cloudflare / cloudflare/workers-sdk

wrangler dev (containers): egress proxy-everything sidecars leak — not removed when a container is deleted

Open
#14,242 2 comments 0 reactions 1 assignee Assigned to @gabivlj View on GitHub
product:containers upstream:workerd
Dominant language
TypeScript
Stars
4.5k
Forks
1.5k
Avg merge
3d 8h
Merged PRs (30d)
186

Description

When using `wrangler dev` with the containers feature against local Docker, each container instance gets a paired `cloudflare/proxy-everything` egress interceptor named `-proxy`. When the container is deleted (DO eviction / normal session churn), the main workerd container is removed but the `-proxy` sidecar keeps running. Over a long session with container churn these orphans accumulate without bound and eventually saturate the Docker daemon and dev server, producing create timeouts and `Container failed to start`.

**Observed:** on a long-lived dev box with heavy container churn, 250+ running `proxy-everything` containers vs ~9 expected, dozens of them orphaned (the corresponding main container no longer exists). Reproduced by listing `-proxy` containers whose main container is gone.

**Repro:** `wrangler dev` with containers, create+delete many instances (or short Durable Object lifetimes); `docker ps --filter name=-proxy | wc -l` grows unbounded while the main-container count stays flat.

**Expected:** the egress interceptor sidecar is torn down with its container.

**Notes:** `getContainerEngine` / `localDocker` hands the egress image to workerd; there's no `-proxy` lifecycle handling in miniflare's JS, so the teardown gap appears to be in workerd's Docker integration. Versions: wrangler 4.84.1, miniflare 4.20260421.0, proxy-everything 3cb1195, Docker on Linux.

**Workaround:** a periodic reaper that removes orphaned `-proxy` containers whose main container is gone.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.