LXC state-aware silently adopts an existing container when a generated name collides

[dhoehna]

What

When a request carries no containerId, resolve_container_name mints one:

src/backends/lxc/common/src/state_aware.rs:104-107

if request.container_id.is_empty() {
    return Ok(format!("mxc-{}", mint_random_token()));
}

mint_random_token (id.rs:20-23) is 4 bytes, so 8 hex characters -- 32 bits.

provision then treats an existing container of that name as a success:

src/backends/lxc/common/src/state_aware.rs:479-487

let created = !container.is_defined();
if created {
    container.create(..)?;
}

So a generated name that collides with an existing container is silently
adopted: provision returns Ok with created: false, and the caller
believes it owns a fresh container it did not create.

Why it matters

Adoption is intentional and documented for a user-supplied id
(lxc_bindings.rs:615) -- the caller named that container, so reattaching to it
is the useful behavior. An auto-generated name carries the opposite intent:
the caller asked for a new container and has no way to know it was handed
someone else's. Both take the identical branch today.

Fix

Have the generated-name path retry rather than adopt: mint, check is_defined,
mint again on collision, and fail after a small bounded number of attempts.
Roughly 10-15 lines, confined to the container_id.is_empty() branch.

Note that MAX_CONTAINER_NAME_LEN = 20 (state_aware.rs:84) is enforced only
for user-supplied ids, and mxc- plus 16 hex characters is 20, so widening the
token would also fit. Keep that out of this fix -- mint_random_token lives
in id.rs and is shared across backends, so widening it is a separate change
with a wider blast radius. Retry-not-adopt is correct on its own and does not
depend on the entropy question.

Provenance

Reported by Copilot on PR #849, verified live against that PR's HEAD. Held out
of the PR deliberately: it changes provision's success semantics, which warrants
its own review.

[github-actions]

Triage complete.

• Labels applied: OS-Linux, Container-Process, Area-Executor-LXC
• Assigned: @SohamDas2021 (LXC / Linux backend owner)

The bug is in src/backends/lxc/common/src/state_aware.rs — the auto-generated container name path takes the same "adopt existing" branch as user-supplied IDs, which is incorrect. The fix is confined to the container_id.is_empty() branch (retry-on-collision instead of adopt).

Maintainers: Comment /investigate to check whether this issue or bug is valid against the most current code. Copilot will also produce a report with the changes that will be needed. For a small, unambiguous documentation or test fix, it may also create one draft PR.

Generated by 🏷️ Issue Triage for #865 · sonnet46 · 18.9 AIC · ⌖ 5.41 AIC · ⊞ 7.4K · ◷

[dhoehna]

Fixed in PR #849, commit 4e5933d. This was filed as a deferral; that deferral was withdrawn and the defect is fixed in the PR itself. The commit carries a Closes #865 trailer, so this closes when #849 merges rather than now -- the fix is not landed until then.

[dhoehna]

Consolidated into #899 -- [LXC] State-aware lifecycle: provision, adopt, and config-rewrite races.

The backlog now carries one issue per area instead of one per finding. This report is reproduced there in full and unedited; nothing here is dropped. Track and fix it at #899.