Make ContainerCreateTimeout configurable at runtime handler level #9499

snir911 · 2025-10-05T13:27:55Z

This allows different runtime handlers to have different container creation timeouts,
useful for VM-based runtimes that may need longer timeouts than OCI runtimes.

What type of PR is this?

/kind feature

What this PR does / why we need it:

Fixes #9151 and additional minor fixes

Which issue(s) this PR fixes:

Fixes #9151

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Added `container_create_timeout` option to control timeout duration of container creation

openshift-ci · 2025-10-05T13:28:08Z

Hi @snir911. Thanks for your PR.

I'm waiting for a cri-o member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

codecov · 2025-10-05T13:34:29Z

Codecov Report

❌ Patch coverage is 37.20930% with 27 lines in your changes missing coverage. Please review.
✅ Project coverage is 66.97%. Comparing base (7a2820a) to head (a0408f0).
⚠️ Report is 18 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9499      +/-   ##
==========================================
- Coverage   67.04%   66.97%   -0.08%     
==========================================
  Files         202      202              
  Lines       28159    28255      +96     
==========================================
+ Hits        18880    18924      +44     
- Misses       7702     7739      +37     
- Partials     1577     1592      +15

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

This allows different runtime handlers to have different container creation timeouts, useful for VM-based runtimes that may need longer timeouts than OCI runtimes. Signed-off-by: Snir Schreiber <ssheribe@redhat.com> Fixes: cri-o#9151

Previously, r.task.Create() used r.ctx (background context) which had no timeout, this may cause the goroutine to continue running even after the select timeout was reached. Signed-off-by: Snir Schreiber <ssheribe@redhat.com>

Signed-off-by: Snir Schreiber <ssheribe@redhat.com>

This eliminates duplication and makes the struct cleaner with a single source of truth for configuration values from the handler. Signed-off-by: Snir Schreiber <ssheribe@redhat.com>

- Add container_create_timeout to crio.conf.5.md man page documentation - Add container_create_timeout to configuration template in template.go Signed-off-by: Snir Schreiber <ssheribe@redhat.com>

- Add ValidateContainerCreateTimeout unit tests covering: * Default timeout when not configured (240s) * Valid configured timeout values * Minimum timeout enforcement (30s) * Zero and negative value handling * Large timeout values * Different timeouts per runtime handler Fixes: cri-o#9151 Signed-off-by: Snir Schreiber <ssheribe@redhat.com>

fidencio · 2025-10-09T11:21:37Z

@snir911, what happens when the ContainerCreateTimeout is set to, let's say, 600 (10 minutes), but kubelet's runtimeRequestTimeout is lower than that?

What I think that would happen is that kubelet's runtimeRequestTimeout would be the value respected in this case, which makes me think it's at least worth it adding to the documentation that the value set here depends also on the kubelet's value.

snir911 · 2025-10-09T12:45:24Z

That's right, I'll mention it, thanks @fidencio !

littlejawa

Thanks @snir911 !

openshift-ci · 2025-10-09T14:24:42Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: littlejawa, snir911
Once this PR has been reviewed and has the lgtm label, please assign mrunalp for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

bitoku · 2025-10-10T13:43:21Z

/ok-to-test

bitoku · 2025-10-10T13:45:26Z

docs/crio.conf.5.md

 If that is also not specified, then the internal default seccomp profile will be used.

+**container_create_timeout**=240
+The timeout for container creation operations in seconds. If not set, defaults to 240 seconds. If set to a value less than 30 seconds, it will be automatically adjusted to 30 seconds (the minimum allowed value). This allows different runtime handlers to have different container creation timeouts, which is useful for VM-based runtimes that may need longer timeouts than OCI runtimes.


I want it to mention about runtimeRequestTimeout in kubelet, and its document link if any.

bitoku · 2025-10-10T13:46:26Z

internal/oci/runtime_vm.go

 	}

-	containerIO, err := r.createContainerIO(ctx, c, cio.WithNewFIFOs(r.fifoDir, c.terminal, c.stdin))
+	containerIO, err := r.createContainerIO(ctx, c, cio.WithNewFIFOs(filepath.Join(r.handler.RuntimeRoot, "crio", "fifo"), c.terminal, c.stdin))


Let's make a function to create this fifo path.

bitoku · 2025-10-10T14:54:05Z

/release-note-edit

Added `container_create_timeout` option to control timeout duration of container creation

openshift-ci · 2025-10-10T14:54:08Z

@bitoku: /release-note-edit must be used with a single release note block.

