Skip to content

Commit ee3ac3a

Browse files
crosbymichaelcrosbymichael
committed
Add init process for zombie fighting
This adds a small C binary for fighting zombies. It is mounted under `/dev/init` and is prepended to the args specified by the user. You enable it via a daemon flag, `dockerd --init`, as it is disable by default for backwards compat. You can also override the daemon option or specify this on a per container basis with `docker run --init=true|false`. You can test this by running a process like this as the pid 1 in a container and see the extra zombie that appears in the container as it is running. ```c int main(int argc, char ** argv) { pid_t pid = fork(); if (pid == 0) { pid = fork(); if (pid == 0) { exit(0); } sleep(3); exit(0); } printf("got pid %d and exited\n", pid); sleep(20); } ``` Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
1 parent d8c9951 commit ee3ac3a

22 files changed

+112
-68
lines changed

‎Dockerfile‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -255,6 +255,16 @@ RUN set -x \
255255
&& cp bin/ctr /usr/local/bin/docker-containerd-ctr \
256256
&& rm -rf "$GOPATH"
257257

258+
ENV GRIMES_COMMIT f207601a8d19a534cc90d9e26e037e9931ccb9db
259+
RUN set -x \
260+
&& export GOPATH="$(mktemp -d)" \
261+
&& git clone https://github.com/crosbymichael/grimes.git "$GOPATH/grimes" \
262+
&& cd "$GOPATH/grimes" \
263+
&& git checkout -q "$GRIMES_COMMIT" \
264+
&& make \
265+
&& cp init /usr/local/bin/docker-init \
266+
&& rm -rf "$GOPATH"
267+
258268
# Wrap all commands in the "docker-in-docker" script to allow nested containers
259269
ENTRYPOINT ["hack/dind"]
260270

‎Dockerfile.aarch64‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,16 @@ RUN set -x \
198198
&& cp bin/ctr /usr/local/bin/docker-containerd-ctr \
199199
&& rm -rf "$GOPATH"
200200

201+
ENV GRIMES_COMMIT f207601a8d19a534cc90d9e26e037e9931ccb9db
202+
RUN set -x \
203+
&& export GOPATH="$(mktemp -d)" \
204+
&& git clone https://github.com/crosbymichael/grimes.git "$GOPATH/grimes" \
205+
&& cd "$GOPATH/grimes" \
206+
&& git checkout -q "$GRIMES_COMMIT" \
207+
&& make \
208+
&& cp init /usr/local/bin/docker-init \
209+
&& rm -rf "$GOPATH"
210+
201211
# Wrap all commands in the "docker-in-docker" script to allow nested containers
202212
ENTRYPOINT ["hack/dind"]
203213

‎Dockerfile.armhf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -196,6 +196,16 @@ RUN set -x \
196196
&& cp bin/ctr /usr/local/bin/docker-containerd-ctr \
197197
&& rm -rf "$GOPATH"
198198

199+
ENV GRIMES_COMMIT f207601a8d19a534cc90d9e26e037e9931ccb9db
200+
RUN set -x \
201+
&& export GOPATH="$(mktemp -d)" \
202+
&& git clone https://github.com/crosbymichael/grimes.git "$GOPATH/grimes" \
203+
&& cd "$GOPATH/grimes" \
204+
&& git checkout -q "$GRIMES_COMMIT" \
205+
&& make \
206+
&& cp init /usr/local/bin/docker-init \
207+
&& rm -rf "$GOPATH"
208+
199209
ENTRYPOINT ["hack/dind"]
200210

201211
# Upload docker source

‎Dockerfile.ppc64le‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,16 @@ RUN set -x \
216216
&& cp bin/ctr /usr/local/bin/docker-containerd-ctr \
217217
&& rm -rf "$GOPATH"
218218

219+
ENV GRIMES_COMMIT f207601a8d19a534cc90d9e26e037e9931ccb9db
220+
RUN set -x \
221+
&& export GOPATH="$(mktemp -d)" \
222+
&& git clone https://github.com/crosbymichael/grimes.git "$GOPATH/grimes" \
223+
&& cd "$GOPATH/grimes" \
224+
&& git checkout -q "$GRIMES_COMMIT" \
225+
&& make \
226+
&& cp init /usr/local/bin/docker-init \
227+
&& rm -rf "$GOPATH"
228+
219229
# Wrap all commands in the "docker-in-docker" script to allow nested containers
220230
ENTRYPOINT ["hack/dind"]
221231

‎Dockerfile.s390x‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -208,6 +208,16 @@ RUN set -x \
208208
&& cp bin/ctr /usr/local/bin/docker-containerd-ctr \
209209
&& rm -rf "$GOPATH"
210210

211+
ENV GRIMES_COMMIT f207601a8d19a534cc90d9e26e037e9931ccb9db
212+
RUN set -x \
213+
&& export GOPATH="$(mktemp -d)" \
214+
&& git clone https://github.com/crosbymichael/grimes.git "$GOPATH/grimes" \
215+
&& cd "$GOPATH/grimes" \
216+
&& git checkout -q "$GRIMES_COMMIT" \
217+
&& make \
218+
&& cp init /usr/local/bin/docker-init \
219+
&& rm -rf "$GOPATH"
220+
211221
# Wrap all commands in the "docker-in-docker" script to allow nested containers
212222
ENTRYPOINT ["hack/dind"]
213223

