mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-15 17:11:30 +00:00
Josh Siviour
eb53dc3396
* fix: reap orphaned nbdkit processes recovery cannot adopt recoverMountedVolumes already rebuilds MountedVolumes from surviving nbdkit processes, but an unadoptable backend (buildVB fails, most commonly a deleted volume) or a duplicate corroborated process for an already-adopted volume was logged and left running forever, with no later pass reconsidering it. Reap both classes, but only when a scan of every other process's /proc/<pid>/cmdline on the host finds no reference to the backend's NBD endpoint -- its socket path, or its 127.0.0.1:<port> pair, checked both joined and split across server.host=/server.port=. A referencing process, or a scan that could not complete, both leave the process running and log loudly instead, since signalling the wrong process destroys a running guest's data path. * fix: treat an unreadable /proc candidate as inconclusive, not absent endpointReferencer skipped any os.ReadFile failure on a candidate's cmdline, which silently counted a read it could not perform as evidence the candidate does not reference the endpoint. Under a /proc mounted with hidepid, a guest QEMU owned by another uid is invisible this way, so an in-use backend could be reaped. Only os.IsNotExist (the candidate exited between ReadDir and the read) continues the scan. Any other error now returns non-nil from endpointReferencer, which reapOrphanedNbdkit already treats as an inconclusive scan: leave the process running, log at WARN. * fix: stop orphan nbdkit reaping from killing live backends under hidepid=invisible hidepid=invisible hides another uid's /proc/<pid> directory entry outright, not just its contents, so a live QEMU referencer (owned by spinifex-daemon) never appeared in viperblockd's scan at all -- a clean "no referencer" result that was actually just a hidden one. reapOrphanedNbdkit now detects the hazardous mount via /proc/self/mountinfo and declines to reap rather than trust a scan that could be blind to a live guest. spinifex-viperblock.service drops ProtectProc=invisible (now default, same tradeoff already accepted by spinifex-qmp-collector.service) so the scan can actually see spinifex-daemon's processes again once it's safe to trust.