Orchestrator: Many orphaned Firecracker instances and leftover network/iptables rules causing host resource leakage
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 1.6k
- Forks
- 438
- PR merge metrics
- No merged PRs in 30d
Description
We observed many Firecracker processes, API sockets, metrics FIFOs and per-slot iptables PREROUTING REDIRECT rules left on the host (≈44 firecracker processes detected). Some instances are adopted by PID 1 (orphans), while others are still managed by the orchestrator (PPID == orchestrator PID). There are no clear D-state (uninterruptible I/O) processes at the moment, but many leftover resources are not cleaned up. This inflates host file descriptors, network interfaces and NAT rules, reducing the ability to start new sandboxes and increasing operational burden.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the orchestrator's Firecracker instance lifecycle and cleanup paths, focusing on processes, API sockets, metrics FIFOs, and per-slot iptables rules. Reproduce or inspect the orphaned-resource condition; done means managed instances and their associated host resources are reliably removed without leaving processes, sockets, FIFOs, or NAT rules behind.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- infrastructure, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 38/100