From 3b8a55deef9ca3511a3066b439cf29e57c2b1019 Mon Sep 17 00:00:00 2001 From: Feng Ruohang Date: Wed, 5 Aug 2026 00:53:25 +0800 Subject: [PATCH] fix: exec into the dropped-privilege process so signals reach MinIO The two chroot branches that drop privileges when MINIO_USERNAME/GROUPNAME (and optionally MINIO_UID/GID) are set ran chroot as a child of the entry shell, leaving the shell as PID 1. A SIGTERM from `docker stop` or an orchestrator then went to the shell, which does not forward it, so MinIO was never asked to shut down and was killed after the stop timeout (exit 137) with no "Exiting on signal" log - risking in-flight requests and data at the flush boundary. The default branch already exec's; these two now do too, so MinIO runs as PID 1 and receives the signal directly. Verified in a faithful reproduction of the release runtime layer: all three paths (default, USERNAME only, USERNAME+UID/GID) now stop in ~0.2s with exit 0 and log the graceful shutdown, where the two drop-privilege paths previously timed out to exit 137. Co-authored-by: Claude --- dockerscripts/docker-entrypoint.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dockerscripts/docker-entrypoint.sh b/dockerscripts/docker-entrypoint.sh index bd617cb83..8e19b665f 100755 --- a/dockerscripts/docker-entrypoint.sh +++ b/dockerscripts/docker-entrypoint.sh @@ -11,11 +11,11 @@ fi docker_switch_user() { if [ -n "${MINIO_USERNAME}" ] && [ -n "${MINIO_GROUPNAME}" ]; then if [ -n "${MINIO_UID}" ] && [ -n "${MINIO_GID}" ]; then - chroot --userspec=${MINIO_UID}:${MINIO_GID} / "$@" + exec chroot --userspec=${MINIO_UID}:${MINIO_GID} / "$@" else echo "${MINIO_USERNAME}:x:1000:1000:${MINIO_USERNAME}:/:/sbin/nologin" >>/etc/passwd echo "${MINIO_GROUPNAME}:x:1000" >>/etc/group - chroot --userspec=${MINIO_USERNAME}:${MINIO_GROUPNAME} / "$@" + exec chroot --userspec=${MINIO_USERNAME}:${MINIO_GROUPNAME} / "$@" fi else exec "$@"