A way to kill the container by signaling docker run

[adamnovak]

Description

The docker run --sig-proxy can't forward SIGKILL because it can't actually receive it without dying itself. But this means there's no way to send SIGKILL to the contained process by signaling docker run, and thus, as far as I can tell, no way to achieve the effect of docker kill and reliably destroy the attached container by signaling docker run.

I would like to be able to configure docker run to tear down the attached container upon receiving some signal (maybe SIGTERM or SIGHUP), regardless of whether it was started with --init or what the PID 1 process inside chooses to do in response to signals.

Workarounds for not having this feature:

• Use --init (and hope you didn't need your container's own init process or handling of any signals that Docker's init uses, and that Docker's init doesn't hang or get a gdb attached to it or otherwise malfunction).
• Use a shell script that wraps docker run, traps a signal, and issues a docker kill.

[laurazard]

Oh! I was about to start writing a comment saying that I believed that signalling the docker run process with SIGINT three times caused a ContainerKill call to be made with KILL signal, but I guess I'm either confusing that with the Compose behavior during teardown, or I'm just misremembering something (such as the CLI forcefully exiting after 3 signals – but not signalling the container).

I'd support implementing something like that – would that address your usecase? cc @thaJeztah

[thaJeztah]

Also related ticket from @adamnovak in moby/moby;

• Allow setting a container to be stopped if its connected client goes away moby/moby#48566

[adamnovak]

I think the job manager I am using that motivated this can only send a signal once, not repeatedly. I'm really looking for something like --kill-container-on-hup so I can change some particular signal from being forwarded to prompting container teardown instead. Then I could set up my job manager to send the right signal.

If I have to send 3 SIGINTs I still need a wrapping shell script, though it would be simpler than one that needs to know the container ID to call docker kill.