From 228effab641f5d1f649e8529346330227ba54a3d Mon Sep 17 00:00:00 2001 From: adamaru <232090+adamaru@noreply.gitea.com> Date: Sun, 1 Nov 2026 07:20:20 +0000 Subject: [PATCH] fix(dind): double-fork in s6-notifyoncheck to eliminate zombie processes (#1364) In `scripts/s6/docker/run`, `s6-notifyoncheck` runs without the `-d` flag: ```bash exec s6-notifyoncheck -n 0 dockerd-entrypoint.sh ``` Without `-d`, `s6-notifyoncheck` performs a single fork to execute the background checking process. The parent immediately replaces itself via `exec` with `dockerd-entrypoint.sh` (which calls `exec rootlesskit` on `dind-rootless`). Because only a single fork occurred, the background checking child remains parented to `rootlesskit`. When the check passes and the process terminates: 1. `rootlesskit` did not spawn this process and never reaps it via `waitpid()`. 2. Under standard Linux process semantics, `s6-svscan` (PID 1) cannot adopt or reap the child because its parent (`rootlesskit`) is still running. 3. The terminated process remains as a permanent zombie (`[s6-notifyoncheck] `) for the container's entire lifespan. Adding `-d` instructs `s6-notifyoncheck` to double-fork, detaching the background check so it is immediately adopted by `s6-svscan` (PID 1) and cleanly reaped upon exit. --------- Co-authored-by: silverwind <2021+silverwind@noreply.gitea.com> Reviewed-on: https://gitea.com/gitea/runner/pulls/1364 Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com> Co-authored-by: adamaru <232090+adamaru@noreply.gitea.com> --- scripts/s6/docker/run | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/s6/docker/run b/scripts/s6/docker/run index 1c6781b5..cdfa4ca2 100755 --- a/scripts/s6/docker/run +++ b/scripts/s6/docker/run @@ -1,3 +1,3 @@ #!/usr/bin/env bash -exec s6-notifyoncheck -n 0 dockerd-entrypoint.sh +exec s6-notifyoncheck -d -n 0 dockerd-entrypoint.sh