10-listen-on-ipv6-by-default.sh is OOM-killing memory-limited containers

Bug Overview

Since the base image moved to Alpine 3.24.2 (apk-tools 3.0.6-r0 → 3.0.8-r0), the apk manifest nginx call in 10-listen-on-ipv6-by-default.sh went from ~10 MiB to ~61 MiB peak memory. This raises the startup peak of an otherwise idle container from ~30 MiB to ~73 MiB, with two consequences:

1. Containers with a memory limit below ~73 MiB are OOM-killed at startup
2. Where only the apk child is killed (cgroup v2 without memory.oom.group), the script silently does the wrong thing. CHECKSUM comes back empty, sha1sum -c fails, and the script logs default.conf differs from the packaged version and exits 0 - even though the config is the pristine packaged one. IPv6 is silently never enabled.

Affected: mainline 1.31.6 and stable 1.30.5, all alpine flavours incl. -otel.

Unaffected: 1.31.5, 1.30.4.

Expected Behavior

Startup memory should stay roughly constant across base-image patch bumps.

Steps to Reproduce the Bug

docker run --rm --memory=32m --memory-swap=32m nginx:1.31.6-alpine
/docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
/docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
/docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf
Killed
10-listen-on-ipv6-by-default.sh: info: /etc/nginx/conf.d/default.conf differs from the packaged version

Environment Details

Images nginx:1.31.6-alpine (sha256:adad2ae9…), -alpine-otel (sha256:1ee0a573…), also 1.30.5-alpine last good 1.31.5-alpine (sha256:72ba65eb…); build commit a16f1329.

Additional Context

Workaround

RUN rm -f /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh

Start with docker-entrypoint.d/10-listen-on-ipv6-by-default.sh, especially the apk manifest nginx call and checksum handling. Reproduce with docker run --rm --memory=32m --memory-swap=32m nginx:1.31.6-alpine, then compare startup memory and IPv6 configuration behavior with the unaffected image versions. Done means startup no longer exceeds the memory limit and the script does not silently skip IPv6 configuration.