Start containers with a restart policy at boot

docs/design/overview.md

@@ -57,7 +57,7 @@ docs/                        # documentation
 
 All Sibyl containers run rootless under one system user, `sibyl` (UID 1001). Rootless Podman confines each container to that user's subordinate UID range. A container escape gives an unprivileged user, not root.
 
-systemd owns the core services. The Quadlet files are in the OS image under `/etc/containers/systemd/users/1001/`. Arcane can stop a core container, but the next boot or `systemctl --user restart` brings it back from the image definition. User stacks that Arcane creates live under `/var/lib/sibyl/stacks`.
+systemd owns the core services. The Quadlet files are in the OS image under `/etc/containers/systemd/users/1001/`. Arcane can stop a core container, but the next boot or `systemctl --user restart` brings it back from the image definition. User stacks that Arcane creates live under `/var/lib/sibyl/stacks`. Podman has no daemon, so a restart policy alone does nothing at boot. The image enables the `podman-restart.service` user unit for every user, and it starts the containers whose policy is `always` or `unless-stopped`. The Quadlet containers have no restart policy, because systemd starts them.
 
 Arcane uses the same user's Podman socket, so it sees and controls the core containers. It runs with `SecurityLabelDisable=true`, because the Arcane docs require it on SELinux hosts. The filtering socket proxy from the earlier design is not used. A proxy cannot filter the Quadlet and D-Bus calls that Arcane needs, and rootless Podman already removes root from the blast radius.
 

docs/guides/host.md

@@ -109,6 +109,8 @@ Arcane is a web interface for containers. Use it to run other containers and Com
 
 Arcane uses the same Podman as the Sibyl services, so it can also stop them. A Sibyl service that you stop starts again at the next boot.
 
+At boot, the host starts every container that has the restart policy `always` or `unless-stopped`, such as `restart: unless-stopped` in a Compose file. A container that you stop with `unless-stopped` stays stopped. A container with no restart policy does not start at boot.
+
 Arcane can build images from a Compose `build:` section with the local build provider. Podman builds them with Buildah. Build secrets, SSH forwarding and BuildKit cache import or export do not work on this host. For those, use the Depot build provider.
 
 The host accepts images from these public registries:

os/Containerfile

@@ -72,7 +72,7 @@ RUN echo "${SIBYL_VERSION}" > /usr/share/sibyl/version \
         sibyl-hostd.path sibyl-hostd-auth.path sibyl-hostd-state.timer sibyl-tls.timer sibyl-provision.service \
         sibyl-diag-boot.service sibyl-diag-watchdog.service sibyl-diag-metrics.service sibyl-diag-upload.timer \
         sibyl-auto-update.timer \
-    && systemctl --global enable podman.socket sibyl-docker-shim.socket sibyl-agent.path sibyl-status.timer \
+    && systemctl --global enable podman.socket podman-restart.service sibyl-docker-shim.socket sibyl-agent.path sibyl-status.timer \
     && systemctl disable bootc-fetch-apply-updates.timer \
     && mkdir -p /etc/containers/systemd/users/1001/llama-swap.container.d \
     && cp "/usr/share/sibyl/backend/${GPU_VARIANT}.conf" \