mirror of
https://github.com/moby/buildkit.git
synced 2026-10-28 16:44:37 +08:00
Joao Otavio ManieriandClaude Opus 5.5
eac3279c43
In NoProcessSandbox mode the build container runs in the PID namespace
of buildkitd, so a process that a step leaves running in the background
is not killed when the step ends. runc still creates a new session
keyring for every container, and each leftover process keeps that
keyring alive. Each of them takes one key from the per-user quota of the
daemon user (kernel.keys.maxkeys, 200 by default for non-root). Once the
quota is used up, every new container fails with:
unable to join session keyring: unable to create session key: disk
quota exceeded
Restarting buildkitd ends the leftover processes and frees the keys, so
long-running rootless daemons hit this again after some days.
Run runc with --no-new-keyring in this mode, so the build containers
use the session keyring of buildkitd. They already share the PID
namespace and procfs with the daemon, and runc treats the per-container
keyring as best-effort isolation, so this removes nothing the mode
provides. ProcessSandbox mode is unchanged.
Fixes #7310
Refs #6247
Signed-off-by: Joao Otavio Manieri <69759037+JoaoManierii@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>