Something wrong with Umbrel – Has the Umbrel OS been compromised?

Support and Troubleshooting
1

Umbrel CLI is spawning thousands of zombie sh processes for weeks

Hi Umbrel team,

I’m reporting a serious issue affecting my Umbrel node. After extensive debugging, I found that Umbrel’s main CLI process has been spawning thousands of zombie sh processes continuously for several weeks, without ever reaping them.

This appears to be a persistent bug inside Umbrel’s internal process management.

:fire: Summary

Umbrel’s main process:/usr/local/bin/node --require /opt/umbreld/node_modules/tsx/dist/preflight.cjs --import file:///opt/umbreld/node_modules/tsx/dist/loader.mjs /opt/umbreld/source/cli.ts --data-directory=/home/umbrel/umbrelhas been running since Aug 03, and has continuously spawned zombie sh processes ([sh] ) every day since then.

All of these zombies share the same parent PID: 3321266, which is the Umbrel CLI process.

:puzzle_piece: Environment

Umbrel running as root

Umbrel CLI entrypoint: /opt/umbreld/source/cli.ts

Node binary: /usr/local/bin/node

Data directory: /home/umbrel/umbrel

System: Linux (Umbrel OS / Umbrel on Linux)

:firecracker: Symptoms

Running ps shows a huge number of zombie sh processes:root 108025 0.0 0.0 0 0 ? Z Aug13 0:00 [sh] root 134169 0.0 0.0 0 0 ? Z Aug13 0:00 [sh] root 188209 0.0 0.0 0 0 ? Z Aug13 0:00 [sh] root 359394 0.0 0.0 0 0 ? Z Aug14 0:00 [sh] root 365194 0.0 0.0 0 0 ? Z Aug14 0:00 [sh] root 432550 0.0 0.0 0 0 ? Z Aug05 0:00 [sh] …root 2759315 0.0 0.0 0 0 ? Z Aug26 0:00 [sh] root 3207192 0.0 0.0 0 0 ? Z 12:32 0:00 [sh] root 3211578 0.0 0.0 0 0 ? Z 12:37 0:00 [sh]

2

Hey @**mayank. Do you know something about this?
**
ps axuw | grep defunct | wc -l
857

uptime
12:53:11 up 1 day, 18:22, 2 users, load average: 0.78, 0.67, 0.63

In a week, there will be thousands of zombie processes. All of them originating from the same main PID (/usr/local/bin/node --require /opt/umbreld/node_modules/tsx/dist/preflight.cjs --import file:///opt/umbreld/node_modules/tsx/dist/loader.mjs /opt/umbreld/source/cli.ts --data-directory=/home/umbrel/umbrel).

3

hey, i dug into this a bit and it doesnt look like the OS was compromised. The [sh] <defunct> entries are dead processes from a bug in the Files watcher, not active shell sessions.

It looks like @parcel/watcher checks for Watchman using a short-lived shell. Watchman isnt included in the current release, and an error path fails to clean up that shell properly. When the Files watcher recovers and reconnects, it can leave another zombie behind. That explains why they all have the main Umbrel Node process as their parent and keep accumulating.

This appears to be the same bug tracked here: Files watcher health check has inotify watch leak · Issue #2158 · getumbrel/umbrel · GitHub. A restart or reboot should clear the existing zombies temporarily, but they may return until the fix reaches a release. I definitely wouldnt factory reset or reflash over this.