v17.0.2

Fix search for app leftover locks

.versionbot/CHANGELOG.yml

@@ -1,3 +1,141 @@
+- commits:
+    - subject: Fix search for app leftover locks
+      hash: d475b1d8301c83b932ce272d3496bf4aac0ef1ad
+      body: |
+        The leftover locks search was creating an array rather than an object
+        keyed by the appId. This could affect the lock cleanup and make leftover
+        locks from one app affect the install of the app in local mode.
+      footer:
+        Change-type: patch
+        change-type: patch
+      author: Felipe Lalanne
+      nested: []
+  version: 17.0.2
+  title: ""
+  date: 2025-04-02T20:16:09.754Z
+- commits:
+    - subject: Clarify firewall docs on behavior with host network containers
+      hash: caed4dcca0043f848f6dd5a3d1a2f82a2466e8d6
+      body: ""
+      footer:
+        Change-type: patch
+        change-type: patch
+        Signed-off-by: Christina Ying Wang <christina@balena.io>
+        signed-off-by: Christina Ying Wang <christina@balena.io>
+      author: Christina Ying Wang
+      nested: []
+  version: 17.0.1
+  title: ""
+  date: 2025-03-25T20:41:20.141Z
+- commits:
+    - subject: Add Docker network label if custom ipam config
+      hash: b596c77ce2d229e79082cbb1f0022f93806f09ae
+      body: >
+        In a target release where the only change is the addition or removal
+
+        of a custom ipam config, the Supervisor does not recreate the network
+
+        due to ignoring ipam config differences when comparing current and
+        target
+
+        network (in network.isEqualConfig). This commit implements the addition
+        of
+
+        a network label if the target compose object includes a network with
+        custom
+
+        ipam. With the label, the Supervisor will detect a difference between a
+
+        network with a custom ipam and a network without, without needing to
+        compare
+
+        the ipam configs themselves.
+
+
+        This is a major change, as devices running networks with custom ipam
+        configs
+
+        will have their networks recreated to add the network label.
+      footer:
+        Closes: "#2251"
+        closes: "#2251"
+        Change-type: major
+        change-type: major
+        See: https://balena.fibery.io/Work/Project/Fix-Supervisor-not-recreating-network-when-passed-custom-ipam-config-1127
+        see: https://balena.fibery.io/Work/Project/Fix-Supervisor-not-recreating-network-when-passed-custom-ipam-config-1127
+        Signed-off-by: Christina Ying Wang <christina@balena.io>
+        signed-off-by: Christina Ying Wang <christina@balena.io>
+      author: Christina Ying Wang
+      nested: []
+  version: 17.0.0
+  title: ""
+  date: 2025-03-24T22:18:08.753Z
+- commits:
+    - subject: Start a dependent if all dependencies are started
+      hash: 7764f98c9d357a1942628e57951266767555f67b
+      body: |
+        The previous behavior required that dependencies were running beefore
+        starting the dependent service. This made it that services dependent on
+        a one-shot service would not get started and goes against the default
+        docker behavior.
+
+        Depending on a service to be running will require the implementation of
+        [long syntax depends_on](https://docs.docker.com/reference/compose-file/services/#long-syntax-1) and the condition
+        `service_healthy`.
+      footer:
+        Change-type: patch
+        change-type: patch
+        Closes: "#2409"
+        closes: "#2409"
+      author: Felipe Lalanne
+      nested: []
+  version: 16.12.9
+  title: ""
+  date: 2025-03-20T18:43:06.085Z
+- commits:
+    - subject: Remove GOT retries on state poll
+      hash: ae337a1dd7743b0ee0a05c32a5ce01965c5bafef
+      body: |
+        The state poll already has retry implementation, making the GOT default
+        unnecessary.
+      footer:
+        Change-type: patch
+        change-type: patch
+      author: Felipe Lalanne
+      nested: []
+    - subject: Ensure poll socket timeout is defined early
+      hash: bdbc6a4ba4766f9466891497bc02bd33aff1d4c7
+      body: |
+        We have observed that even when setting the socket timeout on the
+        state poll https request, the timeout is only applied once the socket is
+        connected. This causes issues with Node's auto family selection (happy
+        eyeballs), as the default https timeout is 5s which means that larger
+        [auto select attempt timeout](https://nodejs.org/docs/latest-v22.x/api/net.html#netgetdefaultautoselectfamilyattempttimeout) may result in the socket timing out before all connection attempts have been tried.
+
+        This commit sets a different https Agent for state polling, with a
+        timeout matching the `apiRequestTimeout` used for other request events.
+      footer:
+        Change-type: patch
+        change-type: patch
+      author: Felipe Lalanne
+      nested: []
+  version: 16.12.8
+  title: ""
+  date: 2025-03-12T14:50:33.204Z
+- commits:
+    - subject: Release locks when removing apps
+      hash: 026dc0aed29ce7d66cfdd8616d80d1f5daf3ad46
+      body: |
+        This prevents leftover locks that can prevent other operations from
+        taking place.
+      footer:
+        Change-type: patch
+        change-type: patch
+      author: Felipe Lalanne
+      nested: []
+  version: 16.12.7
+  title: ""
+  date: 2025-03-06T19:11:18.704Z
 - commits:
     - subject: Log non-API errors during state poll
       hash: 6d00be20930398699da1006176dac1e81b2dbbd6

