From 7c4059c8a835873a69e8654ae99ea12659eef4e8 Mon Sep 17 00:00:00 2001 From: rahul05ranjan <11793455+rahul05ranjan@users.noreply.github.com> Date: Wed, 28 Oct 2026 10:03:02 +0530 Subject: [PATCH] fix(start): stop the container when a poststart hook fails Per the OCI runtime spec, a failing poststart hook must stop the container and continue with the delete transition (runtime.md, lifecycle step 9). The previous error path returned from startUnikontainer without stopping the monitor, so the guest kept running, state.json still reported running and a plain urunc delete refused with 'cannot delete running container'. Mirror what delete --force already does in this situation and stop the monitor via unikontainer.Kill(), so a failed start reaches the same stopped state a killed container has. Fixes #1172 Co-authored-by: rahul05ranjan <11793455+rahul05ranjan@users.noreply.github.com> Signed-off-by: rahul05ranjan <11793455+rahul05ranjan@users.noreply.github.com> --- cmd/urunc/start.go | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/cmd/urunc/start.go b/cmd/urunc/start.go index 51e15dd45..a70c42a66 100644 --- a/cmd/urunc/start.go +++ b/cmd/urunc/start.go @@ -101,7 +101,18 @@ func startUnikontainer(cmd *cli.Command) error { return err } - return unikontainer.ExecuteHooks("Poststart") + if err := unikontainer.ExecuteHooks("Poststart"); err != nil { + // The spec requires a failing poststart hook to stop the container and + // continue with the delete transition (runtime.md, lifecycle step 9). + // The monitor keeps the guest alive otherwise, and a plain delete + // refuses while the container's init process still runs. + if killErr := unikontainer.Kill(); killErr != nil { + return errors.Join(err, fmt.Errorf("failed to stop the container after a failing poststart hook: %w", killErr)) + } + return err + } + + return nil } // startMonitorInit starts the urunc monitor process, blocked since create from