The test for NRI failure leads to a leaked resource. Found while working on kubernetes-sigs/cri-tools#2046
From AI:
Root cause: Between StartSandbox succeeding (line 299) and the NRI RunPodSandbox hook (line 346), there is no defer to stop the sandbox/shim on failure. When NRI returns an error:
- Sandbox metadata is deleted from the store (defer at line 164) ✓
- NRI RemovePodSandbox notification is sent (defer at line 351) ✓
- Shim task is NOT stopped — no call to sandboxService.StopSandbox() or controller.Stop() ✗
- rootfs and shm mounts are NOT unmounted ✗
The fix should add a defer between lines 313 and 344 that calls c.sandboxService.StopSandbox() when retErr != nil. The existing rollback tests (sandbox_run_rollback_test.go) don't cover NRI hook failure.
The test for NRI failure leads to a leaked resource. Found while working on kubernetes-sigs/cri-tools#2046
From AI:
Root cause: Between StartSandbox succeeding (line 299) and the NRI RunPodSandbox hook (line 346), there is no defer to stop the sandbox/shim on failure. When NRI returns an error:
The fix should add a defer between lines 313 and 344 that calls c.sandboxService.StopSandbox() when retErr != nil. The existing rollback tests (sandbox_run_rollback_test.go) don't cover NRI hook failure.