Why container terminates, despite I have an interactive docker exec command running?

Question

I have the following container which I've created using the following command:

docker container create --name="my-service" ubuntu:latest sleep 120

When I start docker container start my-service this container it runs, then exits after 120 seconds, all OK.

Now in a second experiment I start the container, and while it runs I execute:

docker exec -ti my-service /bin/bash

Question

After 120 seconds the interactive bash terminates, because the container itself terminates. Why, and what is exactly the docker engine logic to doing this?

Answer 1

Each container has its own process hierarchy, and your specified command is the one that runs as "PID 1" (the parent of the entire process tree) within the container. Whenever the process with PID 1 exits, the entire process namespace (and with it, the container) is automatically destroyed by the kernel (not by Docker engine).

In full-system containers, PID 1 would be the "init" process; having it exit is how the container asks the host OS to be "shut down". Outside of containers, PID 1 is not allowed to exit at all – if this ever happens, the system will deliberately crash (you get a kernel panic), so the container behavior is rather similar to that.

(Among other things, what makes PID 1 special is that all processes that no longer have a parent are automatically re-parented to under PID 1, therefore it must always exist.)

You can experiment with PID namespaces using low-level tools, unshare and nsenter as the rough equivalents of your two Docker commands (you don't need to have Docker installed at all). You'll notice that ps axf inside the namespace shows 'sleep' as PID 1, and that whenever it exits, the rest of the namespace is immediately killed.

1. unshare --pid --fork --mount-proc sleep 120

2. nsenter --all --target=<pid_of_sleep> ps axf,
   nsenter --all --target=<pid_of_sleep> /bin/bash