wrapper: handle early signals, fail-fast on init-envoy, share waitForX

- Register SIGTERM/SIGINT and install the shutdown goroutine right after
  supervisord starts, so a signal during the readiness window queues
  rather than triggering Go's default immediate exit.
- runStream now returns the command error; init-envoy fatals on
  non-zero exit, matching the old wrapper.sh under `set -o errexit`.
- Extract waitForX to lib/x11.WaitForDisplay so the wrapper and
  chromium-launcher share one implementation.

Author: sjmiller609

server/cmd/chromium-launcher/main.go

@@ -13,6 +13,7 @@ import (
 	"time"
 
 	"github.com/kernel/kernel-images/server/lib/chromiumflags"
+	"github.com/kernel/kernel-images/server/lib/x11"
 )
 
 func main() {
@@ -45,7 +46,9 @@ func main() {
 	// Wait for the X server. The wrapper starts chromium in parallel with
 	// xorg/xvfb, so the display socket may not be ready yet — without this
 	// gate chromium would fail on connect and supervisord would restart us.
-	waitForX(":1", 20*time.Second)
+	if d := x11.WaitForDisplay(":1", 20*time.Second); d >= 20*time.Second {
+		fmt.Fprintf(os.Stderr, "warning: X display :1 not responsive after %s\n", d)
+	}
 
 	baseFlags := os.Getenv("CHROMIUM_FLAGS")
 	runtimeTokens, err := chromiumflags.ReadOptionalFlagFile(*runtimeFlagsPath)
@@ -130,30 +133,6 @@ func execLookPath(file string) (string, error) {
 	return exec.LookPath(file)
 }
 
-// waitForX blocks until the X server is reachable on display :N. We try
-// both the named unix socket (Xorg, headful) and the abstract namespace
-// socket (Xvfb runs with -nolisten unix, which disables the named socket
-// but leaves the abstract one). Mirrors the wrapper's check so chromium
-// can be started in parallel with the X server without failing on connect.
-func waitForX(display string, timeout time.Duration) {
-	num := strings.TrimPrefix(display, ":")
-	named := "/tmp/.X11-unix/X" + num
-	abstract := "@/tmp/.X11-unix/X" + num
-	deadline := time.Now().Add(timeout)
-	for time.Now().Before(deadline) {
-		if c, err := net.DialTimeout("unix", named, 200*time.Millisecond); err == nil {
-			_ = c.Close()
-			return
-		}
-		if c, err := net.DialTimeout("unix", abstract, 200*time.Millisecond); err == nil {
-			_ = c.Close()
-			return
-		}
-		time.Sleep(20 * time.Millisecond)
-	}
-	fmt.Fprintf(os.Stderr, "warning: X display %s not responsive after %s\n", display, timeout)
-}
-
 // waitForPort waits until the given port is available for binding on IPv4.
 // This handles the delay after SIGKILL before the kernel releases the socket.
 // We disable SO_REUSEADDR to get an accurate check matching chromium's bind behavior.

server/cmd/wrapper/display.go

@@ -1,30 +1,15 @@
 package main
 
 import (
-	"net"
-	"strings"
 	"time"
+
+	"github.com/kernel/kernel-images/server/lib/x11"
 )
 
-// waitForX waits until the X server is reachable on display :N. We try both
-// the named unix socket (Xorg, headful) and the abstract namespace socket
-// (Xvfb runs with -nolisten unix, which disables the named socket but leaves
-// the abstract one). Cheaper than spawning xdpyinfo in a loop.
+// waitForX blocks until the X server is reachable on display :N. Logs a
+// warning if the wait times out.
 func waitForX(display string, timeout time.Duration) {
-	num := strings.TrimPrefix(display, ":")
-	named := "/tmp/.X11-unix/X" + num
-	abstract := "@/tmp/.X11-unix/X" + num // Linux abstract namespace
-	deadline := time.Now().Add(timeout)
-	for time.Now().Before(deadline) {
-		if c, err := net.DialTimeout("unix", named, 200*time.Millisecond); err == nil {
-			_ = c.Close()
-			return
-		}
-		if c, err := net.DialTimeout("unix", abstract, 200*time.Millisecond); err == nil {
-			_ = c.Close()
-			return
-		}
-		time.Sleep(20 * time.Millisecond)
+	if d := x11.WaitForDisplay(display, timeout); d >= timeout {
+		logf("WARNING: X display %s not responsive after %s", display, timeout)
 	}
-	logf("WARNING: X display %s not responsive after %s", display, timeout)
 }

server/cmd/wrapper/main.go

@@ -58,6 +58,13 @@ func main() {
 	prof := detectProfile()
 	logf("starting wrapper (profile=%s)", profileName(prof))
 
