.ReadFile(dkimPubPath)
	if err != nil {
		err = fmt.Errorf("Cannot read DKIM public key: %v", err)
		return
	}

	// Format DKIM record
	// Expected format is a pre-formatted TXT record value like "v=DKIM1; k=rsa; p=MIIBIjANBg..."
	dkimRecord := strings.TrimSpace(dkimPub)

	// If the raw public key is read, format it into DNS TXT record format

View on GitHub (pinned to fc36c76c05)

Solutions

Check `docker ps -a` for the rspamd container and start it manually if stopped (docker start rspamd)
Verify the Docker socket is accessible from the process (mount /var/run/docker.sock, correct group membership)
Check `docker logs rspamd` for config errors introduced by the new DKIM block — a malformed config can make the container die on restart
Re-run RepairDKIMSigningConfig once the daemon/container is healthy

Example fix

// before: restart fails, no diagnosis
dk.RestartContainerByName(context.Background(), consts.SERVICES.Rspamd)
// after: inspect container state on failure
docker ps -a --filter name=rspamd
docker logs rspamd --tail 50
# then retry the restart

Defensive patterns

Strategy: retry

Validate before calling

docker ps --format '{{.Names}} {{.Status}}' | grep -q rspamd || echo 'rspamd container not running'
test -S /var/run/docker.sock && echo 'docker socket present'

Type guard

func dockerReachable() bool {
    c, err := net.Dial("unix", "/var/run/docker.sock")
    if err != nil { return false }
    c.Close()
    return true
}

Try / catch

err := dk.RestartContainerByName(ctx, consts.SERVICES.Rspamd)
if err != nil {
    log.Printf("rspamd restart failed: %v — checking container state before retry", err)
    time.Sleep(5 * time.Second)
    return dk.RestartContainerByName(ctx, consts.SERVICES.Rspamd)
}

Prevention

Add Docker socket mount and group permissions to deployment manifests
Add restart policies (unless-stopped) to the rspamd container
Validate rspamd config syntax before restart to avoid crash-loops

When it happens

Trigger: Docker API returns an error from container restart — container not found, docker daemon unreachable/unix socket permission denied, container in a restart loop or unhealthy state, or timeout during stop/start.

Common situations: rspamd container crashed or was renamed, Docker socket not mounted/permission denied for the BillionMail container, daemon restart in progress, or resource exhaustion preventing the container from starting.

Related errors

AI-assisted analysis of Billionmail/BillionMail@fc36c76c05 (2026-09-05). Data as JSON: /api/errors/611312a88239b473. Report an issue: GitHub.