Write the registry's trust into the runtime's file and reload the runtime instead of restarting it; prefix reload-on like restart-on (hq ADR 0102)

internal/overlay/generator_test.go

@@ -1,6 +1,7 @@
 package overlay
 
 import (
+	"fmt"
 	"strings"
 	"testing"
 )
@@ -44,13 +45,20 @@ func TestTheNetworkCarriesRegistryTrust(t *testing.T) {
 	if file == nil || service == nil {
 		t.Fatalf("the trust file or its reload is missing: %v", trusted)
 	}
-	if file["path"] != "/etc/docker/daemon.json" || file["merge"] != "json" {
-		t.Fatalf("the trust is not a merged daemon.json: %v", file)
+	if file["path"] != "/etc/docker/daemon.json" || file["merge"] != "json" || file["into"] != "json" {
+		t.Fatalf("the trust is not written into daemon.json (ADR 0102): %v", file)
 	}
 	if content, _ := file["content"].(string); !strings.Contains(content, `"anchor.internal:5000"`) {
 		t.Fatalf("the trust does not name the store: %v", file["content"])
 	}
 	if service["unit"] != "docker.service" {
-		t.Fatalf("the reload does not restart the runtime: %v", service)
+		t.Fatalf("the reload is not the runtime's: %v", service)
+	}
+	// Reloaded, never restarted: a restart stops every container on the machine (ADR 0102).
+	if _, restarts := service["restart-on"]; restarts {
+		t.Fatalf("the runtime is restarted for its trust: %v", service)
+	}
+	if fmt.Sprint(service["reload-on"]) != "[registry-trust]" {
+		t.Fatalf("the runtime is not reloaded for its trust: %v", service)
 	}
 }