|
| 1 | +#!/usr/bin/env python3 |
| 2 | +""" |
| 3 | +Cleanup script for Firecracker microVMs. |
| 4 | +
|
| 5 | +This script cleans up: |
| 6 | +- Running Firecracker processes |
| 7 | +- TAP devices (tap_*) |
| 8 | +- nftables rules |
| 9 | +- Firecracker directories (optional) |
| 10 | +
|
| 11 | +Usage: |
| 12 | + python cleanup_firecracker.py [--clean-dirs] |
| 13 | +""" |
| 14 | + |
| 15 | +import argparse |
| 16 | +import os |
| 17 | +import subprocess |
| 18 | +import sys |
| 19 | +from pathlib import Path |
| 20 | + |
| 21 | + |
| 22 | +def run_command(cmd, check=False): |
| 23 | + """Run a command and return the result.""" |
| 24 | + try: |
| 25 | + result = subprocess.run( |
| 26 | + cmd, shell=True, capture_output=True, text=True, check=check, timeout=10 |
| 27 | + ) |
| 28 | + return result |
| 29 | + except subprocess.TimeoutExpired: |
| 30 | + print(f"Command timed out: {cmd}") |
| 31 | + return None |
| 32 | + except subprocess.CalledProcessError as e: |
| 33 | + if check: |
| 34 | + print(f"Command failed: {cmd}") |
| 35 | + print(f"Error: {e.stderr}") |
| 36 | + return None |
| 37 | + |
| 38 | + |
| 39 | +def kill_firecracker_processes(): |
| 40 | + """Kill all running Firecracker processes.""" |
| 41 | + print("Killing Firecracker processes...") |
| 42 | + # Kill actual firecracker processes by finding and killing them |
| 43 | + result = run_command( |
| 44 | + "ps aux | grep -E 'firecracker --api-sock|/usr/local/bin/firecracker' | grep -v grep | awk '{print $2}' | xargs -r kill" |
| 45 | + ) |
| 46 | + if result and result.returncode == 0: |
| 47 | + print(f" ✓ Killed Firecracker processes") |
| 48 | + else: |
| 49 | + print(" ! No Firecracker processes found or already killed") |
| 50 | + |
| 51 | + |
| 52 | +def check_firecracker_processes(): |
| 53 | + """Check for remaining Firecracker processes.""" |
| 54 | + # Look for actual firecracker processes, excluding python scripts |
| 55 | + result = run_command( |
| 56 | + "ps aux | grep -E 'firecracker --api-sock|/usr/local/bin/firecracker' | grep -v grep | awk '{print $2}'" |
| 57 | + ) |
| 58 | + if result and result.stdout.strip(): |
| 59 | + pids = result.stdout.strip().split("\n") |
| 60 | + return [p for p in pids if p] |
| 61 | + return [] |
| 62 | + |
| 63 | + |
| 64 | +def delete_tap_devices(): |
| 65 | + """Delete all TAP devices starting with 'tap_'.""" |
| 66 | + print("Deleting TAP devices...") |
| 67 | + result = run_command("ip link show | grep tap_") |
| 68 | + |
| 69 | + if result and result.returncode == 0: |
| 70 | + tap_lines = result.stdout.strip().split("\n") |
| 71 | + tap_devices = [] |
| 72 | + |
| 73 | + for line in tap_lines: |
| 74 | + if line and "tap_" in line: |
| 75 | + # Extract device name from output like "3418: tap_dhdofa0u: <NO-CARRIER,..." |
| 76 | + parts = line.split(":") |
| 77 | + if len(parts) >= 2: |
| 78 | + tap_name = parts[1].strip().split()[0] |
| 79 | + tap_devices.append(tap_name) |
| 80 | + |
| 81 | + for tap_name in tap_devices: |
| 82 | + result = run_command(f"ip link delete {tap_name}") |
| 83 | + if result and result.returncode == 0: |
| 84 | + print(f" ✓ Deleted TAP device: {tap_name}") |
| 85 | + else: |
| 86 | + print(f" ! Failed to delete TAP device: {tap_name}") |
| 87 | + else: |
| 88 | + print(" ! No TAP devices found") |
| 89 | + |
| 90 | + |
| 91 | +def flush_nftables_rules(): |
| 92 | + """Flush nftables chains.""" |
| 93 | + print("Flushing nftables rules...") |
| 94 | + chains = ["ip filter FORWARD", "ip nat PREROUTING", "ip nat POSTROUTING"] |
| 95 | + |
| 96 | + for chain in chains: |
| 97 | + result = run_command(f"nft flush chain {chain}") |
| 98 | + if result and result.returncode == 0: |
