fix: serialize Docker client recovery mutations

internal/securefs/securefs.go

@@ -146,6 +146,37 @@ func (s Store) AtomicWrite(path string, data []byte, mode os.FileMode) error {
 	return directory.Sync()
 }
 
+// WithLock serializes an action across processes using a descriptor-anchored,
+// owner-restricted advisory lock file.
+func (s Store) WithLock(path string, action func() error) error {
+	directory, base, err := s.openParent(path, true)
+	if err != nil {
+		return err
+	}
+	defer directory.Close()
+	lock, err := OpenAt(directory, base, unix.O_CREAT|unix.O_RDWR, 0o600)
+	if err != nil {
+		return err
+	}
+	defer lock.Close()
+	if err := regular(lock); err != nil {
+		return err
+	}
+	if s.Owner != nil && (s.Owner.UID != os.Geteuid() || s.Owner.GID != os.Getegid()) {
+		if err := lock.Chown(s.Owner.UID, s.Owner.GID); err != nil {
+			return err
+		}
+	}
+	if err := lock.Chmod(0o600); err != nil {
+		return err
+	}
+	if err := unix.Flock(int(lock.Fd()), unix.LOCK_EX); err != nil {
+		return err
+	}
+	defer func() { _ = unix.Flock(int(lock.Fd()), unix.LOCK_UN) }()
+	return action()
+}
+
 func (s Store) Remove(path string) error {
 	directory, base, err := s.openParent(path, false)
 	if err != nil {