Repository navigation
Conversation
Forward signals sent to bwrap on to the sandboxed command, through the init process. Forwarding stops once init has reaped the command, as the kernel can then give its pid to an unrelated process. Signals the kernel sent to our process group are not forwarded, as the command received those itself unless it has left the group. Inspired by containers#402 and containers#586. Resolves: containers#369 Resolves: containers#573 Signed-off-by: Benedikt Spies <benedikt.spies@gmail.com> Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An alternative implementation of #586, which no longer merges, taking the
option name and approach from it and #402.
It addresses the two points from the review there: the init process stops
forwarding once it has reaped the command, so a reused pid is never signalled,
and the hook sits in
do_init()rather than keyed off--unshare-pid, so--lock-fileand--sync-fdare covered as well.--as-pid-1stays allowed,documented as only receiving signals the command has a handler for. SIGWINCH is
included, so this closes #573 too.
One caveat:
should_forward_signal()callsgetpgid()from init's signalhandler, which POSIX does not list among the functions guaranteed safe there,
though on Linux it is a bare system call. Dropping it would stop terminal
signals reaching a command that has left bwrap's process group; the alternative
is a signalfd in init instead of handlers.
🤖 Generated/Co-authored with Claude Code