feat: support for --sig-proxy in run

Signed-off-by: CodeChanning <chxgaddy@amazon.com>

cmd/nerdctl/container_run.go

@@ -79,6 +79,7 @@ func setCreateFlags(cmd *cobra.Command) {
 	cmd.Flags().Bool("help", false, "show help")
 
 	cmd.Flags().BoolP("tty", "t", false, "Allocate a pseudo-TTY")
+	cmd.Flags().Bool("sig-proxy", true, "Allow signal proxying")
 	cmd.Flags().BoolP("interactive", "i", false, "Keep STDIN open even if not attached")
 	cmd.Flags().String("restart", "no", `Restart policy to apply when a container exits (implemented values: "no"|"always|on-failure:n|unless-stopped")`)
 	cmd.RegisterFlagCompletionFunc("restart", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
@@ -287,10 +288,19 @@ func processCreateCommandFlagsInRun(cmd *cobra.Command) (opt types.ContainerCrea
 
 	opt.InRun = true
 
+	opt.SigProxy, err = cmd.Flags().GetBool("sig-proxy")
+	if err != nil {
+		return
+	}
+
 	opt.Interactive, err = cmd.Flags().GetBool("interactive")
 	if err != nil {
 		return
 	}
+	opt.SigProxy, err = cmd.Flags().GetBool("sig-proxy")
+	if err != nil {
+		return
+	}
 	opt.Detach, err = cmd.Flags().GetBool("detach")
 	if err != nil {
 		return
@@ -394,8 +404,10 @@ func runAction(cmd *cobra.Command, args []string) error {
 			log.L.WithError(err).Error("console resize")
 		}
 	} else {
-		sigC := signalutil.ForwardAllSignals(ctx, task)
-		defer signalutil.StopCatch(sigC)
+		if createOpt.SigProxy {
+			sigC := signalutil.ForwardAllSignals(ctx, task)
+			defer signalutil.StopCatch(sigC)
+		}
 	}
 
 	statusC, err := task.Wait(ctx)

cmd/nerdctl/container_run_linux_test.go

@@ -29,6 +29,7 @@ import (
 	"runtime"
 	"strconv"
 	"strings"
+	"syscall"
 	"testing"
 	"time"
 
@@ -311,6 +312,61 @@ func TestRunTTY(t *testing.T) {
 	assert.Equal(t, 0, res.ExitCode, res.Combined())
 }
 
+func TestRunSigProxyDefault(t *testing.T) {
+	t.Parallel()
+	base := testutil.NewBase(t)
+	testContainerName := testutil.Identifier(t)
+	defer base.Cmd("rm", "-f", testContainerName).Run()
+
+	process := base.Cmd("run", "--name", testContainerName, testutil.CommonImage, "sh", "-c", testutil.SigProxyTestScript).Start()
+
+	// This sleep waits for until we reach the trap command in the shell script, if sigint is send before that we dont enter the while loop.
+	time.Sleep(1 * time.Second)
+
+	syscall.Kill(process.Cmd.Process.Pid, syscall.SIGINT)
+	process.Cmd.Wait()
+	assert.Assert(base.T, strings.Contains(process.Stdout(), "got sigint"), fmt.Sprintf("expected output to contain %q: %q", "got sigint", process.Stdout()))
+
+	process.Cmd.Wait()
+}
+
+func TestRunSigProxyTrue(t *testing.T) {
+	t.Parallel()
+	base := testutil.NewBase(t)
+	testContainerName := testutil.Identifier(t)
+	defer base.Cmd("rm", "-f", testContainerName).Run()
+
+	process := base.Cmd("run", "--sig-proxy=true", "--name", testContainerName, testutil.CommonImage, "sh", "-c", testutil.SigProxyTestScript).Start()
+
+	// This sleep waits for until we reach the trap command in the shell script, if sigint is send before that we dont enter the while loop.
+	time.Sleep(1 * time.Second)
+
+	syscall.Kill(process.Cmd.Process.Pid, syscall.SIGINT)
+	process.Cmd.Wait()
+	assert.Assert(base.T, strings.Contains(process.Stdout(), "got sigint"), fmt.Sprintf("expected output to contain %q: %q", "got sigint", process.Stdout()))
+
+	process.Cmd.Wait()
+}
+
+func TestRunSigProxyFalse(t *testing.T) {
+	t.Parallel()
+	base := testutil.NewBase(t)
+	testContainerName := testutil.Identifier(t)
+	defer base.Cmd("rm", "-f", testContainerName).Run()
+
+	process := base.Cmd("run", "--sig-proxy=false", "--name", testContainerName, testutil.CommonImage, "sh", "-c", testutil.SigProxyTestScript).Start()
+
+	// This sleep waits for until we reach the trap command in the shell script, if sigint is send before that we dont enter the while loop.
+	time.Sleep(1 * time.Second)
+
+	syscall.Kill(process.Cmd.Process.Pid, syscall.SIGINT)
+	process.Cmd.Wait()
+	assert.Assert(base.T, !strings.Contains(process.Stdout(), "got sigint"), fmt.Sprintf("expected output to contain %q: %q", "got sigint", process.Stdout()))
+
+	process.Cmd.Wait()
+
+}
+
 func TestRunWithFluentdLogDriver(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		t.Skip("fluentd log driver is not yet implemented on Windows")

