Conversation
piler and piler-smtp only log through syslog(3), and a rootless container has no /dev/log to receive it, so their logs were dropped entirely. An LD_PRELOAD shim rewrites those calls to stderr, which supervisord ships to the container log like nginx's and php-fpm's. The binaries are built fortified, so __syslog_chk is the symbol that matters.
stephdl
force-pushed
the
piler-logs-to-stderr
branch
from
August 25, 2026 13:19
a018255 to
a53b3ac
Compare
Also add validate.yml to build.yml's path filters: a CI-only change did not trigger build, so validate never ran on it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #31, itself stacked on #30. Retarget as those merge.
Problem
pilerandpiler-smtplog exclusively throughsyslog(3). There is no syslog daemon in this image and no/dev/logsocket —/devis a root-owned tmpfs created by the runtime, and the container is uid 1000 withcap_drop: ALL, so nothing can create one. Every line the two daemons produced was silently discarded. They were the only things in the container without logs, while nginx and php-fpm stream to stdout/stderr.This is not theoretical: diagnosing a failure during #30 required injecting a syslog collector with
podman exec --user rootto see anything at all.Change
config/syslog-to-stderr.cis a ~40-lineLD_PRELOADshim that overridesopenlog,syslog,vsyslog,__syslog_chkand__vsyslog_chkand writesident[pid]: messageto stderr, expanding%mthe way glibc does.__syslog_chkis the one that matters — the released binaries are built fortified:It is compiled in its own build stage (
gccandlibc6-devnever reach the runtime image) and preloaded forpiler,piler-smtpandsupercroniconly — not for php-fpm or nginx, which have real log configuration.Upstream is the better place to fix this:
LOG_PERRORwhen not daemonising, or a config toggle. Since #30 both daemons run in the foreground, so that flag alone would do it. The shim can be dropped if that lands.Validation
Built and run through the full compose stack. Before this change
podman logs pilerhad no piler lines at all; now:Also re-ran #31's drain scenario under the shim: 200 mails sent,
stop -t 60loggeddraining spool, 34 file(s) leftthenspool drained, and all 200 were archived. Compiles clean with-Wall -Wextra.