Hardening lifecycle state store

Signed-off-by: apostasie <[email protected]>

pkg/ocihook/ocihook.go

@@ -514,10 +514,9 @@ func onCreateRuntime(opts *handlerOpts) error {
  // Set StartedAt
  lf := state.NewLifecycleState(opts.state.Annotations[labels.StateDir])
  return lf.WithLock(func() error {
- err := lf.Load()
- if err != nil {
- return err
- }
+ // Errors are voluntarily ignored here, as they should not be fatal.
+ // The lifecycle struct is also already warning about the issue.
+ _ = lf.Load()
  lf.StartedAt = time.Now()
  return lf.Save()
  })

pkg/ocihook/state/state.go

@@ -24,6 +24,8 @@ import (
  "path/filepath"
  "time"
 
+ "github.com/containerd/log"
+
  "github.com/containerd/nerdctl/v2/pkg/lockutil"
 )
 
@@ -71,18 +73,26 @@ func (lf *LifecycleState) Load() error {
  } else {
  err = json.Unmarshal(data, lf)
  if err != nil {
+ backout := filepath.Join(lf.stateDir, lifecycleFile, ".bak")
+ log.L.Error("unable to unmarshall lifecycle data: %w - broken file has been moved to %q - you should"+
+ "investigate manually and possibly report as a bug", err, backout)
  return fmt.Errorf("unable to unmarshall lifecycle data: %w", err)
  }
  }
  return nil
 }
 
 func (lf *LifecycleState) Save() error {
+ // Write atomically (write, then move) to avoid incomplete writes from happening
  data, err := json.Marshal(lf)
  if err != nil {
  return fmt.Errorf("unable to marshall lifecycle data: %w", err)
  }
- err = os.WriteFile(filepath.Join(lf.stateDir, lifecycleFile), data, 0600)
+ err = os.WriteFile(filepath.Join(lf.stateDir, "."+lifecycleFile), data, 0600)
+ if err != nil {
+ return fmt.Errorf("unable to write lifecycle file: %w", err)
+ }
+ err = os.Rename(filepath.Join(lf.stateDir, "."+lifecycleFile), filepath.Join(lf.stateDir, lifecycleFile))
  if err != nil {
  return fmt.Errorf("unable to write lifecycle file: %w", err)
  }