add tini (#383)

* add tini

* move gpg and dirmngr to build deps

Dockerfile

@@ -7,12 +7,15 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         procps \
         python3 \
         runit \
-        socat \
-    && rm -rf /var/lib/apt/lists/*
+        socat
 
 COPY requirements.txt build-haproxy.sh \
     /marathon-lb/
 
+ENV TINI_VERSION v0.13.1
+ADD https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini /tini
+ADD https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini.asc /tini.asc
+
 RUN set -x \
     && buildDeps=' \
         gcc \
@@ -27,24 +30,28 @@ RUN set -x \
         python3-pip \
         python3-setuptools \
         wget \
+        gpg \
+        dirmngr \
     ' \
     && apt-get update \
-        && apt-get install -y --no-install-recommends $buildDeps \
-        && rm -rf /var/lib/apt/lists/* \
+    && apt-get install -y --no-install-recommends $buildDeps \
+    && rm -rf /var/lib/apt/lists/* \
 # Install Python packages with --upgrade so we get new packages even if a system
 # package is already installed. Combine with --force-reinstall to ensure we get
 # a local package even if the system package is up-to-date as the system package
 # will probably be uninstalled with the build dependencies.
     && pip3 install --no-cache --upgrade --force-reinstall -r /marathon-lb/requirements.txt \
     && /marathon-lb/build-haproxy.sh \
+    && gpg --keyserver ha.pool.sks-keyservers.net --recv-keys 595E85A6B1B4779EA4DAAEC70B588DFF0527A9B7 \
+    && gpg --verify /tini.asc \
+    && chmod +x /tini \
     && apt-get purge -y --auto-remove $buildDeps
 
 COPY  . /marathon-lb
 
 WORKDIR /marathon-lb
 
-ENTRYPOINT [ "/marathon-lb/run" ]
-
+ENTRYPOINT [ "/tini", "-g", "--", "/marathon-lb/run" ]
 CMD [ "sse", "--health-check", "--group", "external" ]
 
 EXPOSE 80 443 9090 9091

README.md

@@ -18,6 +18,7 @@ fast, efficient, battle-tested, highly available load balancer with many advance
  * Automated Docker image builds ([mesosphere/marathon-lb](https://hub.docker.com/r/mesosphere/marathon-lb))
  * Global HAProxy templates which can be supplied at launch
  * Supports IP-per-task integration, such as [Project Calico](https://github.com/projectcalico/calico-containers)
+ * Include [tini](https://github.com/krallin/tini) zombies reaper
 
 ### Getting Started
 
@@ -349,6 +350,15 @@ specify it.  The range is configured using the `--min-serv-port-ip-per-task` and
 assignment is not guaranteed if you change the current set of deployed apps. In
 other words, when you deploy a new app, the port assignments may change.
 
+
+## Zombies reaping
+
+When running within isolated containers, you may have to care about reaping orphan child processes.
+Haproxy typicaly produce orphan processes because of it's two steps reload machanism.
+Marathon-lb is using [tini](https://github.com/krallin/tini) for this purpose.
+When running in a container whitout pid namespace isolation, setting the `TINI_SUBREAPER` environnement variable is recommended.
+
+
 ## Contributing
 
 PRs are welcome, but here are a few general guidelines: