Use SIGKILL when SIGTERM doesn't work

Firecracker's master version cannot be killed by "runc kill" somehow.
While it should be fixed by Firecracker, firecracker-containerd also
should use SIGKILL when SIGTERM doesn't work.

Signed-off-by: Kazuyoshi Kato <[email protected]>

Author: kzys

runtime/jailer.go

@@ -53,7 +53,7 @@ type jailer interface {
 	StubDrivesOptions() []FileOpt
 
 	// Stop the jailer as a way that is visible from the user-level process (e.g. SIGTERM).
-	Stop() error
+	Stop(force bool) error
 
 	// Close will do any necessary cleanup that the jailer has accrued.
 	Close() error

runtime/noop_jailer.go

@@ -101,18 +101,22 @@ func (j *noopJailer) StubDrivesOptions() []FileOpt {
 	return []FileOpt{}
 }
 
-func (j *noopJailer) Stop() error {
+func (j *noopJailer) Stop(force bool) error {
 	if j.pid == 0 {
 		return errors.New("the machine hasn't been started")
 	}
 
-	j.logger.Debugf("sending SIGTERM to %d", j.pid)
+	signal := syscall.SIGTERM
+	if force {
+		signal = syscall.SIGKILL
+	}
+	j.logger.Debugf("sending signal %d to %d", signal, j.pid)
 	p, err := os.FindProcess(j.pid)
 	if err != nil {
 		return err
 	}
 
-	err = p.Signal(syscall.SIGTERM)
+	err = p.Signal(signal)
 	if err == nil || err.Error() == "os: process already finished" {
 		return nil
 	}

runtime/runc_jailer.go

@@ -544,6 +544,10 @@ func getNetNS(spec specs.Spec) string {
 	return ""
 }
 
-func (j runcJailer) Stop() error {
-	return j.runcClient.Kill(j.ctx, j.vmID, int(syscall.SIGTERM), &runc.KillOpts{All: true})
+func (j runcJailer) Stop(force bool) error {
+	signal := syscall.SIGTERM
+	if force {
+		signal = syscall.SIGKILL
+	}
+	return j.runcClient.Kill(j.ctx, j.vmID, int(signal), &runc.KillOpts{All: true})
 }

runtime/service.go

@@ -1234,9 +1234,16 @@ func (s *service) shutdownLoop(
 			timeout: timeout,
 		},
 		{
-			name: "stop the jailer",
+			name: "stop the jailer by SIGTERM",
 			shutdown: func() error {
-				return s.jailer.Stop()
+				return s.jailer.Stop(false)
+			},
+			timeout: jailerStopTimeout,
+		},
+		{
+			name: "stop the jailer by SIGKILL",
+			shutdown: func() error {
+				return s.jailer.Stop(true)
 			},
 			timeout: jailerStopTimeout,
 		},