astelm/minio
1
0
Fork 0
mirror of https://github.com/pgsty/minio.git synced 2026-08-09 07:43:29 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix: exec into the dropped-privilege process so signals reach MinIO

Browse Source 
The two chroot branches that drop privileges when MINIO_USERNAME/GROUPNAME
(and optionally MINIO_UID/GID) are set ran chroot as a child of the entry
shell, leaving the shell as PID 1. A SIGTERM from `docker stop` or an
orchestrator then went to the shell, which does not forward it, so MinIO was
never asked to shut down and was killed after the stop timeout (exit 137) with
no "Exiting on signal" log - risking in-flight requests and data at the flush
boundary. The default branch already exec's; these two now do too, so MinIO
runs as PID 1 and receives the signal directly.

Verified in a faithful reproduction of the release runtime layer: all three
paths (default, USERNAME only, USERNAME+UID/GID) now stop in ~0.2s with exit 0
and log the graceful shutdown, where the two drop-privilege paths previously
timed out to exit 137.

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Feng Ruohang
2026-08-05 00:53:25 +08:00
parent 11d79fddc3
commit 3b8a55deef
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dockerscripts/docker-entrypoint.sh
+2 -2
View File
@@ -11,11 +11,11 @@ fi
docker_switch_user() {
if [ -n "${MINIO_USERNAME}" ] && [ -n "${MINIO_GROUPNAME}" ]; then
if [ -n "${MINIO_UID}" ] && [ -n "${MINIO_GID}" ]; then
chroot --userspec=${MINIO_UID}:${MINIO_GID} / "$@"
exec chroot --userspec=${MINIO_UID}:${MINIO_GID} / "$@"
else
echo "${MINIO_USERNAME}:x:1000:1000:${MINIO_USERNAME}:/:/sbin/nologin" >>/etc/passwd
echo "${MINIO_GROUPNAME}:x:1000" >>/etc/group
chroot --userspec=${MINIO_USERNAME}:${MINIO_GROUPNAME} / "$@"
exec chroot --userspec=${MINIO_USERNAME}:${MINIO_GROUPNAME} / "$@"
fi
else
exec "$@"