From 57e647c5b4bbdd8eca964fdad5ef81dcc6c2d347 Mon Sep 17 00:00:00 2001
From: lrnselfreliance <33263708+lrnselfreliance@users.noreply.github.com>
Date: Fri, 2 Oct 2026 15:49:18 -0600
Subject: [PATCH] docker: web container reaps zombies; zim and help
 healthchecks can pass (#744)

Caddy is PID 1 in the web container and reaps nothing.  The healthcheck's
busybox `wget --spider https://...` forks an `ssl_client` helper that is
orphaned to caddy and stays a zombie, one per check.  `init: true` runs
tini as PID 1 so they are reaped.

The zim healthcheck calls curl, which the debian:13 kiwix image does not
install, so every check exited 127.  The help healthcheck probed port
8086, which is Caddy's HTTPS proxy on the web container; mkdocs serves
on port 80 inside its own container.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
---
 docker-compose.yml    | 5 ++++-
 docker/zim/Dockerfile | 3 ++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 6de09e1c..52098b48 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -130,6 +130,9 @@ services:
       # Set EXTRA_SANS to include the host's LAN IP in the TLS certificate.
       # Example: EXTRA_SANS=IP:10.0.0.5
       - EXTRA_SANS=${EXTRA_SANS:-}
+    # Caddy is PID 1 and reaps nothing; busybox wget's ssl_client helper from the healthcheck is
+    # orphaned to it and stays a zombie (one per check).  init runs tini as PID 1 to reap them.
+    init: true
     healthcheck:
       test: [ 'CMD-SHELL', 'wget --spider --no-check-certificate https://127.0.0.1:443 || exit 1' ]
       interval: 1m
@@ -165,5 +168,5 @@ services:
     volumes:
       - './docker/help/wrolpi-help:/opt/wrolpi-help'
     healthcheck:
-      test: [ 'CMD-SHELL', 'curl http://127.0.0.1:8086' ]
+      test: [ 'CMD-SHELL', 'curl http://127.0.0.1:80' ]  # mkdocs serves on 80; 8086 is Caddy's proxy.
       interval: 1m
diff --git a/docker/zim/Dockerfile b/docker/zim/Dockerfile
index 426d6b95..e771ba9f 100644
--- a/docker/zim/Dockerfile
+++ b/docker/zim/Dockerfile
@@ -1,7 +1,8 @@
 FROM debian:13
 ENV DOCKER=true
 
-RUN apt update && apt-get install -y kiwix kiwix-tools
+# curl is for the compose healthcheck.
+RUN apt update && apt-get install -y kiwix kiwix-tools curl
 
 # Committed blobs (e.g. the default Zim served when the media directory has no
 # functioning zim files).