Repository navigation
Conversation
giuseppe
reviewed
Oct 30, 2026
giuseppe
left a comment
giuseppe
left a comment
Member
There was a problem hiding this comment.
again, please use the full name for the DCO and commit author
giuseppe
reviewed
Oct 30, 2026
kolyshkin
reviewed
Oct 30, 2026
xz-dev
force-pushed
the
pidns-requires-cgroup
branch
from
October 31, 2026 02:48
82ae65e to
bf64723
Compare
When running as rootless without a cgroup path in the configuration, crun ignores a failure to create the cgroup and runs the container without one. That is fine when the container has a PID namespace, as its processes are killed with the init of that namespace. In the host PID namespace, the cgroup is the only way to find all the container processes: "crun kill --all" signals nothing and "crun delete --force" leaves them running. Podman uses "kill --all" to stop such a container, so "podman stop" hangs. Do not ignore the error in this case. runc is changed to refuse such a container too, and its integration test for this case then no longer checks for the runc warning, so do not skip it anymore. Closes: podman-container-tools/podman#30078 Assisted-by: Claude Opus 5.5 Signed-off-by: Xiangzhe Zeng <xiangzhedev@gmail.com>
xz-dev
force-pushed
the
pidns-requires-cgroup
branch
from
October 31, 2026 03:18
bf64723 to
984bb79
Compare
xz-dev
added a commit
to xz-dev/youki
that referenced
this pull request
Oct 31, 2026
In the host PID namespace, the cgroup is the only way to find all the container processes. Without it, "youki kill --all" and "youki delete --force" can only kill init, and the other processes keep running. Podman uses "kill --all" to stop such a container (podman-container-tools/podman#30078). Keep ignoring the rootless cgroup errors only when the container has a PID namespace, new or joined. crun (containers/crun#2427) and runc (opencontainers/runc#5594) are changed the same way. Only the cgroup v2 manager changes: the systemd manager uses the rootless flag only to apply device rules on a best effort basis, and the v1 manager ignores it. Signed-off-by: Xiangzhe Zeng <xiangzhedev@gmail.com>
3 tasks done
|
TMT tests failed. @containers/packit-build please check. |
Only ignore an eligible rootless cgroup failure when the container creates a private PID namespace. Joining another namespace does not let the runtime clean up this container independently of its owner. Reuse has_new_pid_namespace and retain the original cgroup error with an explanation of the cleanup requirement. Check valid joined and host namespace rejection while the private namespace owner remains running. Explicitly disabling the cgroup manager is unchanged. Assisted-by: GPT-6.1-sol Signed-off-by: Xiangzhe Zeng <xiangzhedev@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
When an eligible rootless cgroup-creation error is ignored, crun leaves the container without its own cgroup. That fallback is only sufficient for whole-container cleanup when the container creates a private PID namespace: killing its namespace init kills the namespace's remaining processes.
This PR requires a private PID namespace in
can_ignore_cgroup_enter_errors. Both an inherited host namespace and joining an existing namespace are rejected when cgroup creation fails. The previous revision's host-only exception is removed. The failure explains why a cgroup is needed and retains the original cgroup error.The implementation reuses
has_new_pid_namespaceinstead of adding a second helper that only checks whether a PID namespace entry exists.Existing rootless, explicit-cgroup-path and cgroup-v2/systemd conditions are preserved. Sharing a PID namespace with a working cgroup is unchanged. Explicit
--cgroup-manager=disabledis a separate existing path and is not changed by this PR.No new parameter, process-tree scan or pidfd change is included.
Tests
The rootless
cgroup-rootless-nonprivate-pidnstest keeps a live private namespace owner and verifies, from outside the container, that it has not obtained a separate cgroup. It then checks a valid joined namespace and the inherited host namespace. Both must fail for the expected cgroup/cleanup reason, leave no rejected container listed, and preserve the owner.Local validation of this revision:
make clang-format, Python compilation and diff-check pass. Local build disabled unavailable optional systemd/CRIU support.Not rerun: systemd, initial-user-namespace root, v1/hybrid, full make check/distcheck, runc integration suite or remote CI. TAP results were checked explicitly; the Python harness can exit zero even with
not okoutput.Related work and compatibility
opencontainers/runc#5594 changes runc's existing non-private-PIDns warning into an error for its corresponding rootless cgroup failure. This PR removes the old runc integration skip for the affected create test; integration should use the updated runc expectations.
#2431 provides separate best-effort cleanup of an already-running container whose init is outside its cgroup. It does not establish a complete process membership set for a joined namespace without a cgroup.
Rejecting the implicit rootless fallback affects existing host/joined configurations that previously ran without reliable whole-container cleanup. Cgroup-backed sharing remains supported.
Context: podman-container-tools/podman#30078