hammerkit 1.8.0 → 1.9.0

package/build.schema.json

@@ -309,6 +309,12 @@
                   "cmd": {
                     "type": "string"
                   },
+                  "workdir": {
+                    "type": "string"
+                  },
+                  "shell": {
+                    "type": "string"
+                  },
                   "volumes": {
                     "type": "array",
                     "items": {
@@ -326,6 +332,9 @@
                     "properties": {
                       "cmd": {
                         "type": "string"
+                      },
+                      "timeout": {
+                        "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/timeout"
                       }
                     },
                     "required": [

package/dist/docker/package.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.longestCommonPrefix = exports.packageWorkTree = exports.getDefaultPlatform = void 0;
+exports.getServiceInstructions = exports.longestCommonPrefix = exports.packageWorkTree = exports.getDefaultPlatform = void 0;
 const plan_work_tasks_1 = require("../planner/utils/plan-work-tasks");
 const work_item_1 = require("../planner/work-item");
+const work_service_1 = require("../planner/work-service");
 const execute_docker_1 = require("../executer/execute-docker");
 const node_os_1 = require("node:os");
 const path_1 = require("path");
@@ -199,9 +200,17 @@ function getServiceInstructions(service, options) {
             ? service.data.volumes.map((v) => `RUN chown -R 1000:1000 ${toContainerPath((0, path_1.relative)(dependencyCwd, v.containerPath))}`)
             : []),
         options.overrideUser ? 'USER 1000:1000' : '',
+        // last, so the COPY destinations above stay relative to the build directory
+        service.data.workdir ? `WORKDIR ${service.data.workdir}` : '',
     ];
-    if (service.data.cmd) {
-        instructions.push(`CMD [${[service.data.cmd.parsed.command, ...service.data.cmd.parsed.args].map((p) => `"${p}"`).join(', ')}]`);
+    // exec form, JSON-encoded so arguments with quotes or a whole shell command
+    // survive intact
+    const command = (0, work_service_1.getServiceCommand)(service.data);
+    if (command.entrypoint) {
+        instructions.push(`ENTRYPOINT ${JSON.stringify(command.entrypoint)}`);
+    }
+    if (command.cmd) {
+        instructions.push(`CMD ${JSON.stringify(command.cmd)}`);
     }
     return {
         id: service.id(),
@@ -221,6 +230,7 @@ function getServiceInstructions(service, options) {
         ],
     };
 }
+exports.getServiceInstructions = getServiceInstructions;
 function getDependencyInstructions(cwd, task, taskIds) {
     return task.deps.map((dep) => {
         if (taskIds[dep.id()]) {

package/dist/docker/remove-orphaned-containers.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.removeOrphanedContainers = exports.isProcessAlive = exports.isOrphanedContainer = void 0;
+const os_1 = require("os");
+const remove_container_1 = require("./remove-container");
+// A hammerkit container nothing will remove any more: a task container (they
+// never outlive their run) or a service of a run that is gone, started by a
+// hammerkit process of this machine that no longer exists, and the paused
+// state records hammerkit kept before 1.9. Services of `up --daemon` and
+// containers of other machines or of running processes stay.
+function isOrphanedContainer(container, isProcessAlive) {
+    const labels = container.Labels;
+    const type = labels['hammerkit-type'];
+    if (type === 'task' && container.State === 'paused') {
+        return true;
+    }
+    if (type !== 'task' && type !== 'service') {
+        return false;
+    }
+    if (labels['hammerkit-daemon'] === 'true') {
+        return false;
+    }
+    if (labels['hammerkit-host'] !== (0, os_1.hostname)()) {
+        return false;
+    }
+    const pid = parseInt(labels['hammerkit-pid'] ?? '', 10);
+    if (!pid) {
+        return false;
+    }
+    return !isProcessAlive(pid);
+}
+exports.isOrphanedContainer = isOrphanedContainer;
+function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (e) {
+        // EPERM: it exists, it just belongs to another user
+        return e.code === 'EPERM';
+    }
+}
+exports.isProcessAlive = isProcessAlive;
+async function removeOrphanedContainers(docker) {
+    const containers = await docker.listContainers({ all: true, filters: { label: ['app=hammerkit'] } });
+    const orphaned = containers.filter((c) => isOrphanedContainer(c, isProcessAlive));
+    for (const container of orphaned) {
+        await (0, remove_container_1.removeContainer)(docker.getContainer(container.Id));
+    }
+    return orphaned.map((c) => c.Id);
+}
+exports.removeOrphanedContainers = removeOrphanedContainers;
+//# sourceMappingURL=remove-orphaned-containers.js.map

package/dist/docker/run-labels.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getRunLabels = void 0;
+const os_1 = require("os");
+// Which hammerkit process on which machine started a container. `clean` uses
+// them to tell a container a killed run left behind from one still in use.
+function getRunLabels() {
+    return {
+        'hammerkit-pid': process.pid.toString(),
+        'hammerkit-host': (0, os_1.hostname)(),
+    };
+}
+exports.getRunLabels = getRunLabels;
+//# sourceMappingURL=run-labels.js.map

