Use docker-init -s to fix zombie containerd-shim processes in rootless mode - #580
Open
okhowang wants to merge 1 commit into
Open
Use docker-init -s to fix zombie containerd-shim processes in rootless mode#580okhowang wants to merge 1 commit into
docker-init -s to fix zombie containerd-shim processes in rootless mode#580okhowang wants to merge 1 commit into
Conversation
In rootless Docker (e.g. `docker:dind-rootless`), rootlesskit does not create a PID namespace by default, so `docker-init` is not PID 1. tini only reaps zombies when it is PID 1, so without `-s` the orphaned `containerd-shim` processes described in docker-library#318 are not reaped. Pass `-s` to register `docker-init` as a subreaper, ensuring it reaps orphaned descendant processes even when it is not PID 1. This is harmless in non-rootless mode, where `docker-init` is already PID 1.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
dockerd-entrypoint.shinjectsdocker-init(tini) as PID 1 to work around zombiecontainerd-shimprocesses (docker-library/docker#318).However, in rootless mode this does not actually take effect:
rootlesskit(--net=slirp4netns --mtu=1500 --disable-host-loopback --port-driver=builtin --copy-up=/etc --copy-up=/run ...) does not create a PID namespace (no--pidns) and does not enable--reaper. Sorootlesskitdoes not act as a reaper.docker-initis not PID 1 inside the rootless container. By default tini only reaps orphaned processes when it is PID 1, socontainerd-shimprocesses exit and become zombies that are never reaped.This fixes it by passing
-stodocker-init, which makes tini register itself as a subreaper (PR_SET_CHILD_SUBREAPER) and thus reap orphaned descendants (such ascontainerd-shim) even when it is not PID 1.This is safe for the non-rootless path as well: there
docker-initis already PID 1, and-sis a harmless no-op in that case.Diff
Related
--reapermode (pidns reaper requirement rootless-containers/rootlesskit#532)Remarks
docker:dindanddocker:dind-rootless(both use this entrypoint).