shim/docker: handle SIGTERM & SIGINT?
pepyakin opened this issue · 5 comments
Normally, SIGTERM & SIGINT signals terminate a receiving process, unless overriden. However, the PID 1 process is special cased and doesn't have this behavior. So those signals are ignored.
In Docker, a container's entrypoint is spawned as PID 1 and thus is not killable by default.
One workaround for that is to use tini or alike. We could also just override the default signal handlers. We should ensure however no surprises when running under docker.
IMO the correct approach to this is not to handle it within the binary itself, but just to write our own containers which use tini or a base image which packages a proper init handler: https://github.com/phusion/baseimage-docker
Init process is now part of recent docker versions (based on tini).
For compose: https://docs.docker.com/compose/compose-file/compose-file-v3/#init
For docker run: https://docs.docker.com/engine/reference/run/#specify-an-init-process
I'm fairly inexperienced with docker, but the docker run --init needs to be invoked by the end-user, correct? In that case, it's still quite easy to forget. In the docker-compose case it seems to work well.
Still w.r.t. the initial issue scope, I suggest we close this and decide not to explicitly handle signals in any special way within the shim. The docker containers we provide, docker compose, or docker run user can handle the PID 1 problem correctly.
Agree. FWIW, in my containers, I manually included tini which works great.