From 680cb0a2affb0186a810e12c7f01590ce633dd9d Mon Sep 17 00:00:00 2001 From: NGPixel Date: Fri, 9 Oct 2026 02:28:11 -0400 Subject: [PATCH] fix: prevent git leftover zombie processes in docker --- dev/build/Dockerfile | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/dev/build/Dockerfile b/dev/build/Dockerfile index 91ac20fa1..d9424cf98 100644 --- a/dev/build/Dockerfile +++ b/dev/build/Dockerfile @@ -10,6 +10,7 @@ RUN DEBIAN_FRONTEND=noninteractive apt-get update && apt-get install -qy --no-in gnupg \ openssh-client \ pandoc \ + tini \ && rm -rf /var/lib/apt/lists/* RUN mkdir -p /wiki && \ mkdir -p /logs && \ @@ -113,6 +114,18 @@ VOLUME ["/wiki/data/repo"] EXPOSE 3000 EXPOSE 3443 +# An init in front of node, because whatever is PID 1 inherits every orphaned process in the container +# and has to reap it, and node never does. git orphans one on every commit, pull and rebase: each runs +# `git maintenance run --auto --detach` on the way out, which forks into the background whether or not +# there is anything to maintain, and its parent exits -- so a git storage target left a zombie behind +# per page save, thousands of them on a busy wiki. The browser Puppeteer drives forks helpers of its +# own the same way. +# +# `-s` registers tini as a subreaper, so it still collects them when it is not PID 1 itself (`docker +# run --init`, or a pod sharing its process namespace). Signals are forwarded to node unchanged, so the +# graceful shutdown in `index.ts` sees the same SIGTERM it did before. +ENTRYPOINT ["tini", "-s", "--"] + # Web Storage off, which is what it was before Node 26 turned it on by default. # # Nothing here uses `localStorage`, but `lib0` -- under yjs, which is what makes an editing session