From 1bb9f2562eadce8ebc87fb0eb5724ebe7105ff86 Mon Sep 17 00:00:00 2001
From: Cyrill Troxler <cyrilltroxler@gmail.com>
Date: Sun, 21 Jun 2026 16:23:34 +0200
Subject: [PATCH] fix: do not clean pin path on activator stop

instead clean it only when the sandbox is deleted, e.g. mainly on pod removal.
---
 activator/activator.go       |  5 -----
 activator/bpf.go             |  4 ++--
 shim/task/service_zeropod.go | 30 ++++++++++++++++++++++++++++++
 3 files changed, 32 insertions(+), 7 deletions(-)

diff --git a/activator/activator.go b/activator/activator.go
index 4dfb4f3..aa55caa 100644
--- a/activator/activator.go
+++ b/activator/activator.go
@@ -207,11 +207,6 @@ func (s *Server) Stop(ctx context.Context) {
 		log.G(ctx).WithError(err).Error("closing bpf maps")
 	}
 
-	log.G(ctx).Debugf("removing %s", PinPath(s.sandboxPid))
-	if err := cleanPinPath(s.sandboxPid); err != nil {
-		log.G(ctx).WithError(err).Error("cleaning pin path")
-	}
-
 	s.wg.Wait()
 	log.G(ctx).Debug("activator stopped")
 }
diff --git a/activator/bpf.go b/activator/bpf.go
index 088c05d..599f1d1 100644
--- a/activator/bpf.go
+++ b/activator/bpf.go
@@ -231,11 +231,11 @@ func (bpf *BPF) Cleanup() error {
 	}
 
 	bpf.log.Info("deleting", "path", PinPath(bpf.pid))
-	errs = append(errs, cleanPinPath(bpf.pid))
+	errs = append(errs, CleanPinPath(bpf.pid))
 	return errors.Join(errs...)
 }
 
-func cleanPinPath(pid int) error {
+func CleanPinPath(pid int) error {
 	return errors.Join(
 		os.RemoveAll(PinPath(pid)),
 		os.RemoveAll(PinPath(pid)+ManagedByShimSuffix),
diff --git a/shim/task/service_zeropod.go b/shim/task/service_zeropod.go
index b866d3b..0278ddd 100644
--- a/shim/task/service_zeropod.go
+++ b/shim/task/service_zeropod.go
@@ -24,6 +24,7 @@ import (
 	"github.com/containerd/ttrpc"
 
 	"github.com/containerd/typeurl/v2"
+	"github.com/ctrox/zeropod/activator"
 	v1 "github.com/ctrox/zeropod/api/shim/v1"
 	zshim "github.com/ctrox/zeropod/shim"
 	"google.golang.org/protobuf/types/known/emptypb"
@@ -296,6 +297,9 @@ func (w *wrapper) Delete(ctx context.Context, r *taskAPI.DeleteRequest) (*taskAP
 	log.G(ctx).Info("delete called")
 	zeropodContainer, ok := w.getZeropodContainer(r.ID)
 	if !ok {
+		if err := w.cleanSandboxPin(ctx, r); err != nil {
+			log.G(ctx).WithError(err).Error("cleaning up sandbox pin")
+		}
 		return w.service.Delete(ctx, r)
 	}
 	log.G(ctx).Infof("delete called in zeropod: %s", zeropodContainer.ID())
@@ -465,3 +469,29 @@ func (w *wrapper) postRestore(container *runc.Container, handleStarted zshim.Han
 		handleStarted(container, p)
 	}
 }
+
+// cleanSandboxPin cleanes the eBPF pin path of the sandbox container.
+func (w *wrapper) cleanSandboxPin(ctx context.Context, r *taskAPI.DeleteRequest) error {
+	if r.ExecID != "" {
+		return nil
+	}
+	container, err := w.getContainer(r.ID)
+	if err != nil {
+		return err
+	}
+	spec, err := zshim.GetSpec(container.Bundle)
+	if err != nil {
+		return err
+	}
+	cfg, err := v1.NewConfig(ctx, spec)
+	if err != nil {
+		return err
+	}
+	if cfg.ContainerType != containerTypeSandbox {
+		return nil
+	}
+	if err := activator.CleanPinPath(container.Pid()); err != nil {
+		return err
+	}
+	return nil
+}