package/dist/docker/using-container.js

@@ -5,52 +5,23 @@ const remove_container_1 = require("./remove-container");
 const log_1 = require("../log");
 const execute_docker_1 = require("../executer/execute-docker");
 const work_instance_id_1 = require("../planner/work-instance-id");
-async function usingContainer(docker, item, createOptions, stateKey, callback) {
+const remove_orphaned_containers_1 = require("./remove-orphaned-containers");
+// Runs the callback in a fresh container and removes it afterwards, whatever
+// the outcome. What state the outputs hold is recorded outside docker (see
+// container-task-state.ts), so no container outlives the run.
+async function usingContainer(docker, item, createOptions, callback) {
+    await removeLeftoverContainers(docker, item);
     let container = null;
-    let succeeded = false;
-    let result;
     try {
         container = await docker.createContainer(createOptions);
         item.status.write('debug', `starting container with image ${item.data.image}`);
         await (0, execute_docker_1.startContainer)(item.status, container);
-        result = await callback(container);
-        succeeded = result !== false;
-        return result;
+        return await callback(container);
     }
     finally {
         try {
-            if (stateKey && succeeded) {
-                if (container) {
-                    await container.pause();
-                }
-                const containers = await docker.listContainers({
-                    all: true,
-                    filters: { label: [`hammerkit-id=${(0, work_instance_id_1.getWorkInstanceId)(item)}`] },
-                });
-                for (const container of containers) {
-                    item.status.write('debug', `found container ${container.Id}`);
-                    if (container.Labels['hammerkit-state'] != stateKey) {
-                        const oldContainer = docker.getContainer(container.Id);
-                        await (0, remove_container_1.removeContainer)(oldContainer);
-                    }
-                }
-            }
-            else {
-                if (container) {
-                    await (0, remove_container_1.removeContainer)(container);
-                }
-                // A task run that failed has written into the outputs an earlier run's
-                // container still vouches for (its state label is what currentStateKey
-                // reads), so that record goes too.
-                if (stateKey) {
-                    const containers = await docker.listContainers({
-                        all: true,
-                        filters: { label: [`hammerkit-id=${(0, work_instance_id_1.getWorkInstanceId)(item)}`] },
-                    });
-                    for (const old of containers) {
-                        await (0, remove_container_1.removeContainer)(docker.getContainer(old.Id));
-                    }
-                }
+            if (container) {
+                await (0, remove_container_1.removeContainer)(container);
             }
         }
         catch (e) {
@@ -59,4 +30,20 @@ async function usingContainer(docker, item, createOptions, stateKey, callback) {
     }
 }
 exports.usingContainer = usingContainer;
+// Containers of this item nothing will remove: the paused state records
+// hammerkit kept before 1.9, and stopped ones of a hammerkit process that is
+// gone. A container of a live process (one another call of this run has just
+// created, say) stays.
+async function removeLeftoverContainers(docker, item) {
+    const containers = await docker.listContainers({
+        all: true,
+        filters: { label: [`hammerkit-id=${(0, work_instance_id_1.getWorkInstanceId)(item)}`] },
+    });
+    const leftovers = containers.filter((c) => c.State === 'paused' ||
+        (c.State !== 'running' && !(0, remove_orphaned_containers_1.isProcessAlive)(parseInt(c.Labels['hammerkit-pid'] ?? '', 10) || process.pid)));
+    for (const leftover of leftovers) {
+        item.status.write('debug', `remove leftover container ${leftover.Id}`);
+        await (0, remove_container_1.removeContainer)(docker.getContainer(leftover.Id));
+    }
+}
 //# sourceMappingURL=using-container.js.map

package/dist/executer/check-readiness.js

@@ -2,8 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkReadiness = void 0;
 const execute_docker_1 = require("./execute-docker");
-async function checkReadiness(status, healthCheck, environment, container, abort) {
-    const result = await (0, execute_docker_1.execCommand)(status, environment, container, undefined, [healthCheck.cmd.parsed.command, ...healthCheck.cmd.parsed.args], null, 2000, abort);
+async function checkReadiness(status, command, environment, container, user, abort) {
+    const result = await (0, execute_docker_1.execCommand)(status, environment, container, undefined, command, user, 2000, abort);
     if (result.type === 'timeout') {
         return false;
     }
@@ -12,11 +12,11 @@ async function checkReadiness(status, healthCheck, environment, container, abort
     }
     else {
         if (result.result.ExitCode === 0) {
-            status.write('debug', `healthcheck ${healthCheck.cmd} succeeded`);
+            status.write('debug', `healthcheck ${command.join(' ')} succeeded`);
             return true;
         }
         else {
-            status.write('debug', `healthcheck ${healthCheck.cmd} failed with ${result.result.ExitCode}`);
+            status.write('debug', `healthcheck ${command.join(' ')} failed with ${result.result.ExitCode}`);
             return false;
         }
     }

package/dist/executer/container-task-state.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.removeContainerTaskState = exports.writeContainerTaskState = exports.readContainerTaskState = exports.getContainerTaskStateFile = void 0;
+const path_1 = require("path");
+const get_cache_directory_1 = require("../optimizer/get-cache-directory");
+const work_instance_id_1 = require("../planner/work-instance-id");
+// The record says "the outputs of this container task belong to this state
+// key", like the state file of a local task. It lives in the hammerkit
+// directory, not the project, so writing it never touches a task's src.
+function getContainerTaskStateFile(task) {
+    return (0, path_1.join)((0, get_cache_directory_1.getHammerkitDirectory)(), 'state', (0, work_instance_id_1.getWorkInstanceId)(task));
+}
+exports.getContainerTaskStateFile = getContainerTaskStateFile;
+async function readContainerTaskState(environment, task) {
+    const stateFile = getContainerTaskStateFile(task);
+    if (!(await environment.file.exists(stateFile))) {
+        return null;
+    }
+    return (await environment.file.read(stateFile)).trim() || null;
+}
+exports.readContainerTaskState = readContainerTaskState;
+async function writeContainerTaskState(environment, task, stateKey) {
+    await environment.file.createDirectory((0, path_1.join)((0, get_cache_directory_1.getHammerkitDirectory)(), 'state'));
+    await environment.file.writeFile(getContainerTaskStateFile(task), stateKey);
+}
+exports.writeContainerTaskState = writeContainerTaskState;
+async function removeContainerTaskState(environment, task) {
+    const stateFile = getContainerTaskStateFile(task);
+    if (await environment.file.exists(stateFile)) {
+        await environment.file.remove(stateFile);
+    }
+}
+exports.removeContainerTaskState = removeContainerTaskState;
+//# sourceMappingURL=container-task-state.js.map

