Skip to content

[1.4] fix fd leaks and detect them as comprehensively as possible #5034

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 5 commits into from
Nov 26, 2025
Merged

[1.4] fix fd leaks and detect them as comprehensively as possible #5034

merged 5 commits into from
Nov 26, 2025

Conversation

@lifubang
Copy link
Member

@lifubang lifubang commented Nov 20, 2025 •
edited
Loading

backport: #5026

Fix: #5021
Fix: #5007
Close: #5022
Close: #5024

Without deferring the closure of this file descriptor, starting a container with a very large number of devices can hit the RLIMIT_NOFILE limit.

@lifubang lifubang added the backport/1.4-pr A backport PR to release-1.4 label Nov 20, 2025
@cyphar cyphar added this to the 1.4.0 milestone Nov 20, 2025
@cyphar cyphar mentioned this pull request Nov 20, 2025
Closed
13 tasks
@cyphar cyphar changed the title [1.4] detect file descriptor leaks as comprehensively as possible [1.4] fix fd leaks and detect them as comprehensively as possible Nov 20, 2025
lifubang and others added 5 commits November 20, 2025 11:53
@lifubang @cyphar
ci: detect file descriptor leaks as comprehensively as possible
9f84cce 
Co-authored-by: Aleksa Sarai <[email protected]>
Signed-off-by: lifubang <[email protected]>
(cherry picked from commit ba7f46d)
Signed-off-by: lifubang <[email protected]>
@lifubang
libct: always close m.dstFile in mountToRootfs
612dbb9 
Signed-off-by: lifubang <[email protected]>
(cherry picked from commit e027288)
Signed-off-by: lifubang <[email protected]>
@lifubang
libct: add a defer fd close in createDeviceNode
0ec8f1a 
Signed-off-by: lifubang <[email protected]>
(cherry picked from commit 9a5e626)
Signed-off-by: lifubang <[email protected]>
@lifubang
bump github.com/cyphar/filepath-securejoin from 0.6.0 to 0.6.1
f52ffd1 
Signed-off-by: lifubang <[email protected]>
(cherry picked from commit 0127cc6)
Signed-off-by: lifubang <[email protected]>
@lifubang
integration: verify syscall compatibility after seccomp enforcement
e675743 
Signed-off-by: lifubang <[email protected]>
(cherry picked from commit d870650)
Signed-off-by: lifubang <[email protected]>
@lifubang lifubang force-pushed the ci-detect-fdleak-try-best-1.4 branch from 4e0fea6 to e675743 Compare November 20, 2025 11:53
@AkihiroSuda AkihiroSuda merged commit ffc11bc into opencontainers:release-1.4 Nov 26, 2025
37 checks passed
@lifubang lifubang mentioned this pull request Nov 26, 2025
Merged
@cyphar cyphar mentioned this pull request Nov 27, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cyphar cyphar cyphar approved these changes

@AkihiroSuda AkihiroSuda AkihiroSuda approved these changes

@rata rata Awaiting requested review from rata

@thaJeztah thaJeztah Awaiting requested review from thaJeztah

@kolyshkin kolyshkin Awaiting requested review from kolyshkin

Assignees

No one assigned

Labels

backport/1.4-pr A backport PR to release-1.4

Projects

None yet

Milestone

1.4.0

Development

Successfully merging this pull request may close these issues.

3 participants

@lifubang @cyphar @AkihiroSuda