Dear Maintainer,
I'm using runit under systemd via runit-run. Some of the
runit-supervised services depend on systemd-supervised ones, and it's
easy to add a file in /etc/systemd/system/runit.service.d/ specifying
e.g.
| [Unit]
| After=postgresql.service valkey-server.service
| Wants=postgresql.service valkey-server.service
This works properly for startup. However, there's a race condition on
shutdown:
The runit.service is defined with
| KillSignal=SIGHUP
| KillMode=process
which causes systemd to send SIGHUP to the runsvdir. Quoting
runsvdir(8):
| If runsvdir receives a HUP signal, it sends a TERM signal to each
| runsv(8) process it is monitoring and then exits with 111.
...and that is exactly what it does. In particular, runsvdir does NOT
wait for the runsv processes to exit first, hence the runit-supervised
services may not have terminated (or even gotten SIGTERM) yet.
But systemd (in KillMode=process) assumes that runsvdir exiting means
the service is down, and proceeds to stop the dependencies. Depending on
timing, this breaks my still-running (or still-shutting-down) services.
I wish for this race to be fixed. :)
I can see 2.5 ways to do that:
1) It should be possible to teach runsvdir to wait for its runsv
children to exit before exiting itself. And since runsv in turn does
wait for its children to exit, that would ensure the whole
supervision tree has exited when runsvdir does, as systemd expects.
2) It is possible to use systemd's ExecStop= configuration to delay
systemd from considering the service stopped until the process
specified there has exited. Hence, specify a process that waits for
the supervision tree to die.
2a) You could do so by interacting with
/etc/runit/runsvdir/svmanaged/*/supervise/ to find the processes in
question, or
2b) since systemd puts each service in its own cgroup, you can wait for
that cgroup to become empty.
While I think 1) would be cleaner, I'm unsure about the compatibility
implications (Change SIGHUP behaviour? Use a new signal? Would Debian
want to patch runsvdir like that?) and the reason for the current
runsvdir behaviour (When/why is not waiting ever useful?).
If you think some version of this would be a good feature, please say
so, and I'll try to come up with a patch.
So meanwhile, I implemented 2b), the resulting ExecStop= script is
attached. It has been working well for me. I hope it's useful, or even
acceptable for inclusion in Debian.
Please tell me if I can do anything else to help.
Thank you for maintaining runit!
cheers,
Jan
Hi Jan, thanks for reporting this. I don't use runit-run (and systemd) so the package relies on report from users On Wed, 19 Aug 2026 16:52:34 +0200 Jan Braun <janbraun@gmx.de> wrote: [..] OK now that upstream is active again I prefer not to carry additional Debian specific patches, so this would be better discussed upstream. let's first try to address this without patching runit I'm ok with this patch, but first I wonder if there is a way to address this with systemd directives (without extra scripts); I don't know why we use KillMode=process , by looking at https://www.freedesktop.org/software/systemd/man/latest/systemd.kill.html?__goaway_challenge=meta-refresh&__goaway_id=f51c50d8745b3678afa63ccfdd4956af something like KillMode=control-group TimeoutStopSec=2 can be used instead: did you already tried something like the above (and it does not work)? maybe unrelated, but we may also benefit from SuccessExitStatus=111 Cheers, Lorenzo
Hello Jan, I plan to release runit 2.3.1-5 this weekend or maybe early next week; if you can confirm whether my idea (below) works or not I'm going to include either this or your patch to the next runit upload. Best, Lorenzo
Hi,
Lorenzo schrob:
to *all* processes in the control group, including children of
supervised processes, which should not be killed in this way, but
instead be left alone, to be handled by the supervised processes
themselves.
One case where that might conceivably make a difference is dhcpcd, where
the supervised master process might still use its privsep children to do
additional teardown work before it kills them. I haven't tested that
hypothesis, however.
(Of course, it would always be possible to work around
KillMode=control-group for such services by making their ./run file move
them to their own cgroup, and runsv(8) would still DTRT by virtue of
staying in the runit.cgroup and getting the TERM signal.
I'd consider that a hack, tho.)
That seems appropriate.
cheers,
Jan
Hi, ok, then I'm applying your patch. Only thing to be careful is that I think the service can remain stuck in exectop status for long time if there is some misbehaving runit service that does not stop at all. I think that will result in a systemd timeout of 60 (or 180?) seconds, but I'm not sure... Best, Lorenzo
Hello, Bug #1144866 in runit reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/debian/runit/-/commit/98ef77c9c935d82715beaf96be0eb85149bc8047 ------------------------------------------------------------------------ runit-run: fix race at systemd shutdown Use ExecStop in runit.service to fix a race at systemd shutdown: use systemd's cgroup to track childs of the service and wait for the cgroup to be empty before exec-stop script returns (wait for all runit services to stop before runit.service is considered as down by systemd) Closes: #1144866 Thanks: Jan Braun <janbraun@gmx.de> ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1144866
Lorenzo schrob:
Yes. TimeoutStopSec ?= DefaultTimeoutStopSec ?= 90s, according to the
manpage.
And I think that waiting a long time is indeed the only reasonable
default for a supervisor, because a misbehaving service that does not
stop at all is indistinguishable from a properly behaving service that
just takes very long to stop. Noticing the former case and fixing the
underlying bug should be left as an execise for the humans.
