From 62a906baa19ba60056586a5a6e42885ed376db83 Mon Sep 17 00:00:00 2001 From: Christoph Ostarek Date: Mon, 27 Jul 2026 16:04:42 +0200 Subject: [PATCH] pillar/containerd: drop bogus scheduler from debug exec The process spec used for execs into the debug container sets Scheduler.Deadline, but leaves Scheduler.Policy empty. runc rejects that in ToSchedAttr(), so the container init fails before it can execute the requested program: OCI runtime exec failed: exec failed: unable to start container process: invalid scheduler policy:: unknown Both users of RunInDebugContainer() are affected: the collect-info run triggered through a local operator console (collectinfo agent) and the bpftrace endpoint of pillar's http-debug interface. The spec has looked like this since the bpftrace interface was added, but runc ignored process.scheduler on the exec path until v1.3.0-rc1 (runc#4585), so it stayed unnoticed until the rootfs moved from runc 1.1.12 to 1.3.3 in aa18688626ab ("bump runc to v3.3.0, containerd to v2.2.0; addresses critical CVEs"). Rather than completing the scheduler spec, drop it. Scheduler.Deadline is a SCHED_DEADLINE bandwidth parameter in nanoseconds, not a limit on how long a process may run, and it was assigned a unix timestamp in seconds, so it never did what it looks like it does - the kernel does not kill tasks for missing a deadline either. The timeout is enforced by RunInDebugContainer() itself, which kills the process once its timer fires. Without process.scheduler runc leaves the exec'ed process with the scheduling attributes it inherits from the debug container, which is what CtrExec() relies on as well. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Christoph Ostarek (cherry picked from commit b7d446377a5a69712d9c1f57427961b9bdc042aa) --- pkg/pillar/containerd/run.go | 3 --- 1 file changed, 3 deletions(-) diff --git a/pkg/pillar/containerd/run.go b/pkg/pillar/containerd/run.go index d954e5be598..96b0df2b075 100644 --- a/pkg/pillar/containerd/run.go +++ b/pkg/pillar/containerd/run.go @@ -57,9 +57,6 @@ func RunInDebugContainer(clientCtx context.Context, taskID string, w io.Writer, Args: args, Env: env, Cwd: "/", - Scheduler: &specs.Scheduler{ - Deadline: uint64(time.Now().Add(timeout).Unix()), - }, } stderrBuf := bytes.Buffer{}