docs/command-reference.md

@@ -388,7 +388,7 @@ IPFS flags:
 Unimplemented `docker run` flags:
     `--attach`, `--blkio-weight-device`, `--cpu-rt-*`, `--device-*`,
     `--disable-content-trust`, `--domainname`, `--expose`, `--health-*`, `--isolation`, `--no-healthcheck`,
-    `--link*`, `--mac-address`, `--publish-all`, `--sig-proxy`, `--storage-opt`,
+    `--link*`, `--mac-address`, `--publish-all`, `--storage-opt`,
     `--userns`, `--volume-driver`
 
 ### :whale: :blue_square: nerdctl exec

pkg/api/types/container_types.go

@@ -60,6 +60,8 @@ type ContainerCreateOptions struct {
 	// #region for basic flags
 	// Interactive keep STDIN open even if not attached
 	Interactive bool
+	// SigProxy specifies whether to proxy all received signals to the process
+	SigProxy bool
 	// TTY specifies whether to allocate a pseudo-TTY for the container
 	TTY bool
 	// Detach runs container in background and print container ID
@@ -394,6 +396,8 @@ type ContainerAttachOptions struct {
 	GOptions GlobalCommandOptions
 	// DetachKeys is the key sequences to detach from the container.
 	DetachKeys string
+	// SigProxy specifies whether to proxy all received signals to the process
+	SigProxy bool
 }
 
 // ContainerExecOptions specifies options for `nerdctl (container) exec`

pkg/composer/run.go

@@ -45,6 +45,7 @@ type RunOptions struct {
 	Detach       bool
 	NoDeps       bool
 	Tty          bool
+	SigProxy     bool
 	Interactive  bool
 	Rm           bool
 	User         string

pkg/testutil/testutil.go

@@ -350,6 +350,11 @@ func (c *Cmd) Run() *icmd.Result {
 	return icmd.RunCmd(c.Cmd)
 }
 
+func (c *Cmd) Start() *icmd.Result {
+	c.Base.T.Helper()
+	return icmd.StartCmd(c.Cmd)
+}
+
 func (c *Cmd) CmdOption(cmdOptions ...func(*Cmd)) *Cmd {
 	for _, opt := range cmdOptions {
 		opt(c)

pkg/testutil/testutil_linux.go

@@ -56,6 +56,16 @@ var (
 	// It should be "connection refused" as per the TCP RFC.
 	// https://www.rfc-editor.org/rfc/rfc793
 	ExpectedConnectionRefusedError = "connection refused"
+
+	SigProxyTestScript = `#!/bin/sh
+	set -eu
+	trap 'quit=1' INT
+	quit=0
+	while [ $quit -ne 1 ]; do
+		echo "wait"
+		sleep 1
+	done
+	printf "got sigint"`
 )
 
 const (