From ae30a5cad24925d2aec232d31fb390aa2c77d1ff Mon Sep 17 00:00:00 2001 From: crawfordxx Date: Tue, 23 Jun 2026 12:07:39 +0800 Subject: [PATCH] cri: reject CreateContainer when sandbox is not running Before this fix, CreateContainer would proceed even if the sandbox had already stopped or was in an unknown state. This could result in containers being created in an unusable sandbox, leading to confusing errors downstream. StartContainer already guards with the same check: if sandbox.Status.Get().State != sandboxstore.StateReady { return nil, fmt.Errorf("sandbox container %q is not running", ...) } Apply the identical guard in CreateContainer, immediately after the sandbox state is known, so that callers receive a clear error instead of a partial container object. Fixes #13599 Signed-off-by: crawfordxx --- internal/cri/server/container_create.go | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/internal/cri/server/container_create.go b/internal/cri/server/container_create.go index 963740d3f0..40f34d499f 100644 --- a/internal/cri/server/container_create.go +++ b/internal/cri/server/container_create.go @@ -43,7 +43,7 @@ import ( crilabels "github.com/containerd/containerd/v2/internal/cri/labels" customopts "github.com/containerd/containerd/v2/internal/cri/opts" containerstore "github.com/containerd/containerd/v2/internal/cri/store/container" - "github.com/containerd/containerd/v2/internal/cri/store/sandbox" + sandboxstore "github.com/containerd/containerd/v2/internal/cri/store/sandbox" "github.com/containerd/containerd/v2/internal/cri/util" "github.com/containerd/containerd/v2/internal/registrar" "github.com/containerd/containerd/v2/pkg/blockio" @@ -76,6 +76,9 @@ func (c *criService) CreateContainer(ctx context.Context, r *runtime.CreateConta sandboxID = cstatus.SandboxID sandboxPid = cstatus.Pid ) + if sandbox.Status.Get().State != sandboxstore.StateReady { + return nil, fmt.Errorf("sandbox container %q is not running", sandboxID) + } span.SetAttributes( tracing.Attribute("sandbox.id", sandboxID), tracing.Attribute("sandbox.pid", sandboxPid), @@ -215,7 +218,7 @@ func (c *criService) CreateContainer(ctx context.Context, r *runtime.CreateConta type createContainerRequest struct { ctx context.Context containerID string - sandbox *sandbox.Sandbox + sandbox *sandboxstore.Sandbox sandboxID string imageID string containerConfig *runtime.ContainerConfig