From 4c2f11ace9e67955391030432ae4e43b93cd41b8 Mon Sep 17 00:00:00 2001 From: Brandon Corbett Date: Mon, 31 Aug 2026 09:42:08 -0400 Subject: [PATCH] perf(boot): drop two dead Node processes from container start Two of the three items in #205. The third, moving migrations out of the entrypoint, needs a one-off task in seamless-iac and is not safe to do here alone, so it is left in place. initKeys was doing nothing. The Dockerfile sets NODE_ENV=production and ensureKeys() returns immediately on that branch, so the image was paying a full Node cold start for an empty function. Even in development it writes ./keys/private.pem and ./keys/public.pem, which nothing reads: signingKeyStore keeps its own keys under ./keys/dev and generates them lazily, and that is what the JWKS route serves. exec node instead of `npm run start` drops a second Node program whose only job was to run one command, and puts the server at PID 1 so SIGTERM on task draining reaches it rather than npm. --- validateEnvs.sh | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/validateEnvs.sh b/validateEnvs.sh index b074610..ac3459d 100644 --- a/validateEnvs.sh +++ b/validateEnvs.sh @@ -96,10 +96,6 @@ if [ "${NODE_ENV:-development}" = "production" ] && [ -z "$email_from" ] && [ -z warn "Direct email/SMS delivery is not configured. This is fine when using external delivery mode via a SeamlessAuth server adapter." fi -echo "Generating JWKS keys" -node ./dist/scripts/initKeys.js -echo "JWKS keys ready" - echo "Running migrations..." if ! run_migrations; then @@ -115,4 +111,7 @@ if ! run_migrations; then fi echo "Starting application" -exec npm run start +# exec node, not `npm run start`: npm is a second Node program loaded to run one +# command, and it stays between init and the server, so SIGTERM on task draining +# reaches npm rather than PID 1. +exec node dist/server.js