From 2c9932bcd6ae3134dfa9384e30b4c3798dd835b3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?okhowang=28=E7=8E=8B=E6=B2=9B=E6=96=87=29?= Date: Mon, 10 Aug 2026 13:28:41 +0800 Subject: [PATCH] Inject `docker-init -s` so it reaps orphans in rootless mode In rootless Docker (e.g. `docker:dind-rootless`), rootlesskit does not create a PID namespace by default, so `docker-init` is not PID 1. tini only reaps zombies when it is PID 1, so without `-s` the orphaned `containerd-shim` processes described in docker-library/docker#318 are not reaped. Pass `-s` to register `docker-init` as a subreaper, ensuring it reaps orphaned descendant processes even when it is not PID 1. This is harmless in non-rootless mode, where `docker-init` is already PID 1. --- dockerd-entrypoint.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dockerd-entrypoint.sh b/dockerd-entrypoint.sh index 77ff1aab3..9debc368d 100755 --- a/dockerd-entrypoint.sh +++ b/dockerd-entrypoint.sh @@ -145,7 +145,8 @@ if [ "$1" = 'dockerd' ]; then find /run /var/run -iname 'docker*.pid' -delete || : # XXX inject "docker-init" (tini) as pid1 to workaround https://github.com/docker-library/docker/issues/318 (zombie container-shim processes) - set -- docker-init -- "$@" + # use -s so docker-init also registers as a subreaper and reaps orphaned processes (e.g. containerd-shim) even when it isn't PID 1, which is the case in rootless mode where rootlesskit does not create a PID namespace by default + set -- docker-init -s -- "$@" iptablesLegacy= if [ -n "${DOCKER_IPTABLES_LEGACY+x}" ]; then