From 9294c51f1eb069290f58687d29659500d69a012a Mon Sep 17 00:00:00 2001 From: Christoph Ostarek Date: Mon, 27 Jul 2026 16:04:42 +0200 Subject: [PATCH] pillar/containerd: drop bogus scheduler from debug exec The process spec used for execs into the debug container sets Scheduler.Deadline, but leaves Scheduler.Policy empty. runc rejects that in ToSchedAttr(), so the container init fails before it can execute the requested program: OCI runtime exec failed: exec failed: unable to start container process: invalid scheduler policy:: unknown Both users of RunInDebugContainer() are affected: the collect-info run triggered through a local operator console (collectinfo agent) and the bpftrace endpoint of pillar's http-debug interface. The spec has looked like this since the bpftrace interface was added, but runc ignored process.scheduler on the exec path until v1.3.0-rc1 (runc#4585), so it stayed unnoticed until the rootfs moved from runc 1.1.12 to 1.3.3 in aa18688626ab ("bump runc to v3.3.0, containerd to v2.2.0; addresses critical CVEs"). Rather than completing the scheduler spec, drop it. Scheduler.Deadline is a SCHED_DEADLINE bandwidth parameter in nanoseconds, not a limit on how long a process may run, and it was assigned a unix timestamp in seconds, so it never did what it looks like it does - the kernel does not kill tasks for missing a deadline either. The timeout is enforced by RunInDebugContainer() itself, which kills the process once its timer fires. Without process.scheduler runc leaves the exec'ed process with the scheduling attributes it inherits from the debug container, which is what CtrExec() relies on as well. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Christoph Ostarek (cherry picked from commit b7d446377a5a69712d9c1f57427961b9bdc042aa) [ 13.4-stable: this branch has neither containerd/run.go nor the collectinfo agent - the same bogus spec sits inline in runInDebugContainer() in agentlog/http-debug.go, so the identical hunk was dropped there instead. Only the bpftrace endpoint of pillar's http-debug interface is affected on this branch. ] --- pkg/pillar/agentlog/http-debug.go | 3 --- 1 file changed, 3 deletions(-) diff --git a/pkg/pillar/agentlog/http-debug.go b/pkg/pillar/agentlog/http-debug.go index a508b90a1aa..3b55d0341fe 100644 --- a/pkg/pillar/agentlog/http-debug.go +++ b/pkg/pillar/agentlog/http-debug.go @@ -163,9 +163,6 @@ func (b bpftraceHandler) runInDebugContainer(clientCtx context.Context, w io.Wri pspec := specs.Process{ Args: args, Cwd: "/", - Scheduler: &specs.Scheduler{ - Deadline: uint64(time.Now().Add(timeout).Unix()), - }, } taskID := fmt.Sprintf("bpftrace-%d", rand.Int()) // TODO: avoid collision stderrBuf := bytes.Buffer{}