Sync bbolt databases on close to prevent corruption

When bbolt is opened with NoSync: true, transactions complete in memory
without fsync to disk. On graceful shutdown, dirty pages in the OS page
cache may not be flushed before Close() returns, leading to corruption
when the filesystem is unmounted or snapshots are taken.

This is particularly problematic with network block devices (Ceph RBD)
and container snapshot workflows where:
1. BuildKit stops gracefully (SIGTERM)
2. Close() returns without syncing dirty pages
3. Unmount forces writeback of partial/torn pages
4. Snapshot captures inconsistent B-tree state

The fix wraps bolt.DB with syncingDB that calls Sync() before Close(),
ensuring all pending writes are flushed to disk during graceful shutdown
while preserving the NoSync performance benefits during normal operation.

Signed-off-by: Aditya Maru <adityamaru@gmail.com>

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: 2 people

util/db/boltutil/db.go

@@ -2,15 +2,40 @@ package boltutil
 
 import (
 	"io/fs"
+	"sync"
 
+	"github.com/moby/buildkit/util/bklog"
 	"github.com/moby/buildkit/util/db"
 	bolt "go.etcd.io/bbolt"
 )
 
+// syncingDB wraps a bolt.DB to ensure data is synced to disk before closing.
+// This is important when using NoSync mode, as otherwise dirty pages may not
+// be flushed to disk before unmount, leading to corruption on network block
+// devices or when taking filesystem snapshots.
+type syncingDB struct {
+	*bolt.DB
+	closeOnce sync.Once
+	closeErr  error
+}
+
+// Close syncs the database to disk before closing.
+// This ensures all pending writes are flushed even when NoSync is enabled,
+// preventing corruption during graceful shutdown. Safe to call multiple times.
+func (s *syncingDB) Close() error {
+	s.closeOnce.Do(func() {
+		if err := s.Sync(); err != nil {
+			bklog.L.Warnf("failed to sync database before close: %v", err)
+		}
+		s.closeErr = s.DB.Close()
+	})
+	return s.closeErr
+}
+
 func Open(p string, mode fs.FileMode, options *bolt.Options) (db.DB, error) {
 	bdb, err := bolt.Open(p, mode, options)
 	if err != nil {
 		return nil, err
 	}
-	return bdb, nil
+	return &syncingDB{DB: bdb}, nil
 }