# Reviewed Docker container disposition

Source: root-created, checksum-verified read-only baseline
`/tmp/le-phase2a-container-baseline.HyAW6sPg`, captured 2026-07-12 without
container environments, mounts, secret files, or credentials.

The baseline contains 88 containers: 87 running, one intentionally stopped, and
one unhealthy. `sonarr` is the sole reviewed unhealthy running container. Its
exact container ID, image reference and image ID, running/health state, startup
timestamp, network mode, restart policy, Compose project, and hash of its health
check definition are in `sonarr-unhealthy.allowlist.psv`. The operator verified
that its `/config/config.xml` is empty, no listener exists on port 8989, and its
health check fails. Sonarr is unrelated to Phase 2A and need not be repaired.
Any identity change, unexpected state, or additional unhealthy container is a
hard stop before maintenance.

`directus` is the sole stopped container. It is retired and must remain stopped;
its exact identity is in `directus-stopped.allowlist.psv`. Starting, recreating,
replacing, or changing its recorded state invalidates preflight.

`running-containers.psv` is the authoritative 87-container post-reboot baseline.
Containers recorded healthy must return healthy. Containers without health
checks must return running. Sonarr must remain present and running; its health
may remain unhealthy or improve to healthy. It may not become missing, stopped,
restarting, or dead. No script starts, restarts, or recreates a container.

The running `castopod` and `castopod-redis` containers have restart policy `no`.
If either fails to return after reboot, validation records explicit operator
attention and fails without starting it automatically.