Seamless upgrade procedure

[arun2arunraj]

hi @AkihiroSuda / @cyphar ,

What would be the upgrade procedure for the runc binary (only) in the procedure. We are running mission critical workload in production. Looking for seemless upgrade / graceful migration on the container process which has been initiated by the runc binary( version upgrade).

NOTE : Source version 1.0.2 to the Destination version 1.1.12.

Option 1 :

Override the binary forcefully. We believe it would make some impact to the running containers which makes any syscalls from the applications.

cp -rdp <SOURCE>/runc /usr/bin/runc

Option 2 :

unlink the symlink of runc and forcefully replace the binary file in parallel. Unsure whether it would make any impact to the live process which has been triggered during the upgrade.

unlink /bin/runc && cp -rdp /opt/runc /usr/bin/runc

[cyphar]

(When used with Docker/containerd/cri-o/podman) runc does not have any long-running process, so replacing the binary has no impact on existing containers.

I wouldn't do option 2 because it will remove a symlink that other services on the system might depend on. Just replace the binary.

---

In addition, on Linux open files (including executables mapped for running processes) are kept around even after being unlinked until they are no longer used (and executable data is mapped using MAP_PRIVATE so a running process will never see a change in its mapped executable memory even if the underlying data changes), so even for long-running daemons replacing the running binary shouldn't matter (unless they're doing something weird).