When run fails on (bridge) networking setup, it breaks the namestore, leading to duplicate names

[apostasie]

Description

Yet another variant / breakout of #3352

Steps to reproduce the issue

You need to edit onCteateRuntime so that it panics.

nerdctl rm -f $(nerdctl ps -aq)
nerdctl run --net bridge -d --name foo debian sleep Inf
systemctl --user stop containerd
systemctl --user start containerd
sleep 1
echo "restart foo"
nerdctl start foo
sleep 1
echo "run bar"
nerdctl run -d --name bar debian sleep Inf
nerdctl run -d --name bar debian sleep Inf
echo "result in duplication"
nerdctl ps -a

Describe the results you received and expected

na

What version of nerdctl are you using?

main

Are you using a variant of nerdctl? (e.g., Rancher Desktop)

None

Host information

No response

[apostasie]

Current explanation is that the name gets released as the container start errored, but the container has still be created...

In case the bridge network plugin fails, the oci hook postStop gets called - while the container has still be created.

It is unclear to me at this point what is (wrongly) dispatching the oci hook postStop event.
Does it come from us, or is this a containerd possible issue?

[apostasie]

This looks more and more like an upstream bug - probably in runc? or in containerd?

@AkihiroSuda I can use some help here:

TL;DR: the reproducer above will make onCreateRuntime fail.
Because of that failure, it makes container.NewTask (containerd/client) fail, which wrongly sends a PostStop oci hook event (probably somewhere in runc).

This is currently with:

containerd: v1.7.16

runc version 1.7.19
commit: v1.1.13-0-g58aa920
spec: 1.0.2-dev
go: go1.21.12
libseccomp: 2.5.5