check process state while exec delete

.github/workflows/ci.yml

@@ -30,8 +30,8 @@ jobs:
 
       - run: cargo clippy --all-targets -- -D warnings
       - run: cargo clippy --all-targets --all-features -- -D warnings
-      
-      # the shim has sync code that is not covered when running with --all-features 
+
+      # the shim has sync code that is not covered when running with --all-features
       - run: cargo clippy -p containerd-shim --all-targets  -- -D warnings
 
       - run: cargo doc --no-deps --features docs
@@ -49,10 +49,10 @@ jobs:
       - run: ./scripts/install-protobuf.sh
         shell: bash
       - run: cargo check --examples --tests -p containerd-shim -p containerd-shim-protos -p containerd-client
-      
+
       - run: rustup toolchain install nightly --component rustfmt
       - run: cargo +nightly fmt -p containerd-shim -p containerd-shim-protos -p containerd-client -- --check --files-with-diff
-      
+
       - run: cargo clippy -p containerd-shim -p containerd-shim-protos -- -D warnings
       - run: cargo doc --no-deps -p containerd-shim -p containerd-shim-protos -p containerd-client
         env:
@@ -76,8 +76,8 @@ jobs:
           mkdir -p /tmp/dummy-xdr
           sudo -E $(command -v cargo) test
           sudo -E $(command -v cargo) test --all-features
-          
-          # the shim has sync code that is not covered when running with --all-features 
+
+          # the shim has sync code that is not covered when running with --all-features
           sudo -E $(command -v cargo) test -p containerd-shim
         if: ${{ !contains(matrix.os, 'windows') }}
         env:
@@ -171,7 +171,7 @@ jobs:
         run: |
           sudo -E PATH=$PATH make integration
         working-directory: src/github.com/containerd/containerd
-  
+
   windows-integration:
     name: Windows Integration
     runs-on: ${{ matrix.os }}
@@ -217,11 +217,11 @@ jobs:
           $ErrorActionPreference = "Stop"
 
           get-service containerd
-          $env:TTRPC_ADDRESS="\\.\pipe\containerd-containerd.ttrpc"  
+          $env:TTRPC_ADDRESS="\\.\pipe\containerd-containerd.ttrpc"
 
-          # run the example 
-          cargo run -p containerd-shim --example skeleton -- -namespace default -id 1234 -address "\\.\pipe\containerd-containerd"  -publish-binary ./bin/containerd start 
-          ps skeleton 
+          # run the example
+          cargo run -p containerd-shim --example skeleton -- -namespace default -id 1234 -address "\\.\pipe\containerd-containerd"  -publish-binary ./bin/containerd start
+          ps skeleton
           cargo run -p containerd-shim-protos --example shim-proto-connect \\.\pipe\containerd-shim-17630016127144989388-pipe
           $skeleton = get-process skeleton -ErrorAction SilentlyContinue
           if ($skeleton) { exit 1 }

.github/workflows/publish.yml

@@ -68,4 +68,3 @@ jobs:
         run: |
           git tag $TAG
           git push origin $TAG
-

Cargo.toml

@@ -25,6 +25,8 @@ edition = "2021"
 # Common dependencies for all crates
 [workspace.dependencies]
 async-trait = "0.1.52"
+cgroups-rs = "0.3.4"
+crossbeam = "0.8.1"
 futures = "0.3.19"
 libc = "0.2.112"
 log = {version = "0.4.2", features=["kv_unstable"]}
@@ -37,6 +39,8 @@ prost-build = "0.12"
 prost-types = "0.12"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
+simple_logger = { version = "5.0", default-features = false }
+tempfile = "3.6"
 thiserror = "1.0"
 time = { version = "0.3.29", features = ["serde", "std", "formatting"] }
 tokio = "1.26"

crates/client/examples/container_spec.json

@@ -155,4 +155,4 @@
             "/proc/sysrq-trigger"
         ]
     }
-}
+}

crates/runc-shim/Cargo.toml

@@ -26,7 +26,7 @@ doc = false
 
 [dependencies]
 containerd-shim = { path = "../shim", version = "0.7.1", features = ["async"] }
-crossbeam = "0.8.1"
+crossbeam.workspace = true
 libc.workspace = true
 log.workspace = true
 nix = { workspace = true, features = ["socket", "uio", "term"] }
@@ -44,5 +44,5 @@ futures.workspace = true
 tokio = { workspace = true, features = ["full"] }
 
