[WIP] do not open stdin fifo when exec

[yuqitao]

fix #8856 (comment)

[k8s-ci-robot]

Hi @yuqitao. Thanks for your PR.

I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[fuweid]

I don't think it's correct. containerd supports exec operation with input. Please add your motivation. Thanks

[yuqitao]

containerd/cmd/containerd-shim-runc-v2/process/exec.go

Line 240 in 6e0dc9f

sc, err := fifo.OpenFifo(context.Background(), path, syscall.O_WRONLY|syscall.O_NONBLOCK, 0)

openStdin opens fifo with O_WRONLY，which is only used to hold fifo write endpoint. For init process，it is important to prevent init process sigpipe when restart containerd, but for exec process, when restart containerd, exec process quit is what we want. Stdin copy for exec process parent.Platform.CopyConsole and pio.Copy will open stdin fifo with O_RDONLY in their own logic.

[yuqitao]

I want to use this patch to solve pty device leak in CopyConsole. When restart containerd, there is no fifo write endpoint, copy stdin goroutine in CopyConsole will read EOF, and shutdown epollConsole.

[fuweid]

Synced with @yuqitao offline. I think the right approach is to implement exec operation's GC in CRI level or high-level plugin. The cleanup should be handled async. Since pod exec probe can go crazy, shim could have a lot of running exec processes. It could take time to cleanup. To avoid slow starting, we should handle it async.