Repository navigation
openenv validate leaks the subject container and loses the report when stopped with SIGTERM #1340
Description
openenv validate cleans up correctly on SIGINT, but SIGTERM terminates it immediately. The run-owned subject container is left behind and no report or evidence is written. SIGTERM is how timeout, docker stop, systemd, Kubernetes and many CI cancellations stop a process.
Measured on main 7ccc57ac with the hung-step fixture, signal sent once the subject's step is blocked:
| Signal | Docker 29.7.2, linux/amd64 | Podman 5.8.4, macOS arm64 |
|---|---|---|
| SIGINT | rc=1 after 1.4 s, report written, no container left | rc=1 after 1.3 s, report written, no container left |
| SIGTERM | rc=−15 at once, no report, container left behind | rc=−15 at once, no report, container left behind |
Cause: nothing installs a SIGTERM handler, so only KeyboardInterrupt reaches the runner's evidence-retaining cleanup.
Fix: route SIGTERM to the same interrupt path for the duration of a local validation, and add a SIGTERM acceptance case. The SIGINT acceptance case should also reset SIGINT/SIGTERM in the child: ignored signals are inherited, so a runner launched with SIGINT ignored makes it fail spuriously.
Activity
[-]openenv validate can ignore SIGINT while waiting for a step (SIGINT acceptance case fails on main)[/-][+]openenv validate leaks the subject container and loses the report when stopped with SIGTERM[/+]fix(cli): clean up validation subjects when stopped with SIGTERM (ope…