Windows on Luther Monson

Windows Grab-Bag: SIGTERM That Doesn't Exist and Sparse Files That Break Docker

Sat, 03 Oct 2026 14:30:00 -0700

Two short ones from the Windows node of ephemerd from the last few weeks. Neither is complicated once you know what’s going on. Both took longer than they should have to find, because the failure showed up a long way from the cause.

Part 1: there is no SIGTERM on Windows

ephemerd can run a Cloudflare tunnel so GitHub webhooks reach a node behind NAT. It does that by running cloudflared as a managed subprocess. On Linux the child is tied to ephemerd’s lifetime by the kernel with Pdeathsig:

An Upstream PHP JIT Use-After-Free, and Why Our Default Flipped Twice

Thu, 01 Oct 2026 20:10:00 -0700

In August, ePHPm turned PHP’s tracing JIT on by default in single-site serve mode. Three days later it went back off on every platform, and it’s still off. The reason turned out to be a use-after-free in PHP’s tracing JIT that has nothing to do with ePHPm. Stock php -S with a stock Laravel skeleton dies on it in a couple of requests. The fix is now released upstream. So this seemed like the right time to write up how we got there, and what still has to happen before the default can flip again.

Cross-Platform Process Containment: Job Objects vs Process Groups vs cgroups

Sat, 26 Sep 2026 16:20:00 -0700

Every turn a shipmates crew member takes is a subprocess. It’s claude or the codex app-server. That in turn spawns shells, go test, npm or whatever the task calls for. Two things have to be true about that tree. When a turn ends or gets killed, the whole tree goes, including the grandchildren. And if somebody sets a memory or CPU budget, the budget applies to the whole tree, not just the process I happened to start.

A 1 TB Test: Building a Memory Watchdog for go test

Tue, 22 Sep 2026 20:48:00 -0700

On August 16th a server.test.exe from shipmates climbed to roughly 1 TB of commit charge on my Windows workstation. Windows Terminal was hosting several agent sessions in tabs. It hard-faulted with E_OUTOFMEMORY, and every one of those sessions died at the same moment. It wasn’t the first time either. An earlier one hit about 236 GB through an infinite filepath.Dir loop.

The machine has 128 GB of RAM. Commit charge doesn’t care. It’s backed by the page file, and Windows will happily let a process reserve-and-commit until the commit limit is gone. Then everything else on the desktop starts failing allocations too.

OPcache on Windows: Two Silent Failures

Sat, 29 Aug 2026 16:45:00 -0700

Windows is the platform where ePHPm gets the least traffic and the most surprises. Last week closed out two OPcache bugs that only exist there. Both were quiet in their own way. One killed the server at startup with nothing in our own logs. The other didn’t kill anything. It just ran PHP 8.3 with no opcode cache at all. For three weeks after a fixed SDK was published, every check stayed green.

Five Ways to Not Firewall a Windows Container (and the One That Works)

Sat, 22 Aug 2026 19:40:00 -0700

ephemerd runs CI jobs from pull requests. One of the rules is that a job can reach the internet but not my LAN. On Linux that’s a few iptables rules in the FORWARD path, and I didn’t think about it much. On Windows I spent about a week finding out how many ways there are to write a firewall rule that Windows accepts, lists and never applies.

The setup is Windows Server 2025 (build 26100) with job containers running under Hyper-V isolation. They sit on the default HNS NAT network that every Windows container tutorial uses. In ephemerd’s case that’s 10.88.0.0/16 with gateway 10.88.0.1. The target is the same as Linux. Block 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 and 169.254.0.0/16, and allow everything else.

My Benchmark Was 4x Wrong Because of WSL

Thu, 20 Aug 2026 20:45:00 -0700

I do most of my benchmarking on a Windows box in WSL2. It’s the machine on my desk with 32 threads and 62 GB of RAM. Everybody who does that learns the first rule early: don’t put your data on /mnt/c. DrvFs is the 9p-backed mount that exposes the Windows drives inside WSL, and it’s slow for file-heavy work. So the databases, the docroot and the build output all live on the WSL ext4 disk. My scaling harness for ePHPm even says so in capital letters in its README.

libxml2 2.14 Broke PHP Windows Builds - And Nobody Noticed

Tue, 11 Aug 2026 20:36:00 -0700

Back in April I was getting the embed SAPI building on Windows for ePHPm. I was using my fork of static-php-cli (SPC). The link step for php8ts.dll fell over with a wall of errors that all looked like this:

php8ts.dll.def : error LNK2001: unresolved external symbol UTF8ToHtml
php8ts.dll.def : error LNK2001: unresolved external symbol UTF8Toisolat1
php8ts.dll.def : error LNK2001: unresolved external symbol __htmlDefaultSAXHandler
...
php8ts.dll.def : error LNK2001: unresolved external symbol attributeDecl
...

