fix(s6): make web services wait for their config oneshots (fixes root-mode startup race)

[LorenzoRogai]

Problem

When a container built on the s6 images runs as root, php-fpm and the web server (nginx/apache2) are brought up in parallel with the entrypoint oneshots that configure them — the long-running services declare no dependency on those oneshots.

As root this is a race:

• php-fpm reads its pool config before 5-fpm-pool-user appends user/group, failing with:

  ALERT: [pool www] user has not been defined
  ERROR: failed to post process the configuration
  ERROR: FPM initialization failed
  

• the web server starts before 10-init-webserver-config renders its config, e.g. nginx: [emerg] open() "/etc/nginx/nginx.conf" failed (2: No such file or directory).

s6 restarts the crashed longruns, so the container eventually recovers — which is exactly why this is intermittent and hard to reproduce (see #425). But it emits alarming errors on every boot that loses the race, slows startup, and leaves a brief window with no service.

Fix

docker-php-serversideup-s6-init now adds a dependency from each web-facing longrun to the entrypoint oneshot that configures it, after the oneshots are created:

add_startup_dependency php-fpm 5-fpm-pool-user
add_startup_dependency nginx 10-init-webserver-config
add_startup_dependency apache2 10-init-webserver-config

The entrypoint oneshots are chained in alphabetical order, so depending on one transitively waits for all earlier ones (php-fpm → 5-fpm-pool-user; the web servers → 10-init-webserver-config, which already sits after 5-*). Each dependency is added only when both the service and the oneshot exist, so cli/fpm/frankenphp images — and images where a user removes a script — are unaffected. It does not make services wait on later app oneshots such as 50-laravel-automations, so a failing app hook won't block the web server from starting.

Testing

• Reproduced as root on 8.4-fpm-nginx-alpine: first boot shows the fpm + nginx errors, then self-heals.
• With the fix: 3/3 clean boots — no errors, php-fpm/nginx reach "ready to handle connections" on the first attempt.
• Rootless (default) behavior is unchanged (5-fpm-pool-user is a no-op when not root; the dependency just orders startup).

Refs #425

[mbrodala]

Suggested change

	dependencies_file="${service_dir}/dependencies"
	[ -e "$dependencies_file" ] || : > "$dependencies_file"
	dependencies_file="${service_dir}/dependencies"
	touch "$dependencies_file"

No need to check for file existence, touch is idempotent.

[mbrodala]

Maybe add an explanatory comment for this condition.

[mbrodala]

IMO this should be in Git/PR description only to keep the code compact.

[mbrodala]

Suggested change

	grep -qxF "$2" "$dependencies_file" 2>/dev/null && return 0
	grep --quiet --line-regexp --fixed-strings "$2" "$dependencies_file" 2>/dev/null && return 0

IMO CLI arguments should always be long form unless you are typing in a terminal. This makes it a lot easier to understand the command.

[mbrodala]

Suggested change

	# Ensure existing content ends with a newline before appending (some shipped
	# dependency files, e.g. nginx's, have no trailing newline)
	if [ -s "$dependencies_file" ] && [ -n "$(tail -c 1 "$dependencies_file")" ]; then
	printf '\n' >> "$dependencies_file"
	fi
	printf '%s\n' "$2" >> "$dependencies_file"
	printf '\n%s\n' "$2" >> "$dependencies_file"

The file doesn't need to be pretty. If you need a newline before, just always output it. :-)