Description of problem: CRI-O currently mounts namespaces by attaching to the /proc/$pid/ns of the infra container. This causes races with the kernel (as /proc entries can be torn down anytime after the infra container is stopped, leaving inconsistent state in CRI-O). CRI-O should instead manage its own namespace lifecycle Version-Release number of selected component (if applicable): 4.5 How reproducible: 100% Steps to Reproduce: 1. create a pod and container in cri-o (with crictl or kubectl) 2. run `sudo runc state $ctr_id | jq .bundle` to get the location of the bundle 3. run `cat $bundle_dir/config.json | jq .linux.namespaces` and find where the namespaces are attached Actual results: paths are in /proc Expected results: paths should be somewhere else (/var/run, for instance) Additional info:
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:2409