From 2ff79594347761e25e871e3641d046c288c9e3ff Mon Sep 17 00:00:00 2001
From: HirazawaUi <695097494plus@gmail.com>
Date: Wed, 18 Jun 2025 22:40:08 +0800
Subject: [PATCH] Preventing containers from being unable to be deleted

Signed-off-by: HirazawaUi <695097494plus@gmail.com>
(cherry picked from commit e5a74679b32b32a7670f2a19c99974d96f1585a8)
Signed-off-by: HirazawaUi <695097494plus@gmail.com>
---
 libcontainer/process_linux.go | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/libcontainer/process_linux.go b/libcontainer/process_linux.go
index 88861f0a9..0fa1bc87d 100644
--- a/libcontainer/process_linux.go
+++ b/libcontainer/process_linux.go
@@ -554,6 +554,20 @@ func (p *initProcess) start() (retErr error) {
 		return fmt.Errorf("unable to start init: %w", err)
 	}
 
+	// If the runc-create process is terminated due to receiving SIGKILL signal,
+	// it may lead to the runc-init process leaking due
+	// to issues like cgroup freezing,
+	// and it cannot be cleaned up by runc delete/stop
+	// because the container lacks a state.json file.
+	// This typically occurs when higher-level
+	// container runtimes terminate the runc create process due to context cancellation or timeout.
+	// If the runc-create process terminates due to SIGKILL before
+	// reaching this line of code, we won't encounter the cgroup freezing issue.
+	_, err = p.container.updateState(nil)
+	if err != nil {
+		return fmt.Errorf("unable to store init state before creating cgroup: %w", err)
+	}
+
 	defer func() {
 		if retErr != nil {
 			// Find out if init is killed by the kernel's OOM killer.