Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Closed TCP listening socket stays in LISTEN inside the sandbox until another bind on the same port

Offen
  • Stimmt etwas nicht?
#4,331 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
55/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
docker, rust
Bereich
networking

Rechercherichtung

Start in crates/openshell-sandbox/src/network_broker.rs, especially collect_closed_socket_entries and the broker's descriptor handling after listen; also check the behavior introduced by #4150. Reproduce using the supplied sandbox steps, then verify that closing or exiting a listener removes it from /proc/net/tcp and connections fail with connection refused.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

state:triage-needed
User Story

I use OpenShell to run coding agents that start a local web server inside the sandbox and run browser tests against it.
I directly encountered a listening port that stays open after the server that owned it has closed it and exited.
This makes it look as if a server is still running on that port when nothing is.

Problem Statement

Inside a sandbox, when a workload closes a TCP listening socket (or the process that owns it exits), the socket does not go away. It stays in LISTEN on the same address and port:

  • /proc/net/tcp (and ss -ltn) still lists it.
  • No process in the sandbox owns it.
  • A client that connects is accepted by the kernel but never gets a response.

It goes away only when something else in the sandbox binds the same port. A later bind + listen on that port succeeds, and the stale entry disappears at that moment.

For maintainers: the network broker keeps its own descriptor for every brokered socket. It only reclaims descriptors for closed sockets when a bind hits EADDRINUSE, or when the registry or descriptor budget fills up (collect_closed_socket_entries in crates/openshell-sandbox/src/network_broker.rs). Since #4150, accept no longer goes through the broker, so the broker may not need to keep a listening socket's descriptor after listen succeeds. We have not tested that change.

Impact / Why This Matters
  • Health checks and port probes that run after a server stops see a port that still accepts connections but never answers. They wait for their timeout instead of failing fast.
  • Tools that check for leftover processes or ports after a test run report a listener that no process owns, which is confusing to debug.
  • Workaround today: after the server stops, bind the same port from a socket that never listens (for example, a connect from 127.0.0.1:<port> to a closed port). The bind makes the stale entry go away.
Acceptance Criteria
  • After a workload closes a listening socket, the address and port no longer show as LISTEN in the sandbox.
  • After the process that owns a listening socket exits, the address and port no longer show as LISTEN in the sandbox.
  • Connecting to that port after it is closed fails with connection refused, as it would outside the sandbox.
Reproduction Steps
  1. Create a sandbox with the default image and policy:
    openshell sandbox create --name listen-repro -- sleep infinity
  2. Open a listener on 127.0.0.1:4400, close it, then check whether the port is still listening and whether a connection gets an answer: 
    openshell sandbox exec --name listen-repro -- bash -c '
perl -MIO::Socket::INET -e '\''my $s = IO::Socket::INET->new(LocalAddr => "127.0.0.1", LocalPort => 4400, Listen => 5, ReuseAddr => 1) or die "listen: $!"; close $s; print "listener closed\n"'\''
sleep 3
grep -q ":1130 00000000:0000 0A" /proc/net/tcp && echo "127.0.0.1:4400 still LISTEN" || echo "gone"
perl -MIO::Socket::INET -e '\''my $c = IO::Socket::INET->new(PeerAddr => "127.0.0.1:4400", Timeout => 2); print $c ? "connect: accepted by kernel\n" : "connect failed: $!\n"; if ($c) { $c->blocking(0); sleep 2; my $n = sysread($c, my $b, 1); print defined $n ? "read $n bytes\n" : "no response\n" }'\''
'
  3. Expected: gone, then connect failed: Connection refused.
    Actual: 127.0.0.1:4400 still LISTEN, then connect: accepted by kernel and no response.

The same happens when the owning process exits without closing the socket, and with listeners written in other languages (Node.js net.Server behaves the same way).

Environment
  • OpenShell: 0.1.2 (openshell --version)
  • OS: macOS 27.0.1 on Apple silicon (arm64)
  • Deployment: local gateway, Docker Desktop 29.8.2 (Linux kernel 7.0.14-linuxkit), default sandbox image (Ubuntu 24.04.5 LTS), default policy
  • Not tested on v0.1.3-pre.6, but the reclaim logic in network_broker.rs looks the same there and on main.
Logs
listener closed
127.0.0.1:4400 still LISTEN
connect: accepted by kernel
no response
Vorherrschende Sprache
Rust
Sterne
15.4k
Forks
1.7k
Ø Merge
1 T. 21 Std.
Gemergte PRs (30 T.)
366

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus NVIDIA/OpenShell

Alle Issues in NVIDIA/OpenShell

Ähnliche Issues

Weitere Issues zu Rust

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.