package/dist/executer/docker-service.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.dockerService = void 0;
+const work_service_1 = require("../planner/work-service");
+const run_labels_1 = require("../docker/run-labels");
 const abort_1 = require("./abort");
 const execute_docker_1 = require("./execute-docker");
 const stream_1 = require("../docker/stream");
@@ -8,11 +10,14 @@ const abort_event_1 = require("../utils/abort-event");
 const log_1 = require("../log");
 const remove_container_1 = require("../docker/remove-container");
 const check_readiness_1 = require("./check-readiness");
+const main_process_user_1 = require("./main-process-user");
 const execution_steps_1 = require("./execution-steps");
 const docker_task_1 = require("./docker-task");
 const replace_env_variables_1 = require("../environment/replace-env-variables");
 const get_service_containers_1 = require("./get-service-containers");
 const work_instance_id_1 = require("../planner/work-instance-id");
+const work_healthcheck_1 = require("../planner/work-healthcheck");
+const HEALTHCHECK_INTERVAL_MS = 1000;
 async function dockerService(docker, item, options, environment) {
     let container = null;
     try {
@@ -26,22 +31,25 @@ async function dockerService(docker, item, options, environment) {
         const network = (0, docker_task_1.getNeedsNetwork)(serviceContainers, item.needs);
         item.status.write('debug', `create container with image ${item.data.image}`);
         const envs = (0, replace_env_variables_1.getEnvironmentVariables)(item.data.envs);
+        const command = (0, work_service_1.getServiceCommand)(item.data);
         container = await docker.createContainer({
             Image: item.data.image,
             Env: Object.keys(envs).map((k) => `${k}=${envs[k]}`),
             Labels: {
                 app: 'hammerkit',
                 'hammerkit-id': (0, work_instance_id_1.getWorkInstanceId)(item),
-                'hammerkit-pid': process.pid.toString(),
+                ...(0, run_labels_1.getRunLabels)(),
                 'hammerkit-type': 'service',
                 'hammerkit-state': options.stateKey,
+                'hammerkit-daemon': options.daemon ? 'true' : 'false',
             },
             ExposedPorts: item.data.ports.reduce((map, port) => {
                 map[`${port.containerPort}/tcp`] = {};
                 return map;
             }, {}),
-            Cmd: item.data.cmd ? [item.data.cmd.parsed.command, ...item.data.cmd.parsed.args] : undefined,
-            WorkingDir: item.data.cwd ? (0, execute_docker_1.convertToPosixPath)(item.data.cwd) : undefined,
+            Entrypoint: command.entrypoint ?? undefined,
+            Cmd: command.cmd ?? undefined,
+            WorkingDir: (0, execute_docker_1.convertToPosixPath)((0, work_service_1.getServiceWorkingDir)(item.data)),
             HostConfig: {
                 ExtraHosts: network.hosts,
                 Links: network.links,
@@ -70,11 +78,20 @@ async function dockerService(docker, item, options, environment) {
             });
         }
         else {
+            const healthcheck = item.data.healthcheck;
+            const deadline = Date.now() + healthcheck.timeout;
             let ready = false;
             do {
-                ready = await (0, check_readiness_1.checkReadiness)(item.status, item.data.healthcheck, environment, container, options.abort);
-                if (!ready) {
-                    await new Promise((resolve) => setTimeout(() => resolve(), 1000));
+                // The first check waits one interval too, so an entrypoint that drops
+                // privileges (`exec su-exec app …`) has done so before anything runs.
+                await new Promise((resolve) => setTimeout(() => resolve(), HEALTHCHECK_INTERVAL_MS));
+                if (options.abort.aborted) {
+                    break;
+                }
+                const user = await (0, main_process_user_1.getMainProcessUser)(container);
+                ready = await (0, check_readiness_1.checkReadiness)(item.status, (0, work_service_1.getHealthcheckCommand)(item.data) ?? [], environment, container, user, options.abort);
+                if (!ready && Date.now() >= deadline) {
+                    throw new Error((0, work_healthcheck_1.getHealthcheckTimeoutMessage)(item.name, healthcheck));
                 }
             } while (!ready && !options.abort.aborted);
             if (ready) {

package/dist/executer/docker-task.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.dockerTask = exports.buildCreateOptions = exports.getNeedsNetwork = void 0;
+const run_labels_1 = require("../docker/run-labels");
 const service_dns_1 = require("./service-dns");
 const execute_docker_1 = require("./execute-docker");
 const abort_1 = require("./abort");
@@ -14,6 +15,7 @@ const get_container_binds_1 = require("./get-container-binds");
 const get_service_containers_1 = require("./get-service-containers");
 const work_instance_id_1 = require("../planner/work-instance-id");
 const get_outputs_to_reset_1 = require("../planner/utils/get-outputs-to-reset");
+const container_task_state_1 = require("./container-task-state");
 function getNeedsNetwork(serviceContainers, needs) {
     const links = [];
     const hosts = [];
@@ -51,7 +53,7 @@ function buildCreateOptions(item, stateKey, serviceContainers, environment) {
         Labels: {
             app: 'hammerkit',
             'hammerkit-id': (0, work_instance_id_1.getWorkInstanceId)(item),
-            'hammerkit-pid': process.pid.toString(),
+            ...(0, run_labels_1.getRunLabels)(),
             'hammerkit-type': 'task',
             'hammerkit-state': stateKey,
         },
@@ -67,6 +69,9 @@ exports.buildCreateOptions = buildCreateOptions;
 async function dockerTask(docker, item, environment, options) {
     item.status.write('info', `execute ${item.name} in container`);
     try {
+        // A run that fails overwrites outputs, so the previous record goes first,
+        // and only a run that succeeded writes a new one.
+        await (0, container_task_state_1.removeContainerTaskState)(environment, item);
         const outputsToReset = (0, get_outputs_to_reset_1.getOutputsToReset)(item.data);
         // outputs on the host: file outputs (bind mounts) and exported directories
         for (const generate of outputsToReset.filter((g) => g.isFile || g.export)) {
@@ -81,7 +86,7 @@ async function dockerTask(docker, item, environment, options) {
         const serviceContainers = (0, get_service_containers_1.getServiceContainers)(item.needs);
         const containerOptions = buildCreateOptions(item, options.stateKey, serviceContainers, environment);
         (0, print_container_options_1.printContainerOptions)(item.status, containerOptions);
-        await (0, using_container_1.usingContainer)(docker, item, containerOptions, options.stateKey, async (container) => {
+        const succeeded = await (0, using_container_1.usingContainer)(docker, item, containerOptions, async (container) => {
             await (0, execution_steps_1.setUserPermissions)(item, container, environment);
             for (const generate of outputsToReset.filter((g) => !g.isFile)) {
                 await (0, execute_docker_1.clearContainerDirectory)(item.status, environment, container, generate.path);
@@ -126,6 +131,9 @@ async function dockerTask(docker, item, environment, options) {
             }
             return true;
         });
+        if (succeeded) {
+            await (0, container_task_state_1.writeContainerTaskState)(environment, item, options.stateKey);
+        }
     }
     catch (e) {
         if (e instanceof abort_1.AbortError) {

