Problem with passing stop signal on nginx alpine docker image

[aswarcewicz]

I observe weird behavior with nginx alpine docker image.

When I use below dockerfile stop signal from docker stop is not received by nginx

FROM nginx:1.23.1-alpine

# s6 overlay for proper signal handling, and allow multi processes in single container
COPY ./s6-overlay-noarch-v3.1.2.1.tar.xz /tmp/s6-overlay-noarch.tar.xz
RUN tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz
COPY ./s6-overlay-x86_64-v3.1.2.1.tar.xz /tmp/s6-overlay-x86_64.tar.xz
ENV S6_KEEP_ENV=1
RUN tar -C / -Jxpf /tmp/s6-overlay-x86_64.tar.xz
RUN rm -rf /tmp/*

COPY ./frontend-app-type.sh /etc/s6-overlay/s6-rc.d/frontend-app/type
COPY ./frontend-app-run.sh /etc/s6-overlay/s6-rc.d/frontend-app/run
RUN touch /etc/s6-overlay/s6-rc.d/user/contents.d/frontend-app

ENTRYPOINT ["/init"]

frontend-app/run is simply run command:

#!/command/execlineb -P
/docker-entrypoint.sh nginx -g "daemon off;"

maybe somebody could tell me what I am doing wrong?

[skarnet]

• Signals are transmitted to the CMD, if any, but they are not directly transmitted to services.
• What happens when you run docker stop is that the signal is sent to pid 1 (which is s6-svscan), that triggers the container shutdown procedure. During this procedure, services are sent a SIGTERM. That should bring them down.
• If nginx isn't receiving its SIGTERM, then it's probably due to your /docker-entrypoint.sh script. Check that it execs into its command line and doesn't interpose a shell process between s6-supervise and nginx. (You can check this by running s6-ps -H.)

[aswarcewicz]

• no cmd is run
• when I run docker stop in my opinion s6 do not receive stop signal (no s6 entries in stdout after docker stop)
• docker-entrypoint.sh comes from original nginx image
• For now I think there is something strange with this nginx image (I don’t know what yet).

[skarnet]

There's something weird indeed. When you run docker stop, the container should definitely be stopping and you should see logs on stdout.

That said, I don't think you should use docker-entrypoint.sh in your nginx service - because nginx is not your entrypoint. Just run the nginx invocation.

[aswarcewicz]

@skarnet

Could you try this minimal Dockerfile?

FROM nginx:1.23.1-alpine
#FROM ubuntu
#RUN apt-get update && apt-get install -y nginx xz-utils
ARG S6_OVERLAY_VERSION=3.1.2.1

ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz /tmp
RUN tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz
ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-x86_64.tar.xz /tmp
RUN tar -C / -Jxpf /tmp/s6-overlay-x86_64.tar.xz
ENTRYPOINT ["/init"]

command to build and run:

docker build -t s6test . && docker run --rm --name s6test s6test

When I use FROM nginx:1.23.1-alpine and try docker stop s6test there is no info from s6 about stopping. When I use FROM ubuntu and try docker stop s6test it looks fine.

Could you tell me what's wrong?

[skarnet]

For some reason, the nginx:1.23.1-alpine image generates a SIGQUIT when it receives a docker stop command. This is probably written somewhere in the image configuration but I don't know where off the top of my head.

This is incorrect. docker stop should, unless otherwise specified, send a SIGTERM.

To s6-svscan, which is pid 1 when you're using s6-overlay, SIGQUIT has a different meaning from SIGTERM, and on SIGQUIT it doesn't run the orderly shutdown sequence but tears down the supervision tree right away. Make sure docker stop always sends a SIGTERM to the container.

[aswarcewicz]

Thanks!