[GH-ISSUE #45] Idle reaper ignores policy idle_timeout_minutes for containers adopted via reconcile() #19

New issue

Closed

opened 2026-10-18 21:13:27 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-18 21:13:27 +00:00

Owner

Originally created by @Classic298 on GitHub (Jul 20, 2026).
Original GitHub issue: https://github.com/open-webui/terminals/issues/45

After an orchestrator restart, re-adopted containers are never idle-reaped, regardless of policy. They leak until the Docker bridge hits its 1024-port cap (… failed: exchange full) and provisioning breaks.

Cause: the reaper reads the per-container spec from _specs and falls back to settings.idle_timeout_minutes (default 0 = disabled) when the key is missing:

# base.py _reap_idle
spec = self._specs.get(key, {})
timeout_min = spec.get("idle_timeout_minutes", settings.idle_timeout_minutes)
if not timeout_min or timeout_min <= 0:
    continue

ensure_terminal sets _specs[key] at provision time, but reconcile() (docker.py) rebuilds _instances/_activity and never sets _specs[key] — so adopted containers resolve to the 0 fallback and are skipped forever.

Repro: policy with idle_timeout_minutes: 180, TERMINALS_IDLE_TIMEOUT_MINUTES unset → provision containers → restart orchestrator → they never reap. GET /api/v1/terminals reports idle_timeout_minutes: 0 for them despite the policy.

Fix: populate _specs[key] in reconcile() from the policy (available via the openwebui.com/policy label):

_, spec = await _resolve_policy_spec(policy_id)
self._specs[key] = spec or {}

Also: reconcile() seeds _activity to "now" instead of the persisted terminal_last_active_at, resetting the idle clock on every restart — consider fixing alongside.

Workaround: set TERMINALS_IDLE_TIMEOUT_MINUTES=180 so the fallback is non-zero.

Originally created by @Classic298 on GitHub (Jul 20, 2026). Original GitHub issue: https://github.com/open-webui/terminals/issues/45 After an orchestrator restart, re-adopted containers are never idle-reaped, regardless of policy. They leak until the Docker bridge hits its 1024-port cap (… failed: exchange full) and provisioning breaks. Cause: the reaper reads the per-container spec from _specs and falls back to settings.idle_timeout_minutes (default 0 = disabled) when the key is missing: ``` # base.py _reap_idle spec = self._specs.get(key, {}) timeout_min = spec.get("idle_timeout_minutes", settings.idle_timeout_minutes) if not timeout_min or timeout_min <= 0: continue ``` ensure_terminal sets _specs[key] at provision time, but reconcile() (docker.py) rebuilds _instances/_activity and never sets _specs[key] — so adopted containers resolve to the 0 fallback and are skipped forever. Repro: policy with idle_timeout_minutes: 180, TERMINALS_IDLE_TIMEOUT_MINUTES unset → provision containers → restart orchestrator → they never reap. GET /api/v1/terminals reports idle_timeout_minutes: 0 for them despite the policy. Fix: populate _specs[key] in reconcile() from the policy (available via the openwebui.com/policy label): ``` _, spec = await _resolve_policy_spec(policy_id) self._specs[key] = spec or {} ``` Also: reconcile() seeds _activity to "now" instead of the persisted terminal_last_active_at, resetting the idle clock on every restart — consider fixing alongside. Workaround: set TERMINALS_IDLE_TIMEOUT_MINUTES=180 so the fallback is non-zero.

bsakaguchi closed this issue

2026-10-18 21:13:27 +00:00

bsakaguchi commented

2026-10-18 21:13:29 +00:00

Author

Owner

@owui-terminator[bot] commented on GitHub (Jul 20, 2026):

⚠️ Missing Issue Title Prefix

@Classic298, your issue title is missing a categorising prefix (e.g. bug:, feat:, docs:).

Please update the title to lead with one of:

bug: bug report or error
feat: feature request or enhancement
docs: documentation issue
question: usage question
help: support request

Example: bug: Login fails when the password contains special characters

@owui-terminator[bot] commented on GitHub (Jul 20, 2026): # ⚠️ Missing Issue Title Prefix @Classic298, your issue title is missing a categorising prefix (e.g. `bug:`, `feat:`, `docs:`). Please update the title to lead with one of: - **bug**: bug report or error - **feat**: feature request or enhancement - **docs**: documentation issue - **question**: usage question - **help**: support request Example: `bug: Login fails when the password contains special characters`

bsakaguchi commented

2026-10-18 21:13:29 +00:00

Author

Owner

@owui-terminator[bot] commented on GitHub (Jul 20, 2026):

🔍 Related Issues Found

I found some existing issues that might be related. Please check if any of these are duplicates or contain helpful solutions:

🟢 #39 issue: policy doesnt trigger for constantly running containers
This issue is about lifecycle policy not triggering for containers that remain running, which overlaps with the reported idle-reaping/policy enforcement problem. It’s not the same restart/adoption bug, but it is the closest related policy-trigger behavior.
by Classic298

💡 If your issue is a duplicate, please close it and add any additional details to the existing issue instead.

This comment was generated automatically. React with 👍 if helpful, 👎 if not.

@owui-terminator[bot] commented on GitHub (Jul 20, 2026):  🔍 **Related Issues Found** I found some existing issues that might be related. Please check if any of these are duplicates or contain helpful solutions: 1. 🟢 [#39](https://github.com/open-webui/terminals/issues/39) **issue: policy doesnt trigger for constantly running containers** *This issue is about lifecycle policy not triggering for containers that remain running, which overlaps with the reported idle-reaping/policy enforcement problem. It’s not the same restart/adoption bug, but it is the closest related policy-trigger behavior.* *by Classic298* --- 💡 If your issue is a duplicate, please close it and add any additional details to the existing issue instead. *This comment was generated automatically.* React with 👍 if helpful, 👎 if not.

bsakaguchi referenced this issue

2026-10-18 21:13:48 +00:00

[PR #19] [MERGED] fix: ensure container names don't exceed 63-character DNS label limit #50