coreos/rocket — pull request #244 by vcaputo (2014-12-08 23:50:48+00:00)
Title: rkt run: acquire lock on container directory and record pid

stage0 acquires an exclusive advisory lock on the container directory,
leaving the fd open when executing stage1/init with the fd value stored in
the environment variable RKT_LOCK_FD.

stage1's fakesdboot.so shim prevents closure of RKT_LOCK_FD in nspawn by
replacing the close with a O_CLOEXEC fcntl, retaining the lock handle until
nspawn exits.

fakesdboot.so has also been modified to intercept the clone syscall from
nspawn, recording the pid of the container's PID 1 in
"/var/lib/rkt/containers/$cuuid/pid"

With these changes one can do things like:

query container status:
#!/bin/bash
shopt -s nullglob
for c in /var/lib/rkt/containers/*; do
[ -e "$c/pid" ] || continue
flock --exclusive --nonblock "$c" /bin/true || {
cpid=$(cat "$c/pid")
nsenter --mount --uts --ipc --pid --root --wd --target "${cpid}" systemctl status
}
done

gc dead containers:
#!/bin/bash
shopt -s nullglob
for c in /var/lib/rkt/containers/*; do
[ -e "$c/stage1" ] || continue
flock --exclusive --nonblock "$c" rm -Rf "$c"
done