From 4e33979a92c24c956acec6895490abb36c664b40 Mon Sep 17 00:00:00 2001
From: Alex Clarke <alex.j.tusa@gmail.com>
Date: Sat, 26 Sep 2026 16:19:04 -0600
Subject: [PATCH] fix: sbx bug for reaping zombie processes

---
 Dockerfile                   |  7 ++++++-
 README.md                    |  7 +++++++
 scripts/docker-entrypoint.sh | 12 ++++++++++++
 3 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100755 scripts/docker-entrypoint.sh

diff --git a/Dockerfile b/Dockerfile
index 1481ef4..40e5da4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -82,6 +82,8 @@ RUN set -euo pipefail; \
     chown 1000:1000 /home/agent/.cargo/bin/coyote; \
     rm -rf "$TMPDIR"
 
+COPY --chmod=0755 scripts/docker-entrypoint.sh /usr/local/bin/coyote-entrypoint
+
 FROM scratch
 
 ARG COYOTE_VERSION
@@ -107,4 +109,7 @@ WORKDIR /home/agent/workspace
 
 USER 1000
 
-ENTRYPOINT ["coyote"]
+# tini as PID 1 (as in the sandbox-templates base) reaps orphans and forwards
+# signals; coyote-entrypoint runs coyote by default, or the given command
+# (e.g. the Docker Sandboxes keep-alive) when the first arg is sh/bash/a path.
+ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/coyote-entrypoint"]
diff --git a/README.md b/README.md
index 33d366d..4a0a35b 100644
--- a/README.md
+++ b/README.md
@@ -144,6 +144,13 @@ docker run --rm -it \
   darkalex17/coyote
 ```
 
+Arguments are passed to `coyote`. If the first argument is `sh`, `bash`, or an absolute path, that command runs instead,
+e.g. to get a shell inside the image:
+
+```bash
+docker run --rm -it darkalex17/coyote bash
+```
+
 ### Scripts
 #### Linux/MacOS (`bash`)
 You can use the following command to run a bash script that downloads and installs the latest version of `coyote` for your
diff --git a/scripts/docker-entrypoint.sh b/scripts/docker-entrypoint.sh
new file mode 100755
index 0000000..8bbb6cc
--- /dev/null
+++ b/scripts/docker-entrypoint.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+# Entrypoint for the coyote Docker image. Runs under tini:
+#   ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/coyote-entrypoint"]
+#
+# tini (PID 1) reaps orphaned processes and forwards signals; coyote is not an
+# init and does neither.
+
+case "$1" in
+  sh | bash | /*) exec "$@" ;;
+esac
+
+exec coyote "$@"