openclaw - 💡(How to fix) Fix Sandbox zombie processes remain under PID 1 and accumulate until pids.max risk [1 comments, 2 participants]

Summary

Sandbox sessions can accumulate zombie processes whose PPID is already 1, but they are not reaped by PID 1. Over time they stack up and can contribute to hitting the sandbox process limit (pids.max).

This does not look like a normal user-script leak anymore, because these are already orphaned zombies under PID 1.

Environment

• OpenClaw: v2026.4.15
• Runtime: sandboxed Docker session
• Host: Linux arm64 / OrbStack VM on Apple Silicon

What I observed

Repeated checks inside the sandbox showed zombies like these:

count 23
10448	1	bash
23857	1	sh
44348	1	sh
52955	1	bash
74031	1	bash
74042	1	bash
74388	1	bash
75421	1	bash
83271	1	bash
84642	1	bash
90986	1	bash
98612	1	bash
106630	1	bash
124027	1	git
125371	1	bash
133905	1	git
146115	1	sort
146116	1	sort
146119	1	sort
146120	1	sort
146124	1	sort
146125	1	sort
150588	1	bash

Summary by command:

bash 13
sort 6
sh 2
git 2

Current process health at the time:

📊 Processes: 3 alive, 23 zombie, 26 total

Why this seems like a runtime / PID 1 issue

• These are already zombies, so kill -9 is not meaningful.
• Their PPID is already 1.
• If PID 1 were reaping correctly, they should disappear.
• Instead, they persist and accumulate.

That suggests the sandbox init / PID 1 / process supervision layer is not reaping all orphaned children.

Impact

• Zombie count can keep climbing across normal tool/script usage.
• This risks exhausting the sandbox process budget (pids.max).
• Once process slots get tight, random commands, cron jobs, and tool executions can start failing in hard-to-explain ways.

We previously saw sandbox pressure around pids.max = 256, so this is not purely cosmetic.

Likely triggers

The zombies appear to come from normal shell-heavy activity, including things like:

• bash / sh
• shell pipelines involving sort
• git
• cron/script execution paths

So this may be reproducible with ordinary agent workloads, not only unusual manual commands.

Expected behavior

Orphaned zombie children adopted by PID 1 should be reaped promptly.

Actual behavior

Zombie processes with PPID=1 remain visible indefinitely and accumulate over time.

Optional follow-up

If useful, I can help capture a smaller repro focused on shell pipeline + orphaning behavior inside the sandbox.