-pass-fd does not allow specifying container descriptors 1 or 2

[stepancheg]

Description

Open a file descriptor:

$ exec 9> ~/9
$ cat ~/9

(empty as expected)

Passing file descriptor 5, works correctly:

$ runsc exec -pass-fd 9:5 my-container-id sh -c 'echo test 5 >&5'
$ cat ~/9
test 5

Passing file descriptor 2: identical command, but 2 instead of 5:

$ runsc exec -pass-fd 9:2 my-container-id sh -c 'echo test 2 >&2'
test 2
$ cat ~/9
test 5

Stderr is forwarded to runsc stderr rather than into provided file descriptor.

Update: the last command is actually flaky: in about 1 in 20 invocations redirect actually happens.

Use case

Separate error messages from the runsc itself, and from the process inside the container. For example, one can be shown in UI, and another only sent to logs.

Is this feature related to a specific bug?

No response

Do you have a specific solution in mind?

Either:

• make redirect of descriptors 1, 2 work, or
• explicitly error early to make it clear to a user this is not meant to work

[EtiennePerot]

I believe runsc exec uses FD 1 and 2 from its own invocation. So runsc exec my-container-id sh -c 'echo test 2 >&2' 2>&9 would do the trick (although from my testing this is actually flaky...)
Is the bug suggesting that this behavior should be ignored when -pass-fd is specified for FDs 1 and 2?

[stepancheg]

Incorrect comment, deleted.

[stepancheg]

although from my testing this is actually flaky

Flaky on my machine too.

But also I don't understand what is going on there. This command you posted is not supposed to print anything to stderr, because we have redirected the stderr of outer command to 9.

[stepancheg]

It is even funnier. The command I mentioned initially

runsc exec -pass-fd 9:2 my-container-id sh -c 'echo test 2 >&2'

in about 1 in 20 invocations actually does redirect container stderr into the descriptor 9 (does not print into stderr, but output gets into the file).

[stepancheg]

The issue about non-determinism: #11350.

[stepancheg]

I think this issue is a duplicate of #11350, because redirect -pass-fd 9:2 works properly if stdin is redirected as < /dev/null:

runsc exec -pass-fd 9:2 my-container-id sh -c 'echo test 3 >&2' < /dev/null

This command 100% of time redirects to a provided descriptor.