PHP-FPM issue in Docker Desktop 4.27.2: WARNING: [pool www] child 85 exited on signal 11 (SIGSEGV)

[NiklasBr]

Description

After updating to Docker Desktop 4.27.2 from 4.26.1 PHP-FPM containers cannot run without crashing with the error:

2024-02-09 10:17:13 pimcore-fpm-1    | 172.19.0.6 -  09/Feb/2024:10:17:13 +0100 "GET /index.php" 200
2024-02-09 10:17:14 pimcore-fpm-1    | [09-Feb-2024 10:17:14] WARNING: [pool www] child 85 exited on signal 11 (SIGSEGV) after 239.493217 seconds from start

Reproduce

1. Build a PHP-based image with a Composer package and put it behind an Nginx proxy.
2. Run it using docker compose up -d

Expected behavior

It should run as well as it did in 4.26.1

docker version

Client:
 Cloud integration: v1.0.35+desktop.10
 Version:           25.0.3
 API version:       1.44
 Go version:        go1.21.6
 Git commit:        4debf41
 Built:             Tue Feb  6 21:13:26 2024
 OS/Arch:           darwin/arm64
 Context:           desktop-linux

Server: Docker Desktop 4.27.2 (137060)
 Engine:
  Version:          25.0.3
  API version:      1.44 (minimum version 1.24)
  Go version:       go1.21.6
  Git commit:       f417435e5f6216828dec57958c490c4f8bae4f98
  Built:            Wed Feb  7 00:39:16 2024
  OS/Arch:          linux/arm64
  Experimental:     false
 containerd:
  Version:          1.6.28
  GitCommit:        ae07eda36dd25f8a1b98dfbf587313b99c0190bb
 runc:
  Version:          1.1.12
  GitCommit:        v1.1.12-0-g51d5e94
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

