From 18e97e75ff0360c8267201e4f0564c712b3e8bfa Mon Sep 17 00:00:00 2001
From: Gavin Nugent <g@gnugent.com>
Date: Sat, 6 Jun 2026 11:00:02 +0100
Subject: [PATCH] Guard: bail out for reboot when -Syu replaced the running
 kernel's modules

---
 arch-setup.sh | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/arch-setup.sh b/arch-setup.sh
index 6c872ac..ab3bd42 100755
--- a/arch-setup.sh
+++ b/arch-setup.sh
@@ -94,6 +94,18 @@ fi
 step "1/8 · System updates & essential packages"
 
 pacman -Syu --noconfirm
+
+# If -Syu upgraded the kernel, the running kernel's modules are gone and
+# Docker can't load overlay/netfilter — reboot and re-run (script is
+# safe to re-run; completed steps skip themselves)
+if [ ! -d "/usr/lib/modules/$(uname -r)" ]; then
+    warn "Kernel was upgraded — running kernel $(uname -r) has no modules on disk."
+    warn "Reboot, then re-run this script:"
+    warn "  reboot"
+    warn "  bash arch-setup.sh"
+    exit 1
+fi
+
 # Minimal host package set — omaterm installs everything else it needs
 # (git, tmux, agents, tailscale all live inside its container)
 pacman -S --noconfirm --needed \