🐛 Fix container stop issue

broker-control/Dockerfile

@@ -1,17 +1,19 @@
 # broker-control — internal control sidecar (spec §29)
 #
-# Runs in the mosquitto container's PID namespace (compose `pid: "service:mosquitto"`)
-# so it can signal the broker process (PID 1) without docker.sock access.
-# The backend calls its HTTP API over the backend-net network.
+# PID-namespace OWNER: the broker joins THIS container's PID namespace
+# (compose `pid: "service:mosquitto-control"` on the mosquitto service).
+# Owning the namespace means the sidecar survives broker restarts — it
+# was previously the other way around and the kernel killed the sidecar
+# whenever the broker exited. tini runs as PID 1: it forwards signals to
+# python and reaps the broker's zombies (the broker re-parents to tini
+# when its container entrypoint forks).
 #
 # Responsibilities (deliberately minimal, spec §29):
 #   - validate staged configuration (mosquitto -c <staged> --test-config)
 #   - activate a configuration revision (atomic rename into place)
-#   - signal config reload (mosquitto_signal -p 1 config-reload == SIGHUP)
+#   - signal config reload (mosquitto_signal -p <broker-pid> config-reload)
+#   - signal broker restart (SIGTERM; Docker policy revives the broker)
 #   - check broker process state
-#
-# Release 1 ships validate/activate/reload/status only; restarts are a
-# Release 2 concern (reload-vs-restart classification, spec §28).
 
 FROM eclipse-mosquitto:2.1.2-alpine
 
@@ -20,7 +22,8 @@ FROM eclipse-mosquitto:2.1.2-alpine
 
 # The base image ships NO Python. control.py is stdlib-only, so the
 # distro package is sufficient (no pip, no venv needed).
-RUN apk add --no-cache python3
+# tini: minimal init as PID 1 — signal forwarding + zombie reaping.
+RUN apk add --no-cache python3 tini
 
 COPY control.py /app/control.py
 
@@ -36,4 +39,4 @@ CMD []
 
 EXPOSE 8090
 
-ENTRYPOINT ["python3", "/app/control.py"]
+ENTRYPOINT ["/sbin/tini", "--", "python3", "/app/control.py"]