+	// Register signal handling early so a SIGTERM/SIGINT during the
+	// seconds-long startup window queues into the channel instead of
+	// triggering Go's default exit-immediately behavior. The handler
+	// goroutine is installed below, once supervisord is running.
+	sigs := make(chan os.Signal, 1)
+	signal.Notify(sigs, syscall.SIGTERM, syscall.SIGINT)
+
 	// /dev/shm: only mount when not running under Docker (Docker manages it).
 	if os.Getenv("WITHDOCKER") == "" {
 		_ = os.MkdirAll("/dev/shm", 0o1777)
@@ -123,6 +130,15 @@ func main() {
 	if err := supCmd.Start(); err != nil {
 		fatalf("supervisord start: %v", err)
 	}
+	// Install the shutdown goroutine now so it can clean up if a signal
+	// arrives during the readiness window. Any signal queued in `sigs`
+	// before this point gets picked up on the first iteration.
+	go func() {
+		<-sigs
+		logf("shutdown: stopping services")
+		_ = exec.Command("supervisorctl", "-c", supervisorConf, "stop", "all").Run()
+		_ = supCmd.Process.Signal(syscall.SIGTERM)
+	}()
 	waitForSocket(supervisorSock, 10*time.Second)
 
 	// Phase A: identity-free services. Chromium itself doesn't read any
@@ -184,7 +200,7 @@ func main() {
 	// post-fork (stop+start to force a re-read of refreshed envs).
 	phaseCStart := time.Now()
 	if isExecutable("/usr/local/bin/init-envoy.sh") {
-		runStream("envoy-init", "/usr/local/bin/init-envoy.sh")
+		runStreamFatal("envoy-init", "/usr/local/bin/init-envoy.sh")
 	}
 	restartAll("kernel-images-api")
 	phaseCDone := time.Now()
@@ -212,16 +228,6 @@ func main() {
 	// Re-enable scale-to-zero now that the hot path is up.
 	enableScaleToZero()
 
-	// Forward signals so cleanup runs and supervisord is taken down cleanly.
-	sigs := make(chan os.Signal, 1)
-	signal.Notify(sigs, syscall.SIGTERM, syscall.SIGINT)
-	go func() {
-		<-sigs
-		logf("shutdown: stopping services")
-		_ = exec.Command("supervisorctl", "-c", supervisorConf, "stop", "all").Run()
-		_ = supCmd.Process.Signal(syscall.SIGTERM)
-	}()
-
 	// Block on supervisord; container exits when it does.
 	if err := supCmd.Wait(); err != nil {
 		logf("supervisord exited: %v", err)

server/cmd/wrapper/supervisord.go

@@ -96,11 +96,20 @@ func tailFile(path string) {
 	}
 }
 
-func runStream(label, name string, args ...string) {
+func runStream(label, name string, args ...string) error {
 	cmd := exec.Command(name, args...)
 	cmd.Stdout = prefixWriter{label: label, w: os.Stdout}
 	cmd.Stderr = prefixWriter{label: label, w: os.Stderr}
-	_ = cmd.Run()
+	return cmd.Run()
+}
+
+// runStreamFatal is runStream + fatalf on non-zero exit. Use for scripts the
+// boot path cannot proceed without (init-envoy). The old wrapper.sh ran under
+// `set -o errexit`, so these were already fatal there.
+func runStreamFatal(label, name string, args ...string) {
+	if err := runStream(label, name, args...); err != nil {
+		fatalf("%s failed: %v", label, err)
+	}
 }
 
 type prefixWriter struct {

server/lib/x11/x11.go

@@ -0,0 +1,36 @@
+// Package x11 provides helpers for talking to a local X server.
+package x11
+
+import (
+	"net"
+	"strings"
+	"time"
+)
+
+// WaitForDisplay blocks until the X server is reachable on display :N, returning
+// the time spent waiting. It tries both the named unix socket (Xorg, headful)
+// and the abstract namespace socket (Xvfb runs with -nolisten unix, which
+// disables the named socket but leaves the abstract one). Cheaper than spawning
+// xdpyinfo in a loop.
+//
+// If the deadline elapses, WaitForDisplay still returns; callers can compare
+// the returned duration against timeout to detect a miss.
+func WaitForDisplay(display string, timeout time.Duration) time.Duration {
+	start := time.Now()
+	num := strings.TrimPrefix(display, ":")
+	named := "/tmp/.X11-unix/X" + num
+	abstract := "@/tmp/.X11-unix/X" + num // Linux abstract namespace
+	deadline := start.Add(timeout)
+	for time.Now().Before(deadline) {
+		if c, err := net.DialTimeout("unix", named, 200*time.Millisecond); err == nil {
+			_ = c.Close()
+			return time.Since(start)
+		}
+		if c, err := net.DialTimeout("unix", abstract, 200*time.Millisecond); err == nil {
+			_ = c.Close()
+			return time.Since(start)
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+	return time.Since(start)
+}