cloudflare / cloudflare/workers-sdk
wrangler dev (containers): egress proxy-everything sidecars leak — not removed when a container is deleted
- Dominant language
- TypeScript
- Stars
- 4.5k
- Forks
- 1.5k
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 186
Description
When using `wrangler dev` with the containers feature against local Docker, each container instance gets a paired `cloudflare/proxy-everything` egress interceptor named `-proxy`. When the container is deleted (DO eviction / normal session churn), the main workerd container is removed but the `-proxy` sidecar keeps running. Over a long session with container churn these orphans accumulate without bound and eventually saturate the Docker daemon and dev server, producing create timeouts and `Container failed to start`.
**Observed:** on a long-lived dev box with heavy container churn, 250+ running `proxy-everything` containers vs ~9 expected, dozens of them orphaned (the corresponding main container no longer exists). Reproduced by listing `-proxy` containers whose main container is gone.
**Repro:** `wrangler dev` with containers, create+delete many instances (or short Durable Object lifetimes); `docker ps --filter name=-proxy | wc -l` grows unbounded while the main-container count stays flat.
**Expected:** the egress interceptor sidecar is torn down with its container.
**Notes:** `getContainerEngine` / `localDocker` hands the egress image to workerd; there's no `-proxy` lifecycle handling in miniflare's JS, so the teardown gap appears to be in workerd's Docker integration. Versions: wrangler 4.84.1, miniflare 4.20260421.0, proxy-everything 3cb1195, Docker on Linux.
**Workaround:** a periodic reaper that removes orphaned `-proxy` containers whose main container is gone.
Contributor guide
Assessment
This issue has not been assessed yet.