In response to this:

/release-note-edit

Added `container_create_timeout` option to control timeout duration of container creation

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2025-10-10T16:43:52Z

@snir911: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/ci-e2e	`a0408f0`	link	true	`/test ci-e2e`
ci/prow/e2e-gcp-ovn	`a0408f0`	link	true	`/test e2e-gcp-ovn`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Oct 5, 2025

snir911 force-pushed the 9151 branch from c197064 to 87f0d80 Compare October 5, 2025 13:51

snir911 added 6 commits October 9, 2025 12:11

Add context timeout to task.Create in runtime_vm.go

67d7e39

Previously, r.task.Create() used r.ctx (background context) which had no timeout, this may cause the goroutine to continue running even after the select timeout was reached. Signed-off-by: Snir Schreiber <ssheribe@redhat.com>

Improve returned error text at CreateContainer failure

28a8ad5

Signed-off-by: Snir Schreiber <ssheribe@redhat.com>

Simplify runtimeVM struct by removing redundant fields

d727fb6

This eliminates duplication and makes the struct cleaner with a single source of truth for configuration values from the handler. Signed-off-by: Snir Schreiber <ssheribe@redhat.com>

Add documentation for container_create_timeout configuration option

b932a5b

- Add container_create_timeout to crio.conf.5.md man page documentation - Add container_create_timeout to configuration template in template.go Signed-off-by: Snir Schreiber <ssheribe@redhat.com>

snir911 force-pushed the 9151 branch from f74dbd0 to a0408f0 Compare October 9, 2025 09:13

snir911 marked this pull request as ready for review October 9, 2025 10:33

snir911 requested review from fidencio and mrunalp as code owners October 9, 2025 10:33

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 9, 2025

openshift-ci bot requested review from QiWang19 and hasan4791 October 9, 2025 10:33

littlejawa approved these changes Oct 9, 2025

View reviewed changes

openshift-ci bot assigned littlejawa Oct 9, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 9, 2025

openshift-ci bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Oct 10, 2025

bitoku reviewed Oct 10, 2025

View reviewed changes

openshift-ci bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Oct 10, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Make ContainerCreateTimeout configurable at runtime handler level #9499

Make ContainerCreateTimeout configurable at runtime handler level #9499

snir911 commented Oct 5, 2025 •

edited by bitoku

Loading

Uh oh!

openshift-ci bot commented Oct 5, 2025

Uh oh!

codecov bot commented Oct 5, 2025 •

edited

Loading

Uh oh!

fidencio commented Oct 9, 2025

Uh oh!

snir911 commented Oct 9, 2025

Uh oh!

littlejawa left a comment

Uh oh!

openshift-ci bot commented Oct 9, 2025

Uh oh!

bitoku commented Oct 10, 2025

Uh oh!

bitoku Oct 10, 2025

Uh oh!

bitoku Oct 10, 2025

Uh oh!

bitoku commented Oct 10, 2025

Uh oh!

openshift-ci bot commented Oct 10, 2025

Uh oh!

openshift-ci bot commented Oct 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Make ContainerCreateTimeout configurable at runtime handler level #9499

Are you sure you want to change the base?

Make ContainerCreateTimeout configurable at runtime handler level #9499

Conversation

snir911 commented Oct 5, 2025 • edited by bitoku Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Uh oh!

openshift-ci bot commented Oct 5, 2025

Uh oh!

codecov bot commented Oct 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

fidencio commented Oct 9, 2025

Uh oh!

snir911 commented Oct 9, 2025

Uh oh!

littlejawa left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Oct 9, 2025

Uh oh!

bitoku commented Oct 10, 2025

Uh oh!

bitoku Oct 10, 2025

Choose a reason for hiding this comment

Uh oh!

bitoku Oct 10, 2025

Choose a reason for hiding this comment

Uh oh!

bitoku commented Oct 10, 2025

Uh oh!

openshift-ci bot commented Oct 10, 2025

Uh oh!

openshift-ci bot commented Oct 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

snir911 commented Oct 5, 2025 •

edited by bitoku

Loading

codecov bot commented Oct 5, 2025 •

edited

Loading