Merge branch 'containers:main' into main

README.md

@@ -6,7 +6,7 @@
 [![codecov](https://codecov.io/gh/containers/youki/branch/main/graph/badge.svg)](https://codecov.io/gh/containers/youki)
 
 <p align="center">
-  <img src="docs/youki_flat_full.png" width="450">
+  <img src="docs/youki.png" width="450">
 </p>
 
 youki is an implementation of the [OCI runtime-spec](https://github.com/opencontainers/runtime-spec) in Rust, similar to [runc](https://github.com/opencontainers/runc).  

crates/libcontainer/Cargo.toml

@@ -21,7 +21,7 @@ cgroupsv2_devices = ["libcgroups/cgroupsv2_devices"]
 
 [dependencies]
 anyhow = "1.0"
-bitflags = "2.0.2"
+bitflags = "2.1.0"
 caps = "0.5.5"
 chrono = { version = "0.4", features = ["serde"] }
 crossbeam-channel = "0.5"

crates/libcontainer/src/process/container_main_process.rs

@@ -4,16 +4,17 @@ use crate::{
     rootless::Rootless,
     utils,
 };
-use anyhow::{Context, Result};
+use anyhow::{bail, Context, Result};
 use nix::sys::wait::{waitpid, WaitStatus};
 use nix::unistd::Pid;
 
 #[cfg(feature = "libseccomp")]
 use crate::seccomp;
 #[cfg(feature = "libseccomp")]
 use nix::{
+    errno::Errno,
     sys::socket::{self, UnixAddr},
-    unistd::{self},
+    unistd,
 };
 #[cfg(feature = "libseccomp")]
 use oci_spec::runtime;
@@ -107,15 +108,24 @@ pub fn container_main_process(container_args: &ContainerArgs) -> Result<Pid> {
     // process is exit and reaped. By this point, the intermediate process
     // should already exited successfully. If intermediate process errors out,
     // the `init_ready` will not be sent.
-    match waitpid(intermediate_pid, None)? {
-        WaitStatus::Exited(_, 0) => (),
-        WaitStatus::Exited(_, s) => {
+    match waitpid(intermediate_pid, None) {
+        Ok(WaitStatus::Exited(_, 0)) => (),
+        Ok(WaitStatus::Exited(_, s)) => {
             log::warn!("intermediate process failed with exit status: {s}");
         }
-        WaitStatus::Signaled(_, sig, _) => {
+        Ok(WaitStatus::Signaled(_, sig, _)) => {
             log::warn!("intermediate process killed with signal: {sig}")
         }
-        _ => (),
+        Ok(_) => (),
+        Err(err) => {
+            // This is safe because intermediate_process and main_process check if the process is
+            // finished by piping instead of exit code.
+            if err == Errno::ECHILD {
+                log::warn!("intermediate process already reaped");
+            } else {
+                bail!("failed to wait for intermediate process: {err}");
+            }
+        }
     };
 
     Ok(init_pid)

docs/src/youki.md

@@ -1,7 +1,7 @@
 # Youki
 
 <p align="center">
-  <img src="./assets/youki_flat_full.png" width="450">
+  <img src="./assets/youki.png" width="450">
 </p>
 
 youki is an implementation of the [OCI runtime-spec](https://github.com/opencontainers/runtime-spec) in Rust, similar to [runc](https://github.com/opencontainers/runc).