Should the 10 second grace period before sigkill be discussed? #48394
Replies: 1 comment
-
Thanks for asking! It's hard to pick a good default for this, and any different default will likely result in being "better" for some use-cases and "worse" for others. The current default helps in scenarios where the container may not be handling signals, which is quite common if a pseudo-TTY is attached, e.g.; docker run -dit --name foo busybox
time docker stop foo
foo
________________________________________________________
Executed in 10.17 secs fish external
usr time 13.37 millis 0.20 millis 13.16 millis
sys time 13.24 millis 1.06 millis 12.18 millis Without the timeout, the above, would never complete. Some improvements in this area were made as well to provide slightly more control, for example;
While the above works well for those scenarios, I concur that it may not ba a good one to choose for containers dealing with state, such as database-containers. I'm not sure if there's a good solution for that, at least not without it being a breaking change; while docker makes it easy to run a container from an image, and in doing so may help with pain-points such as dependency management, it won't take away from the fact that the user must get themselves familiar with the software they're running. If you're running (e.g.) PostgreSQL, you'd still need to know how it must be configured for your specific needs. And configuring it will therefore involve configuring both the software running in the container (postresql config), as well as configuration of the container (setting proper limits, attaching the right volumes for storage, but also setting timeouts like the one discussed here). So.. are no improvements possible? I think there are; besides documentation (mentioned above), I think some improvements could be possible; some of them would have to be taken carefully to prevent breaking users. I think UX improvements could be made; for example, docker stop foo
Sending SIGTERM
Waiting for container to gracefully shutdown 10 9 8 7 ...
Container did not terminate within 10 seconds. Forcefully stopping the container using SIGKILL We've been discussing more "interactive" approaches on the CLI, which could ask the user to either cancel or proceed with forcefully terminating; docker stop foo
Sending SIGTERM
Container did not terminate within 10 seconds. Send SIGKILL? [n/Y] Y
Forcefully stopping the container using SIGKILL Some (external) tooling to help and verify container configurations may also be useful for some scenarios (but probably out of scope for the core functionality of the docker engine itself). |
Beta Was this translation helpful? Give feedback.
-
As sysadmin, I was discussing the sigterm handling and the grace period with an application developer I work with.
He was not sure his app would exit in time to avoid a sigkill. I changed the grace period for this container but the question still bug me...
I find this SO answer (and its comments) interesting. It is harsh but I guess it makes a point.
I get how much convenient is this 10 second grace period for big container farms or development container. But it seems dangerous as a default value ? Outside of containers I sometimes see postfix or database software that takes longer to exit.
I wonder if all the app I host within docker were containerized with this limit in mind. And I’m surprised it doesn't cause more corrupted data in practice (or I did not found the one complaining).
The only answer I fond on the question seems to imply that the 10s value was never discussed.
I'd love to know what docker devs or community members think about this!
Is 10s too short for a default grace period?
Is it a relevant question? Is it a good time to discuss it?
Beta Was this translation helpful? Give feedback.
All reactions