Uploaded image for project: 'Mesos'
  1. Mesos
  2. MESOS-7858

Launching a nested container with namespace/pid isolation, with glibc < 2.25, may deadlock the LinuxLauncher and MesosContainerizer

    XMLWordPrintableJSON

    Details

    • Sprint:
      Mesosphere Sprint 61, Mesosphere Sprint 62
    • Story Points:
      5

      Description

      This bug in glibc (fixed in glibc 2.25) will sometimes cause a child process of a fork to assert incorrectly, if the parent enters a new pid namespace before forking:
      https://sourceware.org/bugzilla/show_bug.cgi?id=15392
      https://sourceware.org/bugzilla/show_bug.cgi?id=21386

      The LinuxLauncher code happens to do this when launching nested containers:

      According to the glibc bug, we can work around this by:

      The obvious solution is just to use clone() after setns() and never use fork() - and one can certainly patch both programs to do so. Nevertheless it would be nice to see if fork() also worked after setns(), especially since there is no inherent reason for it not to.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                jieyu Jie Yu
                Reporter:
                kaysoky Joseph Wu
                Shepherd:
                Benjamin Mahler
              • Votes:
                0 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: