cvm: A better way to remove orphans

basefiles/app-compose.service

@@ -1,6 +1,6 @@
 [Unit]
 Description=App Compose Service
-Requires=docker.service
+Wants=docker.service
 After=docker.service tboot.service
 
 [Service]

basefiles/app-compose.sh

@@ -1,5 +1,10 @@
 #!/bin/sh
 tdxctl notify-host -e "boot.progress" -d "starting containers" || true
+
+docker compose up --remove-orphans -d 2>/dev/null || true
+chmod +x /usr/bin/containerd-shim-runc-v2
+systemctl restart docker
+
 if ! docker compose up --remove-orphans -d; then
     tdxctl notify-host -e "boot.error" -d "failed to start containers"
     exit 1

basefiles/tboot.sh

@@ -1,2 +1,6 @@
 #!/bin/sh
+# Temporarily disable container auto-start
+# This will be re-enabled later by app-compose.sh
+chmod -x /usr/bin/containerd-shim-runc-v2
+
 tdxctl tboot