package/dist/executer/event-cache.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.cleanCache = exports.storeCache = exports.getArchivePaths = exports.restoreCache = void 0;
+const remove_orphaned_containers_1 = require("../docker/remove-orphaned-containers");
+const execute_docker_1 = require("./execute-docker");
 const plan_work_tasks_1 = require("../planner/utils/plan-work-tasks");
 const get_cache_directory_1 = require("../optimizer/get-cache-directory");
 const path_1 = require("path");
@@ -90,6 +92,12 @@ async function cleanCache(workTree, environment, options) {
             await service.data.caching.backend.clear(service.id(), environment);
         }
     }
+    if (workTree.environment.type === 'docker') {
+        const removed = await (0, remove_orphaned_containers_1.removeOrphanedContainers)((0, execute_docker_1.getContainerCli)(workTree.environment));
+        for (const id of removed) {
+            environment.console.info(`removed container ${id.substring(0, 12)} left behind by a stopped run`);
+        }
+    }
 }
 exports.cleanCache = cleanCache;
 //# sourceMappingURL=event-cache.js.map

package/dist/executer/execute-command.js

@@ -6,6 +6,12 @@ const os_1 = require("os");
 const log_1 = require("../log");
 const abort_1 = require("./abort");
 const abort_event_1 = require("../utils/abort-event");
+const environment_config_1 = require("../utils/environment-config");
+// how long a local command's process group gets to exit after SIGTERM before
+// it is killed
+function getStopTimeout() {
+    return (0, environment_config_1.getEnvironmentConfig)('HAMMERKIT_STOP_TIMEOUT_MS', 10000);
+}
 async function executeCommand(status, abortSignal, cwd, command, envs, environment) {
     const windows = (0, os_1.platform)() === 'win32';
     return new Promise((resolve, reject) => {
@@ -48,14 +54,38 @@ async function executeCommand(status, abortSignal, cwd, command, envs, environme
                 ps.kill();
                 return;
             }
-            try {
-                process.kill(-ps.pid, 'SIGTERM');
-            }
-            catch {
-                // the group is already gone
-            }
+            stopGroup(ps.pid);
         });
     });
 }
 exports.executeCommand = executeCommand;
+// SIGTERM the whole group, then SIGKILL whatever is still in it after
+// HAMMERKIT_STOP_TIMEOUT_MS. The shell exiting doesn't end the wait: a child that ignores
+// SIGTERM would otherwise outlive hammerkit.
+function stopGroup(pid) {
+    if (!signalGroup(pid, 'SIGTERM')) {
+        return;
+    }
+    const deadline = Date.now() + getStopTimeout();
+    const poll = setInterval(() => {
+        if (!signalGroup(pid, 0)) {
+            clearInterval(poll);
+            return;
+        }
+        if (Date.now() >= deadline) {
+            signalGroup(pid, 'SIGKILL');
+            clearInterval(poll);
+        }
+    }, 100);
+}
+function signalGroup(pid, signal) {
+    try {
+        process.kill(-pid, signal);
+        return true;
+    }
+    catch {
+        // the group is already gone
+        return false;
+    }
+}
 //# sourceMappingURL=execute-command.js.map

package/dist/executer/execute-docker.js

@@ -135,7 +135,7 @@ async function execCommand(status, environment, container, cwd, cmd, user, timeo
 exports.execCommand = execCommand;
 // Empty a directory inside a running container, as root. Volumes are emptied
 // this way rather than recreated: Docker refuses to remove a volume while any
-// container (a dependent's paused one, say) still mounts it.
+// container (a running dependent's, say) still mounts it.
 async function clearContainerDirectory(status, environment, container, path) {
     const result = await execCommand(status, environment, container, '/', ['sh', '-c', 'rm -rf "$1"/* "$1"/.[!.]* "$1"/..?*', 'sh', convertToPosixPath(path)], null, undefined, environment.abortCtrl.signal);
     if (result.type !== 'result' || result.result.ExitCode !== 0) {

package/dist/executer/execute-work-service.js

@@ -32,8 +32,12 @@ async function executeWorkService(work, environment, options) {
             });
             await (0, await_completed_dependencies_1.awaitRunningNeeds)(work, work.needs.map((n) => n.service), abort);
             if (options.type === 'execute') {
+                // rejects when the run is aborted; unhandled, that rejection would
+                // crash hammerkit before the service container is removed
                 (0, await_completed_dependencies_1.awaitNoRequirements)(work, abort).then(() => {
                     stop();
+                }, () => {
+                    // aborted: the service is stopping anyway
                 });
             }
             await work.runtime.execute(environment, {

package/dist/executer/get-container-binds.js

@@ -13,7 +13,7 @@ function getContainerBinds(item) {
         // A source inside another source (a dependency's `app/app.csproj` under the
         // task's own `app`) is already visible through the outer bind. Binding it
         // again would nest bind mounts, which Docker Desktop then refuses to let the
-        // host delete while the paused container exists.
+        // host delete while the container exists.
         ...sources
             .filter((path) => !sources.some((other) => isInside(path, other)))
             .map((path) => ({ localPath: path, containerPath: path })),

package/dist/executer/main-process-user.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getMainProcessUser = exports.parseProcessStatusUser = void 0;
+const stream_1 = require("stream");
+// `uid:gid` from the text of /proc/<pid>/status (effective ids), or null.
+function parseProcessStatusUser(status) {
+    const uid = status.match(/^Uid:\s+\d+\s+(\d+)/m);
+    const gid = status.match(/^Gid:\s+\d+\s+(\d+)/m);
+    if (!uid || !gid) {
+        return null;
+    }
+    return `${uid[1]}:${gid[1]}`;
+}
+exports.parseProcessStatusUser = parseProcessStatusUser;
+// The user the container's main process (PID 1) runs as, read inside the
+// container so user namespaces and rootless docker report the container's ids.
+// Healthchecks run as this user, like a Kubernetes exec probe runs as the
+// container's user: a check run as root could otherwise create files the
+// service then cannot read (RabbitMQ's Erlang cookie). Null when it can't be
+// read (no `cat` in the image, a windows container); the check then runs as
+// the exec default, as before.
+async function getMainProcessUser(container, timeoutMs = 2000) {
+    try {
+        const exec = await container.exec({ Cmd: ['cat', '/proc/1/status'], AttachStdout: true, AttachStderr: true });
+        const stream = await exec.start({ hijack: true, stdin: false });
+        const stdout = new stream_1.PassThrough();
+        const chunks = [];
+        stdout.on('data', (chunk) => chunks.push(chunk));
+        container.modem.demuxStream(stream, stdout, new stream_1.PassThrough());
+        const finished = await Promise.race([
+            new Promise((resolve) => {
+                stream.on('end', () => resolve(true));
+                stream.on('error', () => resolve(false));
+            }),
+            new Promise((resolve) => setTimeout(() => resolve(false), timeoutMs)),
+        ]);
+        if (!finished) {
+            stream.destroy();
+            return null;
+        }
+        const result = await exec.inspect();
+        if (result.ExitCode !== 0) {
+            return null;
+        }
+        return parseProcessStatusUser(Buffer.concat(chunks).toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+exports.getMainProcessUser = getMainProcessUser;
+//# sourceMappingURL=main-process-user.js.map

