opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-11-29 09:37:38 +08:00
Code Issues Packages Projects Releases Wiki Activity

SetupRootless handle case where conmon pid are not valid

Browse Source 
When trying to join the conmon pid to recreate the pause process based
on the namespace it can be that the pid is no longer valid, i.e. when
conmon crashed or was killed.

Currently we have a big issue that can be reproduced using:
$ podman run -d quay.io/libpod/testimage:20241011 sleep 100
$ killall -9 conmon
$ killall catatonit

All commands would fail as we keep trying to rejoin the namespace of the
non existing conmon process.

So to address that fall back to creating a new namespace if we fail to
join the conmon pids.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This commit is contained in:
Paul Holzinger
2025-11-25 15:34:16 +01:00
parent 4833357c72
commit aaadb4726d
2 changed files with 42 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
pkg/domain/infra/abi/system_linux.go
View File

@@ -4,6 +4,7 @@ package abi
import (
"context"
"errors"
"fmt"
"os"
@@ -14,6 +15,7 @@ import (
"go.podman.io/common/pkg/config"
"go.podman.io/common/pkg/systemd"
"go.podman.io/storage/pkg/unshare"
"golang.org/x/sys/unix"
)
// Default path for system runtime state
@@ -90,14 +92,22 @@ func (ic *ContainerEngine) SetupRootless(_ context.Context, noMoveProcess bool,
if len(paths) > 0 {
became, ret, err = rootless.TryJoinFromFilePaths(pausePidPath, paths)
} else {
became, ret, err = rootless.BecomeRootInUserNS(pausePidPath)
if err == nil && !noMoveProcess {
systemd.MovePauseProcessToScope(pausePidPath)
// TryJoinFromFilePaths fails with ESRCH when the PID are all not valid anymore
// In this case create a new userns.
if errors.Is(err, unix.ESRCH) {
logrus.Warnf("Failed to join existing conmon namespace, creating a new rootless podman user namespace. If there are existing container running please stop them with %q to reset the namespace", os.Args[0]+" system migrate")
became, ret, err = rootless.BecomeRootInUserNS(pausePidPath)
}
} else {
logrus.Info("Creating a new rootless user namespace")
became, ret, err = rootless.BecomeRootInUserNS(pausePidPath)
}
if err != nil {
return fmt.Errorf("invalid internal status, try resetting the pause process with %q: %w", os.Args[0]+" system migrate", err)
return fmt.Errorf("fatal error, invalid internal status, unable to create a new pause process: %w. Try running %q and if that doesn't work reboot to recover", err, os.Args[0]+" system migrate")
}
if !noMoveProcess {
systemd.MovePauseProcessToScope(pausePidPath)
}
if became {
os.Exit(ret)