Description

Currently, runc checks the existence of init process inside a container to figure out whether the container is running or not. This is a correct thing to do for a container having its own PID namespace.

Yet, for the container which does not have its own pid namespace (i.e. it shares pidns with the host or possibly another container), merely checking that init is there is not a good way to say whether the container is running or not. In fact, init might be already killed or exited, and other container processes remain.

Since #3132 is fixed, for a no-pidns container we can instead say that the container is running if its cgroup has some processes running. While at it, it might make sense to disallow creating containers with shared or no cgroup and no pidns.

References:

• Issue HostPID Pod Container Cgroup path was residual after container restarts #4040
• Issue regression: can't kill and delete the container with shared(host) pid ns when the init process has dead #4047
• Discussions in Fix a regression when killing and deleting a container with shared(host) pid namespace #4048