inject signal to running container like sigterm

[tiagorvmartins]

From the docs apparently I could use this:

sys.enable_sigterm_injection = [true|false]
(Default: false)

However my entrypoint of my gsc container is the apploader.sh. I used the gsc binary which relies on the templates to create a graminized docker image.

The problem is that the child process that apploader.sh launches is not catching the SIGTERM being sent from docker stop.
How could I do this?

Thank you!

[dimakuv]

This all shouldn't matter for Gramine. If you specify sys.enable_sigterm_injection = true in the manifest file, it will work. The additional layers (Docker GSC container, the apploader.sh script) should be irrelevant.

UPDATE: I see the problem now. This SO discussion is very useful: https://unix.stackexchange.com/questions/146756/forward-sigterm-to-child-in-bash.

According to the discussion, there are two ways to fix the problem:

1. Use the "bash signal trap" solution: https://unix.stackexchange.com/a/146770
2. Use the exec solution: https://unix.stackexchange.com/a/196053

Our apploader.sh from GSC doesn't use any of these two unfortunately:

• https://github.com/gramineproject/gsc/blob/a74a35777530e2065fb51e2fcd19ceca950bd397/templates/Dockerfile.common.build.template#L65
• https://github.com/gramineproject/gsc/blob/master/templates/apploader.common.template

@tiagorvmartins Could you try the second solution, with exec? You should do smth like this in your GSC version:

diff --git a/templates/apploader.common.template b/templates/apploader.common.template
index 4322eca..52f4bbe 100644
--- a/templates/apploader.common.template
+++ b/templates/apploader.common.template
@@ -11,10 +11,10 @@ set -e
 # Default to Linux-SGX if no PAL was specified
 if [ -z "$GSC_PAL" ] || [ "$GSC_PAL" == "Linux-SGX" ]
 then
-    gramine-sgx /gramine/app_files/entrypoint \
+    exec gramine-sgx /gramine/app_files/entrypoint \
         {% if insecure_args %}{{ binary_arguments | map('shlex_quote') | join(' ') }} \
         "${@}"{% endif %}
 else
-    gramine-direct /gramine/app_files/entrypoint \
+    exec gramine-direct /gramine/app_files/entrypoint \
     {{ binary_arguments | map('shlex_quote') | join(' ') }} "${@}"
 fi

[tiagorvmartins]

Thank you @dimakuv will update you on this asap.

[tiagorvmartins]

I can confirm that it worked, without any other issues on my side, thank you!

[dimakuv]

@tiagorvmartins Thanks for testing, I created a PR that will fix it in upstream GSC: gramineproject/gsc#171