From 6873913e64813504772c081e0ae97019d207faff Mon Sep 17 00:00:00 2001 From: rcourtman Date: Mon, 26 Jan 2026 20:48:57 +0000 Subject: [PATCH] fix: install script and docs improvements - Fixed --disable-docker not being passed to systemd service file. Related to #1151 - Added init: true requirement to HTTPS/TLS docs for Docker. Related to #1166 --- docs/CONFIGURATION.md | 4 +++- scripts/install.sh | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/CONFIGURATION.md b/docs/CONFIGURATION.md index 14b85aa2b9..9cb9dbde06 100644 --- a/docs/CONFIGURATION.md +++ b/docs/CONFIGURATION.md @@ -327,12 +327,14 @@ TLS_CERT_FILE=/etc/pulse/cert.pem TLS_KEY_FILE=/etc/pulse/key.pem # Docker -docker run -e HTTPS_ENABLED=true \ +docker run --init -e HTTPS_ENABLED=true \ -v /path/to/certs:/certs \ -e TLS_CERT_FILE=/certs/cert.pem \ -e TLS_KEY_FILE=/certs/key.pem ... ``` +> **Important (Docker with HTTPS)**: Always use `--init` (or `init: true` in docker-compose) when enabling HTTPS. The Alpine-based healthcheck uses busybox `wget`, which spawns `ssl_client` subprocesses. Without an init process to reap them, these become zombie processes over time. + --- ## 🛡️ Security Best Practices diff --git a/scripts/install.sh b/scripts/install.sh index ec37517fb5..ec0d71b2e0 100755 --- a/scripts/install.sh +++ b/scripts/install.sh @@ -1437,6 +1437,8 @@ if command -v systemctl >/dev/null 2>&1; then EXEC_ARGS="$EXEC_ARGS --enable-host=false" fi if [[ "$ENABLE_DOCKER" == "true" ]]; then EXEC_ARGS="$EXEC_ARGS --enable-docker"; fi + # Pass explicit false when Docker was explicitly disabled (prevents auto-detection) + if [[ "$ENABLE_DOCKER" == "false" && "$DOCKER_EXPLICIT" == "true" ]]; then EXEC_ARGS="$EXEC_ARGS --enable-docker=false"; fi if [[ "$ENABLE_KUBERNETES" == "true" ]]; then EXEC_ARGS="$EXEC_ARGS --enable-kubernetes"; fi if [[ -n "$KUBECONFIG_PATH" ]]; then EXEC_ARGS="$EXEC_ARGS --kubeconfig ${KUBECONFIG_PATH}"; fi if [[ "$ENABLE_PROXMOX" == "true" ]]; then EXEC_ARGS="$EXEC_ARGS --enable-proxmox"; fi