Skip to content

Add containers_pid_namespace compatibility flag#6063

Merged
gpanders merged 3 commits intomainfrom
ganders/CC-6790
Feb 17, 2026
Merged

Add containers_pid_namespace compatibility flag#6063
gpanders merged 3 commits intomainfrom
ganders/CC-6790

Conversation

@gpanders
Copy link
Copy Markdown
Member

@gpanders gpanders commented Feb 12, 2026 •
edited
Loading

When set, this compatibility flag instructs the containers runtime to start the user's container in a separate PID namespace. Eventually this will become the default (past some yet-to-be-determined compatibility date).

Per @danlapid's suggestion, this follows the pattern used by neededByFl to annotate compatibility flags specifically needed for the containers service. We'll use this annotation in Edgeworker to send only the required compatibility flags to the ContainerService from the actor.

Part of CC-6789

@gpanders gpanders requested review from a team as code owners February 12, 2026 16:11
kentonv
kentonv reviewed Feb 12, 2026
View reviewed changes
@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Feb 12, 2026 •
edited
Loading

Codecov Report

❌ Patch coverage is 0% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 70.56%. Comparing base (dd7a515) to head (118c2cb).
⚠️ Report is 41 commits behind head on main.

Files with missing lines Patch % Lines
src/workerd/server/container-client.c++ 0.00% 9 Missing ⚠️
src/workerd/api/container.c++ 0.00% 3 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #6063      +/-   ##
==========================================
+ Coverage   70.38%   70.56%   +0.17%     
==========================================
  Files         408      409       +1     
  Lines      108811   108964     +153     
  Branches    18000    18011      +11     
==========================================
+ Hits        76591    76886     +295     
+ Misses      21415    21275     -140     
+ Partials    10805    10803       -2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions
Copy link
Copy Markdown

github-actions bot commented Feb 12, 2026 •
edited
Loading

The generated output of @cloudflare/workers-types matches the snapshot in types/generated-snapshot 🎉

@codspeed-hq
Copy link
Copy Markdown

codspeed-hq bot commented Feb 12, 2026 •
edited
Loading

Merging this PR will not alter performance

✅ 70 untouched benchmarks
⏩ 129 skipped benchmarks1

Comparing ganders/CC-6790 (118c2cb) with main (5361a73)

Open in CodSpeed

Footnotes

  1. 129 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

@kentonv
Copy link
Copy Markdown
Member

kentonv commented Feb 12, 2026

Sorry to suggest yet another redesign, but per my comment above, I think you are going to need to pass this in StartParams. In the edge runtime, it won't be feasible to pass the compatibility flags to the place where the container is first requested, since the worker hasn't necessarily been loaded yet at that point.

@gpanders gpanders mentioned this pull request Feb 13, 2026
Closed
kentonv
kentonv reviewed Feb 17, 2026
View reviewed changes
kentonv
kentonv reviewed Feb 17, 2026
View reviewed changes
@kentonv
Copy link
Copy Markdown
Member

kentonv commented Feb 17, 2026

LGTM once $experimental is added.

The internal build failure is spurious. It'll re-run anyway after the update.

@gpanders
Add containers_pid_namespace compatibility flag
16443db 
When set, this compatibility flag instructs the containers runtime to
start the user's container in a separate PID namespace. Eventually this
will become the default (past some yet-to-be-determined compatibility
date).
@gpanders gpanders force-pushed the ganders/CC-6790 branch 2 times, most recently from c5f2d5a to 5da9707 Compare February 17, 2026 18:24
@gpanders gpanders merged commit 6385aa9 into main Feb 17, 2026
22 checks passed
@gpanders gpanders deleted the ganders/CC-6790 branch February 17, 2026 20:44
gpanders added a commit to cloudflare/cloudflare-docs that referenced this pull request Mar 6, 2026
@gpanders
Add containers-pid-namespace compatibility flag
f22b7a2 
This flag was added in cloudflare/workerd#6063 and the compatibility date added in cloudflare/workerd#6264
@gpanders gpanders mentioned this pull request Mar 6, 2026
Merged
2 tasks
gpanders added a commit to cloudflare/cloudflare-docs that referenced this pull request Mar 11, 2026
@gpanders
Add containers-pid-namespace compatibility flag (#28818)
eaaa83a 
This flag was added in cloudflare/workerd#6063 and the compatibility date added in cloudflare/workerd#6264
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kentonv kentonv kentonv approved these changes

@gabivlj gabivlj gabivlj left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@gpanders @codecov-commenter @kentonv @gabivlj