Skip to content

fix(vllm): accept /run/docker.sock as a default socket for disk-space check #6864

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
yanyunl1991 wants to merge 1 commit into from
Closed

fix(vllm): accept /run/docker.sock as a default socket for disk-space check #6864

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions src/lib/inference/vllm-storage.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -298,6 +298,24 @@ describe("Docker image-storage detection", () => {
});
});

it("accepts /run/docker.sock as a default socket (systemd /var/run -> /run symlink) (#6858)", () => {
// Regression: DOCKER_HOST=unix:///run/docker.sock is the same daemon socket
// as /var/run/docker.sock on systemd Linux, but was read as "non-default" and
// aborted express managed-vLLM disk-space verification.
vi.stubEnv("DOCKER_HOST", "unix:///run/docker.sock");
vi.stubEnv("DOCKER_CONTEXT", "default");

expect(
probeDockerHostLocality({
clientContainerized: false,
dockerInfo: () => nativeDockerInfo(),
osRelease: nativeHost.osRelease,
platform: nativeHost.platform,
dockerSocketPeerSharesMountNamespace: () => true,
}),
).toEqual({ ok: true });
});
Comment on lines +301 to +317

@coderabbitai coderabbitai Bot Jul 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Add the required rejection regression case.

This only proves unix:///run/docker.sock is accepted. Add coverage for /tmp/forwarded-remote.sock remaining rejected, and preferably table-test the supported /run and /var/run forms with and without unix://.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/inference/vllm-storage.test.ts` around lines 301 - 317, Add a
rejection regression test alongside the existing probeDockerHostLocality
coverage to verify /tmp/forwarded-remote.sock remains rejected. Prefer
converting the supported-socket test into a table-driven case covering
/run/docker.sock and /var/run/docker.sock, each with and without the unix://
prefix, while preserving the existing native Docker setup and expected { ok:
true } result for supported forms.


it("fails closed when the default Docker socket is mounted into a client container (#6757)", () => {
vi.stubEnv("DOCKER_HOST", "unix:///var/run/docker.sock");
vi.stubEnv("DOCKER_CONTEXT", "default");
Expand Down
14 changes: 13 additions & 1 deletion src/lib/inference/vllm-storage.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,18 @@ const MODEL_MINIMUM_HEADROOM_BYTES = 2n * GIB_BYTES;
const DEFAULT_CONTAINERD_ROOT = "/var/lib/containerd";
const DEFAULT_CONTAINERD_CONFIG = "/etc/containerd/config.toml";
const DEFAULT_DOCKER_SOCKET = "/var/run/docker.sock";
// `/var/run` is a symlink to `/run` on modern systemd Linux, so the Docker
// daemon socket is canonically `/run/docker.sock` and `/var/run/docker.sock`
// addresses the same file. Accept both (and their `unix://` forms) as the
// default local socket, mirroring the socket candidates probed in platform.ts,
// so a `DOCKER_HOST` pointing at either does not read as a non-default socket
// and abort managed-vLLM disk-space verification. (#6858)
const DEFAULT_DOCKER_SOCKET_PATHS = ["/var/run/docker.sock", "/run/docker.sock"];

function isDefaultDockerSocket(endpoint: string): boolean {
const socketPath = endpoint.startsWith("unix://") ? endpoint.slice("unix://".length) : endpoint;
return DEFAULT_DOCKER_SOCKET_PATHS.includes(socketPath);
}
const DOCKER_SOCKET_PEER_PROBE_TIMEOUT_MS = 5_000;
// SO_PEERCRED translates the daemon PID into the caller's PID namespace. A
// hidden peer therefore exposes the namespace-local PID 1 topology directly,
Expand Down Expand Up @@ -314,7 +326,7 @@ function nativeDockerHostProblem(info: DockerInfoShape, deps: StorageProbeDeps):
if (endpoint) {
const localSocket = endpoint.startsWith("unix://") || path.isAbsolute(endpoint);
if (!localSocket) return `Docker uses a remote endpoint (${endpoint})`;
if (endpoint !== DEFAULT_DOCKER_SOCKET && endpoint !== `unix://${DEFAULT_DOCKER_SOCKET}`) {
if (!isDefaultDockerSocket(endpoint)) {
return `Docker uses a non-default socket (${endpoint}) whose daemon host filesystem cannot be verified`;
}
}
Expand Down
Loading