Skip to content

fix(healthcheck): release exec process resources after probe - #4911

Merged
ChengyuZhu6 merged 1 commit into
containerd:mainfrom
haytok:healthcheck-release-exec-resources
Jun 1, 2026
Merged

ChengyuZhu6 merged 1 commit into
containerd:mainfrom
haytok:healthcheck-release-exec-resources

Conversation

@haytok

@haytok haytok commented May 17, 2026

Copy link
Copy Markdown
Member

Each invocation of a health check runs the user-defined command inside the container via containerd's task.Exec() API.

We can verify this in the probeHealthCheck section of the healthcheck package as follows:

func probeHealthCheck(ctx context.Context, task containerd.Task, hc *Healthcheck, processSpec *specs.Process) (*HealthcheckResult, error) {

...

	process, err := task.Exec(ctx, execID, processSpec, cio.NewCreator(
		cio.WithStreams(nil, outputBuf, outputBuf),
	))

...

	if err := process.Start(ctx); err != nil {
		log.G(ctx).Debugf("failed to start health check: %v", err)
		return nil, fmt.Errorf("start error: %w", err)
	}

	exitStatusC, err := process.Wait(ctx)
	if err != nil {
		return nil, fmt.Errorf("failed to wait for health check: %w", err)
	}

However, the current implementation does not release the resources allocated during the health check once the check is complete.

As a result, for example, pipes that should normally be deleted are not removed and continue to accumulate over time.

We can verify this behavior using the following command:

$ sudo nerdctl run -d --name=health --health-cmd="curl -f http://localhost" --health-interval=1s --health-timeout=1m0s --health-retries=3 --health-start-period=2s nginx:alpine
f2fdd8346a546bc6ef446980efdce1132a436fa63bd64a8ce6756c6197e7ec3f

$ TASK_PID=$(sudo nerdctl inspect health --format '{{.State.Pid}}')

$ SHIM_PID=$(ps -o ppid= -p $TASK_PID | tr -d ' ')

$ sudo ls -la /proc/$SHIM_PID/fd | grep pipe | head -3
lr-x------ 1 root root  64 May 17 20:51 100 -> pipe:[1093131]
lr-x------ 1 root root  64 May 17 20:52 101 -> pipe:[1092248]
lr-x------ 1 root root  64 May 17 20:52 102 -> pipe:[1092228]

$ sudo ls -la /proc/$SHIM_PID/fd | grep pipe | wc -l
16

$ sleep 10

$ sudo ls -la /proc/$SHIM_PID/fd | grep pipe | wc -l
26

So, this change adds a deferred process.Delete() after task.Exec() so that the allocated resources are released when the exec process completes.

Comment thread pkg/healthcheck/executor.go Resolved
@AkihiroSuda

Copy link
Copy Markdown
Member

Needs rebase

Each invocation of a health check runs the user-defined command inside
the container via containerd's `task.Exec()` API.

We can verify this in the `probeHealthCheck` section of the healthcheck
package as follows:

```golang
func probeHealthCheck(ctx context.Context, task containerd.Task, hc *Healthcheck, processSpec *specs.Process) (*HealthcheckResult, error) {

...

	process, err := task.Exec(ctx, execID, processSpec, cio.NewCreator(
		cio.WithStreams(nil, outputBuf, outputBuf),
	))

...

	if err := process.Start(ctx); err != nil {
		log.G(ctx).Debugf("failed to start health check: %v", err)
		return nil, fmt.Errorf("start error: %w", err)
	}

	exitStatusC, err := process.Wait(ctx)
	if err != nil {
		return nil, fmt.Errorf("failed to wait for health check: %w", err)
	}
```

However, the current implementation does not release the resources
allocated during the health check once the check is complete.

As a result, for example, pipes that should normally be deleted are not
removed and continue to accumulate over time.

We can verify this behavior using the following command:

```bash
$ sudo nerdctl run -d --name=health --health-cmd="curl -f http://localhost" --health-interval=1s --health-timeout=1m0s --health-retries=3 --health-start-period=2s nginx:alpine
f2fdd8346a546bc6ef446980efdce1132a436fa63bd64a8ce6756c6197e7ec3f

$ TASK_PID=$(sudo nerdctl inspect health --format '{{.State.Pid}}')

$ SHIM_PID=$(ps -o ppid= -p $TASK_PID | tr -d ' ')

$ sudo ls -la /proc/$SHIM_PID/fd | grep pipe | head -3
lr-x------ 1 root root  64 May 17 20:51 100 -> pipe:[1093131]
lr-x------ 1 root root  64 May 17 20:52 101 -> pipe:[1092248]
lr-x------ 1 root root  64 May 17 20:52 102 -> pipe:[1092228]

$ sudo ls -la /proc/$SHIM_PID/fd | grep pipe | wc -l
16

$ sleep 10

$ sudo ls -la /proc/$SHIM_PID/fd | grep pipe | wc -l
26
```

So, this change adds a deferred `process.Delete()` after `task.Exec()` so that
the allocated resources are released when the exec process completes.

Signed-off-by: Hayato Kiwata <dev@haytok.jp>
@haytok
haytok force-pushed the healthcheck-release-exec-resources branch from 338ab19 to ed918b4 Compare May 27, 2026 14:36
@haytok

haytok commented May 27, 2026

Copy link
Copy Markdown
Member Author

Thanks for checking!! I've resolved this conflict.

@haytok haytok added this to the v2.3.2 milestone May 30, 2026

@ChengyuZhu6 ChengyuZhu6 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@ChengyuZhu6
ChengyuZhu6 merged commit 7fdb195 into containerd:main Jun 1, 2026
73 of 84 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants