PID 1 in a container does not reap children

The first process in a namespace inherits orphaned children and is expected to reap them. A shell script or a PHP process running as PID 1 does not, so every subprocess that exits becomes a zombie.

# zombies accumulate until the process table fills
docker exec shop ps aux | grep -c defunct

# --init inserts a tiny reaper as PID 1
docker run --init shop:latest

It matters for anything spawning processes — an image running a supervisor, a worker shelling out to a converter, a cron container. --init has been available since 1.13 and the equivalent in a compose file is init: true. The other half is signal handling: PID 1 gets no default handlers, so a script that does not trap SIGTERM ignores docker stop until the ten-second timeout kills it.