Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

Closed TCP listening socket stays in LISTEN inside the sandbox until another bind on the same port

Aberta
  • Algo errado?
#4,331 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
4/5
Tempo estimado
3-5 dias
Facilidade para iniciantes
55/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
docker, rust
Domínio
networking

Direção de pesquisa

Start in crates/openshell-sandbox/src/network_broker.rs, especially collect_closed_socket_entries and the broker's descriptor handling after listen; also check the behavior introduced by #4150. Reproduce using the supplied sandbox steps, then verify that closing or exiting a listener removes it from /proc/net/tcp and connections fail with connection refused.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

state:triage-needed
User Story

I use OpenShell to run coding agents that start a local web server inside the sandbox and run browser tests against it.
I directly encountered a listening port that stays open after the server that owned it has closed it and exited.
This makes it look as if a server is still running on that port when nothing is.

Problem Statement

Inside a sandbox, when a workload closes a TCP listening socket (or the process that owns it exits), the socket does not go away. It stays in LISTEN on the same address and port:

  • /proc/net/tcp (and ss -ltn) still lists it.
  • No process in the sandbox owns it.
  • A client that connects is accepted by the kernel but never gets a response.

It goes away only when something else in the sandbox binds the same port. A later bind + listen on that port succeeds, and the stale entry disappears at that moment.

For maintainers: the network broker keeps its own descriptor for every brokered socket. It only reclaims descriptors for closed sockets when a bind hits EADDRINUSE, or when the registry or descriptor budget fills up (collect_closed_socket_entries in crates/openshell-sandbox/src/network_broker.rs). Since #4150, accept no longer goes through the broker, so the broker may not need to keep a listening socket's descriptor after listen succeeds. We have not tested that change.

Impact / Why This Matters
  • Health checks and port probes that run after a server stops see a port that still accepts connections but never answers. They wait for their timeout instead of failing fast.
  • Tools that check for leftover processes or ports after a test run report a listener that no process owns, which is confusing to debug.
  • Workaround today: after the server stops, bind the same port from a socket that never listens (for example, a connect from 127.0.0.1:<port> to a closed port). The bind makes the stale entry go away.
Acceptance Criteria
  • After a workload closes a listening socket, the address and port no longer show as LISTEN in the sandbox.
  • After the process that owns a listening socket exits, the address and port no longer show as LISTEN in the sandbox.
  • Connecting to that port after it is closed fails with connection refused, as it would outside the sandbox.
Reproduction Steps
  1. Create a sandbox with the default image and policy:
    openshell sandbox create --name listen-repro -- sleep infinity
  2. Open a listener on 127.0.0.1:4400, close it, then check whether the port is still listening and whether a connection gets an answer: 
    openshell sandbox exec --name listen-repro -- bash -c '
perl -MIO::Socket::INET -e '\''my $s = IO::Socket::INET->new(LocalAddr => "127.0.0.1", LocalPort => 4400, Listen => 5, ReuseAddr => 1) or die "listen: $!"; close $s; print "listener closed\n"'\''
sleep 3
grep -q ":1130 00000000:0000 0A" /proc/net/tcp && echo "127.0.0.1:4400 still LISTEN" || echo "gone"
perl -MIO::Socket::INET -e '\''my $c = IO::Socket::INET->new(PeerAddr => "127.0.0.1:4400", Timeout => 2); print $c ? "connect: accepted by kernel\n" : "connect failed: $!\n"; if ($c) { $c->blocking(0); sleep 2; my $n = sysread($c, my $b, 1); print defined $n ? "read $n bytes\n" : "no response\n" }'\''
'
  3. Expected: gone, then connect failed: Connection refused.
    Actual: 127.0.0.1:4400 still LISTEN, then connect: accepted by kernel and no response.

The same happens when the owning process exits without closing the socket, and with listeners written in other languages (Node.js net.Server behaves the same way).

Environment
  • OpenShell: 0.1.2 (openshell --version)
  • OS: macOS 27.0.1 on Apple silicon (arm64)
  • Deployment: local gateway, Docker Desktop 29.8.2 (Linux kernel 7.0.14-linuxkit), default sandbox image (Ubuntu 24.04.5 LTS), default policy
  • Not tested on v0.1.3-pre.6, but the reclaim logic in network_broker.rs looks the same there and on main.
Logs
listener closed
127.0.0.1:4400 still LISTEN
connect: accepted by kernel
no response
Linguagem predominante
Rust
Estrelas
15.4k
Forks
1.7k
Merge médio
1d 21h
PRs com merge (30d)
358

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de NVIDIA/OpenShell

Todas as issues de NVIDIA/OpenShell

Issues semelhantes

Mais issues de Rust

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.