Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Closed TCP listening socket stays in LISTEN inside the sandbox until another bind on the same port

Ouverte
  • Quelque chose ne va pas ?
#4,331 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
55/100
Type d'issue
Bug
Clarté
Clairement spécifiée
Activité
Active
Stack technique
docker, rust
Domaine
networking

Piste de recherche

Start in crates/openshell-sandbox/src/network_broker.rs, especially collect_closed_socket_entries and the broker's descriptor handling after listen; also check the behavior introduced by #4150. Reproduce using the supplied sandbox steps, then verify that closing or exiting a listener removes it from /proc/net/tcp and connections fail with connection refused.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

state:triage-needed
User Story

I use OpenShell to run coding agents that start a local web server inside the sandbox and run browser tests against it.
I directly encountered a listening port that stays open after the server that owned it has closed it and exited.
This makes it look as if a server is still running on that port when nothing is.

Problem Statement

Inside a sandbox, when a workload closes a TCP listening socket (or the process that owns it exits), the socket does not go away. It stays in LISTEN on the same address and port:

  • /proc/net/tcp (and ss -ltn) still lists it.
  • No process in the sandbox owns it.
  • A client that connects is accepted by the kernel but never gets a response.

It goes away only when something else in the sandbox binds the same port. A later bind + listen on that port succeeds, and the stale entry disappears at that moment.

For maintainers: the network broker keeps its own descriptor for every brokered socket. It only reclaims descriptors for closed sockets when a bind hits EADDRINUSE, or when the registry or descriptor budget fills up (collect_closed_socket_entries in crates/openshell-sandbox/src/network_broker.rs). Since #4150, accept no longer goes through the broker, so the broker may not need to keep a listening socket's descriptor after listen succeeds. We have not tested that change.

Impact / Why This Matters
  • Health checks and port probes that run after a server stops see a port that still accepts connections but never answers. They wait for their timeout instead of failing fast.
  • Tools that check for leftover processes or ports after a test run report a listener that no process owns, which is confusing to debug.
  • Workaround today: after the server stops, bind the same port from a socket that never listens (for example, a connect from 127.0.0.1:<port> to a closed port). The bind makes the stale entry go away.
Acceptance Criteria
  • After a workload closes a listening socket, the address and port no longer show as LISTEN in the sandbox.
  • After the process that owns a listening socket exits, the address and port no longer show as LISTEN in the sandbox.
  • Connecting to that port after it is closed fails with connection refused, as it would outside the sandbox.
Reproduction Steps
  1. Create a sandbox with the default image and policy:
    openshell sandbox create --name listen-repro -- sleep infinity
  2. Open a listener on 127.0.0.1:4400, close it, then check whether the port is still listening and whether a connection gets an answer: 
    openshell sandbox exec --name listen-repro -- bash -c '
perl -MIO::Socket::INET -e '\''my $s = IO::Socket::INET->new(LocalAddr => "127.0.0.1", LocalPort => 4400, Listen => 5, ReuseAddr => 1) or die "listen: $!"; close $s; print "listener closed\n"'\''
sleep 3
grep -q ":1130 00000000:0000 0A" /proc/net/tcp && echo "127.0.0.1:4400 still LISTEN" || echo "gone"
perl -MIO::Socket::INET -e '\''my $c = IO::Socket::INET->new(PeerAddr => "127.0.0.1:4400", Timeout => 2); print $c ? "connect: accepted by kernel\n" : "connect failed: $!\n"; if ($c) { $c->blocking(0); sleep 2; my $n = sysread($c, my $b, 1); print defined $n ? "read $n bytes\n" : "no response\n" }'\''
'
  3. Expected: gone, then connect failed: Connection refused.
    Actual: 127.0.0.1:4400 still LISTEN, then connect: accepted by kernel and no response.

The same happens when the owning process exits without closing the socket, and with listeners written in other languages (Node.js net.Server behaves the same way).

Environment
  • OpenShell: 0.1.2 (openshell --version)
  • OS: macOS 27.0.1 on Apple silicon (arm64)
  • Deployment: local gateway, Docker Desktop 29.8.2 (Linux kernel 7.0.14-linuxkit), default sandbox image (Ubuntu 24.04.5 LTS), default policy
  • Not tested on v0.1.3-pre.6, but the reclaim logic in network_broker.rs looks the same there and on main.
Logs
listener closed
127.0.0.1:4400 still LISTEN
connect: accepted by kernel
no response
Langage dominant
Rust
Étoiles
15.4k
Forks
1.7k
Merge moyen
1 j 21 h
PR mergées (30 j)
358

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de NVIDIA/OpenShell

Toutes les issues de NVIDIA/OpenShell

Issues similaires

Plus d'issues Rust

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.