Signal in the pre-start window leaks the LXC firewall chain, because lxc-stop -k exits 2 when the container is not running

[dhoehna]

lxc-stop -k exits 2 when the container is not running, so a signal before start aborts the rollback in src/backends/lxc/common/src/signal_cleanup.rs and leaves the firewall chain installed.

[github-actions]

Triage complete.

• Labels applied: OS-Linux, Container-Process, Area-Executor-LXC
• Assigned: @SohamDas2021 (Linux / LXC owner)

This issue describes a potential firewall chain leak in src/backends/lxc/common/src/signal_cleanup.rs where a signal delivered in the pre-start window may cause RemoveFirewall to be skipped if lxc-stop -k returns failure on a never-started container.

Maintainers: Comment /investigate to check whether this issue or bug is valid against the most current code. Copilot will also produce a report with the changes that will be needed. For a small, unambiguous documentation or test fix, it may also create one draft PR.

Generated by 🏷️ Issue Triage for #895 · sonnet46 · 17.4 AIC · ⌖ 5.4 AIC · ⊞ 7.4K · ◷

[dhoehna]

Consolidated into #898 -- [LXC] Firewall teardown and rollback report success while leaving state behind.

The backlog now carries one issue per area instead of one per finding. This report is reproduced there in full and unedited; nothing here is dropped. Track and fix it at #898.