| | @@ -32,7 +32,7 @@ |
| 32 | 32 | # Under web-only egress the relay's own HTTPS needs the egress CA (src/egress.ts). |
| 33 | 33 | env -i PATH="$sys_path" ${NODE_EXTRA_CA_CERTS:+"NODE_EXTRA_CA_CERTS=$NODE_EXTRA_CA_CERTS"} DIFFINERY_RELAY_HOST="$host" DIFFINERY_RELAY_UPSTREAM="https://$host" DIFFINERY_RELAY_PORT="$relay_port" \ |
| 34 | 34 | DIFFINERY_RELAY_CERT="$state/relay.crt" DIFFINERY_RELAY_KEY="$state/relay.key" \ |
| 35 | | - setsid -f node /opt/diffinery/agent.mjs --registry-relay >/var/log/diffinery-relay.log 2>&1 </dev/null |
| 35 | + setsid -f node /opt/diffinery/agent.mjs --registry-relay >/var/log/diffinery-relay.log 2>&1 </dev/null 9>&- |
| 36 | 36 | for _ in $(seq 1 80); do |
| 37 | 37 | if (exec 3<>"/dev/tcp/127.0.0.1/$relay_port") 2>/dev/null; then |
| 38 | 38 | echo "$host" >"$state/relay.host" |
| | @@ -56,7 +56,9 @@ |
| 56 | 56 | echo "The registry relay did not start, so image layers over 100 MB can't be pushed to $host:" >&2 |
| 57 | 57 | tail -n 5 /var/log/diffinery-relay.log >&2 2>/dev/null |
| 58 | 58 | fi |
| 59 | | - env -i PATH="$sys_path" "${proxy[@]}" setsid -f dockerd >/var/log/dockerd.log 2>&1 </dev/null |
| 59 | + # The daemons must not inherit the lock (fd 9): they would hold it for good, and a second |
| 60 | + # docker command that arrives while this one is still starting the daemon would wait forever. |
| 61 | + env -i PATH="$sys_path" "${proxy[@]}" setsid -f dockerd >/var/log/dockerd.log 2>&1 </dev/null 9>&- |
| 60 | 62 | for _ in $(seq 1 240); do "$real" version >/dev/null 2>&1 && break; sleep 0.25; done |
| 61 | 63 | "$real" version >/dev/null 2>&1 || { echo "The Docker daemon did not start:" >&2; tail -n 20 /var/log/dockerd.log >&2; exit 1; } |
| 62 | 64 | fi |