fix(bin): replace lsof port preflight with ss/netstat

.github/workflows/docker-build-ci.yml

@@ -26,6 +26,7 @@ on:
     paths:
       - '**/Dockerfile*'
       - '.dockerignore'
+      - 'hugegraph-server/hugegraph-dist/src/assembly/static/bin/util.sh'
 
 jobs:
   docker-build:
@@ -47,6 +48,28 @@ jobs:
         run: |
           IMAGE_ID=$(docker build -q -f ${{ matrix.dockerfile }} .)
           echo "Built: $IMAGE_ID"
+          echo "IMAGE_ID=$IMAGE_ID" >> "$GITHUB_ENV"
           HC=$(docker inspect --format='{{json .Config.Healthcheck}}' "$IMAGE_ID")
           echo "Healthcheck: $HC"
           [[ "$HC" != "null" ]] || { echo "ERROR: HEALTHCHECK missing in ${{ matrix.dockerfile }}"; exit 1; }
+
+      # The startup preflight needs a socket-table tool, and the base image
+      # ships none of its own.  Without one every start reports "unknown" and
+      # a duplicate start is no longer refused, so assert the image can
+      # actually answer.  Only the server images run check_port.
+      # TODO(docker-ci): this pins the probe dependency, not the behaviour it
+      # protects.  A full duplicate-start/stop check needs a booted server with
+      # a backend, which belongs with the e2e job rather than the image build.
+      - name: Port preflight can answer inside ${{ matrix.dockerfile }}
+        if: ${{ startsWith(matrix.dockerfile, 'hugegraph-server/') }}
+        run: |
+          STATE=$(docker run --rm "$IMAGE_ID" bash -c \
+            'source /hugegraph-server/bin/util.sh && port_listen_state 8080')
+          echo "port_listen_state 8080 -> $STATE"
+          # Assert a positive answer rather than "not unknown": an empty $STATE
+          # would otherwise satisfy the check.  The step's default `bash -e`
+          # already aborts on a failed `docker run`, so this only states intent.
+          [[ "$STATE" == "free" || "$STATE" == "busy" ]] || {
+            echo "ERROR: no usable socket-table tool (ss/netstat) in ${{ matrix.dockerfile }}"
+            exit 1
+          }

.github/workflows/pd-store-ci.yml

@@ -110,7 +110,9 @@ jobs:
       - name: Check startup test prerequisites (PD)
         id: pd-preflight
         run: |
-          for tool in lsof curl java; do
+          # These jobs run on Linux, where the suites clean up ports with fuser.
+          # lsof is no longer required: check_port now uses ss/netstat.
+          for tool in fuser curl java; do
             if ! command -v "$tool" >/dev/null 2>&1; then
               echo "can_run=false" >> "$GITHUB_OUTPUT"
               echo "skip_reason=missing tool: $tool" >> "$GITHUB_OUTPUT"
@@ -190,7 +192,9 @@ jobs:
       - name: Check startup test prerequisites (Store)
         id: store-preflight
         run: |
-          for tool in lsof curl java; do
+          # These jobs run on Linux, where the suites clean up ports with fuser.
+          # lsof is no longer required: check_port now uses ss/netstat.
+          for tool in fuser curl java; do
             if ! command -v "$tool" >/dev/null 2>&1; then
               echo "can_run=false" >> "$GITHUB_OUTPUT"
               echo "skip_reason=missing tool: $tool" >> "$GITHUB_OUTPUT"

.github/workflows/server-ci.yml

@@ -79,17 +79,33 @@ jobs:
         run: |
           mvn clean compile -U -Dmaven.javadoc.skip=true -ntp
 
+      - name: Run check_port unit tests
+        if: ${{ env.BACKEND == 'rocksdb' }}
+        run: |
+          # Validates the ss/netstat port preflight that replaced lsof
+          $TRAVIS_DIR/test-check-port.sh \
+            hugegraph-server/hugegraph-dist/src/assembly/static \
+            hugegraph-store/hg-store-dist/src/assembly/static/bin/util.sh
+
       - name: Check startup test prerequisites
         id: server-preflight
         if: ${{ env.BACKEND == 'rocksdb' }}
         run: |
-          for tool in lsof crontab curl java; do
+          # Note: lsof removed from prerequisites; check_port now uses ss, falling back
+          # to netstat, and warns without blocking when neither can answer.
+          # This job always runs on Linux (ubuntu-22.04), which uses fuser for port cleanup.
+          for tool in crontab curl java; do
             if ! command -v "$tool" >/dev/null 2>&1; then
               echo "can_run=false" >> "$GITHUB_OUTPUT"
               echo "skip_reason=missing tool: $tool" >> "$GITHUB_OUTPUT"
               exit 0
             fi
           done
+          if ! command -v fuser >/dev/null 2>&1; then
+            echo "can_run=false" >> "$GITHUB_OUTPUT"
+            echo "skip_reason=missing tool: fuser (required for Linux port cleanup)" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
           echo "can_run=true" >> "$GITHUB_OUTPUT"
 
       - name: Run start-hugegraph.sh foreground mode tests
@@ -187,6 +203,13 @@ jobs:
         run: |
           mvn clean compile -pl hugegraph-server/hugegraph-test -am -U -Dmaven.javadoc.skip=true -ntp
 
+      - name: Run check_port unit tests
+        # Validates the ss/netstat port preflight that replaced lsof
+        run: |
+          $TRAVIS_DIR/test-check-port.sh \
+            hugegraph-server/hugegraph-dist/src/assembly/static \
+            hugegraph-store/hg-store-dist/src/assembly/static/bin/util.sh
+
       - name: Run RocksDB core test
         run: |
           $TRAVIS_DIR/run-core-test.sh $BACKEND

hugegraph-pd/Dockerfile

@@ -45,12 +45,14 @@ ENV JAVA_OPTS="-XX:+UnlockExperimentalVMOptions -XX:+UseContainerSupport -XX:Max
 WORKDIR /hugegraph-pd/
 
 # 1. Install runtime dependencies
+# Note: lsof is gone because its only consumer was the dead check_port removed
+# from hg-pd-dist bin/util.sh.  PD runs no port preflight, so unlike the server
+# images this needs no socket-table tool in its place.
 RUN apt-get -q update \
     && apt-get -q install -y --no-install-recommends --no-install-suggests \
        dumb-init \
        procps \
        curl \
-       lsof \
        vim \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*