From 5178d5fd0e91ec9a0cd48a4361313fb4c03fa9f8 Mon Sep 17 00:00:00 2001
From: Josh Patterson <josh.patterson@securityonionsolutions.com>
Date: Wed, 15 Jul 2026 11:04:51 -0400
Subject: [PATCH] ensure restart_policy is below image

---
 salt/hydra/enabled.sls    | 3 +--
 salt/registry/enabled.sls | 7 +++----
 salt/suricata/enabled.sls | 2 +-
 salt/zeek/enabled.sls     | 2 +-
 4 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/salt/hydra/enabled.sls b/salt/hydra/enabled.sls
index b19f9a80d..74106f550 100644
--- a/salt/hydra/enabled.sls
+++ b/salt/hydra/enabled.sls
@@ -22,6 +22,7 @@ include:
 so-hydra:
   docker_container.running:
     - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-hydra:{{ GLOBALS.so_version }}
+    - restart_policy: unless-stopped
     - hostname: hydra
     - name: so-hydra
     - networks:
@@ -58,8 +59,6 @@ so-hydra:
       - {{ ULIMIT.name }}={{ ULIMIT.soft }}:{{ ULIMIT.hard }}
     {%   endfor %}
     {% endif %}
-    # Intentionally unless-stopped -- matches the fleet default.
-    - restart_policy: unless-stopped
     - watch:
       - file: hydraconfig
     - require:
diff --git a/salt/registry/enabled.sls b/salt/registry/enabled.sls
index 7b039b313..b2bfbc56d 100644
--- a/salt/registry/enabled.sls
+++ b/salt/registry/enabled.sls
@@ -17,14 +17,13 @@ include:
 so-dockerregistry:
   docker_container.running:
     - image: ghcr.io/security-onion-solutions/registry:3.1.1
+    # Intentionally `always`-- registry is critical and must
+    # come back up even if it was manually stopped.
+    - restart_policy: always
     - hostname: so-registry
     - networks:
       - sobridge:
         - ipv4_address: {{ DOCKERMERGED.containers['so-dockerregistry'].ip }}
-    # Intentionally `always` (not unless-stopped) -- registry is critical infra
-    # and must come back up even if it was manually stopped. Do not homogenize
-    # to unless-stopped; see the container auto-restart section of the plan.
-    - restart_policy: always
     - port_bindings:
       {% for BINDING in DOCKERMERGED.containers['so-dockerregistry'].port_bindings %}
       - {{ BINDING }}
diff --git a/salt/suricata/enabled.sls b/salt/suricata/enabled.sls
index 53f367971..d9206798e 100644
--- a/salt/suricata/enabled.sls
+++ b/salt/suricata/enabled.sls
@@ -17,8 +17,8 @@ include:
 so-suricata:
   docker_container.running:
     - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-suricata:{{ GLOBALS.so_version }}
-    - privileged: True
     - restart_policy: unless-stopped
+    - privileged: True
     - environment:
       - INTERFACE={{ GLOBALS.sensor.interface }}
       {% if DOCKERMERGED.containers['so-suricata'].extra_env %}
diff --git a/salt/zeek/enabled.sls b/salt/zeek/enabled.sls
index 355e555b3..ec01693d7 100644
--- a/salt/zeek/enabled.sls
+++ b/salt/zeek/enabled.sls
@@ -16,9 +16,9 @@ include:
 so-zeek:
   docker_container.running:
     - image: {{ GLOBALS.registry_host }}:5000/{{ GLOBALS.image_repo }}/so-zeek:{{ GLOBALS.so_version }}
+    - restart_policy: unless-stopped
     - start: True
     - privileged: True
-    - restart_policy: unless-stopped
     {% if DOCKERMERGED.containers['so-zeek'].ulimits %}
     - ulimits:
     {%   for ULIMIT in DOCKERMERGED.containers['so-zeek'].ulimits %}