mirror of
https://github.com/pgsty/minio.git
synced 2026-08-09 15:53:28 +03:00
Feng Ruohang
3b8a55deef
The two chroot branches that drop privileges when MINIO_USERNAME/GROUPNAME (and optionally MINIO_UID/GID) are set ran chroot as a child of the entry shell, leaving the shell as PID 1. A SIGTERM from `docker stop` or an orchestrator then went to the shell, which does not forward it, so MinIO was never asked to shut down and was killed after the stop timeout (exit 137) with no "Exiting on signal" log - risking in-flight requests and data at the flush boundary. The default branch already exec's; these two now do too, so MinIO runs as PID 1 and receives the signal directly. Verified in a faithful reproduction of the release runtime layer: all three paths (default, USERNAME only, USERNAME+UID/GID) now stop in ~0.2s with exit 0 and log the graceful shutdown, where the two drop-privilege paths previously timed out to exit 137. Co-authored-by: Claude <noreply@anthropic.com>
27 lines
685 B
Bash
Executable File
27 lines
685 B
Bash
Executable File
#!/bin/sh
|
|
#
|
|
|
|
# If command starts with an option, prepend minio.
|
|
if [ "${1}" != "minio" ]; then
|
|
if [ -n "${1}" ]; then
|
|
set -- minio "$@"
|
|
fi
|
|
fi
|
|
|
|
docker_switch_user() {
|
|
if [ -n "${MINIO_USERNAME}" ] && [ -n "${MINIO_GROUPNAME}" ]; then
|
|
if [ -n "${MINIO_UID}" ] && [ -n "${MINIO_GID}" ]; then
|
|
exec chroot --userspec=${MINIO_UID}:${MINIO_GID} / "$@"
|
|
else
|
|
echo "${MINIO_USERNAME}:x:1000:1000:${MINIO_USERNAME}:/:/sbin/nologin" >>/etc/passwd
|
|
echo "${MINIO_GROUPNAME}:x:1000" >>/etc/group
|
|
exec chroot --userspec=${MINIO_USERNAME}:${MINIO_GROUPNAME} / "$@"
|
|
fi
|
|
else
|
|
exec "$@"
|
|
fi
|
|
}
|
|
|
|
## DEPRECATED and unsupported - switch to user if applicable.
|
|
docker_switch_user "$@"
|