containers / containers/bubblewrap

--die-with-parent is a massive footgun

Open
#692 1 comment 2 reactions 0 assignees View on GitHub
Dominant language
C
Stars
8.7k
Forks
386
Avg merge
3d 17h
Merged PRs (30d)
11

Description

I recently stumbled upon the same issue that was reported in this blog post: https://www.recall.ai/blog/pdeathsig-is-almost-never-what-you-want.

The problem is how `PR_SET_PDEATHSIG` works (from [here](https://man7.org/linux/man-pages/man2/PR_SET_PDEATHSIG.2const.html)):

> The parent-death signal is sent upon subsequent termination of the parent thread

Thus it is triggered by the death of the parent thread, *not* the parent process. This means that if the parent process chooses to launch a subprocess using a thread that isn't the main thread, and then that thread happens to die, then `bwrap` and its children will receive a SIGKILL, even though the parent process is still alive. This can lead to some very hard to debug process deaths.

I was running `bwrap --die-with-parent` in a Docker container via `docker exec`. Docker ultimately invokes `runc` to create processes, and `runc` is evidently multi-threaded, because I would occasionally get these SIGKILL process deaths.

I don't think this is adequately explained in Bubblewrap's documentation, which says this:

```
--die-with-parent Kills with SIGKILL child process (COMMAND) when bwrap or bwrap's parent dies.
```

Considering this flag is also inherently racy (see #633) I feel like it's dangerous to use and maybe should even be removed.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.