containerd / containerd/nerdctl

Container remove (or create?) is not atomic and does break name unicity

Open
#4,239 5 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
10.4k
Forks
826
Avg merge
1d 23h
Merged PRs (30d)
44

Description

### Description

It is possible to produce conditions where the name store ends-up with multiple references for the same name.

While the namestore implementation has been fixed to be atomic, the rest of the flow might not be

It is presumably hard to have a simple reproducer, but here is how I got there:

Loop through rm and run:
```
while true; do nerdctl rm -f foo; nerdctl run -ti --name foo debian echo lol; done
```

Then try to kill it "at the right time". Best way is probably to concurrently `make binaries` to fuck with the execution flow (this is assuming your nerdctl is ran from the build location).

Suggesting to review rm and run flow and ensure we implement this atomically, or at least have some recovery mechanism.

### Steps to reproduce the issue

1.
2.
3.

### Describe the results you received and expected

Not break name unicity.

### What version of nerdctl are you using?

main

### Are you using a variant of nerdctl? (e.g., Rancher Desktop)

None

### Host information

_No response_

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.