[BUG] Full encrypted-DB rewrite per connected session (2.8.0)
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 38/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- docker, sqlite
- Domain
- backend, databases, performance
Research direction
Start by tracing persistence of db.sqlite.encrypted from connected-session activity and host status polling, then reproduce the reported 60-second rewrite cadence with an idle SSH session. Check the session activity writes and schema-migration path mentioned in the report; done means idle sessions and unchanged status checks no longer cause full encrypted-DB rewrites, with the behavior verified against the supplied measurements.
Written by the indexing model from the issue text.
Description
Title
Full encrypted-DB rewrite per connected session
Platform
Website - Chrome
Server Installation Method
Docker
Version
2.8.0
CLI Installation Method
None
CLI Version
No response
Troubleshooting
- I have examined logs and tried to find the issue
- I have reviewed opened and closed issues
- I have tried restarting the application
- I have checked open issues and ensured this is not a duplicate
The Problem
With an encrypted database, every save rewrites the entire db.sqlite.encrypted file. On 2.8.0, each connected terminal session (even fully idle) triggers a full save about once every 60 seconds, and host status polling triggers additional saves. With no clients connected there are zero writes. On small/flash-backed hosts this is sustained write amplification.
Environment
- Termix:
ghcr.io/lukegus/termix:2.8.0(Docker,network_mode: host) - Host: Raspberry Pi 4, ARM64, NVMe
- DB:
/app/data/db.sqlite.encrypted, 9,887,985 bytes - ~10 SSH hosts configured, status check + metrics enabled
- Preference Storage: Browser (also tested with Database — no effect)
Measurements (container cgroup io.stat wbytes, and DB mtime polled at 1s)
Condition | Result
-- | --
No clients connected | 0 DB writes over 2 min
3 idle SSH sessions (no output), status 60s / metrics 30s | ~1.29 MB/s container writes
1 idle session, status 60s / metrics 30s | 5 full saves / 2 min (~60s cadence + bursts 1–12s after)
1 idle session, status 300s / metrics 30s | 2 full saves / 2 min, exactly 60s apart (~165 KB/s)
File size is identical before/after every save (9,887,985 bytes) — the whole file is re-encrypted and rewritten each time, not an incremental write.
Version history (same host, same data)
- 2.4.1: ~0.3 KB/s
- 2.5.1: ~9.6 MB/s (zero clients, metrics disabled)
- 2.7.1: improved vs 2.5.1, still elevated
- 2.8.0: 0 with no clients; ~165–430 KB/s per connected idle session depending on status interval
How to Reproduce
CID=$(docker inspect -f '{{.Id}}' termix) F=/sys/fs/cgroup/system.slice/docker-$CID.scope/io.stat wb(){ awk '{for(i=1;i<=NF;i++) if($i~/^wbytes=/){split($i,x,"=");s+=x[2]}} END{print s+0}' "$F"; } A=$(wb); sleep 300; B=$(wb); echo "$(( (B-A)/300 )) bytes/s"
save cadence
for i in $(seq 1 120); do date -r /path/to/termix-data/db.sqlite.encrypted +%T; sleep 1; done | uniq
- Open one SSH session, leave it idle.
- Observe a full DB rewrite every ~60s; with status check at 60s, additional saves cluster after each poll.
- Close all clients → writes stop.
Expected
Idle sessions should not trigger persistence, or saves should be incremental (e.g. WAL on an in-memory/decrypted DB with batched/debounced encrypted flush, only when data actually changed).
Additional Context
Questions
- What per-session activity is persisted every 60s in 2.8.0 (related to "Session activity writes hitting the database too often")?
- Can status-check results for hosts with live sessions skip DB persistence?
- Is a configurable flush/debounce interval for the encrypted DB possible?
Related observation
2.7.1 → 2.8.0 ran a schema migration (Schema migration completed, dek_migration_boot) but no new pre-migration backup was created in data/backups/ (only the July pre-database-layer-refactor-* exists). Downgrades after a migration need a restore, so an automatic backup here would help.
- Dominant language
- No language data
- Stars
- 30
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Termix-SSH/Support
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 12/100
Termix-SSH/Support#1157 ·
All issues in Termix-SSH/Support
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
micromatch/picomatch#243 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
yetone/magpie#4095 · 1 comment ·
Maintainers usually reply within 1 day
-
[Bug]: Guest messages near the 4,000-char limit fail with 400 "The request was not valid." because multipart turns \n into \r\nPossibly taken @juliusmarminge claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
Maintainers usually reply within 1 day