(That excerpt is from php/php-src#22752. It’s the same failure someone else hit three months later. My log is long gone, and theirs is public.)

Atomic File Replacement on NTFS Is Not rename + fsync

Thu, 06 Aug 2026 21:27:00 -0700

shipmates writes a lot of small state files that other processes read. Voyage plans and state, tracker files. Each of them has to be replaced atomically, so a reader sees the old file or the new one and never half of each. Each also has to be replaced durably. When the function returns success, a power cut doesn’t take it back. Every Unix programmer knows the recipe for that. It doesn’t work on Windows, and the reasons are more interesting than “Windows is different”.

Rescuing a Windows Dynamic Disk Over USB with WSL2 and USB/IP

Sat, 01 Aug 2026 13:15:00 -0700

I pulled a 1 TB NVMe out of an old Windows box, dropped it in a USB enclosure and plugged it in. Windows showed nothing. No drive letter, no “initialize this disk” prompt, nothing in Explorer. Disk Management listed it as Invalid. The enclosure’s booklet said to “bring the disk online”, which silently did nothing. The data was completely intact. Windows was refusing on policy grounds, not because anything was broken. Getting it back meant going around the Windows storage stack entirely. I handed the raw USB device to a Linux kernel that doesn’t share Windows’ opinions.

Fixing Windows Archive Extraction in SPC

Sat, 18 Jul 2026 16:10:00 -0700

One of the first things that broke when I started building PHP on Windows with static-php-cli (SPC) wasn’t PHP at all. It was unpacking the source tarballs. libxml2, xz and a couple of others would die partway through extraction with:

ERROR: The pipe has been ended.

Over the last few months I’ve “fixed” this two different ways, and the maintainers fixed it a third. It’s a small piece of code. But it’s a good example of how much Linux assumption hides in a single shell pipeline, so here’s the whole thing.

Escaping WSL: Booting My Own Linux VM Through Hyper-V's HCS API

Sun, 14 Jun 2026 20:12:00 -0700

I’ve been building ephemerd, a daemon that runs self-hosted GitHub Actions runners with a fresh environment per job. On a Windows host, Windows jobs run in Hyper-V isolated containers. Linux jobs still need a Linux kernel from somewhere. The obvious answer on Windows in 2026 is WSL2, and that’s what I used first. It worked great from my terminal and fell over the moment ephemerd became a real Windows service.

WSL2 doesn’t do LocalSystem

A Windows service that wants to create containers and Hyper-V VMs runs as LocalSystem. WSL2 doesn’t support that context at all. You get WSL_E_LOCAL_SYSTEM_NOT_SUPPORTED and that’s the end of the conversation. There’s no flag for it. WSL is a per-user feature and a service account isn’t a user.

go-diskfs: Getting Rock Ridge Working for Joliet on Windows

Sun, 17 May 2026 20:40:00 -0700

go-proxmox has had a CloudInit() helper since 2023. It builds a small nocloud ISO in Go, uploads it to Proxmox and mounts it on the VM as a CD-ROM. It’s always worked fine for Linux guests. It has never worked for Windows guests running cloudbase-init. The reason is a filesystem extension from 1995 called Joliet.

Getting it fixed took three PRs to go-diskfs over about seven weeks. It also took a bug report from a user who ran it on Windows. That turned out to be the most important part.

Maintaining a Go Tool That Edits /etc/hosts on Every OS

Sat, 03 Feb 2024 19:22:00 -0700

Editing the hosts file sounds like the most boring problem in software. Read a text file, add a line, write it back. Then you find out your binary is being shelled out to from a Ruby Vagrant plugin on a Windows laptop with UAC prompts. Your library is being called in a loop by ddev. And every hosts file you parse was hand-edited by somebody at some point. I’ve been maintaining goodhosts for a few years now. I just spent a chunk of the fall and the holidays on it, so here’s what that looks like.