 [target.'cfg(target_os = "linux")'.dependencies]
-cgroups-rs = "0.3.3"
-nix = { workspace = true, features = ["event"] }
+cgroups-rs.workspace = true
+nix = { workspace = true, features = ["event"] }

crates/runc-shim/README.md

@@ -42,4 +42,4 @@ In addition, we also run 100 pods and collect the total memory overhead.
  | :----------------------------------------------------------- | :----------------- | :---------------- |
  | containerd-shim-runc-v2                                      | 11.02MB            | 1106.52MB         |
  | containerd-shim-runc-v2-rs(sync)                             | 3.45MB             | 345.39MB          |
- | containerd-shim-runc-v2-rs(async, limited to 2 work threads) | 3.90MB             | 396.83MB          |
+ | containerd-shim-runc-v2-rs(async, limited to 2 work threads) | 3.90MB             | 396.83MB          |

crates/runc-shim/src/cgroup_memory.rs

@@ -112,7 +112,7 @@ pub async fn register_memory_event(
         let mut eventfd_file = unsafe { File::from_raw_fd(eventfd.as_raw_fd()) };
         loop {
             match eventfd_file.read(&mut buf).await {
-                Ok(bytes_read) if bytes_read == 0 => return,
+                Ok(0) => return,
                 Err(_) => return,
                 _ => (),
             }

crates/runc-shim/src/main.rs

@@ -17,6 +17,7 @@
 use std::env;
 
 use containerd_shim::{asynchronous::run, parse};
+use tokio::runtime::Builder;
 
 mod cgroup_memory;
 mod common;
@@ -43,8 +44,21 @@ fn parse_version() {
     }
 }
 
-#[tokio::main]
-async fn main() {
+fn main() {
+    let num_threads = std::env::var("RUSTMAXPROCS")
+        .map(|v| v.parse::<usize>().unwrap_or(2))
+        .unwrap_or(2);
+
+    let rt = Builder::new_multi_thread()
+        .worker_threads(num_threads)
+        .enable_all()
+        .build()
+        .expect("Failed to build Tokio runtime");
+
+    rt.block_on(async_main());
+}
+
+async fn async_main() {
     parse_version();
     run::<Service>("io.containerd.runc.v2-rs", None).await;
 }

crates/runc-shim/src/runc.rs

@@ -456,6 +456,9 @@ impl ProcessLifecycle<ExecProcess> for RuncExecLifecycle {
     }
 
     async fn delete(&self, p: &mut ExecProcess) -> Result<()> {
+        if p.state == Status::RUNNING {
+            return Err(Error::Other("cannot delete a running process".to_string()));
+        }
         self.exit_signal.signal();
         let exec_pid_path = Path::new(self.bundle.as_str()).join(format!("{}.pid", p.id));
         remove_file(exec_pid_path).await.unwrap_or_default();

crates/runc/Cargo.toml

@@ -23,10 +23,10 @@ oci-spec.workspace = true
 os_pipe.workspace = true
 path-absolutize = "3.0.11"
 prctl.workspace = true
-rand = "0.8.4"
+rand = "0.8.5"
 serde.workspace = true
 serde_json.workspace = true
-tempfile = "3.6.0"
+tempfile.workspace = true
 thiserror.workspace = true
 time.workspace = true
 uuid.workspace = true

crates/runc/README.md

@@ -5,7 +5,7 @@
 [![Crates.io](https://img.shields.io/crates/l/containerd-shim)](https://github.com/containerd/rust-extensions/blob/main/LICENSE)
 [![CI](https://github.com/containerd/rust-extensions/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/containerd/rust-extensions/actions/workflows/ci.yml)
 
-A crate for consuming the runc binary in your Rust applications, similar to [go-runc](https://github.com/containerd/go-runc) for Go. 
+A crate for consuming the runc binary in your Rust applications, similar to [go-runc](https://github.com/containerd/go-runc) for Go.
 This crate is based on archived [rust-runc](https://github.com/pwFoo/rust-runc).
 
