Skip to content

Windows Containers are leaked when container fails to start #5188

@jsturtevant

Description

@jsturtevant

Description
On Windows, when passing a command to a container to run, if the command isn't valid then containerd gives error and clean up its resources but HCS still shows a container is on the system. If you re-run container with the same name you get an error.

Steps to reproduce the issue:

ctr image pull k8s.gcr.io/pause:3.4.1
ctr.exe run --rm k8s.gcr.io/pause:3.4.1 test-1 echo c:\License.txt
ctr: hcsshim::System::CreateProcess test-1: The system cannot find the file specified.
(extra info: {"CommandLine":"echo c:\\License.txt","User":"ContainerUser","Environment":{"PATH":"C:\\Windows\\system32;C:\\Windows;"},"CreateStdInPipe":true,"CreateStdOutPipe":true,"CreateStdErrPipe":true}): unknown

Containerd doesn't know about the container:

ctr c ls
CONTAINER    IMAGE    RUNTIME
ctr t ls
TASK    PID    STATUS

but hcs has the container in the list:

 hcsdiag list                                   
test-1
    Windows Server Container,   Unknown

Try to run a valid command:

 ctr.exe run --rm k8s.gcr.io/pause:3.4.1 test-1 cmd /c echo c:\License.txt
ctr: hcsshim::CreateComputeSystem test-1: A virtual machine or container with the specified identifier already exists.
(extra info: {"Owner":"containerd-shim-runhcs-v1.exe","SchemaVersion":{"Major":2,"Minor":1},"Container":{"Storage":{"Layers":[{"Id":"e67d9508-fe76-54e0-b098-cabfb7356fd7","Path":"C:\\ProgramData\\containerd\\root\\io.containerd.snapshotter.v1.windows\\snapshots\\24"},{"Id":"e
3732ab4-a8b2-5962-8e88-a0a76ee83d86","Path":"C:\\ProgramData\\containerd\\root\\io.containerd.snapshotter.v1.windows\\snapshots\\23"},{"Id":"51d377df-069c-5b3a-8cb0-e86be7e7cfbe","Path":"C:\\ProgramData\\containerd\\root\\io.containerd.snapshotter.v1.windows\\snapshots\\22"},
{"Id":"994b900c-05b9-5a61-b236-35342d301241","Path":"C:\\ProgramData\\containerd\\root\\io.containerd.snapshotter.v1.windows\\snapshots\\21"}],"Path":"\\\\?\\Volume{0cdda4ac-837b-11eb-b279-845c959994a0}\\"},"Networking":{"AllowUnqualifiedDnsQuery":true,"Namespace":"45B223AA-1
9BF-40D6-9F54-9578BA121B94"}},"ShouldTerminateOnLastHandleClosed":true}): unknown

Describe the results you received:

Describe the results you expected:

What version of containerd are you using:

Tried with 1.4  and 1.5
$ containerd --version
containerd github.com/containerd/containerd v1.4.3 269548fa27e0089a8b8278fc4fc781d7f65a939b
containerd github.com/containerd/containerd v1.5.0-beta.3 02334356d0774a5b194e67b5f1383fd2485ea67a

Any other relevant information (runC version, CRI configuration, OS/Kernel version, etc.):

runc --version
$ runc --version

crictl info
$ crictl info

uname -a
$ uname -a

cmd /c ver

Microsoft Windows [Version 10.0.17763.1577

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions