ensure restart_policy is below image

salt/hydra/enabled.sls

@@ -22,6 +22,7 @@ include:
 so-hydra:
   docker_container.running:
     - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-hydra:{{ GLOBALS.so_version }}
+    - restart_policy: unless-stopped
     - hostname: hydra
     - name: so-hydra
     - networks:
@@ -58,8 +59,6 @@ so-hydra:
       - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
-    # Intentionally unless-stopped -- matches the fleet default.
-    - restart_policy: unless-stopped
     - watch:
       - file: hydraconfig
     - require:

salt/registry/enabled.sls

@@ -17,14 +17,13 @@ include:
 so-dockerregistry:
   docker_container.running:
     - image: ghcr.io/security-onion-solutions/registry:3.1.1
+    # Intentionally `always`-- registry is critical and must
+    # come back up even if it was manually stopped.
+    - restart_policy: always
     - hostname: so-registry
     - networks:
       - sobridge:
         - ipv4_address: {{ DOCKERMERGED.containers['so-dockerregistry'].ip }}
-    # Intentionally `always` (not unless-stopped) -- registry is critical infra
-    # and must come back up even if it was manually stopped. Do not homogenize
-    # to unless-stopped; see the container auto-restart section of the plan.
-    - restart_policy: always
     - port_bindings:
       {% for BINDING in DOCKERMERGED.containers['so-dockerregistry'].port_bindings %}
       - {{ BINDING }}

salt/suricata/enabled.sls

@@ -17,8 +17,8 @@ include:
 so-suricata:
   docker_container.running:
     - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-suricata:{{ GLOBALS.so_version }}
-    - privileged: True
     - restart_policy: unless-stopped
+    - privileged: True
     - environment:
       - INTERFACE={{ GLOBALS.sensor.interface }}
       {% if DOCKERMERGED.containers['so-suricata'].extra_env %}

salt/zeek/enabled.sls

@@ -16,9 +16,9 @@ include:
 so-zeek:
   docker_container.running:
     - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-zeek:{{ GLOBALS.so_version }}
+    - restart_policy: unless-stopped
     - start: True
     - privileged: True
-    - restart_policy: unless-stopped
     {% if DOCKERMERGED.containers['so-zeek'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-zeek'].ulimits %}