Steps to replicate the issue (include links if applicable):
- Construct an application that uses a signal handler to shutdown cleanly
- Have a fixed entrypoint (as supported by buildpack)
What happens?:
The fixed entrypoint is wrapped in sh which does not pass signals down to the main process.
This is historical logic to support filelogging, but is wrapping all buildpack with no filelogging in sh (no bash logic).
What should have happened instead?:
The fixed entrypoint should be run, with all signals passed from the runtime.
Other information (browser name/version, screenshots, etc.):
Example reproduction;
- Build and run application
` $ toolforge build start --image-name broken-signals https://github.com/cluebotng/toolforge-broken-signal-handling.git $ toolforge jobs run --image tool-cluebotng/broken-signals --command run-logic --continuous broken-signals `
- Observe the launcher has been wrapped
tools.cluebotng@tools-bastion-15:~$ kubectl get deployment broken-signals -o json | jq .spec.template.spec.containers[0].command [ "/bin/sh", "-c", "--", "launcher run" ]
- Verify the signal handler functions as expected from within the container
tools.cluebotng@tools-bastion-15:~$ kubectl exec broken-signals-98799f87f-697s6 -- bash -c 'ps | grep -E "php$" | awk "{print \$1}" | xargs kill'
tools.cluebotng@tools-bastion-15:~$ kubectl logs broken-signals-98799f87f-697s6
Recieved signal: 15- Verify the signal is not propagated from pid 1
tools.cluebotng@tools-bastion-15:~$ kubectl exec broken-signals-98799f87f-697s6 -- bash -c 'kill 1' tools.cluebotng@tools-bastion-15:~$ kubectl logs broken-signals-98799f87f-697s6 Recieved signal: 15
- Verify no signal propagated from pod termination (as expected, since pid 1 eats it);
tools.cluebotng@tools-bastion-15:~$ kubectl logs broken-signals-98799f87f-697s6 -f & [1] 245803 tools.cluebotng@tools-bastion-15:~$ Recieved signal: 15 tools.cluebotng@tools-bastion-15:~$ kubectl delete pod broken-signals-98799f87f-697s6 pod "broken-signals-98799f87f-697s6" deleted [1]+ Done kubectl logs broken-signals-98799f87f-697s6 -f tools.cluebotng@tools-bastion-15:~$
This has annoying side effects such as long running bots being able to save persistence on restart.
The file logging logic should not wrap in a shell unless it is needed - though that is easier said than done as the side effect is command supports shellisms - build pack is documented to not be supported in doing this (at least in terms of the launcher env), so that should be a smaller amount of surface area to blow up.