Bug 1831866 - CRI-O should manage namespace lifecycle
Summary: CRI-O should manage namespace lifecycle
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Node
Version: 4.5
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
: 4.5.0
Assignee: Peter Hunt
QA Contact: Sunil Choudhary
Depends On:
TreeView+ depends on / blocked
Reported: 2020-05-05 19:05 UTC by Peter Hunt
Modified: 2020-07-13 17:35 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2020-07-13 17:35:12 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github openshift machine-config-operator pull 1689 0 None closed Bug 1831866: cri-o: manage ns lifecycle, again! 2020-09-09 16:24:08 UTC
Red Hat Product Errata RHBA-2020:2409 0 None None None 2020-07-13 17:35:32 UTC

Description Peter Hunt 2020-05-05 19:05:29 UTC
Description of problem:
CRI-O currently mounts namespaces by attaching to the /proc/$pid/ns of the infra container. This causes races with the kernel (as /proc entries can be torn down anytime after the infra container is stopped, leaving inconsistent state in CRI-O).
CRI-O should instead manage its own namespace lifecycle

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. create a pod and container in cri-o (with crictl or kubectl)
2. run `sudo runc state $ctr_id | jq .bundle` to get the location of the bundle
3. run `cat $bundle_dir/config.json | jq .linux.namespaces` and find where the namespaces are attached

Actual results:
paths are in /proc

Expected results:
paths should be somewhere else (/var/run, for instance)

Additional info:

Comment 4 errata-xmlrpc 2020-07-13 17:35:12 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.