feat(docker)!: s6-overlay container supervision (salvage of #30136) - #31760

Merged

benbarclay merged 36 commits into

mainfrom

hermes/hermes-bf5898da

May 25, 2026

Commits on May 25, 2026

docs(plans): add s6-overlay supervision plan (v3)

benbarclay
authored and
teknium1
committed
d36461d
test(docker): add conftest fixtures for docker harness

benbarclay
authored and
teknium1
committed
0830213
test(docker): lock baseline behavior for Phase 0 harness

benbarclay
authored and
teknium1
committed
6e6acde
test(docker): apply 180s timeout to docker harness tests

benbarclay
authored and
teknium1
committed
a18f69e
test(docker): stabilize Phase 0 baseline harness

benbarclay
authored and
teknium1
committed
440147e
ci(docker): add hadolint + shellcheck for container build inputs

benbarclay
authored and
teknium1
committed
b2168bf
feat(service_manager): add ServiceManager protocol + host wrappers

benbarclay
authored and
teknium1
committed
51914b0
feat(docker)!: replace tini with s6-overlay as PID 1

benbarclay
authored and
teknium1
committed
e0e9c89
feat(service_manager): add S6ServiceManager for runtime gateway supervision

benbarclay
authored and
teknium1
committed
0abf661
feat(docker): per-profile s6 supervision + container-restart reconciliation

benbarclay
authored and
teknium1
committed
2afefc5
docs(s6): document container supervision; doctor + skill + user-guide updates

benbarclay
authored and
teknium1
committed
a36221e
feat(docker): remove gosu from bundled image; s6-setuidgid handles privilege drop

benbarclay
authored and
teknium1
committed
4b4c36c
fix(service_manager): s6 detection works for unprivileged hermes user

benbarclay
authored and
teknium1
committed
fc39296
fix(docker): support multi-arch s6-overlay install (amd64 + arm64)

benbarclay
authored and
teknium1
committed
f7893df
fix(docker): SHA256-verify s6-overlay tarballs

benbarclay
authored and
teknium1
committed
d4e452b
fix(ci): drop --entrypoint override in hermes-smoke-test action

benbarclay
authored and
teknium1
committed
fc26a5a
fix(gateway): route --all stop/restart through s6 under container

benbarclay
authored and
teknium1
committed
6dedaa4
docs(docker): dashboard IS supervised — update note that contradicted the PR

benbarclay
authored and
teknium1
committed
a1a53a5
fix(container_boot): always register gateway-default slot

benbarclay
authored and
teknium1
committed
b044c1a
fix(service_manager): friendly errors for missing slots and s6-svc failures

benbarclay
authored and
teknium1
committed
b28b3f5
fix(docker): dashboard slot stays 'down' when HERMES_DASHBOARD unset

benbarclay
authored and
teknium1
committed
1dfabe4
docs(compose): update entrypoint comment for s6-overlay

benbarclay
authored and
teknium1
committed
143a189
fix(service_manager): rip out dead port parameter

benbarclay
authored and
teknium1
committed
d735b08
docker: drop sh -c wrappers from stage2-hook.sh

benbarclay
authored and
teknium1
committed
9914bfc
fix(container_boot): rotate container-boot.log when it exceeds 256 KiB

benbarclay
authored and
teknium1
committed
4443fb4
fix(container_boot): publish reconciled service dirs atomically

benbarclay
authored and
teknium1
committed
d0b1ab4
docs(docker): deprecation warning in entrypoint.sh shim

benbarclay
authored and
teknium1
committed
04bdbce
test(docker): poll for boot-log signal instead of fixed sleeps

benbarclay
authored and
teknium1
committed
cd5b2c4
docs(plans): trim s6-overlay plan to a post-implementation reference

benbarclay
authored and
teknium1
committed
6c49bdc
fix(profiles): short-circuit s6 hooks on host before importing service_manager
teknium1
committed
a4092ab
fix(ci): exclude tests/docker/ from regular test shards; pin read_text encoding
teknium1
committed
5cbb132
test(dockerfile): accept s6-overlay /init as a known PID-1 init
teknium1
committed
7f6f00f
fix(docker): make s6 lifecycle work for the unprivileged hermes user
benbarclay
committed
4f416fc
test(dockerfile): recognize s6-overlay/init as a valid PID-1; harden against historical-comment masquerade
benbarclay
committed
7d54288
test(docker): fix svstat 'want up' assertion in profile-gateway lifecycle test
benbarclay
committed
c524b8a
ci(docker): run tests/docker/ in build-amd64 against the freshly-built image
benbarclay
committed
da8b2e9

Navigation Menu

feat(docker)!: s6-overlay container supervision (salvage of #30136) - #31760

feat(docker)!: s6-overlay container supervision (salvage of #30136)#31760
benbarclay merged 36 commits into
mainfrom
hermes/hermes-bf5898da

Commits on May 25, 2026

docs(plans): add s6-overlay supervision plan (v3)

test(docker): add conftest fixtures for docker harness

test(docker): lock baseline behavior for Phase 0 harness

test(docker): apply 180s timeout to docker harness tests

test(docker): stabilize Phase 0 baseline harness

ci(docker): add hadolint + shellcheck for container build inputs

feat(service_manager): add ServiceManager protocol + host wrappers

feat(docker)!: replace tini with s6-overlay as PID 1

feat(service_manager): add S6ServiceManager for runtime gateway supervision

feat(docker): per-profile s6 supervision + container-restart reconciliation

docs(s6): document container supervision; doctor + skill + user-guide updates

feat(docker): remove gosu from bundled image; s6-setuidgid handles privilege drop

fix(service_manager): s6 detection works for unprivileged hermes user

fix(docker): support multi-arch s6-overlay install (amd64 + arm64)

fix(docker): SHA256-verify s6-overlay tarballs

fix(ci): drop --entrypoint override in hermes-smoke-test action

fix(gateway): route --all stop/restart through s6 under container

docs(docker): dashboard IS supervised — update note that contradicted the PR

fix(container_boot): always register gateway-default slot

fix(service_manager): friendly errors for missing slots and s6-svc failures

fix(docker): dashboard slot stays 'down' when HERMES_DASHBOARD unset

docs(compose): update entrypoint comment for s6-overlay

fix(service_manager): rip out dead port parameter

docker: drop sh -c wrappers from stage2-hook.sh

fix(container_boot): rotate container-boot.log when it exceeds 256 KiB

fix(container_boot): publish reconciled service dirs atomically

docs(docker): deprecation warning in entrypoint.sh shim

test(docker): poll for boot-log signal instead of fixed sleeps

docs(plans): trim s6-overlay plan to a post-implementation reference

fix(profiles): short-circuit s6 hooks on host before importing service_manager

fix(ci): exclude tests/docker/ from regular test shards; pin read_text encoding

test(dockerfile): accept s6-overlay /init as a known PID-1 init

fix(docker): make s6 lifecycle work for the unprivileged hermes user

test(dockerfile): recognize s6-overlay/init as a valid PID-1; harden against historical-comment masquerade

test(docker): fix svstat 'want up' assertion in profile-gateway lifecycle test

ci(docker): run tests/docker/ in build-amd64 against the freshly-built image