Skip to content

Conversation

@slp
Copy link
Collaborator

@slp slp commented Apr 9, 2025

For the container use case, we need to relay the exit code from
userspace in the microVM all the way to the process using libkrun to
launch the VMM.

Since ioctls are passed mostly unmodified from userspace in the guest
to the virtio-fs device, we can use them as a mechanism for transporting
this information without requiring any specific support in the guest's
kernel.

Here we create an AtomicI32 and wire it up between virtio-fs and Vmm,
using it as exit code if userspace has set it to some value other than
i32::MAX. Otherwise, we keep using the vCPU exit code, as we did before.

@slp
Copy link
Collaborator Author

slp commented Apr 9, 2025

Copy link
Collaborator

@mtjhrc mtjhrc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall looks good, but please add some documentation to krun_start_enter about the special exit codes. I would say they are now part of our public API - podman relies on them to fix the mentioned issues.

slp added 3 commits April 21, 2025 08:16
For the container use case, we need to relay the exit code from
userspace in the microVM all the way to the process using libkrun to
launch the VMM.

Since ioctls are passed mostly unmodified from userspace in the guest
to the virtio-fs device, we can use them as a mechanism for transporting
this information without requiring any specific support in the guest's
kernel.

Here we create an AtomicI32 and wire it up between virtio-fs and Vmm,
using it as exit code if userspace has set it to some value other than
i32::MAX. Otherwise, we keep using the vCPU exit code, as we did before.

Signed-off-by: Sergio Lopez <slp@redhat.com>
We already fixed this for Linux a while ago, do the same for the macOS
implementation.

Signed-off-by: Sergio Lopez <slp@redhat.com>
Use the newly added exit code recording feature in virtio-fs to record
the exit code from workload's entrypoint.

We need to stop ignoring SIGCHLD, as otherwise waitpid doesn't record
the exit code of our child, which also means we need to do a waitpid
on every children to ensure we aren't leaving zombie processes.

Signed-off-by: Sergio Lopez <slp@redhat.com>
@slp slp force-pushed the record-exit-code branch from 38d8608 to b432306 Compare April 21, 2025 12:16
@slp
Copy link
Collaborator Author

slp commented Apr 21, 2025

I think I've addressed all the feedback.

tylerfanelli
tylerfanelli previously approved these changes Apr 22, 2025
For consistency for the container isolation use case, let's use in init
the same exit codes as chroot and podman do:

 125: "init" cannot set up the environment inside the microVM.
 126: "init" can find the executable to be run inside the microVM but cannot not execute it.
 127: "init" cannot find the executable to be run inside the microVM.

Co-authored-by: Matej Hrica <30753707+mtjhrc@users.noreply.github.com>
Signed-off-by: Sergio Lopez <slp@redhat.com>
@slp slp force-pushed the record-exit-code branch from 9551a38 to ca35ca1 Compare April 24, 2025 11:28
Copy link
Collaborator

@mtjhrc mtjhrc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good now!

@slp slp merged commit a137a2f into containers:main Apr 29, 2025
6 checks passed
@slp slp deleted the record-exit-code branch April 29, 2025 16:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants