Ayush Ranjan

To confirm this theory, could you configure runsc with `--directfs=false` and see if this issue reproduces?

Ah, my bad I missed that. Even with directfs=false, the [gofer donates a host file descriptor for regular files](https://cs.opensource.google/gvisor/gvisor/+/master:runsc/fsgofer/lisafs.go;l=504-505) to the sandbox (so that the sandbox can directly read/write to...

Can you check if this issue reproduces with `--ref-leak-mode=panic` (which should have the effect of forcing dentry cache cleanup)? Alternatively, you could also patch #9867 and try to repro.

> under the runsc-sandbox process, the actual processes of the container we've killed (i.e. the Python process) is still running Sorry if I am re-iterating what has already been discussed...

> but the sandbox with all the subprocesses is still running Just to clarify, the `[exe]` subprocesses you see under `runsc-sandbox` are **not** application processes. They are systrap stub processes....

Interesting, thanks for the investigation! We have internal tests which test exceeding the ephemeral storage limits in GKE with `overlay2=root:self` and the pod gets evicted by the kubelet. Happy to...

I have been trying to use the following GKE Reproducer: ``` $ gcloud container clusters create repro --num-nodes=1 --location=us-central1-a --cluster-version=1.28.3-gke.1203001 $ gcloud container node-pools create gvisor --cluster=repro --num-nodes=1 --location=us-central1-a --sandbox=type=gvisor...

No luck with the deployment OR using the latest runsc from master. > FWIW, both /run/containerd/io.containerd.runtime.v2.task/k8s.io/5b6ae772c71b57b0a00297b775a1900bcd30fcd9a6c8ccca2e49573829ae636f/rootfs and /run/containerd/io.containerd.runtime.v2.task/k8s.io/90022bca840ef2fac36200ae8f3511800e883f07558b146290c3b6a9822090b8/rootfs are empty on ls -l @markusthoemmes Could you check the stuck container's...

Actually, the other FDs shown [in this comment](https://github.com/google/gvisor/issues/9834#issuecomment-1877843580) are also from the container rootfs. They don't have the `/run/containerd/io.containerd.runtime.v2.task/k8s.io/5b6ae772c71b57b0a00297b775a1900bcd30fcd9a6c8ccca2e49573829ae636f/rootfs/` path prefix because they were opened after the rootfs was `pivot_root(2)`-ed....

> We have tested these patches by running examples from [cuda-samples](https://github.com/nvidia/cuda-samples)(vectorAdd, vectorAddDrv, matrixMul) > I am not sure if this requires more unittests to be merged. > Happy to add...