feat(monitors): graceful shutdown over the control socket. - #869
Draft
Anamika1608 wants to merge 6 commits into
Draft
feat(monitors): graceful shutdown over the control socket.#869Anamika1608 wants to merge 6 commits into
Anamika1608 wants to merge 6 commits into
Conversation
Expose each monitor's control socket in the normal boot flow, so the runtime can keep talking to the VMM after the guest starts. Every monitor boots exactly as before; the only change is that its control socket stays open and reachable: - Firecracker launches with --api-sock instead of --no-api, keeping --config-file so the guest still boots from the config file. - QEMU exposes a QMP Unix socket in server mode, configured not to wait for a client before booting, alongside the disabled human monitor. - Cloud Hypervisor exposes its REST API socket (--api-socket). The socket location is configurable through a new socket_path option under a monitor's configuration, wired through MonitorConfig, ExecArgs and the state.json annotation passthrough, with a per-container default of /tmp/<id>.sock behind a DefaultSocketDir constant and a shared resolveSocketPath helper. After changeRoot, urunc creates the socket path's directory inside the monitor rootfs, so any custom path works; it fails only if the location is invalid, such as a file already existing at one of the path's components. Extend the QEMU BuildExecCmd tests to cover the new argument and document the socket_path option. Signed-off-by: Anamika Aggarwal <anamikaagg18@gmail.com>
Add an opt-in graceful_shutdown boolean to a monitor's configuration, wired through MonitorConfig and the state.json annotation passthrough the same way as the existing vhost option. It is inert in this commit. Signed-off-by: Anamika Aggarwal <anamikaagg18@gmail.com>
On SIGTERM, when a monitor exposes a control socket and graceful_shutdown is enabled, urunc asks the monitor to inject its native guest-shutdown event over the socket instead of killing the monitor: QEMU system power-down, Cloud Hypervisor vm.power-button, and Firecracker SendCtrlAltDel on x86. The socket lives inside the monitor's rootfs, so it is reached through /proc/<pid>/root. urunc then returns and lets the container manager escalate to SIGKILL on its own grace period. Any error, an unsupported monitor, a disabled feature, or any signal other than SIGTERM falls back to forwarding the signal exactly as before. Add SupportsGuestShutdown and RequestGuestShutdown to the VMM interface with per-monitor implementations and unit tests driving fake QMP and REST servers. Signed-off-by: Anamika Aggarwal <anamikaagg18@gmail.com>
Add a net.Pipe based test whose fully synchronous writes make a single-read client block a follow-up command, guarding the QMP client's read-until-return behavior: a regression that stopped at the asynchronous power-down event instead of the command's own return would fail the suite. Signed-off-by: Anamika Aggarwal <anamikaagg18@gmail.com>
Add a graceful_shutdown row to the Monitor Options table, describing the opt-in SIGTERM behavior and its per-monitor support (QEMU and Cloud Hypervisor on all architectures, Firecracker on x86 only). Signed-off-by: Anamika Aggarwal <anamikaagg18@gmail.com>
Four small safety fixes to the graceful guest-shutdown request path: - bound the whole QMP attempt (dial plus exchange) by a single deadline budget, instead of a dial timeout and an exchange timeout stacking - disable HTTP keep-alive on the unix socket client, so no idle connection lingers in the pool if this helper is reused from a long-lived process - cap the error-body read from the monitor at 4096 bytes - log the case where graceful shutdown is enabled but the monitor does not support it, making the fall-through observable Signed-off-by: Anamika Aggarwal <anamikaagg18@gmail.com>
✅ Deploy Preview for urunc ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds an opt-in graceful shutdown for the monitors that expose a control socket. When
graceful_shutdownis enabled for a monitor and the container receives SIGTERM, urunc asks the monitor to inject its native guest-shutdown event over the control socket instead of killing the monitor:system_powerdownover QMPvm.power-buttonover the REST APISendCtrlAltDel, x86 only (SupportsGuestShutdown()gates it byarchitecture; on aarch64 Firecracker has no such mechanism)
urunc sends the request and returns without forwarding the signal. It does not wait and adds no timeout of its own: the container manager already escalates to SIGKILL after its grace period. Any error, an unsupported monitor, the feature
being disabled, or any signal other than SIGTERM falls back to the exact kill behavior of today.
This is the runtime ("host") side of graceful shutdown. Teaching the guest init (
urunit) to react to these events is a separate follow-up; until then the events are delivered but the guest does not yet act on them.The feature is off by default. It is wired as a per-monitor
graceful_shutdownboolean, following the existingvhostoption pattern.Related issues
How was this tested?
POWERDOWNevent and reads the command'sreturn(a single-read client fails it).urunitdoes not react yet); opt-out parity (feature off behaves exactly as before); a dead monitor and aSIGSTOP'd monitor both falling back safely without hanging; a custom
socket_path; a non-SIGTERM signal never attempting graceful shutdown; and Firecracker on aarch64 taking the unsupported path.nerdctl stoptakes the full ~10s grace period (urunc sends the event and returns, the monitor survives until SIGKILL); with it off, the same stop is ~0.06s.LLM usage
claude code (opus 4.8) for the understanding of codebase, approach decisions and reviews
Checklist
make lint).make test_ctr,make test_nerdctl,make test_docker,make test_crictl).