Hacktoberfest 2026：維護者為十月標記出來的 issue，仍然開放、適合新手。 瀏覽 Hacktoberfest issue

Closed TCP listening socket stays in LISTEN inside the sandbox until another bind on the same port

未關閉
  • 哪裡不對？
#4,331 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

還沒有人認領這個 Issue。

評估

難度
4/5
預估耗時
3-5 天
新手友好度
55/100
Issue 類型
缺陷
描述清晰度
描述清楚
活躍度
活躍
技術堆疊
docker, rust
領域
networking

研究方向

Start in crates/openshell-sandbox/src/network_broker.rs, especially collect_closed_socket_entries and the broker's descriptor handling after listen; also check the behavior introduced by #4150. Reproduce using the supplied sandbox steps, then verify that closing or exiting a listener removes it from /proc/net/tcp and connections fail with connection refused.

由索引模型根據 Issue 內容生成。

描述

state:triage-needed
User Story

I use OpenShell to run coding agents that start a local web server inside the sandbox and run browser tests against it.
I directly encountered a listening port that stays open after the server that owned it has closed it and exited.
This makes it look as if a server is still running on that port when nothing is.

Problem Statement

Inside a sandbox, when a workload closes a TCP listening socket (or the process that owns it exits), the socket does not go away. It stays in LISTEN on the same address and port:

  • /proc/net/tcp (and ss -ltn) still lists it.
  • No process in the sandbox owns it.
  • A client that connects is accepted by the kernel but never gets a response.

It goes away only when something else in the sandbox binds the same port. A later bind + listen on that port succeeds, and the stale entry disappears at that moment.

For maintainers: the network broker keeps its own descriptor for every brokered socket. It only reclaims descriptors for closed sockets when a bind hits EADDRINUSE, or when the registry or descriptor budget fills up (collect_closed_socket_entries in crates/openshell-sandbox/src/network_broker.rs). Since #4150, accept no longer goes through the broker, so the broker may not need to keep a listening socket's descriptor after listen succeeds. We have not tested that change.

Impact / Why This Matters
  • Health checks and port probes that run after a server stops see a port that still accepts connections but never answers. They wait for their timeout instead of failing fast.
  • Tools that check for leftover processes or ports after a test run report a listener that no process owns, which is confusing to debug.
  • Workaround today: after the server stops, bind the same port from a socket that never listens (for example, a connect from 127.0.0.1:<port> to a closed port). The bind makes the stale entry go away.
Acceptance Criteria
  • After a workload closes a listening socket, the address and port no longer show as LISTEN in the sandbox.
  • After the process that owns a listening socket exits, the address and port no longer show as LISTEN in the sandbox.
  • Connecting to that port after it is closed fails with connection refused, as it would outside the sandbox.
Reproduction Steps
  1. Create a sandbox with the default image and policy:
    openshell sandbox create --name listen-repro -- sleep infinity
  2. Open a listener on 127.0.0.1:4400, close it, then check whether the port is still listening and whether a connection gets an answer: 
    openshell sandbox exec --name listen-repro -- bash -c '
perl -MIO::Socket::INET -e '\''my $s = IO::Socket::INET->new(LocalAddr => "127.0.0.1", LocalPort => 4400, Listen => 5, ReuseAddr => 1) or die "listen: $!"; close $s; print "listener closed\n"'\''
sleep 3
grep -q ":1130 00000000:0000 0A" /proc/net/tcp && echo "127.0.0.1:4400 still LISTEN" || echo "gone"
perl -MIO::Socket::INET -e '\''my $c = IO::Socket::INET->new(PeerAddr => "127.0.0.1:4400", Timeout => 2); print $c ? "connect: accepted by kernel\n" : "connect failed: $!\n"; if ($c) { $c->blocking(0); sleep 2; my $n = sysread($c, my $b, 1); print defined $n ? "read $n bytes\n" : "no response\n" }'\''
'
  3. Expected: gone, then connect failed: Connection refused.
    Actual: 127.0.0.1:4400 still LISTEN, then connect: accepted by kernel and no response.

The same happens when the owning process exits without closing the socket, and with listeners written in other languages (Node.js net.Server behaves the same way).

Environment
  • OpenShell: 0.1.2 (openshell --version)
  • OS: macOS 27.0.1 on Apple silicon (arm64)
  • Deployment: local gateway, Docker Desktop 29.8.2 (Linux kernel 7.0.14-linuxkit), default sandbox image (Ubuntu 24.04.5 LTS), default policy
  • Not tested on v0.1.3-pre.6, but the reclaim logic in network_broker.rs looks the same there and on main.
Logs
listener closed
127.0.0.1:4400 still LISTEN
connect: accepted by kernel
no response
主要語言
Rust
星號
15.4k
分支
1.7k
平均合併
1 天 21 小時
30 天內合併 PR
366

環境準備

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

NVIDIA/OpenShell 的其他 Issue

查看 NVIDIA/OpenShell 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。