package/dist/index.js

@@ -6,10 +6,9 @@ const get_file_context_1 = require("./file/get-file-context");
 const work_item_status_1 = require("./planner/work-item-status");
 const empty_writable_1 = require("./utils/empty-writable");
 const run_program_1 = require("./run-program");
+const abort_on_signals_1 = require("./utils/abort-on-signals");
 const abortCtrl = new AbortController();
-process.on('SIGINT', function () {
-    abortCtrl.abort();
-});
+(0, abort_on_signals_1.abortOnSignals)(process, abortCtrl);
 let settled = false;
 // A run that never settles (a task waiting on something that can't happen)
 // lets the event loop drain, and Node then exits 0: CI would report success

package/dist/kubernetes/await-running-state.js

@@ -76,12 +76,30 @@ async function deleteJob(instance, env, name) {
     }
 }
 exports.deleteJob = deleteJob;
-async function awaitDeployRunningState(instance, env, name, pollInterval = 1000) {
+// Waits for a ready replica. The deadline only starts once a pod runs, so an
+// image pull doesn't count against it (as on docker, where it starts after
+// the container started).
+async function awaitDeployRunningState(instance, env, name, readiness, pollInterval = 1000, now = Date.now) {
+    let runningSince = null;
     for (;;) {
         const deployment = await instance.appsApi.readNamespacedDeployment({ name, namespace: env.namespace });
         if ((deployment.status?.readyReplicas ?? 0) > 0) {
             return;
         }
+        if (readiness.timeout !== null) {
+            if (runningSince === null) {
+                const pods = await instance.coreApi.listNamespacedPod({
+                    namespace: env.namespace,
+                    labelSelector: readiness.podSelector,
+                });
+                if (pods.items.some((pod) => pod.status?.phase === 'Running')) {
+                    runningSince = now();
+                }
+            }
+            else if (now() - runningSince >= readiness.timeout) {
+                throw new Error(readiness.timeoutMessage);
+            }
+        }
         await (0, sleep_1.sleep)(pollInterval);
     }
 }

package/dist/kubernetes/ensure-kubernetes-deployment-exists.js

@@ -2,12 +2,14 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ensureKubernetesDeploymentExists = void 0;
 const work_item_1 = require("../planner/work-item");
+const work_service_1 = require("../planner/work-service");
 const apply_1 = require("./apply");
 const get_service_ip_1 = require("./get-service-ip");
 const version_1 = require("../version");
 const replace_env_variables_1 = require("../environment/replace-env-variables");
 const await_running_state_1 = require("./await-running-state");
 const resources_1 = require("./resources");
+const work_healthcheck_1 = require("../planner/work-healthcheck");
 async function ensureKubernetesDeploymentExists(instance, env, service, persistence, stateKey) {
     const hostAliases = [];
     for (const need of service.needs) {
@@ -25,10 +27,12 @@ async function ensureKubernetesDeploymentExists(instance, env, service, persiste
     }
     const envs = (0, replace_env_variables_1.getEnvironmentVariables)(service.data.envs);
     const name = (0, resources_1.getResourceName)(service);
-    const probe = service.data.healthcheck
+    const healthcheckCommand = (0, work_service_1.getHealthcheckCommand)(service.data);
+    const serviceCommand = (0, work_service_1.getServiceCommand)(service.data);
+    const probe = healthcheckCommand
         ? {
             exec: {
-                command: [service.data.healthcheck.cmd.parsed.command, ...service.data.healthcheck.cmd.parsed.args],
+                command: healthcheckCommand,
             },
             periodSeconds: 5,
             failureThreshold: 3,
@@ -68,13 +72,12 @@ async function ensureKubernetesDeploymentExists(instance, env, service, persiste
                         {
                             name: service.name.replace(/:/, '-'),
                             image: service.data.image,
-                            workingDir: service.data.cwd ?? undefined,
+                            workingDir: (0, work_service_1.getServiceWorkingDir)(service.data),
                             env: Object.entries(envs).map(([key, value]) => ({
                                 name: key,
                                 value: value,
                             })),
-                            command: service.data.cmd ? [service.data.cmd.parsed.command] : undefined,
-                            args: service.data.cmd ? service.data.cmd.parsed.args : undefined,
+                            ...getKubernetesCommand(serviceCommand),
                             ports: service.data.ports.map((p) => ({
                                 containerPort: p.containerPort,
                             })),
@@ -99,7 +102,25 @@ async function ensureKubernetesDeploymentExists(instance, env, service, persiste
     if (deploy.status?.readyReplicas ?? 0 > 0) {
         return;
     }
-    await (0, await_running_state_1.awaitDeployRunningState)(instance, env, name);
+    await (0, await_running_state_1.awaitDeployRunningState)(instance, env, name, {
+        podSelector: `hammerkit.dev/id=${service.id()}`,
+        timeout: service.data.healthcheck?.timeout ?? null,
+        timeoutMessage: service.data.healthcheck
+            ? (0, work_healthcheck_1.getHealthcheckTimeoutMessage)(service.name, service.data.healthcheck)
+            : '',
+    });
 }
 exports.ensureKubernetesDeploymentExists = ensureKubernetesDeploymentExists;
+// Kubernetes `command` replaces the image entrypoint and `args` its command.
+// A shell service sets both; an exec-form `cmd` keeps the established mapping
+// (first token as `command`, the rest as `args`).
+function getKubernetesCommand(command) {
+    if (command.entrypoint && command.cmd) {
+        return { command: command.entrypoint, args: command.cmd };
+    }
+    if (command.cmd) {
+        return { command: [command.cmd[0]], args: command.cmd.slice(1) };
+    }
+    return {};
+}
 //# sourceMappingURL=ensure-kubernetes-deployment-exists.js.map

