https://bugzilla.redhat.com/show_bug.cgi?id=1046469

Daniel Walsh dwalsh@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |CURRENTRELEASE Last Closed| |2014-05-28 13:55:23

--- Comment #1 from Daniel Walsh dwalsh@redhat.com --- If you try this with the latest code does it still happen. Killing a container should stop all processes.

Closing as fixed in current release. Reopen if it still happens.

https://bugzilla.redhat.com/show_bug.cgi?id=1046469

Joe Mario jmario@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Status|CLOSED |POST CC| |jmario@redhat.com Resolution|CURRENTRELEASE |--- Keywords| |Reopened

--- Comment #3 from Joe Mario jmario@redhat.com ---

Closing as fixed in current release. Reopen if it still happens.

Re-opening. It's still happening with a RHEL7.2 host, a RHEL7.2 container and a docker-1.8.2-2.el7. The Dockerfile contains systemd, if that matters.

Steps to reproduce: 1) Create two containers using: docker run -d -v /sys/fs/cgroup:/sys/fs/cgroup:ro --privileged test /sbin/init docker run -d -v /sys/fs/cgroup:/sys/fs/cgroup:ro --privileged test /sbin/init

2) Start two containers: docker exec -it <container-1-id> bash docker exec -it <container-2-id> bash

3) Run top on the bare metal host. You should see an agetty process burning up one cpu:

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 73529 root 20 0 110004 680 660 R 99.7 0.0 10:53.98 agetty

Note, this problem does not occur if, when creating the containers, I replace the "--privileged" flag with "--security-opt label:disable --cap-add SYS_ADMIN"

Joe

https://bugzilla.redhat.com/show_bug.cgi?id=1046469

Daniel Walsh dwalsh@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |adimania@gmail.com, | |admiller@redhat.com, | |ichavero@redhat.com, | |jcajka@redhat.com, | |jchaloup@redhat.com, | |miminar@redhat.com Component|docker-io |docker Version|20 |22

https://bugzilla.redhat.com/show_bug.cgi?id=1046469

Jeremy Eder jeder@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |jeder@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1046469

--- Comment #9 from Joe Mario jmario@redhat.com --- Here's a little more info, but likely doesn't help. (It didn't help me). But I share it anyways.

The agetty process continuously loops through calls from main (agetty.c:372) to get_logname().

(gdb) bac #0 get_logname (cp=<synthetic pointer>, tp=0x7fff062f3520, op=0x7fff062f3870) at term-utils/agetty.c:1553 #1 main (argc=<optimized out>, argv=<optimized out>) at term-utils/agetty.c:372

The line read at line 1533 is: Breakpoint 1, get_logname (cp=<synthetic pointer>, tp=0x7fff062f3520, op=0x7fff062f3870) at term-utils/agetty.c:1533 1533 if (read(STDIN_FILENO, &c, 1) < 1) {

After it completes, errno is not set, and the value stored into the variable "c" is: (gdb) p c $15 = 3 '\003'

After a bunch of checks, it gets down to the switch stmt at line 1574: 1573 /* Do erase, kill and end-of-line processing. */ 1574 switch (key) {

Unfortunately the value of "key" is optimized away.

It falls through to the "default:" case at line 1604, and then executes line 1605: 1602 case CTL('D'): 1603 exit(EXIT_SUCCESS); 1604 default: 1605 if (!isascii(ascval) || !isprint(ascval)) 1606 break;

On the call to isprint(), we get to the read() of 1 byte from __fd=0: (gdb) bac #0 0x0000000000401fd0 in read@plt () #1 0x0000000000403752 in read (__nbytes=1, __buf=0x7fff062f3510, __fd=0) at /usr/include/bits/unistd.h:44 #2 get_logname (cp=<synthetic pointer>, tp=0x7fff062f3520, op=0x7fff062f3870) at term-utils/agetty.c:1533 #3 main (argc=<optimized out>, argv=<optimized out>) at term-utils/agetty.c:372

Unfortunately, even though I'm stepping by instruction, in the optimized binary, I can't stop between the isprint() and the upper level read() at line 1533 (where we started above).

Joe

https://bugzilla.redhat.com/show_bug.cgi?id=1046469

--- Comment #11 from Joe Mario jmario@redhat.com --- Here's one workaround for this. Sharing what I've learned.

Adding the following to the docker file

rm -f /lib/systemd/system/systemd*udev* ; \ rm -f /lib/systemd/system/getty.target;

causes both the runnaway agetty and the spike in systemd-udevd processes to go away. I understand there is no need for udev or getty in containers.

I did also try: RUN systemctl disable getty.target RUN systemctl disable systemd-udevd.service

and although the Dockerfile built fine, all the getty and udev services were still running as they were previously. So those two "systemctl disable" appear to be no-ops. Perhaps they get run before /sbin/init (systemd) is invoked.

https://bugzilla.redhat.com/show_bug.cgi?id=1046469

Mike McCune mmccune@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Status|MODIFIED |POST

--- Comment #14 from Mike McCune mmccune@redhat.com --- This bug was accidentally moved from POST to MODIFIED via an error in automation, please see mmccune@redhat.com with any questions