CHANGELOG.md

@@ -4,6 +4,37 @@ All notable changes to this project will be documented in this file
 automatically by Versionist. DO NOT EDIT THIS FILE MANUALLY!
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+# v17.0.2
+## (2025-04-02)
+
+* Fix search for app leftover locks [Felipe Lalanne]
+
+# v17.0.1
+## (2025-03-25)
+
+* Clarify firewall docs on behavior with host network containers [Christina Ying Wang]
+
+# v17.0.0
+## (2025-03-24)
+
+* Add Docker network label if custom ipam config [Christina Ying Wang]
+
+# v16.12.9
+## (2025-03-20)
+
+* Start a dependent if all dependencies are started [Felipe Lalanne]
+
+# v16.12.8
+## (2025-03-12)
+
+* Remove GOT retries on state poll [Felipe Lalanne]
+* Ensure poll socket timeout is defined early [Felipe Lalanne]
+
+# v16.12.7
+## (2025-03-06)
+
+* Release locks when removing apps [Felipe Lalanne]
+
 # v16.12.6
 ## (2025-03-04)
 

VERSION

@@ -1 +1 @@
-16.12.6
+17.0.2

balena.yml

@@ -2,6 +2,6 @@ name: balena-supervisor
 description: 'Balena Supervisor: balena''s agent on devices.'
 joinable: false
 type: sw.application
-version: 16.12.6
+version: 17.0.2
 provides:
   - slug: sw.compose.long-volume-syntax

docs/firewall.md

@@ -8,10 +8,10 @@ To switch between firewall modes, the `HOST_FIREWALL_MODE` (with `BALENA_` or le
 
 > [!NOTE] Configuration variables defined in the dashboard will not apply to devices in local mode.
 
-| Mode | Description                                                                                                                                                 |
-| ---- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| on   | Only traffic for core services provided by balena and containers on the host network are allowed.                                                           |
-| off  | All network traffic is allowed.                                                                                                                             |
+| Mode | Description |
+| ---- | ----------- |
+| on   | Only traffic for core services provided by balena are allowed. Any other ports, including those used by containers with host networking, are blocked unless explicitly configured. |
+| off  | All network traffic is allowed. |
 | auto | If there _are_ host network services, behaves as if `FIREWALL_MODE` = `on`. If there _aren't_ host network services, behaves as if `FIREWALL_MODE` = `off`. |
 
