hermes-s6-container-supervision

Create a directory under docker/s6-rc.d/<name> with a type file containing 'longrun' and a run script using #!/command/with-contenv sh. Add empty dependencies.d/base and user/contents.d/<name> files so it joins the user bundle; the Dockerfile COPY picks it up automatically.

Run /command/s6-svstat /run/service/<name> inside the container; 'down (exitcode N), want up' means s6 wants it running but the process keeps exiting. Check the service logs and fix the underlying configuration — s6 will keep retrying until it stays up.

The /command directory containing s6-overlay binaries is only on PATH for processes spawned by the supervision tree, not for docker exec sessions. Always use the absolute path, e.g. /command/s6-svstat, when running s6 tools via docker exec.

Invoking s6-svscanctl -t or /run/s6/basedir/bin/halt triggers stage 3 shutdown but returns 143 (SIGTERM) instead of your intended exit code. To propagate a real exit code, let the container's CMD exit normally rather than calling halt from a finish script.

Service directories live on tmpfs and are wiped on restart, so a cont-init.d reconciler script must recreate them from persistent state on each boot. In this image, 02-reconcile-profiles walks profile gateway_state.json files and re-registers slots, auto-starting only those previously running.