From 6806b2c1c43c8f48b39ee8160a61ec62112d4b20 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Tue, 17 Aug 2021 17:45:01 -0700 Subject: [PATCH] runc delete -f: fix for cg v1 + paused container runc delete -f is not working for a paused container, since in cgroup v1 SIGKILL does nothing if a process is frozen (unlike cgroup v2, in which you can kill a frozen process with a fatal signal). Theoretically, we only need this for v1, but doing it for v2 as well is OK. Signed-off-by: Kir Kolyshkin --- libcontainer/container_linux.go | 8 ++++++++ tests/integration/delete.bats | 10 ++++++++++ 2 files changed, 18 insertions(+) diff --git a/libcontainer/container_linux.go b/libcontainer/container_linux.go index 583c61566..f6a8f569d 100644 --- a/libcontainer/container_linux.go +++ b/libcontainer/container_linux.go @@ -393,6 +393,14 @@ func (c *linuxContainer) Signal(s os.Signal, all bool) error { if err := c.initProcess.signal(s); err != nil { return fmt.Errorf("unable to signal init: %w", err) } + if status == Paused { + // For cgroup v1, killing a process in a frozen cgroup + // does nothing until it's thawed. Only thaw the cgroup + // for SIGKILL. + if s, ok := s.(unix.Signal); ok && s == unix.SIGKILL { + _ = c.cgroupManager.Freeze(configs.Thawed) + } + } return nil } return ErrNotRunning diff --git a/tests/integration/delete.bats b/tests/integration/delete.bats index 9a6d7e184..ea8a3bb6c 100644 --- a/tests/integration/delete.bats +++ b/tests/integration/delete.bats @@ -50,6 +50,16 @@ function teardown() { [ "$status" -eq 0 ] } +@test "runc delete --force [paused container]" { + runc run -d --console-socket "$CONSOLE_SOCKET" ct1 + [ "$status" -eq 0 ] + testcontainer ct1 running + + runc pause ct1 + runc delete --force ct1 + [ "$status" -eq 0 ] +} + @test "runc delete --force in cgroupv1 with subcgroups" { requires cgroups_v1 root cgroupns set_cgroups_path