 ## Issues

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "balena-supervisor",
-  "version": "16.12.6",
+  "version": "17.0.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "balena-supervisor",
-      "version": "16.12.6",
+      "version": "17.0.2",
       "license": "Apache-2.0",
       "dependencies": {
         "@balena/systemd": "^0.5.0",

package.json

@@ -1,7 +1,7 @@
 {
   "name": "balena-supervisor",
   "description": "This is balena's Supervisor, a program that runs on IoT devices and has the task of running user Apps (which are Docker containers), and updating them as the balena API informs it to.",
-  "version": "16.12.6",
+  "version": "17.0.2",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -137,6 +137,6 @@
     "yargs": "^17.7.2"
   },
   "versionist": {
-    "publishedAt": "2025-03-04T14:25:07.201Z"
+    "publishedAt": "2025-04-02T20:16:10.284Z"
   }
 }

src/api-binder/poll.ts

@@ -3,6 +3,7 @@ import url from 'url';
 import { setTimeout } from 'timers/promises';
 import Bluebird from 'bluebird';
 import type StrictEventEmitter from 'strict-event-emitter-types';
+import { Agent } from 'https';
 
 import type { TargetState } from '../types/state';
 import { InternalInconsistencyError } from '../lib/errors';
@@ -120,6 +121,13 @@ export const update = async (
 		const got = await getGotInstance();
 
 		const { statusCode, headers, body } = await got(endpoint, {
+			retry: { limit: 0 },
+			agent: {
+				https: new Agent({
+					keepAlive: true,
+					timeout: apiRequestTimeout,
+				}),
+			},
 			headers: {
 				Authorization: `Bearer ${deviceApiKey}`,
 				'If-None-Match': cache?.etag,

src/compose/app.ts

@@ -247,6 +247,16 @@ class AppImpl implements App {
 			}
 		}
 
+		// Release locks (if any) for all services before settling state
+		if (state.lock || state.hasLeftoverLocks) {
+			return [
+				generateStep('releaseLock', {
+					appId: this.appId,
+					lock: state.lock,
+				}),
+			];
+		}
+
 		return [];
 	}
 
@@ -911,19 +921,24 @@ class AppImpl implements App {
 		volumePairs: Array<ChangingPair<Volume>>,
 		servicePairs: Array<ChangingPair<Service>>,
 	): boolean {
-		// Firstly we check if a dependency is not already running (this is
+		// Firstly we check if a dependency has already been started (this is
 		// different to a dependency which is in the servicePairs below, as these
 		// are services which are changing). We could have a dependency which is
 		// starting up, but is not yet running.
-		const depInstallingButNotRunning = _.some(this.services, (svc) => {
+		const depCreatedButNotStarted = _.some(this.services, (svc) => {
 			if (target.dependsOn?.includes(svc.serviceName)) {
-				if (!svc.config.running) {
+				if (
+					svc.status === 'Installing' ||
+					svc.startedAt == null ||
+					svc.createdAt == null ||
+					svc.startedAt < svc.createdAt
+				) {
 					return true;
 				}
 			}
 		});
 
-		if (depInstallingButNotRunning) {
+		if (depCreatedButNotStarted) {
 			return false;
 		}
 

src/compose/application-manager.ts

@@ -187,8 +187,12 @@ export async function inferNextSteps(
 	const currentAppIds = Object.keys(currentApps).map((i) => parseInt(i, 10));
 	const targetAppIds = Object.keys(targetApps).map((i) => parseInt(i, 10));
 
-	const withLeftoverLocks = await Promise.all(
-		currentAppIds.map((id) => hasLeftoverLocks(id)),
+	const withLeftoverLocks = Object.fromEntries(
+		await Promise.all(
+			currentAppIds.map(
+				async (id) => [id, await hasLeftoverLocks(id)] as [number, boolean],
+			),
+		),
 	);
 	const bootTime = getBootTime();
 

src/compose/network.ts

@@ -160,6 +160,15 @@ class NetworkImpl implements Network {
 			configOnly: network.config_only || false,
 		};
 
