Merge pull request 'sandbox: init=true so Chromium zombies get reaped' (#3) from sandbox-init-tini into main

Reviewed-on: #3
2026-07-11 19:07:24 +00:00
parent 212e68f6b1 9a5e24eeba
commit bc39f854d8
1 changed files with 5 additions and 0 deletions
@@ -133,6 +133,11 @@ impl SandboxDriver for DockerDriver {
            memory: Some(spec.memory_bytes),
            nano_cpus: Some(spec.nano_cpus),
            pids_limit: Some(spec.pids_limit),
            // Run tini as PID 1 so it reaps re-parented children (Chromium
            // spawns short-lived helper/crashpad processes). `sleep infinity`
            // never wait()s, so without this they accumulate as zombies and
            // eventually exhaust `pids_limit` in long-lived browser sandboxes.
            init: Some(true),
            ..Default::default()
        };
        let body = ContainerCreateBody {