runc delete, container.Destroy: kill all processes

(For a container with no private PID namespace, that is).

When runc delete (or container.Destroy) is called on a stopped
container without private PID namespace and there are processes
in its cgroup, kill those.

Add a test case.

Signed-off-by: Kir Kolyshkin <[email protected]>

Author: kolyshkin

libcontainer/state_linux.go

@@ -35,6 +35,17 @@ type containerState interface {
 }
 
 func destroy(c *Container) error {
+	// Usually, when a container init is gone, all other processes in its
+	// cgroup are killed by the kernel. This is not the case for a shared
+	// PID namespace container, which may have some processes left after
+	// its init is killed or exited.
+	//
+	// As the container without init process running is considered stopped,
+	// and destroy is supposed to remove all the container resources, we need
+	// to kill those processes here.
+	if !c.config.Namespaces.IsPrivate(configs.NEWPID) {
+		_ = signalAllProcesses(c.cgroupManager, unix.SIGKILL)
+	}
 	err := c.cgroupManager.Destroy()
 	if c.intelRdtManager != nil {
 		if ierr := c.intelRdtManager.Destroy(); err == nil {

tests/integration/delete.bats

@@ -62,9 +62,19 @@ function teardown() {
 	[ "$status" -eq 0 ]
 }
 
-# Issue 4047, case "runc delete -f".
-# See also: "kill KILL [host pidns + init gone]" test in kill.bats.
+# Issue 4047, case "runc delete".
+@test "runc delete [host pidns + init gone]" {
+	test_runc_delete_host_pidns
+}
+
+# Issue 4047, case "runc delete --force" (different code path).
+# shellcheck disable=SC2030
 @test "runc delete --force [host pidns + init gone]" {
+	test_runc_delete_host_pidns --force
+}
+
+# See also: "kill KILL [host pidns + init gone]" test in kill.bats.
+function test_runc_delete_host_pidns() {
 	requires cgroups_freezer
 
 	update_config '	  .linux.namespaces -= [{"type": "pid"}]'
@@ -91,6 +101,7 @@ function teardown() {
 	fi
 
 	runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
+	# shellcheck disable=SC2031
 	[ "$status" -eq 0 ]
 	cgpath=$(get_cgroup_path "pids")
 	init_pid=$(cat "$cgpath"/cgroup.procs)
@@ -113,10 +124,14 @@ function teardown() {
 		kill -0 "$p"
 	done
 
-	runc delete -f test_busybox
+	# Must kill those processes and remove container.
+	# shellcheck disable=SC2031
+	runc delete "$@" test_busybox
+	# shellcheck disable=SC2031
 	[ "$status" -eq 0 ]
 
 	runc state test_busybox
+	# shellcheck disable=SC2031
 	[ "$status" -ne 0 ] # "Container does not exist"
 
 	# Make sure all processes are gone.