Skip to content

docker: close the log stream before retrying a tail - #4782

Open
k4lleanka wants to merge 1 commit into
crowdsecurity:masterfrom
k4lleanka:fix/docker-close-log-streams
Open

k4lleanka wants to merge 1 commit into
crowdsecurity:masterfrom
k4lleanka:fix/docker-close-log-streams

Conversation

@k4lleanka

Copy link
Copy Markdown

Fixes #4781.

When the scanner stopped while the daemon kept the stream open (e.g. a log line over 64KiB), the container and service tails retried without closing the previous ContainerLogs/ServiceLogs stream. Each retry leaked a connection and the daemon's handles on the log files. The stream is now closed when the attempt returns.

Tested:

  • TestTailClosesLogStreams (container and service) fails on master (7 and 9 streams left open) and passes with the fix; 50 runs with -race.
  • go test -race ./pkg/acquisition/modules/docker/... on Linux, golangci-lint v2.13 for linux, windows and freebsd.
  • Against Docker 29.8.1 with a container printing a 70KB line per second: master leaked 20 streams in 40s and dockerd's fds on the container's json log grew from 1 to 18. With the fix, every stream was closed and the fd count stayed at 1.

I read the diff line by line, ran the tests myself, and verified the Docker reproduction.

/kind fix
/area agent

When the scanner stopped while the daemon kept the stream open (e.g. a
log line over 64KiB), the container and service tails retried without
closing the previous stream, leaking a connection and the daemon's
handles on the log files on every retry.

Fixes crowdsecurity#4781

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Docker datasource accumulates hundreds of open log streams / file descriptors, leading to excessive dockerd memory usage and host OOM (v1.8.0)

1 participant