### docker info

```bash
Client:
 Version:    25.0.3
 Context:    desktop-linux
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.12.1-desktop.4
    Path:     /Users/nikbr/.docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.24.5-desktop.1
    Path:     /Users/nikbr/.docker/cli-plugins/docker-compose
  debug: Get a shell into any image or container. (Docker Inc.)
    Version:  0.0.24
    Path:     /Users/nikbr/.docker/cli-plugins/docker-debug
  dev: Docker Dev Environments (Docker Inc.)
    Version:  v0.1.0
    Path:     /Users/nikbr/.docker/cli-plugins/docker-dev
  extension: Manages Docker extensions (Docker Inc.)
    Version:  v0.2.21
    Path:     /Users/nikbr/.docker/cli-plugins/docker-extension
  feedback: Provide feedback, right in your terminal! (Docker Inc.)
    Version:  v1.0.4
    Path:     /Users/nikbr/.docker/cli-plugins/docker-feedback
  init: Creates Docker-related starter files for your project (Docker Inc.)
    Version:  v1.0.0
    Path:     /Users/nikbr/.docker/cli-plugins/docker-init
  sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc.)
    Version:  0.6.0
    Path:     /Users/nikbr/.docker/cli-plugins/docker-sbom
  scout: Docker Scout (Docker Inc.)
    Version:  v1.4.1
    Path:     /Users/nikbr/.docker/cli-plugins/docker-scout
WARNING: Plugin "/Users/nikbr/.docker/cli-plugins/docker-scan" is not valid: failed to fetch metadata: fork/exec /Users/nikbr/.docker/cli-plugins/docker-scan: no such file or directory

Server:
 Containers: 18
  Running: 11
  Paused: 0
  Stopped: 7
 Images: 36
 Server Version: 25.0.3
 Storage Driver: overlayfs
  driver-type: io.containerd.snapshotter.v1
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: ae07eda36dd25f8a1b98dfbf587313b99c0190bb
 runc version: v1.1.12-0-g51d5e94
 init version: de40ad0
 Security Options:
  seccomp
   Profile: unconfined
  cgroupns
 Kernel Version: 6.6.12-linuxkit
 Operating System: Docker Desktop
 OSType: linux
 Architecture: aarch64
 CPUs: 9
 Total Memory: 23.44GiB
 Name: docker-desktop
 ID: 8f590826-49c3-4f7b-8c5d-0d6228d1cf1a
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 HTTP Proxy: http.docker.internal:3128
 HTTPS Proxy: http.docker.internal:3128
 No Proxy: hubproxy.docker.internal
 Experimental: false
 Insecure Registries:
  hubproxy.docker.internal:5555
  127.0.0.0/8
 Live Restore Enabled: false

WARNING: daemon is not using the default seccomp profile

### Diagnostics ID

B99BCF91-9CAF-4D12-AE8B-A4858EC43329/20240209095720

### Additional Info

I thought this was supposed to be fixed in 4.27.2 according to the release notes?

[dgageot]

@NiklasBr this would really help if you could share the complete Dockerfile and compose files that you use. With it, we can probably fix your issue under an hour. Without, it will take much much longer. If you can provide those files, that would be awesome!

[NiklasBr]

Nginx Dockerfile:

FROM nginx:1.24

RUN apt-get update && apt-get install -y --no-install-recommends nano && rm -rf /var/lib/apt/lists/*

COPY etc/default.conf.tmpl /etc/nginx/conf.d/default.conf.tmpl
COPY etc/includes/maintenance.conf.tmpl /etc/nginx/conf.d/includes/maintenance.conf.tmpl
COPY etc/nginx.conf /etc/nginx/nginx.conf
COPY etc/extra/ /etc/nginx/extra/
COPY bin/* /usr/local/bin/

RUN mkdir -p /etc/nginx/ssl/cert/

EXPOSE 80

ENV UPLOAD_MAX_FILESIZE 100M
ENV FPM_HOST pimcore-fpm
ENV FPM_PORT 9000
ENV PIMCORE_ROOT /var/www/pimcore
ENV DEBUG false
ENV BASIC_AUTH off

RUN chmod +x /usr/local/bin/docker-entrypoint.sh

ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
CMD ["nginx", "-g", "daemon off;"]

[NiklasBr]

PHP application Dockerfile:

FROM php:8.1-fpm

WORKDIR /var/www

RUN apt-get update && apt-get install -y lsb-release \
    && echo "deb http://deb.debian.org/debian $(lsb_release -sc)-backports main" > /etc/apt/sources.list.d/backports.list \
    && apt-get update && apt-get install -y --no-install-recommends \
      autoconf automake libtool nasm make pkg-config libz-dev build-essential openssl g++ \
      libzip-dev libicu-dev libbz2-dev libavif-dev libheif-dev libpng-dev libc-client-dev libonig-dev \
      libkrb5-dev libxml2-dev libxslt1.1 libxslt1-dev locales locales-all \
      libfreetype6-dev ffmpeg ghostscript pngcrush jpegoptim exiftool liblcms2-dev libwebp-dev poppler-utils git wget \
      libx11-dev libjpeg-dev libtiff-dev opencv-data webp graphviz libreoffice cmake unzip rsync \
      msmtp procps gettext-base nano sudo iproute2 libltdl-dev \
      liblqr-1-0-dev libjpeg-turbo-progs libjpeg62-turbo-dev libopenjp2-7-dev \
      libdjvulibre-dev libpango1.0-dev libxpm-dev \
      xfonts-75dpi xfonts-base \
      advancecomp zopfli optipng pngquant

RUN wget https://imagemagick.org/archive/ImageMagick.tar.gz \
      && tar -xvf ImageMagick.tar.gz \
      && cd ImageMagick-7.* \
      && ./configure --enable-shared --with-tiff=yes --disable-docs --with-tcmalloc --without-perl \
      && make --jobs=$(nproc) \
      && make install \
      && ldconfig /usr/local/lib \
