Container Operations

Run day-to-day checks on the pfSense Actions container without opening an SSH session to the firewall.

Why Use These Procedures?

1. Separates container health from pfSense reachability, so monitoring doesn't sign in to the firewall every few seconds.
2. Shows when s6-overlay keeps restarting a service that exits.
3. Keeps the data volume in place across stops, starts, and rebuilds.

Check Health

docker compose ps

• The health check runs every 30 seconds with a 5-second timeout, and it marks the container unhealthy after 3 failures in a row. Failures in the first 10 seconds after a start don't count.
• It confirms that s6 is supervising the service and that port 22603 accepts a TCP connection inside the container.
• It doesn't call the API or contact pfSense, so a connectivity check is the way to test the whole path.
• To get an alert when pfSense stops answering, the scheduled check described in Notifications watches the firewall for you.

Inspect s6 Supervision

docker compose top

The process list shows /init from s6-overlay, its supervisor processes, and node build/index.js running as the PUID and PGID user. If Node exits, s6-overlay starts it again, so repeated startup lines in the logs point to a crash loop.

Read the Logs

docker compose logs --follow --tail 100 app

• Each line reads LEVEL message, with INFO on standard output and WARN and ERROR on standard error.
• LOG_TIME="true" adds an ISO 8601 timestamp to each line, and LOG_LEVEL="warn" or LOG_LEVEL="error" hides the levels below it. Both go under environment in compose.yml.
• The logs show the startup lines, the setup code while no administrator account exists, warnings about deprecated variables or a missing encryption key, the message of any unexpected error, and startup failures.
• They don't show requests, the cause of a 502, console activity, or whether an alert arrived, so the activity log and the Notifications page are better places to look for those.

Stop and Start

docker compose down
docker compose up --detach

• docker compose down removes the container but keeps the image and the data volume.
• Stopping ends any request that's still running, because pfSense Actions doesn't wait for active requests or SSH sessions to finish.
• A restart keeps the console signed in, because each browser session is stored in the database.

Rebuild or Update

git pull
docker compose up --build --detach

• The data volume carries over, so tokens and settings stay as they were.
• The Dockerfile pins its base images by digest, so their versions change only when the Dockerfile does.

Operational Boundaries