fix: make restart honor every CLI flag exactly like start

Since fc2dbda, restart reloads the workspace config between its stop
and start, because main's argument scheme had loaded the booted
snapshot while the container was alive and that snapshot is gone after
the stop. The reload silently clobbered every flag the CLI override
pass had applied: restart --hw-access -f came up with hardware access
disabled and in the background, and -B binds vanished the same way.
start was unaffected only because it never reloads.

The architecture's invariant is that CLI overrides are applied after
any disk load; restart inverted it because the override pass was
welded inline into main(). Extract it into ds_apply_cli_overrides()
and re-run it right after restart's reload. Daemon mode is covered
for free since workers re-exec the full binary with the client's
argv; the socketd bridge passes NULL since its config arrives over
the wire with no CLI overrides to re-apply.

The extraction keeps every case byte-identical except where a second
run over the same argv demanded it: -B now tokenizes a strdup'd copy
instead of writing NULs into argv, -n validates into a scratch buffer
since the discovery pass already captured the names, and -u becomes a
no-op for the same reason. long_options moves to file scope so the
helper can see it.

Three more gaps separated restart from start, all closed here. --reset
moved inside ds_apply_cli_overrides: a pre-scan wipes the config
before the other flags land, so restart resets and re-applies exactly
like start instead of surviving by accident of the eager workspace
save; main's separate reset block and its dead cli_net_mode plumbing
are gone. --conf skips restart's reload entirely: an explicit config
file never read the booted snapshot, so cfg already holds that file
plus the overrides, where the old reload overwrote them with the
workspace copy and then wrote that back over the user's own file. And
the by-name reload now starts from a clean slate via
ds_config_reset_defaults, split out of apply_reset_config without its
trailing save: ds_config_load only overlays keys present in the file,
so loading into the lived-in snapshot cfg left stale values behind
for every conditionally-written key and unioned port_forwards and
upstream_ifaces across the two loads. The reset also frees env vars,
closing a stale-environment hazard.

The result is one pipeline for both commands: load, reset if asked,
apply CLI overrides, save, boot. Persistence was already shared:
start_rootfs mirrors the effective config to the workspace
unconditionally before the fork, and restart ends in start_rootfs.

The enforce_nat_safety argv rescan stays as belt and braces.

Signed-off-by: ravindu644 <droidcasts@protonmail.com>

Author: ravindu644

src/config.c

@@ -988,8 +988,12 @@ int ds_config_save_by_name(const char *name, struct ds_config *cfg) {
   return ds_config_save(config_path, cfg);
 }
 
-void apply_reset_config(struct ds_config *cfg, int cli_net_mode_set,
-                        enum ds_net_mode cli_net_mode) {
+/* Wipe cfg back to defaults while preserving container identity. Shared by
+ * --reset and by restart's post-stop reload, which must start from the same
+ * clean slate a fresh start gets: ds_config_load only overlays the keys
+ * present in the file, so loading into a lived-in cfg would leave stale
+ * snapshot values behind for every conditionally-written key. */
+void ds_config_reset_defaults(struct ds_config *cfg) {
   char save_name[256], save_rootfs[PATH_MAX], save_img[PATH_MAX];
   char save_config[PATH_MAX], save_prog[64], save_uuid[64];
   int save_is_img = cfg->is_img_mount;
@@ -1029,6 +1033,11 @@ void apply_reset_config(struct ds_config *cfg, int cli_net_mode_set,
   cfg->unknown_head = save_head;
   cfg->unknown_tail = save_tail;
   cfg->block_nested_ns = save_block_nested_ns;
+}
+
+void apply_reset_config(struct ds_config *cfg, int cli_net_mode_set,
+                        enum ds_net_mode cli_net_mode) {
+  ds_config_reset_defaults(cfg);
 
   if (cli_net_mode_set)
     cfg->net_mode = cli_net_mode;

src/container.c

@@ -1992,7 +1992,8 @@ int show_info(struct ds_config *cfg, int trust_cfg_pid) {
   return 0;
 }
 
