Merge pull request containerd#4165 from apostasie/fix-2025-04-locking

[FIX]: tentatively fix concurrent access to locked CNI directory (containerd#3783)

Author: AkihiroSuda

pkg/lockutil/lockutil_unix.go

@@ -28,6 +28,7 @@ import (
 )
 
 func WithDirLock(dir string, fn func() error) error {
+	_ = os.MkdirAll(dir, 0700)
 	dirFile, err := os.Open(dir)
 	if err != nil {
 		return err
@@ -55,6 +56,7 @@ func flock(f *os.File, flags int) error {
 }
 
 func Lock(dir string) (*os.File, error) {
+	_ = os.MkdirAll(dir, 0700)
 	dirFile, err := os.Open(dir)
 	if err != nil {
 		return nil, err

pkg/netutil/netutil.go

@@ -56,7 +56,8 @@ func (e *CNIEnv) ListNetworksMatch(reqs []string, allowPseudoNetwork bool) (list
 	var err error
 
 	var networkConfigs []*NetworkConfig
-	err = lockutil.WithDirLock(e.NetconfPath, func() error {
+	// NOTE: we cannot lock NetconfPath directly, as Cilium (maybe others) are also locking it.
+	err = lockutil.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), func() error {
 		networkConfigs, err = e.networkConfigList()
 		return err
 	})
@@ -220,7 +221,7 @@ func (e *CNIEnv) NetworkList() ([]*NetworkConfig, error) {
 		netConfigList, err = e.networkConfigList()
 		return err
 	}
-	err = lockutil.WithDirLock(e.NetconfPath, fn)
+	err = lockutil.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), fn)
 
 	return netConfigList, err
 }
@@ -336,7 +337,7 @@ func (e *CNIEnv) CreateNetwork(opts types.NetworkCreateOptions) (*NetworkConfig,
 		}
 		return e.writeNetworkConfig(netConf)
 	}
-	err := lockutil.WithDirLock(e.NetconfPath, fn)
+	err := lockutil.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), fn)
 	if err != nil {
 		return nil, err
 	}
@@ -350,7 +351,7 @@ func (e *CNIEnv) RemoveNetwork(net *NetworkConfig) error {
 		}
 		return net.clean()
 	}
-	return lockutil.WithDirLock(e.NetconfPath, fn)
+	return lockutil.WithDirLock(filepath.Join(e.NetconfPath, ".nerdctl.lock"), fn)
 }
 
 // GetDefaultNetworkConfig checks whether the default network exists

pkg/netutil/netutil_test.go

@@ -196,9 +196,9 @@ func testDefaultNetworkCreation(t *testing.T) {
 	}
 	err = filepath.Walk(cniConfTestDir, walkF)
 	assert.NilError(t, err)
-	assert.Assert(t, len(files) == 2) // files[0] is the entry for '.'
-	assert.Assert(t, filepath.Join(cniConfTestDir, files[1].Name()) == defaultNetConf.File)
-	assert.Assert(t, firstConfigModTime.Equal(files[1].ModTime()))
+	assert.Equal(t, len(files), 3) // files[0] is the entry for '.', files[1] is the lock
+	assert.Assert(t, filepath.Join(cniConfTestDir, files[2].Name()) == defaultNetConf.File)
+	assert.Assert(t, firstConfigModTime.Equal(files[2].ModTime()))
 }
 
 // Tests whether nerdctl properly creates the default network
@@ -295,9 +295,9 @@ func testDefaultNetworkCreationWithBridgeIP(t *testing.T) {
 	}
 	err = filepath.Walk(cniConfTestDir, walkF)
 	assert.NilError(t, err)
-	assert.Assert(t, len(files) == 2) // files[0] is the entry for '.'
-	assert.Assert(t, filepath.Join(cniConfTestDir, files[1].Name()) == defaultNetConf.File)
-	assert.Assert(t, firstConfigModTime.Equal(files[1].ModTime()))
+	assert.Equal(t, len(files), 3) // files[0] is the entry for '.', files[1] is the lock
+	assert.Assert(t, filepath.Join(cniConfTestDir, files[2].Name()) == defaultNetConf.File)
+	assert.Assert(t, firstConfigModTime.Equal(files[2].ModTime()))
 }
 
 // Tests whether nerdctl skips the creation of the default network if a

pkg/ocihook/ocihook.go

@@ -107,7 +107,7 @@ func Run(stdin io.Reader, stderr io.Writer, event, dataStore, cniPath, cniNetcon
 	if err != nil {
 		return err
 	}
-	lock, err := lockutil.Lock(cniNetconfPath)
+	lock, err := lockutil.Lock(filepath.Join(cniNetconfPath, ".nerdctl.lock"))
 	if err != nil {
 		return err
 	}