From 505f2d38874a387f3a6f5cc384756fe6b493c42c Mon Sep 17 00:00:00 2001 From: lingkai5wu Date: Sun, 11 Oct 2026 23:42:50 +0800 Subject: [PATCH] fix: prevent concurrent nginx configuration reloads --- nginx/.reload-in-container.sh | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/nginx/.reload-in-container.sh b/nginx/.reload-in-container.sh index c26c165..780bf8f 100644 --- a/nginx/.reload-in-container.sh +++ b/nginx/.reload-in-container.sh @@ -8,6 +8,21 @@ readonly TEMPLATE_SUFFIX="${NGINX_ENVSUBST_TEMPLATE_SUFFIX:-.template}" readonly OUTPUT_DIR="${NGINX_ENVSUBST_OUTPUT_DIR:-/etc/nginx}" readonly ENVSUBST_SCRIPT="${NGINX_RELOAD_ENVSUBST_SCRIPT:-/docker-entrypoint.d/20-envsubst-on-templates.sh}" readonly MANAGED_DIRS="conf.d snippets" +readonly LOCK_FILE="${NGINX_RELOAD_LOCK_FILE:-/tmp/nginx-reload.lock}" + +acquire_lock() { + if ! command -v flock >/dev/null 2>&1; then + echo "Error: flock is required to serialize configuration reloads." >&2 + return 1 + fi + + # Keep FD 9 open through rollback and cleanup; never unlink the lock file. + exec 9>"$LOCK_FILE" + if ! flock -n 9; then + echo "Error: cannot acquire reload lock; another reload may be running: $LOCK_FILE" >&2 + return 1 + fi +} is_managed_template() { for managed_dir in $MANAGED_DIRS; do @@ -107,6 +122,7 @@ finish() { } main() { + acquire_lock validate_templates backup_dir="$(mktemp -d /tmp/nginx-reload.XXXXXX)" transaction_state=backing_up