Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Closed TCP listening socket stays in LISTEN inside the sandbox until another bind on the same port

Aperta
  • Qualcosa non va?
#4,331 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
55/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
docker, rust
Ambito
networking

Direzione di ricerca

Start in crates/openshell-sandbox/src/network_broker.rs, especially collect_closed_socket_entries and the broker's descriptor handling after listen; also check the behavior introduced by #4150. Reproduce using the supplied sandbox steps, then verify that closing or exiting a listener removes it from /proc/net/tcp and connections fail with connection refused.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

state:triage-needed
User Story

I use OpenShell to run coding agents that start a local web server inside the sandbox and run browser tests against it.
I directly encountered a listening port that stays open after the server that owned it has closed it and exited.
This makes it look as if a server is still running on that port when nothing is.

Problem Statement

Inside a sandbox, when a workload closes a TCP listening socket (or the process that owns it exits), the socket does not go away. It stays in LISTEN on the same address and port:

  • /proc/net/tcp (and ss -ltn) still lists it.
  • No process in the sandbox owns it.
  • A client that connects is accepted by the kernel but never gets a response.

It goes away only when something else in the sandbox binds the same port. A later bind + listen on that port succeeds, and the stale entry disappears at that moment.

For maintainers: the network broker keeps its own descriptor for every brokered socket. It only reclaims descriptors for closed sockets when a bind hits EADDRINUSE, or when the registry or descriptor budget fills up (collect_closed_socket_entries in crates/openshell-sandbox/src/network_broker.rs). Since #4150, accept no longer goes through the broker, so the broker may not need to keep a listening socket's descriptor after listen succeeds. We have not tested that change.

Impact / Why This Matters
  • Health checks and port probes that run after a server stops see a port that still accepts connections but never answers. They wait for their timeout instead of failing fast.
  • Tools that check for leftover processes or ports after a test run report a listener that no process owns, which is confusing to debug.
  • Workaround today: after the server stops, bind the same port from a socket that never listens (for example, a connect from 127.0.0.1:<port> to a closed port). The bind makes the stale entry go away.
Acceptance Criteria
  • After a workload closes a listening socket, the address and port no longer show as LISTEN in the sandbox.
  • After the process that owns a listening socket exits, the address and port no longer show as LISTEN in the sandbox.
  • Connecting to that port after it is closed fails with connection refused, as it would outside the sandbox.
Reproduction Steps
  1. Create a sandbox with the default image and policy:
    openshell sandbox create --name listen-repro -- sleep infinity
  2. Open a listener on 127.0.0.1:4400, close it, then check whether the port is still listening and whether a connection gets an answer: 
    openshell sandbox exec --name listen-repro -- bash -c '
perl -MIO::Socket::INET -e '\''my $s = IO::Socket::INET->new(LocalAddr => "127.0.0.1", LocalPort => 4400, Listen => 5, ReuseAddr => 1) or die "listen: $!"; close $s; print "listener closed\n"'\''
sleep 3
grep -q ":1130 00000000:0000 0A" /proc/net/tcp && echo "127.0.0.1:4400 still LISTEN" || echo "gone"
perl -MIO::Socket::INET -e '\''my $c = IO::Socket::INET->new(PeerAddr => "127.0.0.1:4400", Timeout => 2); print $c ? "connect: accepted by kernel\n" : "connect failed: $!\n"; if ($c) { $c->blocking(0); sleep 2; my $n = sysread($c, my $b, 1); print defined $n ? "read $n bytes\n" : "no response\n" }'\''
'
  3. Expected: gone, then connect failed: Connection refused.
    Actual: 127.0.0.1:4400 still LISTEN, then connect: accepted by kernel and no response.

The same happens when the owning process exits without closing the socket, and with listeners written in other languages (Node.js net.Server behaves the same way).

Environment
  • OpenShell: 0.1.2 (openshell --version)
  • OS: macOS 27.0.1 on Apple silicon (arm64)
  • Deployment: local gateway, Docker Desktop 29.8.2 (Linux kernel 7.0.14-linuxkit), default sandbox image (Ubuntu 24.04.5 LTS), default policy
  • Not tested on v0.1.3-pre.6, but the reclaim logic in network_broker.rs looks the same there and on main.
Logs
listener closed
127.0.0.1:4400 still LISTEN
connect: accepted by kernel
no response
Lingua principale
Rust
Stelle
15.4k
Fork
1.7k
Merge medio
1g 19h
PR unite (30g)
347

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di NVIDIA/OpenShell

Tutte le issue di NVIDIA/OpenShell

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.