Orphan-reaper for kai-server: reap PPID-1 container payloads holding stale locks #316

Open
opened 2026-06-12 11:20:02 +00:00 by coilysiren · 0 comments
Owner

Mitigation 3 from #311. The disease is deterministic so the cure scripts cleanly: find PPID-1 processes whose cgroup maps to no live pod, confirm they hold the contested lock, kill them, delete the crashlooped pods. Two deployment shapes that leave k3s config untouched: a privileged hostPID DaemonSet shipped as a manifest from this repo, or a standalone orphan-reaper.service systemd unit ordered After=k3s.service (separate unit, not a drop-in). Durable-state workloads (VictoriaMetrics, ClickHouse) need this; scratch-state workloads are covered by the init-wipe ticket instead.

Mitigation 3 from #311. The disease is deterministic so the cure scripts cleanly: find PPID-1 processes whose cgroup maps to no live pod, confirm they hold the contested lock, kill them, delete the crashlooped pods. Two deployment shapes that leave k3s config untouched: a privileged hostPID DaemonSet shipped as a manifest from this repo, or a standalone orphan-reaper.service systemd unit ordered After=k3s.service (separate unit, not a drop-in). Durable-state workloads (VictoriaMetrics, ClickHouse) need this; scratch-state workloads are covered by the init-wipe ticket instead.
coilysiren added
P2
and removed
P1
labels 2026-06-17 08:39:25 +00:00
coilyco-ops added
P2
and removed
P3
labels 2026-07-10 09:00:11 +00:00
Sign in to join this conversation.
No description provided.