package/dist/planner/unreferenced-build-file-envs.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getUnreferencedBuildFileEnvs = void 0;
+// Build-file `envs` are passed to every task of the file and are part of every
+// task's cache key, so a value only some tasks use (an image tag, a test token)
+// reruns all of them when it changes. Returns the build-file envs the task's own
+// definition never mentions as `$NAME` / `${NAME}`. The task may still read
+// them implicitly at runtime (NODE_ENV), so this is only worth a warning.
+function getUnreferencedBuildFileEnvs(task) {
+    const buildFileEnvs = task.scope.schema.envs ?? {};
+    const taskSchema = getTaskSchema(task);
+    // an aggregate (deps only) runs nothing, so a rerun costs nothing
+    if (!taskSchema || 'extend' in taskSchema || (taskSchema.cmds ?? []).length === 0) {
+        return [];
+    }
+    const taskEnvs = taskSchema.envs ?? {};
+    const definition = JSON.stringify(taskSchema);
+    return Object.keys(buildFileEnvs)
+        .filter((name) => !(name in taskEnvs))
+        .filter((name) => !isReferenced(definition, name));
+}
+exports.getUnreferencedBuildFileEnvs = getUnreferencedBuildFileEnvs;
+function getTaskSchema(task) {
+    const prefix = task.scope.namePrefix.length > 0 ? `${task.scope.namePrefix}:` : '';
+    if (!task.name.startsWith(prefix)) {
+        return null;
+    }
+    const tasks = task.scope.schema.tasks ?? {};
+    return tasks[task.name.substring(prefix.length)] ?? null;
+}
+function isReferenced(definition, name) {
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return new RegExp(`\\$(\\{${escaped}\\}|${escaped}(?![A-Za-z0-9_]))`, 'i').test(definition);
+}
+//# sourceMappingURL=unreferenced-build-file-envs.js.map

package/dist/planner/utils/append-work-service.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.appendWorkService = void 0;
+exports.getHealthcheckTimeout = exports.DEFAULT_HEALTHCHECK_TIMEOUT = exports.appendWorkService = void 0;
 const work_service_id_1 = require("../work-service-id");
 const parse_work_ports_1 = require("./parse-work-ports");
 const template_value_1 = require("./template-value");
@@ -17,6 +17,8 @@ const state_1 = require("../../executer/state");
 const lazy_resolver_1 = require("../../executer/lazy-resolver");
 const get_work_runtime_1 = require("./get-work-runtime");
 const resolve_cache_1 = require("../../cache/resolve-cache");
+const units_1 = require("../../utils/units");
+const log_1 = require("../../log");
 function appendWorkService(workTree, service, environment, context) {
     const workService = parseService(workTree, service, environment, context);
     if (!workTree.services[workService.name]) {
@@ -91,13 +93,16 @@ function parseService(workTree, service, environment, context) {
             continuous: service.schema.continuous ?? false,
             healthcheck: service.schema.healthcheck
                 ? {
-                    cmd: (0, parse_work_command_1.parseWorkCommand)(service.cwd, service.schema.healthcheck, envs),
+                    cmd: (0, parse_work_command_1.parseWorkCommand)(service.cwd, service.schema.healthcheck.cmd, envs),
+                    timeout: getHealthcheckTimeout(service.schema.healthcheck.timeout, environment),
                 }
                 : null,
             envs: (0, replace_env_variables_1.buildEnvironmentVariables)(service.envs, environment, context),
             image: (0, template_value_1.templateValue)(service.schema.image, envs),
             cwd: service.cwd,
             cmd: service.schema.cmd ? (0, parse_work_command_1.parseWorkCommand)(service.cwd, service.schema.cmd, envs) : null,
+            workdir: service.schema.workdir ? (0, template_value_1.templateValue)(service.schema.workdir, envs) : null,
+            shell: service.schema.shell ? (0, template_value_1.templateValue)(service.schema.shell, envs) : null,
             volumes: (0, parse_work_volume_1.parseWorkVolumes)(service.cwd, service.schema.volumes, envs),
             mounts: (0, parse_work_mounts_1.parseWorkMounts)(service.cwd, service.schema, envs),
             src: (0, parse_work_source_1.parseWorkSource)(service.cwd, service.schema.src, envs),
@@ -105,4 +110,23 @@ function parseService(workTree, service, environment, context) {
         };
     }
 }
+exports.DEFAULT_HEALTHCHECK_TIMEOUT = '20s';
+// A service's own `healthcheck.timeout`, else HAMMERKIT_HEALTHCHECK_TIMEOUT,
+// else 20s: a check that never passes fails the run instead of hanging it.
+function getHealthcheckTimeout(timeout, environment) {
+    if (timeout) {
+        return (0, units_1.parseDuration)(timeout);
+    }
+    const fromEnv = environment.processEnvs['HAMMERKIT_HEALTHCHECK_TIMEOUT'];
+    if (fromEnv) {
+        try {
+            return (0, units_1.parseDuration)(fromEnv);
+        }
+        catch (e) {
+            throw new Error(`HAMMERKIT_HEALTHCHECK_TIMEOUT: ${(0, log_1.getErrorMessage)(e)}`);
+        }
+    }
+    return (0, units_1.parseDuration)(exports.DEFAULT_HEALTHCHECK_TIMEOUT);
+}
+exports.getHealthcheckTimeout = getHealthcheckTimeout;
 //# sourceMappingURL=append-work-service.js.map

package/dist/planner/validate.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkIfContextExists = exports.hasDependencyCycle = exports.hasNeedCycle = exports.hasMixedCycle = exports.validate = void 0;
 const read_build_file_1 = require("../parser/read-build-file");
 const plan_work_tasks_1 = require("./utils/plan-work-tasks");
+const unreferenced_build_file_envs_1 = require("./unreferenced-build-file-envs");
 async function* validate(workTree, context) {
     const cycleItems = [];
     for (const item of (0, plan_work_tasks_1.iterateWorkServices)(workTree)) {
@@ -49,6 +50,15 @@ async function* validate(workTree, context) {
         if ((!task.cmds || task.cmds.length === 0) && (!item.deps || item.deps.length === 0)) {
             yield { type: 'warn', message: `task is empty`, item: task };
         }
+        const unreferencedEnvs = (0, unreferenced_build_file_envs_1.getUnreferencedBuildFileEnvs)(task);
+        if (unreferencedEnvs.length > 0) {
+            yield {
+                type: 'warn',
+                message: `build-file envs ${unreferencedEnvs.join(', ')} are part of this task's cache key but not referenced ` +
+                    `by it: changing them reruns it. If it doesn't read them at runtime, define them on the tasks that do`,
+                item: task,
+            };
+        }
         for (const src of task.src) {
             if (!(await context.file.exists(src.absolutePath))) {
                 yield {

