Code review caught that dumb-init is not a drop-in replacement for tini as
invoked. tini without -g forwards a signal only to its direct child;
dumb-init without --single-child calls setsid() and forwards to the entire
process group. Verified against dumb-init 1.2.5 with a parent that catches
SIGTERM and does not forward it: under the default the grandchild is still
signalled, under --single-child it is not.
Without the flag, `docker stop` delivered SIGTERM to the tenant's node
process directly and simultaneously with pm2, bypassing pm2's kill_timeout
shutdown sequencing. Since the wedged-container fix in #1 introduced tini
specifically for its signal forwarding, the previous commit's claim that
the two are equivalent did not hold.
Also corrects MEMORY-GUIDE.md, which still described header buffers as
"reduced" after they were raised from 2 1k to the nginx default of 4 8k.
The nginx memory budget is unchanged: these buffers are allocated per
request only when a request needs them, not preallocated per connection.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Keeps local Claude Code settings out of the build context alongside the
other editor directories. No effect on the image itself -- the Dockerfile
only copies scripts/, configs/ and examples/ -- but the directory was
being sent to the daemon on every build.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Base image moves from AlmaLinux 9 to 10, which forces two related changes:
EPEL repo URL bumps to the el10 release RPM, and tini is replaced with
dumb-init as PID 1 since tini is not packaged in EPEL 10. Both provide the
signal forwarding and zombie reaping the wedged-container fix relies on.
Nginx 1.26 in AlmaLinux 10 deprecates the `listen ... http2` parameter, so
the server block now uses the separate `http2 on;` directive.
Also fixes three issues that affected WebSocket apps (socket.io, ws):
- `Connection: upgrade` was hardcoded on every proxied request, including
ordinary HTTP. Now driven by a `map $http_upgrade $connection_upgrade`
so only genuine upgrade requests carry it.
- No explicit proxy read/send timeout meant idle WebSockets were cut at
nginx's 60s default. Set to 600s, which clears any sane heartbeat without
pinning connection slots (worker_connections is 512, two per client).
- `large_client_header_buffers 2 1k` returned 400 for any single header
line over 1KB, which session cookies and bearer tokens routinely exceed.
Raised to the nginx default of 4 8k; buffers are allocated on demand, so
this only costs memory for requests that need it.
Verified by rendering the generated config and running it under nginx with
a Node backend: WebSocket handshakes return 101 and reach the upstream
'upgrade' event, polling requests arrive with `Connection: close`, and a
3KB cookie returns 200 where the old buffer setting returned 400.
README gains a WebSocket Support section covering the PM2 cluster-mode
trap, the concurrency ceiling, and reconnects on memory restarts.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
shadowdaoandClaude Opus 5