From 576874d4e1dc7e5d3b8d7d2a05b2b41708017adc Mon Sep 17 00:00:00 2001
From: Ian Alloway <200005377+ianalloway@users.noreply.github.com>
Date: Sat, 31 Oct 2026 11:46:02 -0400
Subject: [PATCH] fix(docker): run images under tini so orphaned prisma node
 processes are reaped

The prisma CLI forks a detached node child that is reparented to PID 1
(the litellm python process) and never reaped, leaving permanent
<defunct> zombies (#33414, #14739, #10216). Install Wolfi's tini in the
runtime stage and wrap the entrypoint with it in all three Dockerfiles.

Supersedes #33599, which targeted the stale litellm_oss_daily_2026_07_20
branch.

Signed-off-by: Ian Alloway <200005377+ianalloway@users.noreply.github.com>
---
 Dockerfile                 | 4 ++--
 docker/Dockerfile.database | 4 ++--
 docker/Dockerfile.non_root | 4 ++--
 docker/tests/nonroot.yaml  | 2 +-
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 4cef63c8d71..836ad638ee2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -142,7 +142,7 @@ USER root
 RUN echo "https://packages.wolfi.dev/os" >> /etc/apk/repositories
 
 # node (without npm) is required by the prisma CLI at runtime
-RUN apk add --no-cache bash openssl libssl3 tzdata nodejs python-3.13 libsndfile libevent
+RUN apk add --no-cache bash openssl libssl3 tzdata nodejs python-3.13 libsndfile libevent tini
 COPY --from=pgbouncer-builder /usr/local/bin/pgbouncer /usr/local/bin/pgbouncer
 
 WORKDIR /app
@@ -182,5 +182,5 @@ RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \
 
 EXPOSE 4000/tcp
 
-ENTRYPOINT ["docker/prod_entrypoint.sh"]
+ENTRYPOINT ["/usr/bin/tini", "--", "docker/prod_entrypoint.sh"]
 CMD ["--port", "4000"]
diff --git a/docker/Dockerfile.database b/docker/Dockerfile.database
index 20f810686a3..f07427c02c1 100644
--- a/docker/Dockerfile.database
+++ b/docker/Dockerfile.database
@@ -123,7 +123,7 @@ ENV LITELLM_RELEASE_TAG=${LITELLM_RELEASE_TAG}
 USER root
 
 # node (without npm) is required by the prisma CLI at runtime
-RUN apk add --no-cache bash openssl libssl3 tzdata nodejs python-3.13 libsndfile libevent
+RUN apk add --no-cache bash openssl libssl3 tzdata nodejs python-3.13 libsndfile libevent tini
 COPY --from=pgbouncer-builder /usr/local/bin/pgbouncer /usr/local/bin/pgbouncer
 
 WORKDIR /app
@@ -164,5 +164,5 @@ RUN find /app/.venv -type f -path "*/tornado/test/*" -delete && \
 
 EXPOSE 4000/tcp
 
-ENTRYPOINT ["docker/prod_entrypoint.sh"]
+ENTRYPOINT ["/usr/bin/tini", "--", "docker/prod_entrypoint.sh"]
 CMD ["--port", "4000"]
diff --git a/docker/Dockerfile.non_root b/docker/Dockerfile.non_root
index 90bcc523d9e..d49ef6aaef1 100644
--- a/docker/Dockerfile.non_root
+++ b/docker/Dockerfile.non_root
@@ -135,7 +135,7 @@ RUN for i in 1 2 3; do \
       apk upgrade --no-cache && break || sleep 5; \
     done && \
     for i in 1 2 3; do \
-      apk add --no-cache python-3.13 bash openssl libssl3 tzdata libsndfile nodejs libevent && break || sleep 5; \
+      apk add --no-cache python-3.13 bash openssl libssl3 tzdata libsndfile nodejs libevent tini && break || sleep 5; \
     done
 COPY --from=pgbouncer-builder /usr/local/bin/pgbouncer /usr/local/bin/pgbouncer
 
@@ -204,5 +204,5 @@ USER 65534
 
 EXPOSE 4000/tcp
 
-ENTRYPOINT ["/app/docker/prod_entrypoint.sh"]
+ENTRYPOINT ["/usr/bin/tini", "--", "/app/docker/prod_entrypoint.sh"]
 CMD ["--port", "4000"]
diff --git a/docker/tests/nonroot.yaml b/docker/tests/nonroot.yaml
index 36118ca8c59..74b8724b6e6 100644
--- a/docker/tests/nonroot.yaml
+++ b/docker/tests/nonroot.yaml
@@ -1,7 +1,7 @@
 schemaVersion: 2.0.0
 
 metadataTest:
-  entrypoint: ["docker/prod_entrypoint.sh"]
+  entrypoint: ["/usr/bin/tini", "--", "/app/docker/prod_entrypoint.sh"]
   user: "65534"
   workdir: "/app"