Subprocess: Use pidfd (PIDFD_GET_INFO if supported) to monitor an imported process for exit status

[tomponline]

Makes process.Stop() wait for the process to exit when the process has been imported, the same as it does for when the process has been started and stopped from the same parent process.

This is related to #18918 which wraps virtiofsd in a userns (always) and requires that LXD waits for virtiofsd to stop (and the userns be cleared up) before the volume can be deleted.

[Copilot]

Pull request overview

Adds imported-process monitoring so Stop waits for termination, supporting safe virtiofsd cleanup after daemon restarts.

Changes:

• Adds pidfd-based Linux monitoring with portable fallback.
• Shares monitoring between spawned and imported processes.
• Adds imported-process wait and exit-code tests.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
lxd/subprocess/procwait_other.go	Adds polling fallback.
lxd/subprocess/procwait_linux.go	Adds pidfd monitoring and exit-status retrieval.
lxd/subprocess/proc.go	Introduces shared monitor lifecycle and safe persistence copy.
lxd/subprocess/manager.go	Starts monitors for live imported processes.
lxd/subprocess/bgpm_test.go	Adds imported-process monitoring tests.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Suppressed comments (4)

Previously missed (3) — in code that hasn't changed since the last review.

lxd/subprocess/proc.go:297

• The monitor-owned fields are all unexported, so YAML already ignores them and yaml.Marshal(p) cannot race on exitCode/exitErr. Manually duplicating every persisted field instead creates a second schema that can silently omit future exported fields. Keep marshaling the process directly unless a dedicated persisted type is needed for another reason.

	// Marshal a copy of only the persisted fields. Marshalling the live process would have yaml
	// read the whole struct (via reflect) and race with the monitor goroutine updating the
	// exit state. The excluded fields are not persisted anyway.
	saved := Process{
		Name:        p.Name,
		Args:        p.Args,
		Apparmor:    p.Apparmor,
		PID:         p.PID,
		BootID:      p.BootID,
		UID:         p.UID,
		GID:         p.GID,
		SetGroups:   p.SetGroups,
		StartTime:   p.StartTime,
		SysProcAttr: p.SysProcAttr,
	}

lxd/subprocess/procwait_other.go:12

• Use US English spelling: “canceled.”

// waitProcess blocks until the process identified by pid has exited, or ctx is cancelled.

lxd/subprocess/procwait_linux.go:55

• Use US English spelling: “canceled.”

// waitProcess blocks until the process identified by pid has exited, or ctx is cancelled.

lxd/subprocess/procwait_linux.go:116

• A readable pidfd only establishes that the task exited; PIDFD_INFO_EXIT is populated later when the parent reaps the task (pidfs_exit runs from release_task). Calling the ioctl once at POLLIN therefore races the parent and can return -1 on a kernel that supports exit info. Wait for/retry through the reaping transition, with a bounded policy so an unreaping parent cannot hang this monitor.

			if revents&unix.POLLIN != 0 {
				return pidfdExitCode(pidFd), nil