NVIDIA / nvidia-container-toolkit / 37856676616

45%

main: 45%

push

github

fix: resolve containerd pid reliably before sending SIGHUP

SignalContainerd enabled SO_PASSCRED after connect(). containerd's gRPC
server writes its first frames immediately on accept, and the kernel only
records peer credentials on data queued while SO_PASSCRED is set, so the
credentials could parse as pid 0. The pid was passed to kill(2)
unvalidated, and kill(0, SIGHUP) signals the calling process's own
process group: the toolkit killed itself, logged "Successfully signaled
containerd", and crash-looped until a retry resolved the real pid,
restarting containerd well after node startup had completed.

Enable SO_PASSCRED before connect() via net.Dialer.Control so every
message carries credentials, and reject non-positive peer pids so a
failed resolution feeds the existing retry loop instead of a signal.

Fixes NVIDIA/nvidia-container-toolkit#2126

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Justin Schmitt <justin.schmitt@baseten.co>

24 of 43 new or added lines in 1 file covered. (55.81%)

6076 of 13564 relevant lines covered (44.8%)

0.45 hits per line