 ## Usage
@@ -29,7 +29,7 @@ async fn main() {
     let opts = runc::options::CreateOpts::new()
         .pid_file("/path/to/pid/file")
         .no_pivot(true);
-    
+
     client.create("container-id", "path/to/bundle", Some(&opts)).unwrap();
 }
 ```

crates/shim-protos/Cargo.toml

@@ -48,7 +48,7 @@ path = "examples/connect-async.rs"
 required-features = ["async"]
 
 [dependencies]
-async-trait = { version = "0.1.48", optional = true }
+async-trait = { workspace = true, optional = true }
 protobuf = "=3.1"
 ttrpc = "0.8"
 
@@ -58,11 +58,9 @@ ttrpc-codegen = "0.4"
 [dev-dependencies]
 ctrlc = { version = "3.0", features = ["termination"] }
 log.workspace = true
-simple_logger = { version = "5.0", default-features = false, features = [
-  "stderr",
-] }
+simple_logger = { workspace = true, features = ["stderr"] }
 tokio = { workspace = true, features = ["full"] }
-crossbeam = "0.8.0" # Used by create_ttrpc_context()
+crossbeam.workspace = true # Used by create_ttrpc_context()
 
 [package.metadata.docs.rs]
 features = ["docs"]

crates/shim-protos/vendor/README.md

@@ -7,4 +7,4 @@ Proto files are copy-pasted directly from upstream repos:
 + https://github.com/protocolbuffers/protobuf
 + https://github.com/gogo/protobuf
 + https://github.com/containerd/cgroups
-+ https://github.com/microsoft/hcsshim
++ https://github.com/microsoft/hcsshim

crates/shim/Cargo.toml

@@ -49,7 +49,7 @@ nix = { workspace = true, features = [
 ] }
 oci-spec.workspace = true
 page_size = "0.6.0"
-prctl = "1.0.0"
+prctl.workspace = true
 signal-hook = "0.3.13"
 serde.workspace = true
 serde_json.workspace = true
@@ -68,7 +68,7 @@ signal-hook-tokio = { version = "0.3.1", optional = true, features = [
 tokio = { workspace = true, features = ["full"], optional = true }
 
 [target.'cfg(target_os = "linux")'.dependencies]
-cgroups-rs = "0.3.4"
+cgroups-rs.workspace = true
 
 [target.'cfg(unix)'.dependencies]
 command-fds = "0.3.0"
@@ -87,7 +87,7 @@ windows-sys = { version = "0.52.0", features = [
 ] }
 
 [dev-dependencies]
-tempfile = "3.6"
+tempfile.workspace = true
 
 [package.metadata.docs.rs]
 features = ["docs"]

crates/shim/src/asynchronous/monitor.rs

@@ -87,10 +87,7 @@ impl Monitor {
         };
 
         self.subscribers.insert(id, subscriber);
-        self.topic_subs
-            .entry(topic)
-            .or_insert_with(Vec::new)
-            .push(id);
+        self.topic_subs.entry(topic).or_default().push(id);
         Ok(Subscription { id, rx })
     }
 

crates/shim/src/synchronous/monitor.rs

@@ -83,10 +83,7 @@ impl Monitor {
             topic: topic.clone(),
         };
         self.subscribers.insert(id, subscriber);
-        self.topic_subs
-            .entry(topic)
-            .or_insert_with(Vec::new)
-            .push(id);
+        self.topic_subs.entry(topic).or_default().push(id);
         Ok(Subscription { id, rx })
     }
 

crates/snapshots/Cargo.toml

@@ -30,10 +30,9 @@ tokio = { workspace = true, features = ["sync"] }
 tokio-stream = "0.1.8"
 
 [dev-dependencies]
-async-stream = "0.3.2"
 futures.workspace = true
 log.workspace = true
-simple_logger = { version = "5.0", default-features = false }
+simple_logger.workspace = true
 
 [build-dependencies]
 tonic-build.workspace = true

crates/snapshots/README.md

@@ -87,4 +87,4 @@ Server::builder()
     .serve_with_incoming(incoming)
     .await
     .expect("Serve failed");
-```
+```

deny.toml

@@ -58,7 +58,7 @@ ignore = [
 # * Medium - CVSS Score 4.0 - 6.9
 # * High - CVSS Score 7.0 - 8.9
 # * Critical - CVSS Score 9.0 - 10.0
-#severity-threshold = 
+#severity-threshold =
 
 # This section is considered when running `cargo deny check licenses`
 # More documentation for the licenses section can be found here:
@@ -72,6 +72,7 @@ unlicensed = "deny"
 allow = [
     "MIT",
     "Apache-2.0",
+    "BSD-2-Clause",
     "BSD-3-Clause",
 ]
 # List of explictly disallowed licenses
@@ -170,8 +171,8 @@ deny = [
 skip = [
     #{ name = "ansi_term", version = "=0.11.0" },
 ]
-# Similarly to `skip` allows you to skip certain crates during duplicate 
-# detection. Unlike skip, it also includes the entire tree of transitive 
+# Similarly to `skip` allows you to skip certain crates during duplicate
+# detection. Unlike skip, it also includes the entire tree of transitive
 # dependencies starting at the specified crate, up to a certain depth, which is
 # by default infinite
 skip-tree = [

rust-toolchain.toml

@@ -1,3 +1,3 @@
 [toolchain]
-channel = "1.71"
+channel = "1.74"
 components = ["rustfmt", "clippy", "llvm-tools"]