‎Dockerfile.simple‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,16 @@ RUN set -x \
8080
&& cp bin/ctr /usr/local/bin/docker-containerd-ctr \
8181
&& rm -rf "$GOPATH"
8282

83+
ENV GRIMES_COMMIT f207601a8d19a534cc90d9e26e037e9931ccb9db
84+
RUN set -x \
85+
&& export GOPATH="$(mktemp -d)" \
86+
&& git clone https://github.com/crosbymichael/grimes.git "$GOPATH/grimes" \
87+
&& cd "$GOPATH/grimes" \
88+
&& git checkout -q "$GRIMES_COMMIT" \
89+
&& make \
90+
&& cp init /usr/local/bin/docker-init \
91+
&& rm -rf "$GOPATH"
92+
8393
ENV AUTO_GOPATH 1
8494
WORKDIR /usr/src/docker
8595
COPY . /usr/src/docker

‎api/types/container/host_config.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -321,6 +321,9 @@ type HostConfig struct {
321321

322322
// Mounts specs used by the container
323323
Mounts []mount.Mount `json:",omitempty"`
324+
325+
// Run a custom init inside the container, if null, use the daemon's configured settings
326+
Init *bool `json:",om itempty"`
324327
}
325328

326329
// Box specifies height and width dimensions. Used for sizing of a console.

‎daemon/config_unix.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ type Config struct {
3535
Runtimes map[string]types.Runtime `json:"runtimes,omitempty"`
3636
DefaultRuntime string `json:"default-runtime,omitempty"`
3737
OOMScoreAdjust int `json:"oom-score-adjust,omitempty"`
38+
Init bool `json:"init,omitempty"`
3839
}
3940

4041
// bridgeConfig stores all the bridge driver specific
@@ -91,6 +92,7 @@ func (config *Config) InstallFlags(flags *pflag.FlagSet) {
9192
flags.Var(runconfigopts.NewNamedRuntimeOpt("runtimes", &config.Runtimes, stockRuntimeName), "add-runtime", "Register an additional OCI compatible runtime")
9293
flags.StringVar(&config.DefaultRuntime, "default-runtime", stockRuntimeName, "Default OCI runtime for containers")
9394
flags.IntVar(&config.OOMScoreAdjust, "oom-score-adjust", -500, "Set the oom_score_adj for the daemon")
95+
flags.BoolVar(&config.Init, "init", false, "Run an init in the container to forward signals and reap processes")
9496

9597
config.attachExperimentalFlags(flags)
9698
}

‎daemon/oci_linux.go‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"fmt"
55
"io"
66
"os"
7+
"os/exec"
78
"path/filepath"
89
"sort"
910
"strconv"
@@ -585,6 +586,26 @@ func (daemon *Daemon) populateCommonSpec(s *specs.Spec, c *container.Container)
585586
cwd = "/"
586587
}
587588
s.Process.Args = append([]string{c.Path}, c.Args...)
589+
590+
// only add the custom init if it is specified and the container is running in its
591+
// own private pid namespace. It does not make sense to add if it is running in the
592+
// host namespace or another container's pid namespace where we already have an init
593+
if c.HostConfig.PidMode.IsPrivate() {
594+
if (c.HostConfig.Init != nil && *c.HostConfig.Init) ||
595+
(c.HostConfig.Init == nil && daemon.configStore.Init) {
596+
s.Process.Args = append([]string{"/dev/init", c.Path}, c.Args...)
597+
path, err := exec.LookPath("docker-init")
598+
if err != nil {
599+
return err
600+
}
601+
s.Mounts = append(s.Mounts, specs.Mount{
602+
Destination: "/dev/init",
603+
Type: "bind",
604+
Source: path,
605+
Options: []string{"bind", "ro"},
606+
})
607+
}
608+
}
588609
s.Process.Cwd = cwd
589610
s.Process.Env = c.CreateDaemonEnvironment(linkedEnv)
590611
s.Process.Terminal = c.Config.Tty

‎docs/reference/commandline/dockerd.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ Options:
4848
-H, --host=[] Daemon socket(s) to connect to
4949
--help Print usage
5050
--icc=true Enable inter-container communication
51+
--init Run an init inside containers to forward signals and reap processes
5152
--insecure-registry=[] Enable insecure registry communication
5253
--ip=0.0.0.0 Default IP when binding container ports
5354
--ip-forward=true Enable net.ipv4.ip_forward
@@ -1140,6 +1141,7 @@ This is a full example of the allowed configuration options on Linux:
11401141
"group": "",
11411142
"cgroup-parent": "",
11421143
"default-ulimits": {},
1144+
"init": false,
11431145
"ipv6": false,
11441146
"iptables": false,
11451147
"ip-forward": false,

0 commit comments

Comments
 (0)