fix: `session.gc_probability` missing from default `phpIniOverride` template — GC disabled by default

[alehostert]

Summary

The default phpIniOverride block in /app/conf/php-webserver/primary.conf does not define session.gc_probability, resulting in the session Garbage Collector being disabled (value defaults to 0).

Combined with session.save_path = /tmp (also defined in the override), this causes PHP sessions to accumulate indefinitely in the overlay filesystem's upper directory, producing growing overhead on fuse-overlayfs and container instability.

Observed values (phpinfo via web runtime)

session.gc_probability = 0
session.gc_divisor    = 1000
session.save_path     = /tmp

Root cause

gc_probability = 0 is not an OpenLiteSpeed design decision — it's inherited from the upstream Debian/Ubuntu php.ini. On Debian-based systems, the native PHP GC is deliberately disabled because session cleanup is delegated to a cron job (/etc/cron.d/php) that runs /usr/lib/php/sessionclean every 30 minutes, deleting stale files from /var/lib/php/sessions. Sources: OpenLiteSpeed forum thread #4422, OpenLiteSpeed forum thread #4918.

lsphp ships with this same inherited php.ini, but only carries over half of the Debian design: it keeps gc_probability = 0, while OS is setting session.save_path back to /tmp — without ever bringing in the corresponding cleanup cronjob. The result is a config designed to depend on an external cleaner, deployed in an environment where no external cleaner exists.

We confirmed this isn't solvable by relying on the sessionclean binary shipped inside each lsphpXX/bin/ directory (e.g. /usr/local/lsws/lsphp83/bin/sessionclean). Inspecting the script shows it's a stock Debian PHP package artifact (php-common), hardcoded to look for config at /etc/php/{version}/{apache2,fpm,cgi}/php.ini and to match against apache2/php5-fpm/cgi process names — none of which exist in this container. The actual config lives at /usr/local/lsws/lsphpXX/etc/php/X.X/litespeed/php.ini and the running process is lsphp. So even if something invoked this script via cron, it would silently find nothing to clean — it's dead weight in the image, not a usable fallback.

Even LiteSpeed's own staff acknowledged this gap in the forum without ever shipping a fix, as of the last relevant reply in 2021 ("we will take a look if adjusting the default setting is required") — and our own findings in 2026 confirm the default is still 0.

Expected

session.gc_probability = 1
session.gc_divisor    = 1000

This ensures GC runs with a 0.1% probability per request, guaranteeing periodic session cleanup — self-contained in phpIniOverride block, with no dependency on a cron job, a systemd timer, or any OLS-external mechanism that doesn't exist in this container.

Suggested fix

Add the following lines to the default phpIniOverride template:

php_value session.gc_probability 1
php_value session.gc_divisor 1000

Impact

Containers using LiteSpeed with session.save_handler = files and session.save_path = /tmp accumulate sessions without limit in the overlay filesystem, causing:

• Growing overhead on fuse-overlayfs
• Increasing disk consumption in the upper directory
• Possible contribution to timeouts (504) and container overload