Skip to content

runtime: allow delete of a created container - #1324

Merged
kolyshkin merged 1 commit into
opencontainers:mainfrom
kolyshkin:delete-created
Oct 11, 2026
Merged

runtime: allow delete of a created container#1324
kolyshkin merged 1 commit into
opencontainers:mainfrom
kolyshkin:delete-created

Conversation

@kolyshkin

@kolyshkin kolyshkin commented Oct 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Since before runtime-spec v1.0.0, both runc and crun implement delete of a container in the created state by terminating the container process and then deleting the container, rather than generating an error.

Relax the spec to allow this behavior, while keeping the current one (generating an error) valid as well. Deleting a container in any state other than created or stopped still MUST generate an error.

See also:

giuseppe
giuseppe approved these changes Oct 9, 2026
View reviewed changes

@giuseppe giuseppe left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@kolyshkin kolyshkin mentioned this pull request Oct 10, 2026
Merged
utam0k
utam0k approved these changes Oct 10, 2026
View reviewed changes

@utam0k utam0k left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. We should also update runtime-tools to reflect this change. The current test requires deleting a container in the created state to fail.
https://github.com/opencontainers/runtime-tools/blob/8a4db579f5c88af5a0d036fad34bddc9c1f703f3/validation/delete/delete.go#L51-L80

@AkihiroSuda AkihiroSuda added this to the v1.3.1 milestone Oct 10, 2026
thaJeztah
thaJeztah reviewed Oct 11, 2026
View reviewed changes
Comment thread runtime.md Outdated
This operation MUST [generate an error](#errors) if it is not provided the container ID.
Attempting to `delete` a container that is not [`stopped`](#state) MUST have no effect on the container and MUST [generate an error](#errors).
Attempting to `delete` a container that is neither [`created`](#state) nor [`stopped`](#state) MUST have no effect on the container and MUST [generate an error](#errors).
Attempting to `delete` a container that is [`created`](#state) MAY either have no effect on the container and [generate an error](#errors), or stop the container and then delete it.

@thaJeztah thaJeztah Oct 11, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I got confused for a bit because created in Moby means "no processes running", but in the OCI runtime, I guess in this stage, the init process may be present.

Wondering if it should be more explicit, e.g.

When deleting a container in the created state, the runtime MAY terminate the container's init process and then delete the container.

@kolyshkin kolyshkin Oct 11, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure about the terminology here. What we have in created container is, strictly speaking, not container's init yet, but rather "proto-init" (runc init or something, which just waits to exec the real container init). It is "init" in a sense that it's PID is 1 inside a container, but not "init" by any other means (not what's specified in spec nor what is expected by a user).

Referring to that proto-init as init it makes it less clear to me (☝🏻 "but hey, there's no init yet at this stage").

@kolyshkin kolyshkin Oct 11, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(wrote a comment and lost it; trying to recreate a short version)

in other parts of spec (definition of "created") it is called "container process" so I'm following the trend.

thaJeztah
thaJeztah approved these changes Oct 11, 2026
View reviewed changes

@thaJeztah thaJeztah left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

overall LGTM, but left a suggestion for consideration.

@thaJeztah

thaJeztah commented Oct 11, 2026

Copy link
Copy Markdown
Member

Looks like GolangCi-lint needs an update in this repository;

run golangci-lint
  Running [/home/runner/golangci-lint-2.10.1-linux-amd64/golangci-lint config path] in [/home/runner/work/runtime-spec/runtime-spec] ...
  Running [/home/runner/golangci-lint-2.10.1-linux-amd64/golangci-lint run] in [/home/runner/work/runtime-spec/runtime-spec] ...
  Error: can't load config: the Go language version (go1.26) used to build golangci-lint is lower than the targeted Go version (1.27.2)
  The command is terminated due to an error: can't load config: the Go language version (go1.26) used to build golangci-lint is lower than the targeted Go version (1.27.2)

@kolyshkin
runtime: allow delete of a created container
ed05122 
Since before runtime-spec v1.0.0, both runc and crun implement `delete`
of a container in the `created` state by terminating the container
process and then deleting the container, rather than generating an error.

