s6-overlay vs supervisord — Memory Footprint Comparison
s6-overlay:
Uses only 1–2 MB of RAM. Its service processes typically consume around 200 KB RSS each.
Extremely lightweight, written in C, minimal overhead.
supervisord:
Consumes roughly 10–15 MB of RAM in real-world usage.
Implemented in Python, so it naturally has a higher baseline memory footprint (≈8–10× s6-overlay).
This commit improves the security posture for Shadowrocket, Clash, and sing-box clients by implementing certificate fingerprint validation instead of the less secure certificate skipping approach.
Key changes:
- Shadowrocket: Replaced insecure TLS validation with HPKP-based certificate fingerprint verification
- Clash: Updated configuration to use certificate fingerprints instead of skip-cert-verify flags
- sing-box: Implemented certificate_public_key_sha256 verification for enhanced TLS security
This change ensures that only connections with verified server certificates are accepted, significantly reducing the risk of man-in-the-middle attacks while maintaining compatibility with self-signed certificates.
fscarmen