Repository navigation
--cidfile fails if file exists even if empty #5954
Description
Description
The best practice when creating a temporary file is not only to generate a filename of a file that does not already exist, but also to create/open the file with O_EXCL, to avoid TOCTOU, typically that's what mkstemp(3) does.
Unfortunately, docker-run's --cidfile prevents from passing it a safe temporary file, because docker-run will fail if the given file merely exists.
Reproduce
t=$(mktemp)
docker run --rm --cidfile=$t debian
Expected behavior
docker-run should fail only if the file given as --cidfile contains a PID (even better, check if the PID is alive by using kill(the_pid, 0) which is designed for that)
docker version
Client:
Version: 20.10.24+dfsg1
API version: 1.41
Go version: go1.19.8
Git commit: 297e128
Built: Sat Oct 12 15:19:49 2024
OS/Arch: linux/amd64
Context: default
Experimental: true
Server:
Engine:
Version: 20.10.5+dfsg1
API version: 1.41 (minimum version 1.12)
Go version: go1.15.15
Git commit: 363e9a8
Built: Mon May 30 18:34:49 2022
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: 1.6.20~ds1
GitCommit: 1.6.20~ds1-1+deb12u1
runc:
Version: 1.1.5+ds1
GitCommit: 1.1.5+ds1-1+deb12u1
docker-init:
Version: 0.19.0
GitCommit:docker info
too much identifying infoAdditional Info
No response
Activity
nbiswal1 commentedon Mar 23, 2025
Hello @hydrargyrum ,
I would like to work on this bug.
thaJeztah commentedon Mar 23, 2025
Note that this file contains the container ID (not a PID); on
docker run, it contains the ID that was generated after the container is created (as part of thedocker run)hydrargyrum commentedon Mar 23, 2025
@thaJeztah indeed, that part about using
kill()is completely mistaken (but it's still possible to check if the container is alive, if desired)feat(10-04): rewrite ensure_image + run_cell + main with taxonomy + c…
locker95 commentedon Aug 25, 2026
took a look — empty files from mktemp should be fine, so I opened #7239