cloud-hosting-platform/cloud-node-container
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use dumb-init --single-child for tini signal parity

Browse Source 
Code review caught that dumb-init is not a drop-in replacement for tini as
invoked. tini without -g forwards a signal only to its direct child;
dumb-init without --single-child calls setsid() and forwards to the entire
process group. Verified against dumb-init 1.2.5 with a parent that catches
SIGTERM and does not forward it: under the default the grandchild is still
signalled, under --single-child it is not.

Without the flag, `docker stop` delivered SIGTERM to the tenant's node
process directly and simultaneously with pm2, bypassing pm2's kill_timeout
shutdown sequencing. Since the wedged-container fix in #1 introduced tini
specifically for its signal forwarding, the previous commit's claim that
the two are equivalent did not hold.

Also corrects MEMORY-GUIDE.md, which still described header buffers as
"reduced" after they were raised from 2 1k to the nginx default of 4 8k.
The nginx memory budget is unchanged: these buffers are allocated per
request only when a request needs them, not preallocated per connection.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
shadowdao
2026-08-03 09:06:10 -07:00
co-authored by Claude Opus 5
parent 6651872729
commit 80b03c884e
2 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MEMORY-GUIDE.md
+6 -2
View File
@@ -18,7 +18,7 @@
| **Base AlmaLinux 10** | ~80-120MB | Minimal base system |
| **Node.js Runtime** | ~30-50MB | V8 JavaScript engine |
| **PM2 Process Manager** | ~15-25MB | Process monitoring and management |
| **Nginx (Optimized)** | ~8-15MB | Single worker, limited buffers |
| **Nginx (Optimized)** | ~8-15MB | Single worker; header buffers allocated on demand |
| **User Application** | ~50-200MB | Depends on application complexity |
| **Memcached (DEV mode)** | ~10-15MB | 32MB memory limit, actual usage varies |
| **System Overhead** | ~30-50MB | Logging, cron, system processes |
@@ -33,7 +33,11 @@
2. **PM2 Memory Restart**: Applications restart at 256MB usage
3. **Memcached Limit**: 32MB maximum cache size
4. **Nginx Workers**: Single worker process for memory efficiency
5. **Buffer Limits**: Reduced client buffer sizes
5. **Buffer Limits**: Reduced client body buffer (16k) and 8MB max body size.
Header buffers use the nginx default (`large_client_header_buffers 4 8k`)
rather than a reduced value -- a smaller limit rejects ordinary session
cookies with a 400. These are allocated per request only when a request
actually needs them, not preallocated per connection.
6. **Log Buffering**: 2-minute flush intervals to reduce I/O
### Application-Level Recommendations
scripts/entrypoint.sh
+7 -1
View File
@@ -102,6 +102,12 @@ tail -F /home/$user/logs/nginx/access.log \
# When pm2 exits (e.g. max_restarts exhausted), dumb-init exits and Docker's
# restart policy brings the container back.
# (dumb-init replaces tini, which is not packaged in EPEL 10.)
#
# --single-child is required for parity with tini. dumb-init defaults to
# setsid() plus forwarding signals to the whole process group, whereas tini
# without -g forwards only to its direct child. Without this flag a
# `docker stop` would signal the tenant's node process directly and at the
# same moment as pm2, bypassing pm2's kill_timeout shutdown sequencing.
echo "Starting PM2 as user $user (under dumb-init as PID 1)..."
cd /home/$user/app
exec dumb-init -- su - $user -c "cd /home/$user/app && NODE_ENV=production pm2 start ecosystem.config.js --no-daemon"
exec dumb-init --single-child -- su - $user -c "cd /home/$user/app && NODE_ENV=production pm2 start ecosystem.config.js --no-daemon"