containers / containers/bubblewrap
--die-with-parent is a massive footgun
- Dominant language
- C
- Stars
- 8.7k
- Forks
- 386
- Avg merge
- 3d 17h
- Merged PRs (30d)
- 11
Description
I recently stumbled upon the same issue that was reported in this blog post: https://www.recall.ai/blog/pdeathsig-is-almost-never-what-you-want.
The problem is how `PR_SET_PDEATHSIG` works (from [here](https://man7.org/linux/man-pages/man2/PR_SET_PDEATHSIG.2const.html)):
> The parent-death signal is sent upon subsequent termination of the parent thread
Thus it is triggered by the death of the parent thread, *not* the parent process. This means that if the parent process chooses to launch a subprocess using a thread that isn't the main thread, and then that thread happens to die, then `bwrap` and its children will receive a SIGKILL, even though the parent process is still alive. This can lead to some very hard to debug process deaths.
I was running `bwrap --die-with-parent` in a Docker container via `docker exec`. Docker ultimately invokes `runc` to create processes, and `runc` is evidently multi-threaded, because I would occasionally get these SIGKILL process deaths.
I don't think this is adequately explained in Bubblewrap's documentation, which says this:
```
--die-with-parent Kills with SIGKILL child process (COMMAND) when bwrap or bwrap's parent dies.
```
Considering this flag is also inherently racy (see #633) I feel like it's dangerous to use and maybe should even be removed.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.