feat: replace OCI hook networking with inline CNI calls - #443
Draft
ayush-panta wants to merge 18 commits into
Draft
feat: replace OCI hook networking with inline CNI calls#443ayush-panta wants to merge 18 commits into
ayush-panta wants to merge 18 commits into
Conversation
ayush-panta
changed the title
ayush-panta
force-pushed
the
feat/hookless-networking
branch
8 times, most recently
from
April 30, 2026 21:42
3bc32d1 to
9467e26
Compare
ayush-panta
force-pushed
the
feat/hookless-networking
branch
from
May 19, 2026 18:40
9467e26 to
7c6a040
Compare
ayush-panta
force-pushed
the
feat/hookless-networking
branch
from
June 1, 2026 15:24
7c6a040 to
db603ca
Compare
ayush-panta
marked this pull request as ready for review
June 22, 2026 22:46
ayush-panta
marked this pull request as draft
June 22, 2026 22:46
ayush-panta
force-pushed
the
feat/hookless-networking
branch
7 times, most recently
from
June 23, 2026 23:22
c608572 to
7187eae
Compare
ayush-panta
force-pushed
the
feat/hookless-networking
branch
4 times, most recently
from
June 24, 2026 06:44
6705a20 to
088534e
Compare
ayush-panta
force-pushed
the
feat/hookless-networking
branch
from
June 29, 2026 17:16
c01afaa to
e3b582f
Compare
Signed-off-by: ayush-panta <ayushkp@amazon.com>
Signed-off-by: ayush-panta <ayushkp@amazon.com>
Signed-off-by: ayush-panta <ayushkp@amazon.com>
Signed-off-by: ayush-panta <ayushkp@amazon.com>
Signed-off-by: ayush-panta <ayushkp@amazon.com>
Signed-off-by: ayush-panta <ayushkp@amazon.com>
Signed-off-by: ayush-panta <ayushkp@amazon.com>
Add --log-cli-level=DEBUG to pytest invocations for invoke and start-lambda tests to capture SAM CLI internal timing during test failures. Signed-off-by: ayush-panta <ayushkp@amazon.com>
When a container is force-removed while an attach stream is following logs, the task exit channel (waitCh) may never fire because the task is already deleted. This causes the attach connection to hang until the client times out. Subscribe to containerd's container delete event as a fallback signal to stop the log viewer immediately when the container is removed. Signed-off-by: ayush-panta <ayushkp@amazon.com>
When a container is force-removed, ocihook.Run("postStop") fails at
hostsstore.Release because RemoveContainer already deleted the files.
This causes the function to return early, never killing the port
reserver process. The port reserver holds host port sockets open,
causing clients connected to those ports to hang indefinitely.
Add fallback to manually kill the port-reserver process via its pid
file when postStop fails. Also revert debug logging flags from CI
test scripts.
Signed-off-by: ayush-panta <ayushkp@amazon.com>
Move killPortReserver call to before runPostStop in watchPostStop. runPostStop acquires a mutex and runs the full ocihook.Run which can be slow under contention. Killing the port reserver first ensures clients connected to the container's mapped ports get an immediate connection reset rather than hanging until the full teardown completes. Signed-off-by: ayush-panta <ayushkp@amazon.com>
Add killPortReserver call in the Remove() handler after container removal completes. The async postStop watcher's task.Wait() can be delayed 10+ seconds under load, leaving port reservers alive and causing clients to hang or port conflicts on the next container. Also add removeCh fallback in attach handler to stop the log viewer promptly when a container is force-removed before task.Wait() fires. Re-enable SAM_DEBUG for CI diagnostic visibility. Signed-off-by: ayush-panta <ayushkp@amazon.com>
…apture Signed-off-by: ayush-panta <ayushkp@amazon.com>
Add millisecond-level timing to customStart and Remove for diagnosing flaky failures under load. Restore full test suite (remove filters). Signed-off-by: ayush-panta <ayushkp@amazon.com>
Move ocihook.Run("createRuntime") from the container Start path to the
Create path. This eliminates ~200ms latency from Start, which caused
durable Lambda execution tests to fail due to timing-sensitive event
ordering in the emulator.
At Create time:
- Pre-create a named network namespace (/var/run/netns/<id>)
- Set the nerdctl/network-namespace label on the container
- Call ocihook.Run with PID=0 (uses netns annotation, not /proc/pid)
At Start time:
- Read the netns annotation from container labels
- Set spec.Linux.Namespaces[network].Path to join the pre-created netns
- Skip setupNetworking (already done)
- Container unpauses instantly with networking ready
At Remove time:
- Clean up the pre-created netns (umount + remove)
Signed-off-by: ayush-panta <ayushkp@amazon.com>
This reverts commit 088534e. Signed-off-by: ayush-panta <ayushkp@amazon.com>
Pin the durable functions emulator to v1.1.1 to avoid upstream event ordering regression in the latest image. SAM CLI unpinned this in v1.162.0 (#9054) and their own CI is now failing the same way. Signed-off-by: ayush-panta <ayushkp@amazon.com>
Apply upstream fix from aws/aws-sam-cli#9097 — the emulator now reports WaitForCallback instead of RunInChildContext. This patch can be removed once a new SAM CLI release includes the fix. Signed-off-by: ayush-panta <ayushkp@amazon.com>
ayush-panta
force-pushed
the
feat/hookless-networking
branch
from
June 30, 2026 19:12
e3b582f to
0bf581e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue #, if available:
Description of changes:
Testing done:
License Acceptance
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.