From 2e033590067d75f8b9e51eb37a2aeab38dc9743e Mon Sep 17 00:00:00 2001 From: Delicious233 <101502465+DeliciousBuding@users.noreply.github.com> Date: Mon, 13 Jul 2026 11:18:50 +0800 Subject: [PATCH] fix: add tini as init to reap Docker healthcheck zombie children Root cause: server-hub runs as PID 1 in the container (entrypoint exec). Docker healthcheck spawns 'wget -qO- http://localhost:8080/health' every 30-90s inside the container PID namespace. When these children exit, Go runtime only reaps processes started via os/exec - not externally injected Docker healthcheck children. Result: ~150 wget zombies accumulated over 3 days on production (hk2 + us1). Fix: tini as PID 1 handles SIGCHLD and reaps all orphaned children. Standard Docker best practice for non-C-native binaries. Closes #420. --- hub-server/deployments/Dockerfile | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/hub-server/deployments/Dockerfile b/hub-server/deployments/Dockerfile index 2046606f7..0a41a7a2d 100644 --- a/hub-server/deployments/Dockerfile +++ b/hub-server/deployments/Dockerfile @@ -36,9 +36,11 @@ FROM alpine:3.21 # Single RUN to minimise layers: upgrade base packages, install # runtime deps (ca-certificates for TLS, tzdata for timezones, -# wget for HEALTHCHECK), configure nsswitch, create non-root user. +# wget for HEALTHCHECK, tini as init process (reaps zombie children +# that Docker healthcheck injects into the PID namespace), configure +# nsswitch, create non-root user. RUN apk upgrade --no-cache \ - && apk add --no-cache ca-certificates tzdata wget \ + && apk add --no-cache ca-certificates tzdata wget tini \ && echo "hosts: files dns" > /etc/nsswitch.conf \ && adduser -D -h /app agenthub @@ -65,5 +67,5 @@ EXPOSE 8080 HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \ CMD wget -qO- http://localhost:8080/health || exit 1 -ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"] +ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/docker-entrypoint.sh"] CMD ["./server-hub"]