add some doc for shim reap orphan process #10002
Conversation
|
Hi @ningmingxiao. Thanks for your PR. I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
done |
ningmingxiao
force-pushed
the
shim_doc
branch
3 times, most recently
from
81f75d8
to
05d0d08
Compare
Signed-off-by: ningmingxiao <ning.mingxiao@zte.com.cn>
| @@ -537,3 +537,9 @@ It works with standard protobufs and GRPC services as well as generating clients | |||
| The only difference between grpc and ttrpc is the wire protocol. | |||
| ttrpc removes the http stack in order to save memory and binary size to keep shims small. | |||
| It is recommended to use ttrpc in your shim but grpc support is currently an experimental feature. | |||
|
|
|||
| #### runc-shim reap orphan process created by exec-init | |||
There was a problem hiding this comment.
Suggestion:
containerd-shim-runc-v2 as sub-reaper
The shim process takes responsibility as a sub-reaper to cleanup exited containers or setns(2) processes.
When container is running in new PID namespace, the container should cleanup orphaned processes before it exits.
If container uses the same PID namespace with shim process, its descendant processes will be reparented to shim process. The shim process will reap them when they exit.
However, [PATCH] exit: fix the setns() && PR_SET_CHILD_SUBREAPER interaction prevents any cross-namespace reparenting in kernel. Assume that container is in X-namespace and P in root-namespace setns into X-namespace. P forks child C. The child C forks a grandchild G and exits. The G will be reparented to X instead of P's reaper.
If the PID namespace is different from shim process, the container init process should cleanup any orphaned reparented processes created by setns process (exec operation).
|
ping @ningmingxiao sorry for late reply. Added my comment, PTAL. Thanks |
No description provided.