$ show just-containers/s6-overlay
s6-overlay is a production-grade init system and process supervisor for Docker containers, built on top of the s6 ecosystem (s6, s6-rc, s6-linux-init). It replaces the default container PID 1 with a robust supervision tree that handles zombie reclamation, orderly startup/shutdown, service dependencies, and logging. The architecture is layered: stage0 (s6-linux-init-maker) generates stage1 infrastructure at runtime, stage2 (rc.init) compiles s6-rc service databases and brings up services via s6-rc, supporting both legacy /etc/services.d directories and modern s6-rc source definitions. The system provides utilities like with-contenv (inject container environment), logutil-service (privilege-dropped logging), and with-retries (retry with timeout). It handles edge cases such as read-only root filesystems, non-root USER directives, and Kubernetes world-writable /run configurations. The codebase is predominantly shell and execline scripts, with a Makefile-based build system that cross-compiles all skaware dependencies statically. It is actively maintained, with a clear separation of concerns and extensive documentation derived from the actual code behavior.
The LLM identified 5 files worth highlighting for reuse:
A small execline script that reads the container environment from /run/s6/container_environment (populated by s6-envdir) and executes a command with those variables set. If S6_KEEP_ENV is set, it becomes a no-op passthrough. This is a self-contained, reusable pattern for injecting container environment into subprocesses, independent of the rest of s6-overlay.
A shell script that retrieves a single environment variable either from the container environment file (/run/s6/container_environment/$1) or from the process environment if S6_KEEP_ENV is set. It exits 1 if the variable is not found. This is a simple, reusable utility for reading container configuration, easily extractable for any project needing a similar pattern.
An execline script that runs a command with retries and a per-attempt timeout. Uses s6-seq to iterate, s6-maximumtime to enforce timeout, and exits 0 on success or 99 if all retries fail. This is a generic retry wrapper that can be reused in any shell-based init or CI system without modification.
An execline script that sets up a logging service: it drops privileges to the 'nobody' user (with fallback to 65534:65534), clears environment, and executes s6-log with the configured S6_LOGGING_SCRIPT. It optionally reads from a FIFO if the -f option is given. This is a self-contained logging helper that can be extracted for any service needing automatic log rotation and privilege separation.
A shell script that runs as the first userland process (via s6-overlay-suexec) to validate and fix the container environment: ensures /run is writable and executable, creates a tmpfs if needed, fixes /var/run symlink, cleans up stale state, and handles read-only root and non-root USER scenarios. It is a robust, self-contained pre-init routine that could be reused in any container init system to perform similar sanity checks.