fix: sbx bug for reaping zombie processes

Dockerfile

@@ -82,6 +82,8 @@ RUN set -euo pipefail; \
     chown 1000:1000 /home/agent/.cargo/bin/coyote; \
     rm -rf "$TMPDIR"
 
+COPY --chmod=0755 scripts/docker-entrypoint.sh /usr/local/bin/coyote-entrypoint
+
 FROM scratch
 
 ARG COYOTE_VERSION
@@ -107,4 +109,7 @@ WORKDIR /home/agent/workspace
 
 USER 1000
 
-ENTRYPOINT ["coyote"]
+# tini as PID 1 (as in the sandbox-templates base) reaps orphans and forwards
+# signals; coyote-entrypoint runs coyote by default, or the given command
+# (e.g. the Docker Sandboxes keep-alive) when the first arg is sh/bash/a path.
+ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/coyote-entrypoint"]

README.md

@@ -144,6 +144,13 @@ docker run --rm -it \
   darkalex17/coyote
 ```
 
+Arguments are passed to `coyote`. If the first argument is `sh`, `bash`, or an absolute path, that command runs instead,
+e.g. to get a shell inside the image:
+
+```bash
+docker run --rm -it darkalex17/coyote bash
+```
+
 ### Scripts
 #### Linux/MacOS (`bash`)
 You can use the following command to run a bash script that downloads and installs the latest version of `coyote` for your

scripts/docker-entrypoint.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+# Entrypoint for the coyote Docker image. Runs under tini:
+#   ENTRYPOINT ["/usr/bin/tini", "--", "/usr/local/bin/coyote-entrypoint"]
+#
+# tini (PID 1) reaps orphaned processes and forwards signals; coyote is not an
+# init and does neither.
+
+case "$1" in
+  sh | bash | /*) exec "$@" ;;
+esac
+
+exec coyote "$@"