Maksym Pavlenko 16d7ff4f1a cmd: add containerd-sandbox-init ...

A minimal PID 1 for the PID namespace of a pod that shares it, run by
containerd-shim-sandboxed-runc-v2 in place of a pause container. It
stays alive so that the namespace does, ignores SIGCHLD so that the
kernel reaps the orphans reparented to it, and removes every signal
handler so that nothing sent from inside the pod can end it or run code
in it: the kernel drops a signal sent to the init of a PID namespace
when init has no handler for it. The Go runtime installs handlers for
almost every signal, including the synchronous faults, SIGPROF and the
signals 32 and 33 that os/signal cannot reset, so those go back to the
default disposition, or are ignored for the others, through
rt_sigaction. Only SIGKILL from the
parent namespace ends it. It makes itself non-dumpable, so that the
other processes of the pod can neither ptrace it nor open its /proc
entries without CAP_SYS_PTRACE. It runs with one P, no garbage
collector and parks in pause(2).

It is built static like the shims and installed with them.

Signed-off-by: Maksym Pavlenko <pavlenko.maksym@gmail.com>

2026-11-04 19:04:42 -08:00

..

main_test.go

cmd: add containerd-sandbox-init

2026-11-04 19:04:42 -08:00

main.go

cmd: add containerd-sandbox-init

2026-11-04 19:04:42 -08:00