Skip to content

Write provisional state.json with PID -1 before cgroup Apply #5257

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
HirazawaUi wants to merge 2 commits into
base: main
Choose a base branch
from
+55 −2
Open

Write provisional state.json with PID -1 before cgroup Apply #5257

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5ca26e6
Write provisional state.json with PID -1 before cgroup Apply
HirazawaUi Apr 19, 2026
fabe44e
test
HirazawaUi Apr 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions libcontainer/process_linux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -819,6 +819,24 @@ func (p *initProcess) start() (retErr error) {
}
}()

// Write a provisional state.json before cgroup Apply. This ensures that
// if the runc-create process is killed (e.g., SIGKILL from a higher-level
// runtime due to timeout), runc-delete can still find and clean up the
// container's cgroup and state directory.
//
// We temporarily nil out c.initProcess so that the saved state uses
// PID -1 (the default when initProcess is nil). This prevents external
// tools from seeing the container as "created" before the init process
// is fully set up, avoiding a race where "runc start" could be called
// with a stale STAGE_PARENT PID that will be reaped during creation.
savedInit := p.container.initProcess
p.container.initProcess = nil
_, uerr := p.container.updateState(nil)
p.container.initProcess = savedInit

@rata rata Apr 20, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd move this to a new function

if uerr != nil {
return fmt.Errorf("unable to store init state: %w", uerr)

@rata rata Apr 20, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: we are using the same string above, let's use a different message here so it's not ambigous later if we hit this error.

}

// Do this before syncing with child so that no children can escape the
// cgroup. We don't need to worry about not doing this and not being root
// because we'd be using the rootless cgroup manager in that case.
Expand Down
Loading