From a4e5f3b688c846271840a58c01fc0b873686015f Mon Sep 17 00:00:00 2001 From: LoanCold Date: Wed, 7 Aug 2024 07:07:25 +0000 Subject: [PATCH] runsc: Fix bug of container creation clean-up process When the container finds that the container already exists, checked by `LockForNew()`, it returns an error and starts the clean-up process. The clean-up process will clean up the metadata file of the container, which was created by others. What's worse, the clean-up process only deletes metadata files rather than all resources of the container, leaking resources including the socket, makes it impossible to create a new container with this ID anymore. This patch makes sure that the clean-up process will not happen when no resources are allocated. It then avoids deleting resources not created by itself to fix the bug. Fixes #10724 Signed-off-by: Chenghao Li --- runsc/container/container.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/runsc/container/container.go b/runsc/container/container.go index 185400e27..6d4e653d8 100644 --- a/runsc/container/container.go +++ b/runsc/container/container.go @@ -243,6 +243,9 @@ func New(conf *config.Config, args Args) (*Container, error) { // Lock the container metadata file to prevent concurrent creations of // containers with the same id. if err := c.Saver.LockForNew(); err != nil { + // As we have not allocated any resources yet, we revoke the clean-up operation. + // Otherwise, we may accidently destroy an existing container. + cu.Release() return nil, fmt.Errorf("cannot lock container metadata file: %w", err) } defer c.Saver.UnlockOrDie()