This is useful in practice, since a container which was created but
never started can not otherwise reach the `stopped` state without an
explicit `kill`.

Relax the spec to allow this behavior, while keeping the current one
(generating an error) valid as well.

Deleting a container in any state other than `created` or `stopped`
still MUST generate an error.

See also: opencontainers/runc#1774

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
@kolyshkin
kolyshkin merged commit fbb4178 into opencontainers:main Oct 11, 2026
3 of 6 checks passed
@kolyshkin kolyshkin mentioned this pull request Oct 11, 2026
Merged
@kolyshkin

kolyshkin commented Oct 11, 2026

Copy link
Copy Markdown
Contributor Author

Looks like GolangCi-lint needs an update in this repository;

run golangci-lint
  Running [/home/runner/golangci-lint-2.10.1-linux-amd64/golangci-lint config path] in [/home/runner/work/runtime-spec/runtime-spec] ...
  Running [/home/runner/golangci-lint-2.10.1-linux-amd64/golangci-lint run] in [/home/runner/work/runtime-spec/runtime-spec] ...
  Error: can't load config: the Go language version (go1.26) used to build golangci-lint is lower than the targeted Go version (1.27.2)
  The command is terminated due to an error: can't load config: the Go language version (go1.26) used to build golangci-lint is lower than the targeted Go version (1.27.2)

Opened #1325 and #1326

kolyshkin added a commit to kolyshkin/runtime-tools that referenced this pull request Oct 11, 2026
@kolyshkin
validation/delete: allow delete of a created container
475d7a6 
Since runtime-spec PR #1324, attempting to delete a container in the
created state MAY either have no effect and generate an error (as
before), or terminate the container process and delete the container
(as runc and crun do).

Add a new DeleteCreatedNoEffectOrDelete spec error code, and modify
the delete test so that the created case passes in either of the two
cases. Update DeleteNonStop* comments and messages accordingly.

See opencontainers/runtime-spec#1324

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
@kolyshkin kolyshkin mentioned this pull request Oct 11, 2026
Merged
@kolyshkin

kolyshkin commented Oct 11, 2026

Copy link
Copy Markdown
Contributor Author

LGTM. We should also update runtime-tools to reflect this change. The current test requires deleting a container in the created state to fail. https://github.com/opencontainers/runtime-tools/blob/8a4db579f5c88af5a0d036fad34bddc9c1f703f3/validation/delete/delete.go#L51-L80

Opened opencontainers/runtime-tools#817

@kolyshkin kolyshkin mentioned this pull request Oct 16, 2026
Closed
kolyshkin added a commit to kolyshkin/runtime-tools that referenced this pull request Oct 17, 2026
@kolyshkin
validation/delete: allow delete of a created container
414f50c 
Since runtime-spec PR #1324, attempting to delete a container in the
created state MAY either have no effect and generate an error (as
before), or terminate the container process and delete the container
(as runc and crun do).

Add a new DeleteCreatedNoEffectOrDelete spec error code, and modify
the delete test so that the created case passes in either of the two
cases. Update DeleteNonStop* comments and messages accordingly.

See opencontainers/runtime-spec#1324

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@giuseppe giuseppe giuseppe approved these changes
@thaJeztah thaJeztah thaJeztah approved these changes
@AkihiroSuda AkihiroSuda AkihiroSuda approved these changes
@utam0k utam0k utam0k approved these changes
@crosbymichael crosbymichael Awaiting requested review from crosbymichael crosbymichael is a code owner
@cyphar cyphar Awaiting requested review from cyphar cyphar is a code owner
@dqminh dqminh Awaiting requested review from dqminh dqminh is a code owner
@hqhq hqhq Awaiting requested review from hqhq hqhq is a code owner
@mrunalp mrunalp Awaiting requested review from mrunalp mrunalp is a code owner
@tianon tianon Awaiting requested review from tianon tianon is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

v1.3.1

Development

Successfully merging this pull request may close these issues.

5 participants

@kolyshkin @thaJeztah @giuseppe @AkihiroSuda @utam0k