safeexec

Documentation

Overview

Package safeexec provides a thin wrapper around os/exec that pre-sets WaitDelay on every command. This eliminates the zombie process accumulation hazard that occurs when exec.CommandContext is used directly: if the context expires and SIGKILL is sent to the process, cmd.Wait() can block indefinitely when a grandchild (e.g. git credential helper, shell wrapper) holds the stdout/stderr pipes open. WaitDelay forces Wait() to return and close pipes after 2 seconds regardless.

Usage: replace exec.CommandContext(ctx, ...) with safeexec.CommandContext(ctx, ...). The returned *exec.Cmd is identical to exec.CommandContext's result except that WaitDelay is already set.

The norawexec lint rule enforces that application code uses this package instead of calling exec.Command or exec.CommandContext directly.

Package safeexec provides thin wrappers around os/exec that pre-set WaitDelay on every command. This eliminates the zombie process accumulation hazard that occurs when exec.CommandContext is used directly.

Index

• Constants
• func CommandContext(ctx context.Context, name string, arg ...string) *exec.Cmd
• func CommandContextPG(ctx context.Context, name string, arg ...string) *exec.Cmd

Constants

const DefaultWaitDelay = 2 * time.Second

DefaultWaitDelay is the time to wait after SIGKILL before forcibly closing pipes. Set to 2 seconds: generous enough not to truncate output on slow machines, tight enough to bound zombie lifetime to a few seconds.

Functions

func CommandContext

func CommandContext(ctx context.Context, name string, arg ...string) *exec.Cmd

CommandContext returns an exec.Cmd backed by ctx with WaitDelay pre-set to DefaultWaitDelay. Use it wherever exec.CommandContext would be used.

func CommandContextPG

func CommandContextPG(ctx context.Context, name string, arg ...string) *exec.Cmd

CommandContextPG returns an exec.Cmd with WaitDelay pre-set AND Setpgid: true.

The Setpgid flag causes the child process to be placed in a new process group. When the context fires its cancel func, Go's internal watchCtx goroutine calls cmd.Cancel, which (via the override set below) sends SIGTERM to the entire process group rather than just the direct child. This ensures grandchildren spawned by the child are also terminated, preventing orphaned processes.

IMPORTANT: Do NOT use CommandContextPG for processes that require a controlling terminal (e.g. "tmux attach-session" passed to pty.Start()). Setting Setpgid without a corresponding Setsid causes the child to remain in the parent's session but in a new process group, which can cause SIGTTIN/SIGTTOU issues when the child tries to access the terminal. For PTY-attached processes, use CommandContext instead and let pty.Start() manage the terminal assignment.