package/dist/planner/work-healthcheck.js

@@ -1,3 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.getHealthcheckTimeoutMessage = void 0;
+const units_1 = require("../utils/units");
+function getHealthcheckTimeoutMessage(serviceName, healthcheck) {
+    return (`service ${serviceName} did not pass its healthcheck "${healthcheck.cmd.cmd}" within ` +
+        `${(0, units_1.formatDuration)(healthcheck.timeout)} of starting (see its log above; raise healthcheck.timeout ` +
+        `or HAMMERKIT_HEALTHCHECK_TIMEOUT if it is just slow)`);
+}
+exports.getHealthcheckTimeoutMessage = getHealthcheckTimeoutMessage;
 //# sourceMappingURL=work-healthcheck.js.map

package/dist/planner/work-instance-id.js

@@ -4,9 +4,9 @@ exports.getWorkInstanceId = void 0;
 const crypto_1 = require("crypto");
 // `id()` is the portable cache identity: identical for the same task in every
 // checkout, so a shared cache hits across machines. Machine-local runtime state
-// (docker container labels, the cache staging directory) must instead stay
-// scoped to one checkout — two worktrees of the same repo on one host would
-// otherwise see each other's paused containers and staging files. The instance
+// (docker container labels, task state files, the cache staging directory)
+// must instead stay scoped to one checkout — two worktrees of the same repo on
+// one host would otherwise see each other's state records and staging files. The instance
 // id folds the absolute project root into the portable id for that purpose.
 function getWorkInstanceId(item) {
     return (0, crypto_1.createHash)('sha1').update(`${item.id()}\0${item.data.projectRoot}`).digest('hex');

package/dist/planner/work-runtime-docker.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.dockerServiceRuntime = exports.dockerTaskRuntime = void 0;
+const run_labels_1 = require("../docker/run-labels");
 const execute_docker_1 = require("../executer/execute-docker");
 const remove_container_1 = require("../docker/remove-container");
 const docker_task_1 = require("../executer/docker-task");
@@ -13,6 +14,7 @@ const tar_1 = require("tar");
 const plan_work_volume_1 = require("./utils/plan-work-volume");
 const work_instance_id_1 = require("./work-instance-id");
 const stream_1 = require("stream");
+const container_task_state_1 = require("../executer/container-task-state");
 function dockerTaskRuntime(task, workEnvironment) {
     const docker = (0, execute_docker_1.getContainerCli)(workEnvironment);
     return {
@@ -22,7 +24,8 @@ function dockerTaskRuntime(task, workEnvironment) {
                     label: [`hammerkit-id=${(0, work_instance_id_1.getWorkInstanceId)(task)}`],
                 },
             });
-            const currentTask = currentTasks[0];
+            // a paused container is a state record of hammerkit before 1.9, not a run
+            const currentTask = currentTasks.find((c) => c.State === 'running');
             if (!currentTask) {
                 return;
             }
@@ -53,8 +56,9 @@ function dockerTaskRuntime(task, workEnvironment) {
         async execute(environment, options) {
             await (0, docker_task_1.dockerTask)(docker, task, environment, options);
         },
-        async remove() {
+        async remove(environment) {
             await this.stop();
+            await (0, container_task_state_1.removeContainerTaskState)(environment, task);
             for (const generate of task.data.generates) {
                 if (generate.inherited) {
                     continue;
@@ -70,17 +74,8 @@ function dockerTaskRuntime(task, workEnvironment) {
             }
         },
         async currentStateKey(environment) {
-            const containers = await docker.listContainers({
-                all: true,
-                filters: {
-                    label: [`hammerkit-id=${(0, work_instance_id_1.getWorkInstanceId)(task)}`],
-                },
-            });
-            const container = containers[0];
-            if (!container) {
-                return null;
-            }
-            if (!container.Labels['hammerkit-state']) {
+            const stateKey = await (0, container_task_state_1.readContainerTaskState)(environment, task);
+            if (!stateKey) {
                 return null;
             }
             // outputs removed since the run (a deleted export, a pruned volume)
@@ -93,7 +88,7 @@ function dockerTaskRuntime(task, workEnvironment) {
                     return null;
                 }
             }
-            return container.Labels['hammerkit-state'];
+            return stateKey;
         },
     };
 }
@@ -114,7 +109,7 @@ async function restoreContainer(docker, environment, item, path) {
         Labels: {
             app: 'hammerkit',
             'hammerkit-id': (0, work_instance_id_1.getWorkInstanceId)(item),
-            'hammerkit-pid': process.pid.toString(),
+            ...(0, run_labels_1.getRunLabels)(),
             'hammerkit-type': 'task',
         },
         HostConfig: {
@@ -130,7 +125,7 @@ async function restoreContainer(docker, environment, item, path) {
                     .filter((v) => !v.inherited && !v.isFile)
                     .map((v) => `${v.volumeName}:${(0, execute_docker_1.convertToPosixPath)(v.path)}`),
         },
-    }, null, async (container) => {
+    }, async (container) => {
         for (const generate of (0, event_cache_1.getArchivePaths)(item.data, path)) {
             if (await environment.file.exists(generate.filename)) {
                 // a cache hit means exactly the stored outputs: whatever a failed or
@@ -236,7 +231,7 @@ async function archiveContainer(docker, environment, item, path) {
         Labels: {
             app: 'hammerkit',
             'hammerkit-id': (0, work_instance_id_1.getWorkInstanceId)(item),
-            'hammerkit-pid': process.pid.toString(),
+            ...(0, run_labels_1.getRunLabels)(),
             'hammerkit-type': 'task',
         },
         HostConfig: {
@@ -249,7 +244,7 @@ async function archiveContainer(docker, environment, item, path) {
                     .filter((v) => !v.inherited && !v.isFile)
                     .map((v) => `${v.volumeName}:${(0, execute_docker_1.convertToPosixPath)(v.path)}`),
         },
-    }, null, async (container) => {
+    }, async (container) => {
         const hostFiles = new Set(item.data.type === 'container-task'
             ? item.data.generates.filter((g) => !g.inherited && g.isFile).map((g) => g.path)
             : []);

