From fee4c9a7d94e4a44a3b54f04f4e6e17fe2dde3f5 Mon Sep 17 00:00:00 2001 From: Yu-Ju Hong Date: Thu, 20 Oct 2016 09:55:28 -0700 Subject: [PATCH] Return empty network namespace if the infra container has exited If the infra container has already terminated, `docker inspect` will report pid 0. The path constructed using the pid to check the network namespace of the process will be invalid. This commit changes docker to report an empty path to stop kubenet from erroring out whenever TearDown is called on an exited infra container. This is not a fix for all the plugins, as some plugins may require the actual network namespace to tear down properly. --- pkg/kubelet/dockershim/helpers.go | 6 ++++++ pkg/kubelet/dockertools/docker_manager.go | 7 +++++++ 2 files changed, 13 insertions(+) diff --git a/pkg/kubelet/dockershim/helpers.go b/pkg/kubelet/dockershim/helpers.go index 83fa2cc907..e7e3c31ed8 100644 --- a/pkg/kubelet/dockershim/helpers.go +++ b/pkg/kubelet/dockershim/helpers.go @@ -213,6 +213,12 @@ func getSandboxSecurityOpts(sandboxConfig *runtimeApi.PodSandboxConfig, seccompP } func getNetworkNamespace(c *dockertypes.ContainerJSON) string { + if c.State.Pid == 0 { + // Docker reports pid 0 for an exited container. We can't use it to + // check the network namespace, so return an empty string instead. + glog.V(4).Infof("Cannot find network namespace for the terminated container %q", c.ID) + return "" + } return fmt.Sprintf(dockerNetNSFmt, c.State.Pid) } diff --git a/pkg/kubelet/dockertools/docker_manager.go b/pkg/kubelet/dockertools/docker_manager.go index eb7868ab93..96e0e8ac21 100644 --- a/pkg/kubelet/dockertools/docker_manager.go +++ b/pkg/kubelet/dockertools/docker_manager.go @@ -2531,6 +2531,13 @@ func (dm *DockerManager) GetNetNS(containerID kubecontainer.ContainerID) (string glog.Errorf("Error inspecting container: '%v'", err) return "", err } + if inspectResult.State.Pid == 0 { + // Docker reports pid 0 for an exited container. We can't use it to + // check the network namespace, so return an empty string instead. + glog.V(4).Infof("Cannot find network namespace for the terminated container %q", containerID.ID) + return "", nil + } + netnsPath := fmt.Sprintf(DockerNetnsFmt, inspectResult.State.Pid) return netnsPath, nil }