+		// Add label if there's non-default ipam config
+		// e.g. explicitly defined subnet or gateway.
+		// When updating between a release where the ipam config
+		// changes, this label informs the Supervisor that
+		// there's an ipam diff that requires recreating the network.
+		if (net.config.ipam.config.length > 0) {
+			net.config.labels['io.balena.private.ipam.config'] = 'true';
+		}
+
 		return net;
 	}
 

src/compose/service.ts

@@ -61,6 +61,7 @@ class ServiceImpl implements Service {
 	public dockerImageId: string | null;
 	public status: ServiceStatus;
 	public createdAt: Date | null;
+	public startedAt: Date | null;
 
 	private static configArrayFields: ServiceConfigArrayField[] = [
 		'volumes',
@@ -476,6 +477,7 @@ class ServiceImpl implements Service {
 		}
 
 		svc.createdAt = new Date(container.Created);
+		svc.startedAt = new Date(container.State.StartedAt);
 		svc.containerId = container.Id;
 		svc.exitErrorMessage = container.State.Error;
 

src/compose/types/service.ts

@@ -373,6 +373,7 @@ export interface Service {
 	// from docker
 	status: ServiceStatus;
 	createdAt: Date | null;
+	startedAt: Date | null;
 
 	hasNetwork(networkName: string): boolean;
 	hasVolume(volumeName: string): boolean;

test/integration/compose/application-manager.spec.ts

@@ -1128,11 +1128,20 @@ describe('compose/application-manager', () => {
 		const { currentApps, availableImages, downloading, containerIdsByAppId } =
 			createCurrentState({
 				services: [
-					await createService({
-						image: 'dep-image',
-						serviceName: 'dep',
-						commit: 'new-release',
-					}),
+					await createService(
+						{
+							image: 'dep-image',
+							serviceName: 'dep',
+							commit: 'new-release',
+						},
+						{
+							state: {
+								createdAt: new Date(Date.now() - 5 * 1000),
+								// Container was started 5 after creation
+								startedAt: new Date(),
+							},
+						},
+					),
 				],
 				networks: [DEFAULT_NETWORK],
 				images: [

test/integration/compose/network.spec.ts

@@ -67,6 +67,8 @@ describe('compose/network: integration tests', () => {
 				Labels: {
 					'io.balena.supervised': 'true',
 					'io.balena.app-id': '12345',
+					// This label should be present as we've defined a custom ipam config
+					'io.balena.private.ipam.config': 'true',
 				},
 				Options: {},
 				ConfigOnly: false,

test/integration/state-engine.spec.ts

@@ -260,7 +260,33 @@ describe('state engine', () => {
 			});
 	});
 
-	it('updates an app with two services with a network change', async () => {
+	it('updates an app with two services with a network change where the only change is a custom ipam config addition', async () => {
+		const services = {
+			'1': {
+				image: 'alpine:latest',
+				imageId: 11,
+				serviceName: 'one',
+				restart: 'unless-stopped',
+				running: true,
+				command: 'sleep infinity',
+				stop_signal: 'SIGKILL',
+				networks: ['default'],
+				labels: {},
+				environment: {},
+			},
+			'2': {
+				image: 'alpine:latest',
+				imageId: 12,
+				serviceName: 'two',
+				restart: 'unless-stopped',
+				running: true,
+				command: 'sleep infinity',
+				stop_signal: 'SIGKILL',
+				networks: ['default'],
+				labels: {},
+				environment: {},
+			},
+		};
 		await setTargetState({
 			config: {},
 			apps: {
@@ -268,30 +294,10 @@ describe('state engine', () => {
 					name: 'test-app',
 					commit: 'deadbeef',
 					releaseId: 1,
-					services: {
-						'1': {
-							image: 'alpine:latest',
-							imageId: 11,
-							serviceName: 'one',
-							restart: 'unless-stopped',
-							running: true,
-							command: 'sleep infinity',
-							stop_signal: 'SIGKILL',
-							labels: {},
-							environment: {},
-						},
-						'2': {
-							image: 'alpine:latest',
-							imageId: 12,
-							serviceName: 'two',
-							restart: 'unless-stopped',
-							running: true,
-							command: 'sleep infinity',
-							labels: {},
-							environment: {},
-						},
+					services,
+					networks: {
+						default: {},
 					},
-					networks: {},
 					volumes: {},
 				},
 			},
@@ -311,6 +317,21 @@ describe('state engine', () => {
 		]);
 		const containerIds = containers.map(({ Id }) => Id);
 
+		// Network should not have custom ipam config
+		const defaultNet = await docker.getNetwork('123_default').inspect();
+		expect(defaultNet)
+			.to.have.property('IPAM')
+			.to.not.deep.equal({
+				Config: [{ Gateway: '192.168.91.1', Subnet: '192.168.91.0/24' }],
+				Driver: 'default',
+				Options: {},
+			});
+
+		// Network should not have custom ipam label
+		expect(defaultNet)
+			.to.have.property('Labels')
+			.to.not.have.property('io.balena.private.ipam.config');
+
 		await setTargetState({
 			config: {},
 			apps: {
@@ -318,32 +339,7 @@ describe('state engine', () => {
 					name: 'test-app',
 					commit: 'deadca1f',
 					releaseId: 2,
-					services: {
-						'1': {
-							image: 'alpine:latest',
-							imageId: 21,
-							serviceName: 'one',
-							restart: 'unless-stopped',
-							running: true,
-							command: 'sleep infinity',
-							stop_signal: 'SIGKILL',
-							networks: ['default'],
-							labels: {},
-							environment: {},
-						},
-						'2': {
-							image: 'alpine:latest',
-							imageId: 22,
-							serviceName: 'two',
-							restart: 'unless-stopped',
-							running: true,
-							command: 'sh -c "echo two && sleep infinity"',
-							stop_signal: 'SIGKILL',
-							networks: ['default'],
-							labels: {},
-							environment: {},
-						},
-					},
+					services,
 					networks: {
 						default: {
 							driver: 'bridge',
@@ -364,8 +360,8 @@ describe('state engine', () => {
 		expect(
 			updatedContainers.map(({ Names, State }) => ({ Name: Names[0], State })),
 		).to.have.deep.members([
-			{ Name: '/one_21_2_deadca1f', State: 'running' },
-			{ Name: '/two_22_2_deadca1f', State: 'running' },
+			{ Name: '/one_11_2_deadca1f', State: 'running' },
+			{ Name: '/two_12_2_deadca1f', State: 'running' },
 		]);
 
 		// Container ids must have changed
@@ -373,13 +369,145 @@ describe('state engine', () => {
 			containerIds,
 		);
 
-		expect(await docker.getNetwork('123_default').inspect())
+		// Network should have custom ipam config
+		const customNet = await docker.getNetwork('123_default').inspect();
+		expect(customNet)
 			.to.have.property('IPAM')
 			.to.deep.equal({
 				Config: [{ Gateway: '192.168.91.1', Subnet: '192.168.91.0/24' }],
 				Driver: 'default',
 				Options: {},
 			});
+
+		// Network should have custom ipam label
+		expect(customNet)
+			.to.have.property('Labels')
+			.to.have.property('io.balena.private.ipam.config');
+	});
+
+	it('updates an app with two services with a network change where the only change is a custom ipam config removal', async () => {
+		const services = {
+			'1': {
+				image: 'alpine:latest',
+				imageId: 11,
+				serviceName: 'one',
+				restart: 'unless-stopped',
+				running: true,
+				command: 'sleep infinity',
+				stop_signal: 'SIGKILL',
+				networks: ['default'],
+				labels: {},
+				environment: {},
+			},
+			'2': {
+				image: 'alpine:latest',
+				imageId: 12,
+				serviceName: 'two',
+				restart: 'unless-stopped',
+				running: true,
+				command: 'sleep infinity',
+				stop_signal: 'SIGKILL',
+				networks: ['default'],
+				labels: {},
+				environment: {},
+			},
+		};
+		await setTargetState({
+			config: {},
+			apps: {
+				'123': {
+					name: 'test-app',
+					commit: 'deadbeef',
+					releaseId: 1,
+					services,
+					networks: {
+						default: {
+							driver: 'bridge',
+							ipam: {
+								config: [
+									{ gateway: '192.168.91.1', subnet: '192.168.91.0/24' },
+								],
+								driver: 'default',
+							},
+						},
+					},
+					volumes: {},
+				},
+			},
+		});
+
+		const state = await getCurrentState();
+		expect(
+			state.apps['123'].services.map((s: any) => s.serviceName),
+		).to.deep.equal(['one', 'two']);
+
+		// Network should have custom ipam config
+		const customNet = await docker.getNetwork('123_default').inspect();
+		expect(customNet)
+			.to.have.property('IPAM')
+			.to.deep.equal({
+				Config: [{ Gateway: '192.168.91.1', Subnet: '192.168.91.0/24' }],
+				Driver: 'default',
+				Options: {},
+			});
+
+		// Network should have custom ipam label
+		expect(customNet)
+			.to.have.property('Labels')
+			.to.have.property('io.balena.private.ipam.config');
+
+		const containers = await docker.listContainers();
+		expect(
+			containers.map(({ Names, State }) => ({ Name: Names[0], State })),
+		).to.have.deep.members([
+			{ Name: '/one_11_1_deadbeef', State: 'running' },
+			{ Name: '/two_12_1_deadbeef', State: 'running' },
+		]);
+		const containerIds = containers.map(({ Id }) => Id);
+
+		await setTargetState({
+			config: {},
+			apps: {
+				'123': {
+					name: 'test-app',
+					commit: 'deadca1f',
+					releaseId: 2,
+					services,
+					networks: {
+						default: {},
+					},
+					volumes: {},
+				},
+			},
+		});
+
+		const updatedContainers = await docker.listContainers();
+		expect(
+			updatedContainers.map(({ Names, State }) => ({ Name: Names[0], State })),
+		).to.have.deep.members([
+			{ Name: '/one_11_2_deadca1f', State: 'running' },
+			{ Name: '/two_12_2_deadca1f', State: 'running' },
+		]);
+
+		// Container ids must have changed
+		expect(updatedContainers.map(({ Id }) => Id)).to.not.have.members(
+			containerIds,
+		);
+
+		// Network should not have custom ipam config
+		const defaultNet = await docker.getNetwork('123_default').inspect();
+		expect(defaultNet)
+			.to.have.property('IPAM')
+			.to.not.deep.equal({
+				Config: [{ Gateway: '192.168.91.1', Subnet: '192.168.91.0/24' }],
+				Driver: 'default',
+				Options: {},
+			});
+
+		// Network should not have custom ipam label
+		expect(defaultNet)
+			.to.have.property('Labels')
+			.to.not.have.property('io.balena.private.ipam.config');
 	});
 
 	it('updates an app with two services with a network removal', async () => {

test/unit/compose/app.spec.ts

@@ -1458,7 +1458,14 @@ describe('compose/app', () => {
 				services: [
 					await createService(
 						{ appId: 1, serviceName: 'dep' },
-						{ state: { containerId: 'dep-id' } },
+						{
+							state: {
+								containerId: 'dep-id',
+								createdAt: new Date(Date.now() - 5 * 1000),
+								// Container was started 5 after creation
+								startedAt: new Date(),
+							},
+						},
 					),
 				],
 				networks: [DEFAULT_NETWORK],
@@ -1475,7 +1482,7 @@ describe('compose/app', () => {
 				.that.deep.includes({ serviceName: 'main' });
 		});
 
