diff --git a/baseimage/initializeBaseUbuntuImage.sh b/baseimage/initializeBaseUbuntuImage.sh
index a75463430..47f7982c3 100644
--- a/baseimage/initializeBaseUbuntuImage.sh
+++ b/baseimage/initializeBaseUbuntuImage.sh
@@ -227,7 +227,8 @@ Description=Cloudron Installer
 Type=idle
 ExecStart="${INSTALLER_SOURCE_DIR}/src/server.js"
 Environment="DEBUG=installer*,connect-lastmile" ${provisionEnv}
-KillMode=process
+; kill any child (installer.sh, retire.sh) as well
+KillMode=control-group
 Restart=on-failure
 
 [Install]
diff --git a/installer/src/installer.js b/installer/src/installer.js
index eb6a6ac7f..2459f926b 100644
--- a/installer/src/installer.js
+++ b/installer/src/installer.js
@@ -36,6 +36,7 @@ util.inherits(InstallerError, Error);
 InstallerError.INTERNAL_ERROR = 1;
 InstallerError.ALREADY_PROVISIONED = 2;
 
+// system until file has KillMode=control-group to bring down child processes
 function spawn(tag, cmd, args, callback) {
     assert.strictEqual(typeof tag, 'string');
     assert.strictEqual(typeof cmd, 'string');
diff --git a/setup/container/systemd/box.service b/setup/container/systemd/box.service
index 8d6ddc755..faf136a0d 100644
--- a/setup/container/systemd/box.service
+++ b/setup/container/systemd/box.service
@@ -9,7 +9,8 @@ WorkingDirectory=/home/yellowtent/box
 Restart=always
 ExecStart=/usr/bin/node --max_old_space_size=150 /home/yellowtent/box/box.js
 Environment="HOME=/home/yellowtent" "USER=yellowtent" "DEBUG=box*,connect-lastmile" "BOX_ENV=cloudron" "NODE_ENV=production"
-KillMode=process
+; kill apptask processes as well
+KillMode=control-group
 User=yellowtent
 Group=yellowtent
 MemoryLimit=200M
diff --git a/src/taskmanager.js b/src/taskmanager.js
index 2b5fcf29a..89e4e8860 100644
--- a/src/taskmanager.js
+++ b/src/taskmanager.js
@@ -92,6 +92,7 @@ function startAppTask(appId) {
         return;
     }
 
+    // when parent process dies, apptask processes are killed because KillMode=control-group in systemd unit file
     gActiveTasks[appId] = child_process.fork(__dirname + '/apptask.js', [ appId ]);
 
     var pid = gActiveTasks[appId].pid;