Implement NRI container garbage collection in StopContainer

Add sweeping garbage collection that removes stale NRI volumes when containers
stop. The plugin now caches the CRI socket at initialization and uses it to
query the runtime for active containers, then removes volumes for containers
no longer in the active list.

Changes:
- Cache CRI socket in NriPlugin constructor (required for GC)
- Query active containers from CRI API in StopContainer hook
- Remove the stopping container from active list
- Clean up volumes in NRI_CONTAINERS that aren't in active list
- Log GC progress and stale volume removals

This ensures orphaned volumes are cleaned up even if containers are removed
via external tools or fail to call StopContainer.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

Author: Lillecarl

kubenix/rbac.nix

@@ -22,7 +22,7 @@ in
               "list"
             ];
           }
-          # Query kubelet configz via API server proxy for CRI socket discovery
+          # Kubelet configz via API server proxy for CRI socket discovery
           {
             apiGroups = [ "" ];
             resources = [ "nodes/proxy" ];

python/nix_csi/cri.py

@@ -28,16 +28,18 @@ async def get_cri_socket() -> Path:
         raise RuntimeError("KUBE_NODE_NAME environment variable not set")
 
     try:
-        api = kr8s.asyncio.Api()
+        api = await kr8s.asyncio.api()
         async with api.call_api(
             "GET",
-            url=f"/api/v1/nodes/{node_name}/proxy/configz",
+            url=f"nodes/{node_name}/proxy/configz",
         ) as response:
             config = response.json()
             endpoint = config.get("kubeletconfig", {}).get("containerRuntimeEndpoint")
 
             if not endpoint:
-                raise RuntimeError("containerRuntimeEndpoint not found in kubelet configz")
+                raise RuntimeError(
+                    "containerRuntimeEndpoint not found in kubelet configz"
+                )
 
             # Strip unix:// prefix if present
             endpoint = endpoint.removeprefix("unix://")

python/nix_csi/nriplugin.py

@@ -30,6 +30,7 @@
     NRI_PLUGIN_NAME,
     NRI_RUNTIME_SOCKET,
 )
+from .cri import get_cri_socket, list_container_ids
 from .nix import build_packages, get_build_args, get_closure_paths
 from .ns_mount import mount_in_container
 from .store import extract_store_paths
@@ -121,9 +122,10 @@ def parse_store_mounts(pod_annotations, container_name: str) -> dict[Path, Path]
 class NriPlugin(nri_grpc.PluginBase):
     """NRI plugin with ZeroMQ build coordination."""
 
-    def __init__(self, zmq_server: ZeroMQServer):
+    def __init__(self, zmq_server: ZeroMQServer, cri_socket: Path):
         super().__init__()
         self.zmq_server = zmq_server
+        self.cri_socket = cri_socket
         # Find nri-wait binary on PATH (available as nix-csi dependency)
         self.nri_wait_bin = shutil.which("wait")
         logger.debug("nri-wait binary resolved to: %s", self.nri_wait_bin)
@@ -312,11 +314,10 @@ async def StopContainer(self, stream) -> None:
             req.container.name,
         )
 
-        # Phase 1: Cleanup volume directory if it was created
         container_id = req.container.id
-        # Use pod-side path for cleanup (same as creation)
-        volume_path = NRI_CONTAINERS / container_id
 
+        # Phase 1: Cleanup volume directory for this container
+        volume_path = NRI_CONTAINERS / container_id
         if volume_path.exists():
             try:
                 shutil.rmtree(volume_path)
@@ -328,6 +329,44 @@ async def StopContainer(self, stream) -> None:
                     e,
                 )
 
+        # Phase 2: Garbage collect stale volumes from containers no longer in CRI
+        try:
+            # Get list of active containers from CRI, excluding the one stopping
+            # Access socket through host mount since we're in a container
+            socket_path = Path("/host") / self.cri_socket.relative_to("/")
+            active_ids = await list_container_ids(socket_path)
+            active_ids.discard(container_id)  # Remove the stopping container
+            logger.debug(
+                "GC: Active containers from CRI: %d (excluding stopping container)",
+                len(active_ids),
+            )
+
+            # Clean up volumes for containers not in active list
+            if NRI_CONTAINERS.exists():
+                stale_count = 0
+                for volume_dir in NRI_CONTAINERS.iterdir():
+                    if volume_dir.is_dir() and volume_dir.name not in active_ids:
+                        try:
+                            shutil.rmtree(volume_dir)
+                            stale_count += 1
+                            logger.debug(
+                                "GC: Removed stale volume for container=%r",
+                                volume_dir.name,
+                            )
+                        except Exception as e:
+                            logger.warning(
+                                "GC: Failed to remove stale volume at %r: %s",
+                                volume_dir,
+                                e,
+                            )
+                if stale_count > 0:
+                    logger.info("GC: Cleaned up %d stale NRI volumes", stale_count)
+        except Exception as e:
+            logger.warning(
+                "GC: Failed to perform garbage collection: %s",
+                e,
+            )
+
         await stream.send_message(nri_pb2.StopContainerResponse())
 
     async def UpdatePodSandbox(self, stream) -> None:
@@ -582,8 +621,11 @@ async def _nri_run() -> None:
     zmq_server = ZeroMQServer()
     await zmq_server.initialize()
 
+    # Discover CRI socket for garbage collection
+    cri_socket = await get_cri_socket()
+
     mapping: dict = {}
-    plugin = NriPlugin(zmq_server)
+    plugin = NriPlugin(zmq_server, cri_socket)
     for h in [plugin]:
         mapping.update(h.__mapping__())