Skip to content

fix(supervisor): terminate orphaned non-main processes when ssh connection drops (#4946) - #5009

Closed
Mohit20057 wants to merge 1 commit into
NVIDIA:mainfrom
Mohit20057:fix/4946-terminate-orphan-ssh-processes/Mohit20057
Closed

Mohit20057 wants to merge 1 commit into
NVIDIA:mainfrom
Mohit20057:fix/4946-terminate-orphan-ssh-processes/Mohit20057

Conversation

@Mohit20057

Copy link
Copy Markdown

Summary

Fixes an issue where unexpectedly dropped SSH connections (client process kill, network loss, laptop sleep) leave behind orphan shell and exec processes in the sandbox boundary. Over time, these orphaned processes accumulated until subsequent exec requests failed.

Related Issue

Closes #4946

Changes

  • Updated SshHandler::drop in crates/openshell-supervisor-process/src/ssh.rs to iterate over active channels and asynchronously terminate any lingering non-main processes (state.process.take()).
  • Unconditionally clean up input tasks for all dropped channels.
  • Preserved the reconnectable canonical MainSession attachment semantics so main sessions survive client disconnects.
  • Added a regression test dropped_ssh_session_terminates_in_flight_exec in exec_input_tests.rs.

Release Notes

Terminate orphaned in-boundary exec and shell processes when an SSH connection severs unexpectedly, preventing sandbox resource exhaustion.

Testing

  • Checks appropriate to the affected code and behavior pass
  • Unit tests added/updated (if applicable)
  • E2E tests added/updated (if applicable)

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)
  • Architecture docs updated (if applicable)

…ction drops

When an SSH connection drops abruptly (e.g. client killed, network drop, or client computer sleeping), channels are dropped without russh invoking channel_close. Previously, SshHandler::drop only detached the main session and ignored non-main processes stored in ChannelState.process.

This caused active shell and exec processes to remain running inside the sandbox boundary reparented to PID 1, eventually accumulating until subsequent exec requests failed with 'failed to start boundary exec'.

Update SshHandler::drop to iterate over all active channels, clean up pending input tasks, and asynchronously terminate any lingering non-main boundary processes while preserving the reconnectable main session.

Closes NVIDIA#4946

Signed-off-by: Mohit20057 <mohitnehete6@gmail.com>
@github-actions

Copy link
Copy Markdown

Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:


I have read the DCO document and I hereby sign the DCO.


You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot.

@copy-pr-bot

copy-pr-bot Bot commented Oct 28, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@github-actions

Copy link
Copy Markdown

Thank you for your interest in contributing to OpenShell, @Mohit20057.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

  1. Open a Vouch Request discussion.
  2. Describe what you want to change and why.
  3. Write in your own words — do not have an AI generate the request.
  4. A maintainer will comment /vouch if approved.
  5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

@github-actions github-actions Bot closed this Oct 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Dropped SSH sessions leave running shells, too many orphan shells block new SSH sessions

1 participant