libvirt lxc can't stop all process when destroy vm.

[yuanzhicao]

Environments:
System: zesty
libvirt version: 2.5.0-3ubuntu5
vm rootfs release: ubuntu:16.04

Reproduce:
1. Run command "virsh -c lxc:// start vm" and the release of vm is xenial
2. Run command "pa aux|grep init" ,you would find the pid of init launch by vm.
3. Run command "virsh -c lxc:// destroy vm".
4. Run command "virsh -c lxc:// list --all" and "ps aux|grep init" ,you could find that vm is shutoff, but the init process launch by vm is still running.

Infact I have found the case of this bug, there is a patch after 1.3.1 that import this bug.

-------------------------------------------------------------
Commit: dc576025c360a1d2c89da410d0f3f0da55d0143f [dc57602]
Parents: 511e7c5bba
Author: Daniel P. Berrange <email address hidden>
Date: 2016年1月23日 GMT+8 上午12:07:18
Commit Date: 2016年1月27日 GMT+8 上午12:11:32
lxc: don't try to hide parent cgroups inside container
-------------------------------------------------------------

Cgroups inside container does't hide parent, so the process of container can change it own cgroup to another cgroup.
lxc destroy process by read cgroup tasks file,if process change it own cgroup,it can't destroy container process normally.

[Christian Ehrhardt  (paelzer)]

Hi yuanzhicao,
thank you for your report and your analysis to a suggested fix.

The fix you refer to was released in 1.3.2, setting later releases to fix-released.

In general Libvirt's lxc support is not of focus, I'd highly recommend using lxd for system containers which is far more stable in my experience (Setting prio low to reflect that).

I'll try to quickly come up with a ppa to test for you and get back here.

[Christian Ehrhardt  (paelzer)]

I uploaded a test build into a ppa at [1].

Note - this also needs
commit c7f5e26b5f0215c916923498df89bf4bfe467b85
Author: Michal Privoznik <email address hidden>
Date: Tue Jan 26 17:37:29 2016 +0100

    vircgroup: Finish renaming of virCgroupIsolateMount

It is still building, please test if that would solve your issue.
The version in there is libvirt_1.3.1-1ubuntu10.14~ppa2

If it does fix your issue I'd ask for your help to provide a good SRU Template [2].
Since IM(personal)HO libvirt-lxc is not very useful in the face of lxd I often struggle at making a compelling case why one should SRU things - since you use it I'd think you can make that much better for the SRU team to consider our work as an SRU.
When you do so please slightly extend your steps to reproduce including how to create the initial container and use that as testcase steps.

[1]: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/2891
[2]: https://wiki.ubuntu.com/StableReleaseUpdates#SRU_Bug_Template

[yuanzhicao (caoyuanzhi)]

The issue is still exist.

[Christian Ehrhardt  (paelzer)]

Hi,
sorry to ask but it is an important detail - do you mean it still exists when you test with the ppa that I provided?
It has the fix you suggested - so we would need more if that is the case.

Further even being not at high prio I fixed an issue around libvirt-lxc in the latest uploads to the devel release. TL;DR on that was that it was actually a new systemd that was needed (bug 1702823).

I'll also take a look to recreate your case later today, but the info if your "still exists" was with the ppa or not is important.

[Christian Ehrhardt  (paelzer)]

I have a very trivial lxc-vm (just a shell)
lxc-vm.xml
<domain type='lxc'>
    <name>lxc-vm</name>
    <memory unit='KiB'>1048576</memory>
    <os>
        <type>exe</type>
        <init>/bin/sh</init>
    </os>
    <devices>
        <console type='pty'/>
    </devices>
</domain>

On the host that looks like:
14209 - Sl ? 0:00 /usr/lib/libvirt/libvirt_lxc --name lxc-vm --console 24 --security=apparmor
--handshake 28
14212 - Ss ? 0:00 \_ /bin/sh

I can start more from inside the shell it still exists when I drop out
(enter with virsh console and exit with the console exit key binding).

Once I virsh delete the libvirt-lxc container all processes it owned are gone.
Please can you:
1. retry with and without the ppa I provided
2. grab a full console log while you do so including your libvirt xml and post it here?

[Christian Ehrhardt  (paelzer)]

Hi, sorry but since I can't reproduce (even without the ppa to test) I can't continue on a fix for now.
Please come back once you found the time to check
1. the ppa I provided for your case (since there are newer versions you need to force install that version from the ppa [1])
2. On the error case as I outlined it doesn't reproduce for me, please describe your case more in Detail and provide the full console log while it triggers. (We will need the steps to reproduce anyway if we eventually want to push to Xenial via SRU)

Until then I consider this timed out and set invalid, please set back to new once you found the time to provide the extra data.

[1]: https://askubuntu.com/questions/92019/how-to-install-specific-ubuntu-packages-with-exact-version