gefyrahq / gefyra / 25423650490

78%

push

github

fix(GO-1031): give gefyra-run containers their own PID namespace (#1044)

App containers were sharing cargo's PID namespace via
pid_mode="container:gefyra-cargo", which caused `docker rm -f` on one
gefyra-run container to cascade SIGTERM to all sibling containers.

The shared namespace was a leftover from the 2022 migration away from
external nsenter; patchContainerGateway.sh only needs cargo's view of
the host PID namespace (cargo runs pid_mode=host), not a shared
namespace with the app containers. Routing via cargo continues to work
unchanged after the fix.

Also drop pid_mode from the managed-keys allowlist for extra container
args, since we no longer set it ourselves.

515 of 840 branches covered (61.31%)

Branch coverage included in aggregate %.

4932 of 6151 relevant lines covered (80.18%)

1.04 hits per line