Repository navigation
Do not transition shim to stopped state from a state query - #14646
Merged
copybara-service[bot] merged 1 commit intoSep 9, 2026
Merged
copybara-service[bot] merged 1 commit into
copybara-service[bot] merged 1 commit into
Conversation
createdState.State and runningState.State transitioned the shim's init process to stoppedState whenever a single `runsc state` call answered "stopped". That transition bypasses SetExited: waitBlock is never closed, no TaskExit event is published, and handleStoppedKill silently swallows all subsequent kills, so containerd waits forever and the container can never be torn down. This behaviour comes from commit 1e472a8, which tried to fix the opposite problem of containerd never seeing that a container died due to query errors. However, this part was never essential, because the real fixes had to do with state queries on dead or deleted containers erroring out. In light of google#14645, there is now a concrete example of a buggy runsc not being an authoritative and irreversible source for the stopped state, so kills can be accepted but dropped, and the pod was stuck terminating forever.
EtiennePerot
approved these changes
Sep 9, 2026
copybara-service Bot
pushed a commit
that referenced
this pull request
Sep 9, 2026
createdState.State and runningState.State transitioned the shim's init process to stoppedState whenever a single `runsc state` call answered "stopped". That transition bypasses SetExited: waitBlock is never closed, no TaskExit event is published, and handleStoppedKill silently swallows all subsequent kills, so containerd waits forever and the container can never be torn down. This behaviour comes from commit 1e472a8, which tried to fix the opposite problem of containerd never seeing that a container died due to query errors. However, this part was never essential, because the real fixes had to do with state queries on dead or deleted containers erroring out. In light of #14645, there is now a concrete example of a buggy runsc not being an authoritative and irreversible source for the stopped state, so kills can be accepted but dropped, and the pod will be stuck terminating forever. FUTURE_COPYBARA_INTEGRATE_REVIEW=#14646 from konstantin-s-bogom:shim-stopped-latch-fix ecc1bf7 PiperOrigin-RevId: 978203572
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
createdState.State and runningState.State transitioned the shim's init process to stoppedState whenever a single
runsc statecall answered "stopped". That transition bypasses SetExited: waitBlock is never closed, no TaskExit event is published, and handleStoppedKill silently swallows all subsequent kills, so containerd waits forever and the container can never be torn down.This behaviour comes from commit 1e472a8, which tried to fix the opposite problem of containerd never seeing that a container died due to query errors. However, this part was never essential, because the real fixes had to do with state queries on dead or deleted containers erroring out. In light of #14645, there is now a concrete example of a buggy runsc not being an authoritative and irreversible source for the stopped state, so kills can be accepted but dropped, and the pod will be stuck terminating forever.