Skip to content

runc delete -f fails to remove a paused container on cgroup v1 #3134

@kolyshkin

Description

@kolyshkin

Cgroup v2:

[root@kir-rhat runc-tst]# ../runc/runc run -d 345
[root@kir-rhat runc-tst]# ../runc/runc pause 345
[root@kir-rhat runc-tst]# time ../runc/runc delete -f 345

real	0m0.129s
user	0m0.010s
sys	0m0.008s
[root@kir-rhat runc-tst]# ../runc/runc list
ID          PID         STATUS      BUNDLE      CREATED     OWNER

Cgroup v1:

root@ubu2004:/home/kir/git/runc/tst# ../runc run -d 345
root@ubu2004:/home/kir/git/runc/tst# ../runc pause 345
root@ubu2004:/home/kir/git/runc/tst# time ../runc delete -f 345
ERRO[0010] container init still running                 

real	0m10.090s
user	0m0.009s
sys	0m0.089s
root@ubu2004:/home/kir/git/runc/tst# ../runc list
ID          PID         STATUS      BUNDLE                   CREATED                          OWNER
345         229339      paused      /home/kir/git/runc/tst   2021-08-06T18:57:03.953021519Z   root

This happens because in cgroup v2, "[p]rocesses in the frozen cgroup can be killed by a fatal signal" (https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2.html), and it's not so for cgroup v1.

Most interesting thing is, *linuxContainer) Destroy() thaws a container if it is paused, but we don't call it until we kill init process in the killContainer (in delete.go) only calls it when the process is gone, which never happens.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions