Add support for parent death signal (pdeathSignal) to ensure child
processes receive a signal when the parent process dies. This addresses
the FIXME comment in Runc.execute().
## Changes
- Add pdeathSignal field to exec_command_attrs C struct
- Implement prctl(PR_SET_PDEATHSIG) in child process handler (Linux
only)
- Expose pdeathSignal through Command.Attrs Swift API
- Wire up pdeathSignal in Runc.execute() to remove FIXME
## Implementation Details
The implementation uses Linux-specific prctl() to set the parent death
signal, ensuring proper cleanup when parent processes terminate. The
feature is conditionally compiled for Linux only, maintaining
compatibility with other platforms.
* on glibc, swift expects that the msg_controllen is type Int
* on glibc, socket shutdown options should be an Int32
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- We're already setting the default `HOME` and `TERM`. Setting the
default `PATH` as well seems reasonable.
- This PR also fixes the bug in retrieving the `PATH` value (`PATH=` has
to be removed, and `=` should be allowed in folder names).
The mount flags are defined as `Int`s for musl but as `Int32`s for
glibc, despite the mount methods expecting `Int32` for both. This was
leading to build errors when building with glibc like:
```
| "async": .init(true, MS_SYNCHRONOUS),
| `- error: cannot convert value of type 'Int' to expected type 'Int32'
```
This PR allows for different Int sizes based on if we're building for
glibc or not to avoid this build error.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
This class does not work for glibc due to missing flags and methods.
This PR removes the ability to load the `Epoll` class when using glibc
for now.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
- Current implementation shuts down everything as soon as EOF is
detected on DispatchSourceRead for the relay. This is problematic for,
say an HTTP request where the client makes a request, and calls
`shutdown(fd, SHUT_WR)` to close the send side, but it expects to be
able to keep calling `recv()` to get the response.
- Changed cancel handlers so that the one that sees that both sources
have been cancelled then closes both the UDS and vsock fds.
- Updated vminitd VsockProxy to also do `shutdown(fd, SHUT_WR)` for read
hangup or EOF, and only close the underlying fds and unwire pollers on
full hangup, broken pipe, error, or when both sides half-close.
Fixes an issue first described in
https://github.com/apple/container/issues/740.
Previously the initial process of the container was using vminitd's
environment variables to find the target executable. This PR updates the
code to use the container's configured environment for the initial
process instead. The behavior of an exec in a container should be the
same as before.
Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
Improves https://github.com/apple/containerization/pull/245. A potential
deadlock risk was not proven. This PR moves the closing operation inside
the lock to prevent leaking an unclosed handle in case of an error.
While individual accesses were properly mutex-protected, the logical
operations were not atomic, leading to a potential inconsistency in a
multi-threaded environment. Multiple separate `state.withLock` calls
created race windows. With the proposed changes, single atomic
operations check and update the state together.
While reviewing test coverage, I noticed a couple of minor issues:
- 0 is non-negative - allow for zero memory
- we should likely use lstat instead of stat for file info
- we should check for empty name parameter
---------
Signed-off-by: Eric Ernst <eric_ernst@apple.com>
This change adds documentation to quite a few existing public types that
didn't have a blurb before.
Additionally, this fixes a couple things that I think either didn't make
sense when going to document them:
- Rename ConnectionStream to VsockConnectionStream. This type only
functions for vsock connections.
- Deletes NsLock+Closure. This was not used anywhere.
- Rename ContainerizationOCI/Config.swift to ImageConfig.swift.
Signed-off-by: Danny Canter <danny_canter@apple.com>
GAUTAM RAJU