-int restart_rootfs_with_timeout(struct ds_config *cfg, int timeout_seconds) {
+int restart_rootfs_with_timeout(struct ds_config *cfg, int timeout_seconds,
+                                int argc, char **argv) {
   pid_t pid = 0;
   if (!is_container_running(cfg, &pid) || pid <= 0) {
     ds_error("Container '%s' is not running or invalid.", cfg->container_name);
@@ -2005,16 +2006,27 @@ int restart_rootfs_with_timeout(struct ds_config *cfg, int timeout_seconds) {
   /* The stop above tore down using the booted snapshot (loaded while the
    * container was alive). It is gone now, so reloading by name returns the
    * workspace copy - reload it so host-side container.config edits made while
-   * it ran take effect on this restart. start_rootfs re-derives the preserved
-   * mount from the on-disk .mount sidecar, so losing the snapshot paths is
-   * fine. */
-  free_config_binds(cfg);
-  ds_config_load_by_name(cfg->container_name, cfg);
+   * it ran take effect on this restart, then re-apply the CLI overrides
+   * (--reset included) so every flag behaves exactly as it would on a fresh
+   * start. An explicit --conf never read the booted snapshot in the first
+   * place: cfg already holds that file plus the overrides, so skip the
+   * reload entirely. start_rootfs re-derives the preserved mount from the
+   * on-disk .mount sidecar, so losing the snapshot paths is fine. */
+  if (!cfg->config_file_specified) {
+    /* Clean slate first: the load only overlays keys present in the file, so
+     * without the reset every conditionally-written key would keep its value
+     * from the booted snapshot, and port/upstream lists would union across
+     * the two loads instead of being replaced. */
+    ds_config_reset_defaults(cfg);
+    ds_config_load_by_name(cfg->container_name, cfg);
+    if (argv && ds_apply_cli_overrides(argc, argv, cfg, 0) != 0)
+      return -1;
+  }
   putchar('\n');
   print_ds_banner();
   return start_rootfs(cfg);
 }
 
-int restart_rootfs(struct ds_config *cfg) {
-  return restart_rootfs_with_timeout(cfg, DS_STOP_TIMEOUT);
+int restart_rootfs(struct ds_config *cfg, int argc, char **argv) {
+  return restart_rootfs_with_timeout(cfg, DS_STOP_TIMEOUT, argc, argv);
 }

src/include/droidspace.h

@@ -558,6 +558,7 @@ void ds_config_free(struct ds_config *cfg);
 int ds_split_flags(const char *str, char ***out_argv, int *out_argc);
 void ds_free_split_flags(char **argv, int argc);
 char *ds_config_auto_path(const char *rootfs_path);
+void ds_config_reset_defaults(struct ds_config *cfg);
 void apply_reset_config(struct ds_config *cfg, int cli_net_mode_set,
                         enum ds_net_mode cli_net_mode);
 void parse_privileged(const char *value, struct ds_config *cfg);
@@ -868,8 +869,14 @@ int run_in_rootfs(struct ds_config *cfg, int argc, char **argv,
                   const char *as_user);
 int show_info(struct ds_config *cfg, int trust_cfg_pid);
 int show_container_usage(struct ds_config *cfg);
-int restart_rootfs(struct ds_config *cfg);
-int restart_rootfs_with_timeout(struct ds_config *cfg, int timeout_seconds);
+/* argc/argv: the process's original arguments, so restart can re-apply CLI
+ * overrides after its post-stop config reload. NULL argv skips that step. */
+int restart_rootfs(struct ds_config *cfg, int argc, char **argv);
+int restart_rootfs_with_timeout(struct ds_config *cfg, int timeout_seconds,
+                                int argc, char **argv);
+/* The CLI override pass, lives in main.c. Idempotent over the same argv. */
+int ds_apply_cli_overrides(int argc, char **argv, struct ds_config *cfg,
+                           int strict);
 
 /* documentation.c */