child bwrap process is left as zombie

Open

#697 opened on Sep 1, 2025 5 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 48/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Quiet
Tech stack: c, docker, linux
Domain: operating-systems

Research direction

Start with the --unshare-pid path and reproduce the issue using the Docker commands and ps aux output described here. Trace how the child bwrap process is handled after the user command exits, then verify that the child is reaped and no [bwrap] zombie remains without an init process.

Written by the indexing model from the issue text.

Description

Hi! Apologies in advance if this isn't really a bug / my findings are wrong.

Bubblewrap clones itself to create a child, then clones again and exec's the user binary in this grandchild process.
I noticed that with --unshare-pid the parent doesn't wait() for the child, so the child is left as a zombie.

I think a fix would just look like waiting for this child, since we should be able to do that from outside the pid namespace(?).

Minimal reproduction (tested on arm64-darwin):

CONTAINER=$(docker run --privileged --detach alpine:3.22 sleep 10m)
docker exec $CONTAINER apk add bubblewrap
docker exec $CONTAINER bwrap --version
docker exec $CONTAINER bwrap --unshare-pid --dev-bind / / -- echo hi
docker exec $CONTAINER ps aux

This outputs

bubblewrap 0.11.0
hi
PID   USER     TIME  COMMAND
    1 root      0:00 sleep 10m
   27 root      0:00 [bwrap]            <- this is the zombie
   29 root      0:00 ps aux

Running without --unshare-pid the process is cleaned up fine.

This isn't causing problems for me - I only noticed it because my container didn't have an init process to reap this zombie child. The workaround was just to run with docker run --init to add an init process.

Dominant language: C
Stars: 8.8k
Forks: 387
Avg merge: 2d 18h
Merged PRs (30d): 17

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

if(cond,a,b) treats any nonzero cond as true in every bngsim backend (ExprTk interpreter, C codegen, SSA), which contradicts docs/reference/expressions.md ('true when > 0.5') and BNG's run_network. A non-boolean condition in (-inf,0) or... Open

bug

Difficulty 1/5 Under an hour Newbie friendliness 60/100

lanl/bngsim#774 · Opened Sep 23, 2026
Signed left-shift undefined behavior in `nbase/nbase_addrset.c` (`(1<<31)`, 4 sites) Open

Nmap

Difficulty 1/5 Under an hour Newbie friendliness 85/100

nmap/nmap#3514 · Opened Sep 23, 2026
[BUG] libcuml fails to build with -DCUML_ALGORITHMS=SVM (cuVS not linked) Open

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

NVIDIA/cuml#8705 · Opened Sep 23, 2026
Vulkan int8-coopmat matmul on RDNA3 (#27952): RX 7900 XTX 27B benchmark data + a small boundary-safety fix Open

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

ggml-org/llama.cpp#29342 · Opened Sep 23, 2026
[flang][cuda] CUFPredefinedVarToGPU crashes on a fir.copy whose destination is the predefined-variable declare Open

flang:fir-hlfir

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

llvm/llvm-project#225935 · Opened Sep 23, 2026

More C issues