package/dist/planner/work-service-id.js

@@ -23,6 +23,9 @@ function getWorkServiceId(service) {
                 .sort(),
             src: service.src.map((s) => portable(s.absolutePath)).sort(),
             mounts: service.mounts.map((m) => m.mount).sort(),
+            // only when declared, so existing services keep their ids
+            ...(service.workdir ? { workdir: service.workdir } : {}),
+            ...(service.shell ? { shell: service.shell } : {}),
         }
         : {
             context: service.context,

package/dist/planner/work-service.js

@@ -1,6 +1,32 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isContainerWorkService = void 0;
+exports.getHealthcheckCommand = exports.getServiceCommand = exports.getServiceWorkingDir = exports.isContainerWorkService = void 0;
 const isContainerWorkService = (svc) => 'image' in svc && svc.type === 'container-service';
 exports.isContainerWorkService = isContainerWorkService;
+// The container's working directory: the declared `workdir`, else the build
+// file's directory (the default every runtime applied before `workdir`).
+const getServiceWorkingDir = (service) => service.workdir ?? service.cwd;
+exports.getServiceWorkingDir = getServiceWorkingDir;
+// The container's entrypoint and command for a service: with a `shell`, its
+// `cmd` runs as `<shell> -c "<cmd>"` in place of the image entrypoint; without
+// one the tokenized `cmd` becomes the command and the image entrypoint stays.
+function getServiceCommand(service) {
+    if (!service.cmd) {
+        return { entrypoint: null, cmd: null };
+    }
+    if (service.shell) {
+        return { entrypoint: [service.shell, '-c'], cmd: [service.cmd.cmd] };
+    }
+    return { entrypoint: null, cmd: [service.cmd.parsed.command, ...service.cmd.parsed.args] };
+}
+exports.getServiceCommand = getServiceCommand;
+// The healthcheck as an exec command, through the service's `shell` if it has one.
+function getHealthcheckCommand(service) {
+    if (!service.healthcheck) {
+        return null;
+    }
+    const cmd = service.healthcheck.cmd;
+    return service.shell ? [service.shell, '-c', cmd.cmd] : [cmd.parsed.command, ...cmd.parsed.args];
+}
+exports.getHealthcheckCommand = getHealthcheckCommand;
 //# sourceMappingURL=work-service.js.map

package/dist/program.js

@@ -228,13 +228,13 @@ async function getProgram(environment, argv) {
                 if (validation.type === 'error') {
                     errors++;
                 }
-                for (const [buildFilename, errors] of Object.entries(fileErrors)) {
-                    environment.stdout.write(`${colors_1.default.underline(colors_1.default.gray(buildFilename))}\n`);
-                    for (const error of errors) {
-                        environment.stdout.write(` ${colors_1.default.underline(colors_1.default.blue(error.type))} at ${colors_1.default.gray(error.item.name)} ${error.message}\n`);
-                    }
-                    environment.stdout.write('\n');
+            }
+            for (const [buildFilename, errors] of Object.entries(fileErrors)) {
+                environment.stdout.write(`${colors_1.default.underline(colors_1.default.gray(buildFilename))}\n`);
+                for (const error of errors) {
+                    environment.stdout.write(` ${colors_1.default.underline(colors_1.default.blue(error.type))} at ${colors_1.default.gray(error.item.name)} ${error.message}\n`);
                 }
+                environment.stdout.write('\n');
             }
             if (errors !== 0) {
                 program.error('Detected errors in the hammerkit configuration', { exitCode: 1 });

package/dist/schema/build-file-container-service-schema.js

@@ -18,6 +18,14 @@ exports.buildFileContainerServiceSchema = (0, zod_1.object)({
     src: (0, zod_1.array)((0, zod_1.string)()).optional(),
     needs: (0, zod_1.array)(build_file_need_schema_1.buildFileNeedSchema).optional(),
     cmd: (0, zod_1.string)().optional(),
+    // Absolute path inside the container. Without it the service runs in the
+    // build file's directory, like a task; images whose entrypoint expects their
+    // own WORKDIR (relative `./dist/…` paths, `npm start`) need it.
+    workdir: (0, zod_1.string)().optional(),
+    // Runs `cmd` and the healthcheck as `<shell> -c "<cmd>"` (replacing the
+    // image entrypoint for `cmd`), like a task's `shell`. Without it both are
+    // split into exec-form arguments.
+    shell: (0, zod_1.string)().optional(),
     volumes: (0, zod_1.array)((0, zod_1.string)()).optional(),
     labels: labels_schema_1.labelsSchema.optional(),
     continuous: (0, zod_1.boolean)().optional(),

package/dist/schema/build-file-service-container-healthcheck.js

@@ -2,7 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildFileServiceContainerHealthcheck = void 0;
 const zod_1 = require("zod");
+const duration_schema_1 = require("./duration-schema");
 exports.buildFileServiceContainerHealthcheck = (0, zod_1.object)({
     cmd: (0, zod_1.string)(),
+    // How long the service may take to pass `cmd` once its container runs
+    // (default 20s, HAMMERKIT_HEALTHCHECK_TIMEOUT changes the default).
+    timeout: duration_schema_1.durationSchema.optional(),
 });
 //# sourceMappingURL=build-file-service-container-healthcheck.js.map

package/dist/utils/abort-on-signals.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.abortOnSignals = exports.ABORT_SIGNALS = void 0;
+// Ctrl-C (SIGINT), a CI job being cancelled or a supervisor stopping hammerkit
+// (SIGTERM) and a closed terminal (SIGHUP) all stop the run the same way: abort,
+// so services are removed and local tasks' process groups are killed. Without a
+// handler Node exits on SIGTERM/SIGHUP at once and leaves both behind.
+exports.ABORT_SIGNALS = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+function abortOnSignals(source, abortCtrl) {
+    for (const signal of exports.ABORT_SIGNALS) {
+        source.on(signal, () => {
+            abortCtrl.abort();
+        });
+    }
+}
+exports.abortOnSignals = abortOnSignals;
+//# sourceMappingURL=abort-on-signals.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hammerkit",
   "description": "Containerized build tool with incremental caching that runs the same build file locally, in Docker and on Kubernetes.",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "keywords": [
     "build",
     "build-tool",