      && cd .. \
      && rm -rf ImageMagick* \
   && docker-php-ext-install -j$(nproc) intl mysqli bcmath bz2 gd soap xsl pdo pdo_mysql fileinfo exif zip opcache sockets \
    && docker-php-ext-enable intl mysqli bcmath bz2 gd soap xsl pdo pdo_mysql fileinfo exif zip opcache sockets \
    && pecl install imagick apcu redis \
    && pecl install -f xmlrpc \
    && docker-php-ext-enable redis imagick apcu xmlrpc \
    && docker-php-ext-configure imap --with-kerberos --with-imap-ssl \
    && docker-php-ext-install -j$(nproc) imap \
    && docker-php-ext-enable imap \
    \
    && pecl install -o -f xdebug \
    && cd ~

COPY --from=composer:latest /usr/bin/composer /usr/bin/composer

ENV COMPOSER_ALLOW_SUPERUSER 1
ENV COMPOSER_MEMORY_LIMIT -1
ENV COMPOSER_HOME /var/www/.composer
VOLUME /var/www/.composer

ENV PIMCORE_ROOT /var/www/pimcore
ENV PHP_MEMORY_LIMIT 2G
ENV PHP_ENABLE_XDEBUG false

ENV DEBUG false
ENV UPDATE_UID_GID false
ENV APP_ENV dev
ENV CLUSTER_SETUP false

# PHP opcache default values
ENV OPCACHE_MAX_FILES 16229
ENV OPCACHE_MEMORY 128
ENV OPCACHE_STRINGS_BUFFER 24
ENV OPCACHE_VALIDATE_TIMESTAMPS 1
ENV OPCACHE_REVALIDATE_FREQ 2

# PHP fpm
ENV PHP_PM_MAX_CHILDREN 20
ENV PHP_PM_START_SERVERS 8
ENV PHP_PM_MIN_SPARSE_SERVERS 5
ENV PHP_PM_MAX_SPARSE_SERVERS 12
ENV UPLOAD_MAX_FILESIZE 64M
ENV POST_MAX_SIZE 128M

# New Relic:
ENV NEW_RELIC_LICENSE_KEY must_set
ENV NEW_RELIC_APM_HIGH_SECURITY_MODE false
ENV NEW_RELIC_APM_ENABLED false
ENV NEW_RELIC_PROJECT_NAME must_set
ENV NEW_RELIC_COMMON_APP_NAME Pimcore
ENV NEW_RELIC_TIER_LABEL FPM
ENV NEW_RELIC_ENVIRONMENT_LABEL must_set

COPY etc/bashrc.sh /tmp/
RUN cat /tmp/bashrc.sh >> /etc/bash.bashrc && rm -f /tmp/bashrc.sh

COPY etc/php-fpm.conf.tmpl   /usr/local/etc/
COPY etc/php-fpm.ini /usr/local/etc/php/conf.d/zz-pimcore.ini
COPY etc/php-mail.ini /usr/local/etc/php/conf.d/zz-mail.ini
COPY etc/php-opcache.ini /usr/local/etc/php/conf.d/zz-opcache.ini
COPY etc/php-xdebug.ini /usr/local/etc/php/conf.d/zz-xdebug-settings.ini
COPY etc/php-timezone.ini /usr/local/etc/php/conf.d/zz-timezone.ini
COPY etc/php-newrelic.ini /usr/local/etc/php/conf.d/zz-newrelic.ini
COPY etc/msmtp.conf.tmpl /etc/

COPY bin/* /usr/local/bin/
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
RUN touch /var/log/msmtp.log && chown www-data /var/log/msmtp.log

# Install NR with multiarch support
RUN  VERSION_REGEX='[1-9][0-9]\?\(\.[0-9]\+\)\{3\}' \
   && NEWRELIC_FILE=$(curl 'https://download.newrelic.com/php_agent/release/' | grep -o 'newrelic-php5.*linux\.tar\.gz' | sed -e 's/^.*>//;s/<[^>]*>//g') \
   && NEWRELIC_FOLDER=$(echo ${NEWRELIC_FILE} | sed 's/.tar.gz//g') \
   && curl https://download.newrelic.com/php_agent/release/${NEWRELIC_FILE} | tar -zx \
   && cd ${NEWRELIC_FOLDER} \
   && export NR_INSTALL_USE_CP_NOT_LN=1 \
   && export NR_INSTALL_SILENT=1 \
   && export NR_INSTALL_KEY=TEMPLICENSEAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
   && ./newrelic-install install \
   && rm -rf ${NEWRELIC_FOLDER}

RUN ln -fs /usr/share/zoneinfo/Europe/Oslo /etc/localtime && echo "Europe/Oslo" > /etc/timezone

ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]

CMD ["php-fpm", "-F"]

[dgageot]

@NiklasBr do you run this with Rosetta or Qemu?

[NiklasBr]

[NiklasBr]

@dgageot I also tried EXPERIMENTAL_DOCKER_DESKTOP_FORCE_QEMU=1 docker build … but it did not change anything.

[dgageot]

@dgageot I also tried EXPERIMENTAL_DOCKER_DESKTOP_FORCE_QEMU=1 docker build … but it did not change anything.

Your issue is a run issue, not a build issue. Could you try with and without Rosetta enabled?
That should at least give you different errors in both cases.

[NiklasBr]

Same error without Rosetta enabled:

2024-02-12 08:17:15 pimcore-fpm-1    | 172.19.0.11 -  12/Feb/2024:08:17:13 +0100 "GET /index.php" 200
2024-02-12 08:17:15 pimcore-fpm-1    | [12-Feb-2024 08:17:15] WARNING: [pool www] child 113 said into stderr: "qemu: uncaught target signal 11 (Segmentation fault) - core dumped"
2024-02-12 08:17:15 pimcore-fpm-1    | [12-Feb-2024 08:17:15] WARNING: [pool www] child 113 exited on signal 11 (SIGSEGV) after 39.193922 seconds from start
2024-02-12 08:17:15 pimcore-web-1    | 2024/02/12 07:17:15 [error] 32#32: *47 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 192.168.65.1, server: localhost, request: "GET /_wdt/46c3d5 HTTP/1.1", upstream: "fastcgi://172.19.0.9:9000",
2024-02-12 08:17:15 pimcore-fpm-1    | [12-Feb-2024 08:17:15] NOTICE: [pool www] child 129 started

[dgageot]

qemu: uncaught target signal 11 (Segmentation faul

This can't be a rosetta error

[NiklasBr]

Not disagreeing, but in real life it is still a blocking problem. Cannot use the Docker license I am paying for at the moment.

[dgageot]

@NiklasBr That would be easier to help you with a basic project to repro. You shared dockerfiles but they rely on plenty of files on your system.
You shared Rosetta logs but they are qemu in fact.

I really really want to help you but it requires way too much guessing on my part.