Docker zombie process reaping and install fixes

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

• #7407 fix(infra): salvage Docker/install PRs #6934 #6910 #6904 + entrypoint dirs from #6936

  merged to main

  files: docker/entrypoint.sh, pyproject.toml, scripts/install.sh, tools/environments/docker.py

  Show the diff

  • docker/entrypoint.sh

    @@ -12,7 +12,7 @@ INSTALL_DIR="/opt/hermes"
     # The "home/" subdirectory is a per-profile HOME for subprocesses (git,
     # ssh, gh, npm …).  Without it those tools write to /root which is
     # ephemeral and shared across profiles.  See issue #4426.
    -mkdir -p "$HERMES_HOME"/{cron,sessions,logs,hooks,memories,skills,home}
    +mkdir -p "$HERMES_HOME"/{cron,sessions,logs,hooks,memories,skills,skins,plans,workspace,home}
     
     # .env
     if [ ! -f "$HERMES_HOME/.env" ]; then

  • pyproject.toml

    @@ -16,7 +16,7 @@ dependencies = [
       "anthropic>=0.39.0,<1",
       "python-dotenv>=1.2.1,<2",
       "fire>=0.7.1,<1",
    -  "httpx>=0.28.1,<1",
    +  "httpx[socks]>=0.28.1,<1",
       "rich>=14.3.3,<15",
       "tenacity>=9.1.4,<10",
       "pyyaml>=6.0.2,<7",

  • scripts/install.sh

    @@ -1082,10 +1082,19 @@ install_node_deps() {
             log_success "Node.js dependencies installed"
     
             # Install Playwright browser + system dependencies.
    -        # Playwright's install-deps only supports apt/dnf/zypper natively.
    +        # Playwright's --with-deps only supports apt-based systems natively.
             # For Arch/Manjaro we install the system libs via pacman first.
    +        # Other systems must install Chromium dependencies manually.
             log_info "Installing browser engine (Playwright Chromium)..."
             case "$DISTRO" in
    +            ubuntu|debian|raspbian|pop|linuxmint|elementary|zorin|kali|parrot)
    +                log_info "Playwright may request sudo to install browser system dependencies (shared libraries)."
    +                log_info "This is standard Playwright setup — Hermes itself does not require root access."
    +                cd "$INSTALL_DIR" && npx playwright install --with-deps chromium 2>/dev/null || {
    +                    log_warn "Playwright browser installation failed — browser tools will not work."
    +                    log_warn "Try running manually: cd $INSTALL_DIR && npx playwright install --with-deps chromium"
    +                }
    +                ;;
                 arch|manjaro)
                     if command -v pacman &> /dev/null; then
                         log_info "Arch/Manjaro detected — installing Chromium system dependencies via pacman..."
    @@ -1100,15 +1109,35 @@ install_node_deps() {
                             log_warn "  sudo pacman -S nss atk at-spi2-core cups libdrm libxkbcommon mesa pango cairo alsa-lib"
                         fi
                     fi
    -                cd "$INSTALL_DIR" && npx playwright install chromium 2>/dev/null || true
    +                cd "$INSTALL_DIR" && npx playwright install chromium 2>/dev/null || {
    +                    log_warn "Playwright browser installation failed — browser tools will not work."
    +                }
    +                ;;
    +            fedora|rhel|centos|rocky|alma)
    +                log_warn "Playwright does not support automatic dependency installation on RPM-based systems."
    +                log_info "Install Chromium system dependencies manually before using browser tools:"
    +                log_info "  sudo dnf install nss atk at-spi2-core cups-libs libdrm libxkbcommon mesa-libgbm pango cairo alsa-lib"
    +                cd "$INSTALL_DIR" && npx playwright install chromium 2>/dev/null || {
    +                    log_warn "Playwright browser installation failed — install dependencies above and retry."
    +                }
    +                ;;
    +            opensuse*|sles)
    +                log_warn "Playwright does not support automatic dependency installation on zypper-based systems."
    +                log_info "Install Chromium system dependencies manually before using browser tools:"
    +                log_info "  sudo zypper install mozilla-nss libatk-1_0-0 at-spi2-core cups-libs libdrm2 libxkbcommon0 Mesa-libgbm1 pango cairo libasound2"
    +                cd "$INSTALL_DIR" && npx playwright install chromium 2>/dev/null || {
    +                    log_warn "Playwright browser installation failed — install dependencies above and retry."
    +                }
                     ;;
                 *)
    -                log_info "Playwright may request sudo to install browser system dependencies (shared libraries)."
    -                log_info "This is standard Playwright setup — Hermes itself does not require root access."
    -                cd "$INSTALL_DIR" && npx playwright install --with-deps chromium 2>/dev/null || true
    +                log_warn "Playwright does not support automatic dependency installation on $DISTRO."
    +                log_info "Install Chromium/browser system dependencies for your distribution, then run:"
    +                log_info "  cd $INSTALL_DIR && npx playwright install chromium"
    +                log_info "Browser tools will not work until dependencies are installed."
    +                cd "$INSTALL_DIR" && npx playwright install chromium 2>/dev/null || true
                     ;;
             esac
    -        log_success "Browser engine installed"
    +        log_success "Browser engine setup complete"
         fi
     
         # Install WhatsApp bridge dependencies

  • tools/environments/docker.py

    @@ -409,11 +409,12 @@ def __init__(
             container_name = f"hermes-{uuid.uuid4().hex[:8]}"
             run_cmd = [
                 self._docker_exe, "run", "-d",
    +            "--init",           # tini/catatonit as PID 1 — reaps zombie children
                 "--name", container_name,
                 "-w", cwd,
                 *all_run_args,
                 image,
    -            "sleep", "2h",
    +            "sleep", "infinity",  # no fixed lifetime — idle reaper handles cleanup
             ]
             logger.debug(f"Starting container: {' '.join(run_cmd)}")
             result = subprocess.run(