fix(cmd/urunc): add fail-fast exec stub to fix Argo Workflows hang - #883
Draft
Anand-240 wants to merge 1 commit into
Draft
fix(cmd/urunc): add fail-fast exec stub to fix Argo Workflows hang#883Anand-240 wants to merge 1 commit into
Anand-240 wants to merge 1 commit into
Conversation
✅ Deploy Preview for urunc canceled.
|
containerd-shim-runc-v2/go-runc invoke `urunc exec` to signal sidecar
containers in a pod (e.g. Argo Workflows' wait container) via kubectl
exec. urunc had no exec subcommand at all, so this call failed with an
opaque CLI-usage error ("No help topic for 'exec'") that callers could
not distinguish from "urunc is broken". This caused Argo workflows using
runtimeClassName: urunc to hang in Running forever, since the sidecar
could never be signaled to terminate.
This adds a minimal exec subcommand that accepts the same CLI shape
go-runc sends (--process, --console-socket, --detach, --pid-file,
<container-id>) and fails fast with a clear "not supported" error and
a dedicated exit code (255, matching runc's own convention), instead
of the previous unknown-command failure. This is intentionally a
fail-fast stub, not a real exec-into-unikernel implementation. See
the doc comment on execCommand for why that's a separate, larger
problem out of scope here.
Fixes urunc-dev#882
Signed-off-by: Anand-240 <anandprakashsrivastava68@gmail.com>
Anand-240
force-pushed
the
fix/urunc-exec-stub
branch
from
August 2, 2026 10:25
fe1ab68 to
e79cd04
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
urunc had no exec OCI-runtime subcommand at all. containerd-shim-runc-v2/go-runc invoke
<runtime> exec --process <spec.json> [flags] <container-id>to signal sidecar containers in a pod. This is how Argo Workflows tells its wait sidecar a step is done via kubectl exec. Because RuntimeClass is pod-scoped, that exec call gets routed through urunc's shim for every container in the pod, including plain-Linux sidecars, and previously failed with urfave/cli's generic "No help topic for 'exec'" error.That failure was indistinguishable from "urunc is broken", so callers like Argo's workflow-controller retried it forever instead of failing cleanly. The workflow just hangs in Running permanently. Full reproduction and root-cause writeup: #882.
What this PR adds
A minimal exec subcommand (
cmd/urunc/exec.go) that:--process,--console-socket,--detach,--pid-file,<container-id>), so parsing doesn't fail"exec is not supported by urunc: ...") and a dedicated exit code (255, matching runc's own convention for exec failures)Plus unit tests (
cmd/urunc/exec_test.go) and a newtest_cmd_uruncMakefile target wired intounittest(this package had no test coverage before).What this PR intentionally does NOT do
This is a fail-fast stub, not a real "exec a process inside a running unikernel" implementation. That would need something like a guest-agent/virtio-console channel into the VM, and doesn't apply uniformly across urunc's supported unikernel types. It also isn't verifiable without a KVM-capable environment. Flagging it as a possible separate future issue, not attempting it here.
Testing
Since this was developed on a Mac and cmd/urunc can't build natively there (it cgo-links runc/libcontainer/nsenter, Linux-only), all verification below ran in a Linux container:
go build ./cmd/urunc/...: cleango vet ./cmd/urunc/...: cleango test ./cmd/urunc/... -v: 4/4 new tests passgolangci-lint run(project's.golangci.yml,golangci-lint:v2.9): zero issues in the new/changed code (one pre-existing, unrelatedineffassignincreate.goremains, not touched by this PR)Fixes #882