Thanks again for maintaining runit. :)
cheers,
Jan
Hello, Bug #1144866 in runit reported by you has been fixed in the Git repository and is awaiting an upload. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/debian/runit/-/commit/98ef77c9c935d82715beaf96be0eb85149bc8047 ------------------------------------------------------------------------ runit-run: fix race at systemd shutdown Use ExecStop in runit.service to fix a race at systemd shutdown: use systemd's cgroup to track childs of the service and wait for the cgroup to be empty before exec-stop script returns (wait for all runit services to stop before runit.service is considered as down by systemd) Closes: #1144866 Thanks: Jan Braun <janbraun@gmx.de> ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1144866
We believe that the bug you reported is fixed in the latest version of
runit, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1144866@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Lorenzo Puliti <plorenzo@disroot.org> (supplier of updated runit package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 02 Oct 2026 16:19:22 +0200
Source: runit
Architecture: source
Version: 2.3.1-5
Distribution: unstable
Urgency: medium
Maintainer: Lorenzo Puliti <plorenzo@disroot.org>
Changed-By: Lorenzo Puliti <plorenzo@disroot.org>
Closes: 923449 1105907 1143778 1144866
Changes:
runit (2.3.1-5) unstable; urgency=medium
.
* default-syslog: silence socklog-check output
* add runsv-cg for setting up cgroups on runit
* stage 1: setup (mount) cgroup2
* add a manpage for runsv-cg
* runsv-cg:
- fix typo
- do not require runit as init
* use /sys/fs/cgroup/runit for runit's services cgroups
* invoke-run, finish-exec: add optional cgroup support (Closes: #923449)
* invoke-run:
- update manpage for cgroups
- allow users to control verbosity for user services (Closes: #1143778)
- clarify home directory for user services in manpage
* runit-run: fix race at systemd shutdown.
+ thanks to Jan Braun <janbraun@gmx.de> (Closes: #1144866)
* getty-run: always test for fuser before calling it (Closes: #1105907)
* d/control: use dh-sequence for dh_runit and dh_sysuser
* d/control: drop {runit:Breaks} and {runit:Conflicts} for runit
* d/control (runit-run): drop ancient Breaks and Replaces
* bump S-V to 4.7.4, no changes required
Checksums-Sha1:
8b86709175d2df04fa1cccd7452c10b8a6d24deb 2265 runit_2.3.1-5.dsc
4d5550a17d5ffb8d9270bb139549e2a7125a2a41 90448 runit_2.3.1-5.debian.tar.xz
bc4b5c13462a9f9fcd420ac476b071a85cee09c9 6934 runit_2.3.1-5_amd64.buildinfo
Checksums-Sha256:
538a06cba27ef5f51e6e48b49d5bfaf98789a2ee635fda439d4bc53e590230f0 2265 runit_2.3.1-5.dsc
4a13705a96dd79d19555584242ba51420b1e871da76ae07dd25845f2a5ed1a21 90448 runit_2.3.1-5.debian.tar.xz
4ee723a42e71c06cbfe1953006b92280cb0ed43b8c499e376c20b0306a7a43ac 6934 runit_2.3.1-5_amd64.buildinfo
Files:
f33ea6456a4991f34f5d4a7dd1cc03ef 2265 admin optional runit_2.3.1-5.dsc
4a1892bbd1e1c971bcc40c39cab9baf3 90448 admin optional runit_2.3.1-5.debian.tar.xz
99e305bf0d8d87105b3ed75831c6ef6b 6934 admin optional runit_2.3.1-5_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE2ji91PGnrxOd1bVNxxYb07RU7gMFAmrBSAYACgkQxxYb07RU
7gNgaQ//V9hWXyGgsIvtwkn6jdgFmptQJxKNtJMsGSPJLGLDWg5uUfYqtycc5FQi
JwsG4xNckWwnqQB0RiBIVDL3YlxWYf0paZYIjNLoquBtFJZt0WrpYqgmSYJM+Hnj
Tv7rle73pS8i6KzGtu0zkC02M6U/06oCYHEcqRiKlbxlnVfUpqKUb4rAzYQj+BW5
OZSZONKNPBt1EKKY3YCUYCltLvpss6CnGod8lOQZ1nqi52Tugupi+9Rk7UvM5hOy
i+zQA3GbfDyaFO5tE4vRc0dWyQsFhtKim5tXBGPmrhU8KecUuXGr4DClVbOSddqC
lrwm8LzFUdkzzd/tCpDcGUcaQIpiFbx+ojcd24oDBc9G+evgzmgW1r6fjOT57ZXu
zqRSGptKaUQrJijI9ZzerpUtT2xvK9HP/diC14RQhguvZZk5K7pe4lNKgS6rYChu
q7k7xsURuzz4/SavuX3N+zTfRiWWU8g0e/aahQHCIiUkwDIH2IFDYkjxJUM/oy2R
McYp1iOV6SMss8ePikjrqZmkowvCipGqV7PzzwYB/KrQX7doHZY6EiV4fGnUzev5
Tme5wvuz5L/VvwhZ0FsyS4NUIPT0V5oEI0MfomyzdjpvsFZlRZO+NgZtCRez6HCw
aGvo2fYYOud0F56kWLmbuXnzRQfiZld3p2z60wq+mZF7s62zDdc=
=XwEp
-----END PGP SIGNATURE-----