Fix: SIGINT was ignored by the cln docker container
What the developer wrote
Authored by Nicolas Dorier
Fix: SIGINT was ignored by the cln docker container
Changelog-Fixed: Fix: SIGINT was ignored by the cln docker container
What changed, and why it matters
This commit fixes a Docker startup script so that when a user or system sends a shutdown signal (SIGINT/SIGTERM) to the container, Core Lightning actually receives it and shuts down cleanly. Previously the signal was ignored, which could force unclean shutdowns. This is a reliability/operational fix, not an exploitable security vulnerability.
No immediate security response required. Users running Core Lightning in Docker should update to include this fix to ensure clean shutdowns and reduce risk of database or wallet state corruption during container stop/restart.
Security signals we found
Signal handling / graceful shutdown fix
Docker PID 1 signal propagation issue
Potential unclean shutdown leading to state corruption
Evidence from the diff
The change modifies tools/docker-entrypoint.sh to run lightningd in the background, capture its PID, install a TERM/INT trap that forwards the signal to lightningd, and then wait on the process. Previously the script used ‘fg %-’ which, in a Docker context where the shell is PID 1, meant SIGINT/SIGTERM were not reliably propagated to lightningd. This could lead to unclean shutdown and potential data corruption or state inconsistency, but it is not a remote exploit.
Changed components
tools/docker-entrypoint.shDocker deployment of Core LightningInspect captured patch +6 / −1
diff --git a/tools/docker-entrypoint.sh b/tools/docker-entrypoint.sh
index 8d7bbfd2..89b2f821 100755
--- a/tools/docker-entrypoint.sh
+++ b/tools/docker-entrypoint.sh
@@ -6,6 +6,8 @@ networkdatadir="${LIGHTNINGD_DATA}/${LIGHTNINGD_NETWORK}"
set -m
lightningd --network="${LIGHTNINGD_NETWORK}" "$@" &
+LIGHTNINGD_PID=$!
+trap 'kill -TERM "$LIGHTNINGD_PID" 2>/dev/null' TERM INT
echo "Core-Lightning starting"
while read -r i; do if [ "$i" = "lightning-rpc" ]; then break; fi; done \
@@ -24,4 +26,7 @@ if [ -d "$LIGHTNINGD_DATA"/lightning-poststart.d ]; then
done
fi
-fg %-
+wait "$LIGHTNINGD_PID"
+trap - TERM INT
+wait "$LIGHTNINGD_PID"
+exit $?
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.