opencontainers
update state earlier to avoid cgroup leak when process failed
update state earlier to avoid cgroup leak when process failed if process stuck in somewhere. upper caller like containerd may have a timeout for process launching.
process will be killed after this timeout, and then call runc delete to retrieve its resource like cgroup and perform poststop
hook.
if process got stuck right before updating state, and after cgroup
applied, like prestart-hook. In such case, runc delete xxx will
do nothing because state file is missing, runc is not aware of this
container. so process cgroup will stay and never get removed.
Signed-off-by: zhongjiawei [email protected]
@kamizjw thank you for your PR. Do you think it's possible to create a test case for this issue?
@kamizjw thank you for your PR. Do you think it's possible to create a test case for this issue?
Does constructing a scenario verification that exits unexpectedly cause leakage?
@kamizjw thank you for your PR. Do you think it's possible to create a test case for this issue?
Does constructing a scenario verification that exits unexpectedly cause leakage?
Something like this. Maybe you can use prestart-hook to do that.
Having a test case as part of the PR would be very nice.
@kamizjw thank you for your PR. Do you think it's possible to create a test case for this issue?
Does constructing a scenario verification that exits unexpectedly cause leakage?
Something like this. Maybe you can use prestart-hook to do that.
Having a test case as part of the PR would be very nice.
I'm not good at writing go test cases, can you help me write one？thank you very much
I'm not good at writing go test cases, can you help me write one？thank you very much
Write any kind of reproducer for the issue you're solving with this patch. This can be a script, or a text description of what steps to take. Once we have it, I'll help you to convert a reproducer to the test case.
I'm not good at writing go test cases, can you help me write one？thank you very much
Write any kind of reproducer for the issue you're solving with this patch. This can be a script, or a text description of what steps to take. Once we have it, I'll help you to convert a reproducer to the test case.
1.Prepare a script to execute in the prestart-hook phase, which takes a while to execute 2.Configure the execution of this script under the prestart option of the configuration file 3.Make sure that the runc delete command is executed when runc runs the prestart-hook
update state earlier to avoid cgroup leak when process failed if process stuck in somewhere. upper caller like containerd may have a timeout for process launching.
Perhaps the best approach to avoid this situation is to specify the hook timeout for the prestart hook, and make sure it is less than the internal containerd timeout.
hook timeout
update state earlier to avoid cgroup leak when process failed if process stuck in somewhere. upper caller like containerd may have a timeout for process launching.
Perhaps the best approach to avoid this situation is to specify the hook timeout for the prestart hook, and make sure it is less than the internal containerd timeout.
this needs to consider different application scenarios, and updating state.json immediately is the most concise way