You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I was trying to exec a process on a container that was not running from Kata Containers, and I have realized that we get an issue because of the way our agent relies on libcontainer. Indeed, our agent is a long lasting process that keeps libcontainer.Container containers and libcontainer.Process processes pointers in memory.
The case of the exec being started on a created container does not support this behavior. It assumes the container status will be asked from the disk everytime. That's a problem in our case and I found how to fix this, by removing this.
Basically, this else statement modifies the in-memory status of the container but never saves/stores it on disk. That's a problem when you rely exclusively on in-memory statuses like we do in case of our agent.
Now, I have opened this issue to suggest that we could remove this code part, but I might be missing a real use case for that, and I am looking for guidance here.
I think it makes sense but maybe we should do a refresh on the state to make sure its is written. You will have to work on the implementation some to figureout what is the right course of action.
I am glad you're okay with that @crosbymichael , and of course I'll do the implementation :).
I am not sure about what you mean by "refresh" ? My understanding is that we don't want this state to be written on disk because that would mean the container would be considered running because we did an exec, which would be wrong because the container workload would not have been started.
sboeuf
pushed a commit
to sboeuf/runc
that referenced
this issue
Mar 30, 2018
There is no reason to set the container state to "running" as a
temporary value when exec'ing a process on a container in "created"
state. The problem doing this is that consumers of the libcontainer
library might use it by keeping pointers in memory. In this case,
the container state will indicate that the container is running, which
is wrong, and this will end up with a failure on the next action
because the check for the container state transition will complain.
Fixesopencontainers#1767
Signed-off-by: Sebastien Boeuf <[email protected]>
I was trying to exec a process on a container that was not
running
from Kata Containers, and I have realized that we get an issue because of the way our agent relies onlibcontainer
. Indeed, our agent is a long lasting process that keepslibcontainer.Container
containers andlibcontainer.Process
processes pointers in memory.The case of the
exec
being started on acreated
container does not support this behavior. It assumes the container status will be asked from the disk everytime. That's a problem in our case and I found how to fix this, by removing this.Basically, this else statement modifies the in-memory status of the container but never saves/stores it on disk. That's a problem when you rely exclusively on in-memory statuses like we do in case of our agent.
Now, I have opened this issue to suggest that we could remove this code part, but I might be missing a real use case for that, and I am looking for guidance here.
@crosbymichael @mrunalp @cyphar please let me know what you think about this.
The text was updated successfully, but these errors were encountered: