Ignite vm stop/rm - iptables: Too many links

[lucidprogrammer]

This issue is not in the commit. 4966569

Ignite version: version.Info{Major:"0", Minor:"6+", GitVersion:"v0.6.0-84+292dd05b1b9389", GitCommit:"292dd05b1b938928d735c9977ac7ae48097b4d2b", GitTreeState:"clean", BuildDate:"2019-09-27T10:07:45Z", GoVersion:"go1.12.9", Compiler:"gc", Platform:"linux/amd64"}
Firecracker version: v0.18.0
Runtime: containerd

INFO[0000] Removing the container with ID "ignite-bc6b53e9addd1040" from the "cni" network 
FATA[0000] running [/sbin/iptables -t nat -X CNI-598ec25f80183838805ef182 --wait]: exit status 1: iptables: Too many links.

If I look at iptables, it removes only the MASQUERADE and ACCEPT. POSTROUTING remains and the main nat entry.

[chanwit]

Thank you @lucidprogrammer for reporting!!

It seems being addressed by #461 ? cc @stealthybox

@lucidprogrammer If you think it's a new bug, could you please provide us steps to reproduce.
I'm guessing you're creating massive number of VMs?

[lucidprogrammer]

Thank you @lucidprogrammer for reporting!!

It seems being addressed by #461 ? cc @stealthybox
yes it seems the same issue.
@lucidprogrammer If you think it's a new bug, could you please provide us steps to reproduce.
I'm guessing you're creating massive number of VMs?
thats the idea!! :-)

@chanwit not sure if this is related - haven't looked at the code in detail

/var/lib/cni/networks/ignite-containerd-bridge keeps incrementing as the last-used ip is still there. Ideally if that is cleaned on vm stop/removal, could be best.
Hmm on further look - it is not really done by ignite - looks like its by cni itself. So ignore this comment

[stealthybox]

@lucidprogrammer, I was seeing this before I wrote #461 -- it happens when CNI is instructed to remove rules for a cni network name that does not exist. (the comment that's used to match is incorrect)

Can you try it out a new build and check if you're still having this problem?

[lucidprogrammer]

@stealthybox current commit 03baaa9 works fine.
It will be ideal if the ip address in /var/lib/cni/networks/ignite-cni-bridge/last_reserved_ip.0 is rolled back when a vm is removed or stopped.