The state.json should be generated prior to the creation of the cgroup.

[jianghao65536]

Fix 4534

Make sure that the state.json is in place before setting up the cgroup or writing 'THAWED' into the freezer.state. This way, the 'runc delete --force' command will work as expected.

[wxx213]

@kolyshkin Could you help to check this?

[lifubang]

Thanks.
We should know that we will write the pid of init process to state.json, so when we do delete -f, once this init process has dead, but runc stage 2 process is alive, I think maybe we still can't remove this cgroup path either because there is still one process in this cgroup.

[jianghao65536]

In my testing, I discovered that when systemd is used to handle cgroup, it gets cleaned up once runc init has exited. However, if we don't use systemd, some remnants of cgroup are left behind.

If we're not using systemd to manage, we might need to do a check in runc delete to see if runc init is still listed in cgroups.procs. This shouldn't take too much time since runc init is bound to exit due to an error. This error happens because when runc init gets to parts like procHooks that require synchronization with the parent process, it fails as the parent process has already been terminated, leading to errors when runc init tries to write or read values from the pipeline, and consequently, it exits.

[lifubang]

I paste the CI error msgs here, you can refer it if you can't see the logs.

• libcontainer/process_linux.go:564: File is not gofumpt-ed (gofumpt)
  // A SIGKILL can happen at any time, and without the state.json,
• libcontainer/process_linux.go:564: // A SIGKILL can happen at any time, and without the state.json,
  ^^^ extra whitespace at EOL, please fix
• Commit sha: 2026161, Author: jianghao53, Committer: jianghao53; The sign-off is missing.

To add your Signed-off-by line to every commit in this branch:

Ensure you have a local copy of your branch by checking out the pull request locally via command line.
In your local branch, run: git rebase HEAD~1 --signoff
Force push your changes to overwrite the branch: git push --force-with-lease origin generate-state-before-procHooks

[kolyshkin]

While I generally agree this is a bug which should be fixed, I don't like the way it is fixed. The issues are:

• lot of code duplication;
• API bloat (we now have LoadCreatingState and DestroyCreating -- does libcontainer user really has to care about all this?);
• maybe some bugs (like, creating-state.json is removed after state.json is written, not at the same time).

Can we reuse the same state.json, and consider the state is "creating" if init pid is not known?

[kolyshkin]

Also, it would be nice to have a test case added (somehow).

[jianghao65536]

Thank you, I'll make some adjustments. However, I'm still not sure how to add a test case. This bug isn't easily reproducible unless we simulate a timeout by adding a sleep command before runc creates the state.json file.

[kolyshkin]

@jianghao65536 are you still working on this?

[jianghao65536]

@kolyshkin Yes, I've been a bit busy recently and haven't had time to submit. I'll resubmit this week

[jianghao65536]

My apologies for the late submission. I inadvertently merged the latest code from the main branch into this one, which made things a bit chaotic. To rectify this, I've submitted a new pr, please close this pr

[kolyshkin]

I inadvertently merged the latest code from the main branch into this one, which made things a bit chaotic

You can use git pull --rebase origin/main to pick the latest upstream changes without creating a merge commit.

In case you messed up, you can always fix things locally and do git push --force to your repo/branch on github.