Description of problem:
CRI-O currently mounts namespaces by attaching to the /proc/$pid/ns of the infra container. This causes races with the kernel (as /proc entries can be torn down anytime after the infra container is stopped, leaving inconsistent state in CRI-O).
CRI-O should instead manage its own namespace lifecycle
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. create a pod and container in cri-o (with crictl or kubectl)
2. run `sudo runc state $ctr_id | jq .bundle` to get the location of the bundle
3. run `cat $bundle_dir/config.json | jq .linux.namespaces` and find where the namespaces are attached
paths are in /proc
paths should be somewhere else (/var/run, for instance)
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.