Containers on Luther Monson

Windows Grab-Bag: SIGTERM That Doesn't Exist and Sparse Files That Break Docker

Sat, 03 Oct 2026 14:30:00 -0700

Two short ones from the Windows node of ephemerd from the last few weeks. Neither is complicated once you know what’s going on. Both took longer than they should have to find, because the failure showed up a long way from the cause.

Part 1: there is no SIGTERM on Windows

ephemerd can run a Cloudflare tunnel so GitHub webhooks reach a node behind NAT. It does that by running cloudflared as a managed subprocess. On Linux the child is tied to ephemerd’s lifetime by the kernel with Pdeathsig:

Bind Mounts Across Mount Namespaces: Four PRs and a Container Escape

Thu, 24 Sep 2026 21:02:00 -0700

GitHub Actions has a container: key that runs a job’s steps inside an image of your choosing. It’s popular because it gives you a reproducible toolchain without building a custom runner image. On a self-hosted runner it works by having the runner drive Docker. On ephemerd, “Docker” is a shim that speaks the Docker API and creates containers in containerd. Getting bind mounts right through that shim took four PRs in a week. A couple of months later the version that worked turned out to be an escape.

Zero-Dependency Deployments - Single Binary for WordPress

Tue, 08 Sep 2026 20:25:00 -0700

The standard way to run a WordPress site is four services:

nginx for HTTP and TLS
php-fpm to run PHP
MySQL for data
Redis, once the site gets slow enough that someone installs an object cache plugin

That’s four processes and four config files. There are three sockets between them and four things to upgrade. For a big site that’s fine. For a brochure site or a staging copy it’s absurd. The same goes for a PR preview, a box at the edge, or a CI job that needs a real WordPress to test a plugin against.

My iptables Rule Matched 0 Packets in 9.8 GB

Wed, 26 Aug 2026 20:30:00 -0700

After a week of Windows firewall rules that listed fine and enforced nothing, I went back to the Linux side of ephemerd feeling pretty good about it. iptables is the boring, well-understood one. Then I looked at the packet counters on a live node. I found a rule that had never matched a packet in its life. That node had pushed 9.8 GB through the same chain.

The rules I thought I had

Job containers sit on a CNI bridge, 10.88.0.0/16, with the host on 10.88.0.1. ephemerd puts its egress policy in its own chain, EPHEMERD-FORWARD. FORWARD jumps to it for anything to or from the container subnet. From a live node: