opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-05-21 00:56:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

Inhibit SIGTERM during Conmon startup

Browse Source 
If we get a SIGTERM immediately after Conmon starts but before we
record its PID in the database, we end up leaking a Conmon and
associated OCI runtime process. Inhibit shutdown using the logic
we originally wrote to prevent similar issues during container
creation to prevent this problem.

[NO NEW TESTS NEEDED] No real way to test this I can think of.

Fixes #15557

Signed-off-by: Matthew Heon <matthew.heon@pm.me>
This commit is contained in:
Matthew Heon
2022-08-31 10:58:06 -04:00
parent f98215c668
commit fed4ce0ea9
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
libpod/container_internal.go
View File

@ -27,6 +27,7 @@ import (
cutil "github.com/containers/common/pkg/util"
"github.com/containers/podman/v4/libpod/define"
"github.com/containers/podman/v4/libpod/events"
"github.com/containers/podman/v4/libpod/shutdown"
"github.com/containers/podman/v4/pkg/ctime"
"github.com/containers/podman/v4/pkg/lookup"
"github.com/containers/podman/v4/pkg/rootless"
@ -1038,6 +1039,13 @@ func (c *Container) init(ctx context.Context, retainRetries bool) error {
}
}
// To ensure that we don't lose track of Conmon if hit by a SIGTERM
// in the middle of setting up the container, inhibit shutdown signals
// until after we save Conmon's PID to the state.
// TODO: This can likely be removed once conmon-rs support merges.
shutdown.Inhibit()
defer shutdown.Uninhibit()
// With the spec complete, do an OCI create
if _, err = c.ociRuntime.CreateContainer(c, nil); err != nil {
return err
@ -1073,6 +1081,7 @@ func (c *Container) init(ctx context.Context, retainRetries bool) error {
if err := c.save(); err != nil {
return err
}
if c.config.HealthCheckConfig != nil {
if err := c.createTimer(); err != nil {
logrus.Error(err)