Repository navigation
Conversation
When a container has no cgroup (rootless with the cgroup creation error ignored, or --cgroup-manager=disabled), "crun kill --all" sends no signal at all and returns success, and "crun delete --force" kills nothing when the container does not have its own PID namespace. Podman uses "kill --all" to stop a container, so "podman stop" waits for a container which never gets the signal. Without a cgroup, the container processes cannot be found, so signal init, which is what runc does in this case. For "kill --all", do not treat a container which is not running as an error, as with an empty cgroup. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
|
It would be great if we could ask Linux to support sending signals to a process tree, or broadcasting signals based on a "subreaper" process. |
xz-dev
added a commit
to xz-dev/youki
that referenced
this pull request
Oct 31, 2026
When the container init is not in the container cgroup, because the rootless cgroup manager could not create it, kill_all_processes finds no process and signals nothing. Signal init too in this case, with a warning. With SIGKILL, that kills all processes of a container which has its own PID namespace. runc does the same when it can not kill the processes through the cgroup, and containers/crun#2431 makes crun do it too. Signed-off-by: Xiangzhe Zeng <xiangzhedev@gmail.com>
3 tasks done
Collaborator
Author
There is such a thing already, actually, two!
I don't think we need a third mechanism :) |
When the cgroup creation error is ignored for a rootless container, and the container does not have its own PID namespace, its processes cannot be found, and so cannot all be killed. Warn about such configuration, as runc does. Use libcrun_error, as libcrun_warning is not shown with the default log level. This makes the "runc create [shared pidns + rootless]" runc integration test pass, so remove it from the skip list. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
kolyshkin
changed the title
container: signal init on kill --all without a cgroup When a container has no cgroup (rootless with the cgroup creation error ignored, or --cgroup-manager=disabled), "crun kill --all" sends no signal at all and returns success, and "crun delete --force" kills nothing when the container does not have its own PID namespace. Podman uses "kill --all" to stop a container, so "podman stop" waits for a container which never gets the signal. Without a cgroup, the container processes cannot be found, so signal init, which is what runc does in this case. For "kill --all", do not treat a container which is not running as an error, as with an empty cgroup. As runc, warn when signaling init only for a container without its own PID namespace, as its other processes do not get the signal. Use libcrun_error, as libcrun_warning is not shown with the default log level. Assisted-by: Claude Code (claude-opus-5-5) Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
|
Thanks for the explanation, that makes sense. Just to check my understanding: both of those mechanisms seem to need some privileges for a rootless user, right?
I was just curious how the no-cgroup / shared-pidns case is handled, and this PR answers that. Thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When a container has no cgroup (rootless with the cgroup creation error ignored, or
--cgroup-manager=disabled),crun kill --allsends no signal at all and returns success.crun delete --forcekills nothing when such a container also lacks its own PID namespace.Podman uses
kill --allto stop a container, sopodman stopwaits forever for a container which never got the signal.Without a cgroup, the container processes cannot be found, so signal init instead. This is what runc does: when killing all processes via the cgroup fails for a rootless container, it warns and signals init. Do the same, warning when the container has no PID namespace of its own. For
kill --all, a container which is not running is not an error, as with an empty cgroup.Also, add a warning (as runc does) when a rootless container gets no cgroup and has no PID namespace of its own, since its processes cannot all be killed then. This makes the
runc create [shared pidns + rootless]runc integration test pass, so it is removed from the skip list.Related to: podman-container-tools/podman#30078