vcontainer: detach background-process stdio from memres start caller

The memres start operation spawns long-running background processes
(host-side idle watchdog and Xen domain monitor) that persist beyond
the vrunner.sh script. These processes inherited file descriptors
0/1/2 from the parent shell without redirection.

When invoked through a harness capturing output via pipes—such as
pytest's subprocess.run(..., capture_output=True)—the inherited pipe
write-ends kept the caller's read/communicate() operations blocked
until memres stop executed, potentially for up to 30 minutes
(IDLE_TIMEOUT default).

The fix fully detaches stdio from three background spawners:
- vrunner.sh: Watchdog subshell now redirects stdin from /dev/null,
  stdout/stderr to /dev/null, and uses disown
- vrunner-backend-qemu.sh: Adds stdin redirection from /dev/null
  to existing log file redirections
- vrunner-backend-xen.sh: Applies same detachment plus disown for
  daemon mode; redirects stdin for ephemeral-mode console reader

From: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>

3 files changed, 35 insertions, 7 deletions

diff --git a/recipes-containers/vcontainer/files/vrunner-backend-qemu.sh b/recipes-containers/vcontainer/files/vrunner-backend-qemu.sh
index 87054876..3ea73cc7 100644
--- a/recipes-containers/vcontainer/files/vrunner-backend-qemu.sh
+++ b/recipes-containers/vcontainer/files/vrunner-backend-qemu.sh
@@ -188,10 +188,16 @@ hv_start_vm_background() {
     local log_file="$2"
     local timeout_val="$3"
 
+    # Fully detach stdio from the invoking shell. In daemon mode this
+    # process outlives vrunner.sh, and if the CLI that invoked us was
+    # wrapped by something that pipes stdout/stderr (e.g. a test harness
+    # using subprocess.run(capture_output=True)), any inherited fd here
+    # would block the parent's read/communicate() call until QEMU exits.
+    # Redirect fd 0 from /dev/null and fd 1/fd 2 to the log file.
     if [ -n "$timeout_val" ]; then
-        timeout $timeout_val $HV_CMD $HV_OPTS -append "$kernel_append" > "$log_file" 2>&1 &
+        timeout $timeout_val $HV_CMD $HV_OPTS -append "$kernel_append" </dev/null > "$log_file" 2>&1 &
     else
-        $HV_CMD $HV_OPTS -append "$kernel_append" > "$log_file" 2>&1 &
+        $HV_CMD $HV_OPTS -append "$kernel_append" </dev/null > "$log_file" 2>&1 &
     fi
     HV_VM_PID=$!
 }
diff --git a/recipes-containers/vcontainer/files/vrunner-backend-xen.sh b/recipes-containers/vcontainer/files/vrunner-backend-xen.sh
index 55e87bd1..f490f91c 100644
--- a/recipes-containers/vcontainer/files/vrunner-backend-xen.sh
+++ b/recipes-containers/vcontainer/files/vrunner-backend-xen.sh
@@ -397,13 +397,23 @@ hv_start_vm_background() {
         # Monitor process: stays alive while domain exists.
         # vcontainer-common.sh checks /proc/$pid → alive means daemon running.
         # When domain dies (xl destroy, guest reboot), monitor exits.
+        #
+        # Detach the monitor's stdio from the invoking shell: in daemon
+        # mode this process outlives vrunner.sh, and any inherited fd
+        # would keep a pipe-wrapped caller (e.g. subprocess.run with
+        # capture_output=True) blocked in communicate() until the domain
+        # exits. Redirect fd 0/1/2 and disown.
         local _domname="$HV_DOMNAME"
-        (while xl list "$_domname" >/dev/null 2>&1; do sleep 10; done) &
+        (while xl list "$_domname" >/dev/null 2>&1; do sleep 10; done) \
+            </dev/null >/dev/null 2>&1 &
         HV_VM_PID=$!
+        disown $! 2>/dev/null || true
     else
         # Ephemeral mode: capture guest console (hvc0) to log file
-        # so the monitoring loop in vrunner.sh can see output markers
-        stdbuf -oL xl console "$HV_DOMNAME" >> "$log_file" 2>&1 &
+        # so the monitoring loop in vrunner.sh can see output markers.
+        # Detach stdin so the background reader doesn't hold the caller's
+        # fd 0 open.
+        stdbuf -oL xl console "$HV_DOMNAME" </dev/null >> "$log_file" 2>&1 &
         _XEN_CONSOLE_PID=$!
         log "DEBUG" "Console capture started (PID: $_XEN_CONSOLE_PID)"
     fi
diff --git a/recipes-containers/vcontainer/files/vrunner.sh b/recipes-containers/vcontainer/files/vrunner.sh
index f1fb4d2b..1744245a 100755
--- a/recipes-containers/vcontainer/files/vrunner.sh
+++ b/recipes-containers/vcontainer/files/vrunner.sh
@@ -1365,7 +1365,18 @@ if [ "$DAEMON_MODE" = "start" ]; then
         # Set up port forwards via backend (e.g., iptables for Xen)
         hv_setup_port_forwards
 
-        # Start host-side idle watchdog if timeout is set
+        # Start host-side idle watchdog if timeout is set.
+        #
+        # The watchdog is a long-running background subshell that outlives
+        # vrunner.sh itself. It MUST fully detach from the invoking shell's
+        # stdio: when the caller (e.g. the vdkr CLI, or a test harness that
+        # wraps vdkr in subprocess.run(capture_output=True)) reads
+        # stdout/stderr via pipes, any inherited write-end fd in the
+        # watchdog keeps those pipes open and blocks the caller's
+        # communicate()/read until the daemon is stopped (up to
+        # IDLE_TIMEOUT, default 30 minutes). Redirect all three fds so the
+        # watchdog holds no descriptors from the caller, and disown it so
+        # the shell's job table doesn't retain it either.
         if [ "$IDLE_TIMEOUT" -gt 0 ] 2>/dev/null; then
             ACTIVITY_FILE="$DAEMON_SOCKET_DIR/activity"
             touch "$ACTIVITY_FILE"
@@ -1399,7 +1410,8 @@ if [ "$DAEMON_MODE" = "start" ]; then
                         exit 0
                     fi
                 done
-            ) &
+            ) </dev/null >/dev/null 2>&1 &
+            disown $! 2>/dev/null || true
             log "DEBUG" "Started host-side idle watchdog (timeout: ${IDLE_TIMEOUT}s)"
         fi