-		it('should not start a container when it depends on a service that is not running', async () => {
+		it('should not start a container when it depends on a service that has not been started yet', async () => {
 			const current = createApp({
 				services: [
 					await createService(
@@ -1535,7 +1542,14 @@ describe('compose/app', () => {
 				services: [
 					await createService(
 						{ appId: 1, serviceName: 'dep' },
-						{ state: { containerId: 'dep-id' } },
+						{
+							state: {
+								containerId: 'dep-id',
+								createdAt: new Date(Date.now() - 5 * 1000),
+								// Container was started 5 after creation
+								startedAt: new Date(),
+							},
+						},
 					),
 				],
 				networks: [DEFAULT_NETWORK],
@@ -2399,5 +2413,19 @@ describe('compose/app', () => {
 			const [releaseLockStep] = expectSteps('releaseLock', steps, 1);
 			expect(releaseLockStep).to.have.property('appId').that.equals(1);
 		});
+
+		it('should infer a releaseLock step when removing an app', async () => {
+			const current = createApp({
+				services: [],
+				networks: [],
+			});
+
+			const steps = current.stepsToRemoveApp({
+				...defaultContext,
+				lock: mockLock,
+			});
+			const [releaseLockStep] = expectSteps('releaseLock', steps, 1);
+			expect(releaseLockStep).to.have.property('appId').that.equals(1);
+		});
 	});
 });

test/unit/compose/network.spec.ts

@@ -183,6 +183,8 @@ describe('compose/network', () => {
 				'io.balena.supervised': 'true',
 				'io.balena.app-id': '12345',
 				'com.docker.some-label': 'yes',
+				// This label should be present as we've defined a custom ipam config
+				'io.balena.private.ipam.config': 'true',
 			});
 
 			expect(dockerConfig.Options).to.deep.equal({
@@ -344,12 +346,14 @@ describe('compose/network', () => {
 					'io.resin.features.something': '123',
 					'io.balena.features.dummy': 'abc',
 					'io.balena.supervised': 'true',
+					'io.balena.private.ipam.config': 'true',
 				} as NetworkInspectInfo['Labels'],
 			} as NetworkInspectInfo);
 
 			expect(network.config.labels).to.deep.equal({
 				'io.balena.features.something': '123',
 				'io.balena.features.dummy': 'abc',
+				'io.balena.private.ipam.config': 'true',
 			});
 		});
 	});
@@ -425,34 +429,32 @@ describe('compose/network', () => {
 	});
 
 	describe('comparing network configurations', () => {
-		it('ignores IPAM configuration', () => {
-			const network = Network.fromComposeObject('default', 12345, 'deadbeef', {
-				ipam: {
-					driver: 'default',
-					config: [
-						{
-							subnet: '172.20.0.0/16',
-							ip_range: '172.20.10.0/24',
-							gateway: '172.20.0.1',
-						},
-					],
-					options: {},
+		it('distinguishes a network with custom ipam config from a network without', () => {
+			const customIpam = Network.fromComposeObject(
+				'default',
+				12345,
+				'deadbeef',
+				{
+					ipam: {
+						driver: 'default',
+						config: [
+							{
+								subnet: '172.20.0.0/16',
+								gateway: '172.20.0.1',
+							},
+						],
+						options: {},
+					},
 				},
-			});
-			expect(
-				network.isEqualConfig(
-					Network.fromComposeObject('default', 12345, 'deadbeef', {}),
-				),
-			).to.be.true;
+			);
+			const noCustomIpam = Network.fromComposeObject(
+				'default',
+				12345,
+				'deadbeef',
+				{},
+			);
 
-			// Only ignores ipam.config, not other ipam elements
-			expect(
-				network.isEqualConfig(
-					Network.fromComposeObject('default', 12345, 'deadbeef', {
-						ipam: { driver: 'aaa' },
-					}),
-				),
-			).to.be.false;
+			expect(customIpam.isEqualConfig(noCustomIpam)).to.be.false;
 		});
 
 		it('compares configurations recursively', () => {