harden(pii): quote PII_WORKERS expansion + raise healthcheck start-period for multi-worker

TheodoreSpeaks · TheodoreSpeaks · commit 044eb3d1c955 · 2026-07-06T18:14:16.000-07:00
- Quote ${PII_WORKERS} so a malformed value fails uvicorn arg-parsing instead of
  being shell-interpreted (verified: '1; echo X' rejected as non-integer, X not run)
- Bump HEALTHCHECK start-period 180s -&gt; 300s: N workers load the spaCy models in
  parallel, stretching cold start beyond the single-worker case
diff --git a/docker/pii.Dockerfile b/docker/pii.Dockerfile
@@ -42,13 +42,16 @@ USER pii
 # 5001 avoids colliding with the app's 3000 in local/compose runs on one host.
 EXPOSE 5001
 
-# start-period is generous: five large spaCy models load at import before
-# /health responds. Tune against measured cold-start once built.
-HEALTHCHECK --interval=30s --timeout=5s --start-period=180s --retries=3 \
+# start-period covers the model cold start. With PII_WORKERS>1 each worker loads
+# the five spaCy models independently and in parallel, so allow generous headroom
+# (memory-bandwidth contention stretches the wall-time beyond the single-worker case).
+HEALTHCHECK --interval=30s --timeout=5s --start-period=300s --retries=3 \
     CMD curl -fsS http://localhost:5001/health || exit 1
 
 # Worker count is env-driven so ONE image scales per task size: set PII_WORKERS to
 # the task's vCPU count (each worker loads the models independently, ~3 GB each, so
 # size task memory ≈ PII_WORKERS × 3 GB + overhead). Defaults to 1 for local/small.
 # `sh -c exec` expands the env var while keeping uvicorn as PID 1 for clean SIGTERM.
-CMD ["sh", "-c", "exec uvicorn server:app --host 0.0.0.0 --port 5001 --workers ${PII_WORKERS:-1}"]
+# Quote the expansion so a malformed PII_WORKERS fails uvicorn arg-parsing rather
+# than being interpreted by the shell.
+CMD ["sh", "-c", "exec uvicorn server:app --host 0.0.0.0 --port 5001 --workers \"${PII_WORKERS:-1}\""]