| 99 | + print(f" ✓ Flushed chain: {chain}") |
| 100 | + else: |
| 101 | + print(f" ! Failed to flush chain: {chain} (may not exist)") |
| 102 | + |
| 103 | + |
| 104 | +def cleanup_firecracker_dirs(): |
| 105 | + """Clean up Firecracker directories.""" |
| 106 | + firecracker_dir = Path("/var/lib/firecracker") |
| 107 | + |
| 108 | + if not firecracker_dir.exists(): |
| 109 | + print(f" ! Firecracker directory not found: {firecracker_dir}") |
| 110 | + return |
| 111 | + |
| 112 | + print(f"Cleaning up Firecracker directories...") |
| 113 | + |
| 114 | + # Get all subdirectories |
| 115 | + subdirs = [d for d in firecracker_dir.iterdir() if d.is_dir()] |
| 116 | + |
| 117 | + if not subdirs: |
| 118 | + print(" ! No Firecracker directories to clean") |
| 119 | + return |
| 120 | + |
| 121 | + for subdir in subdirs: |
| 122 | + try: |
| 123 | + # Check if it's a VM directory (has socket or logs) |
| 124 | + socket_file = subdir / "firecracker.socket" |
| 125 | + log_dir = subdir / "logs" |
| 126 | + |
| 127 | + if socket_file.exists() or log_dir.exists(): |
| 128 | + print(f" ✓ Removing directory: {subdir.name}") |
| 129 | + subprocess.run( |
| 130 | + f"rm -rf {subdir}", shell=True, capture_output=True, timeout=30 |
| 131 | + ) |
| 132 | + else: |
| 133 | + print(f" - Skipping non-VM directory: {subdir.name}") |
| 134 | + except Exception as e: |
| 135 | + print(f" ! Failed to remove directory {subdir.name}: {e}") |
| 136 | + |
| 137 | + |
| 138 | +def main(): |
| 139 | + parser = argparse.ArgumentParser( |
| 140 | + description="Cleanup script for Firecracker microVMs" |
| 141 | + ) |
| 142 | + parser.add_argument( |
| 143 | + "--clean-dirs", |
| 144 | + action="store_true", |
| 145 | + help="Also clean up Firecracker directories in /var/lib/firecracker", |
| 146 | + ) |
| 147 | + parser.add_argument( |
| 148 | + "--dry-run", |
| 149 | + action="store_true", |
| 150 | + help="Show what would be done without actually doing it", |
| 151 | + ) |
| 152 | + |
| 153 | + args = parser.parse_args() |
| 154 | + |
| 155 | + print("=" * 60) |
| 156 | + print("Firecracker Cleanup Script") |
| 157 | + print("=" * 60) |
| 158 | + |
| 159 | + if args.dry_run: |
| 160 | + print("\n[DRY RUN] No actual changes will be made\n") |
| 161 | + |
| 162 | + # Check if running as root |
| 163 | + if os.geteuid() != 0: |
| 164 | + print("\nWARNING: Not running as root. Some operations may fail.") |
| 165 | + print("Consider running with: sudo python cleanup_firecracker.py\n") |
| 166 | + |
| 167 | + # Kill Firecracker processes |
| 168 | + if not args.dry_run: |
| 169 | + kill_firecracker_processes() |
| 170 | + remaining = check_firecracker_processes() |
| 171 | + if remaining: |
| 172 | + print(f" ! Still have {len(remaining)} Firecracker processes running") |
| 173 | + print(f" ! PIDs: {', '.join(remaining)}") |
| 174 | + else: |
| 175 | + pids = check_firecracker_processes() |
| 176 | + if pids: |
| 177 | + print(f"Would kill {len(pids)} Firecracker processes") |
| 178 | + print(f"PIDs: {', '.join(pids)}") |
| 179 | + else: |
| 180 | + print("No Firecracker processes to kill") |
| 181 | + |
| 182 | + # Delete TAP devices |
| 183 | + if not args.dry_run: |
| 184 | + delete_tap_devices() |
| 185 | + else: |
| 186 | + result = run_command("ip link show | grep tap_") |
| 187 | + if result and result.returncode == 0: |
| 188 | + tap_lines = result.stdout.strip().split("\n") |
| 189 | + tap_devices = [] |
| 190 | + for line in tap_lines: |
| 191 | + if line and "tap_" in line: |
| 192 | + parts = line.split(":") |
| 193 | + if len(parts) >= 2: |
| 194 | + tap_name = parts[1].strip().split()[0] |
| 195 | + tap_devices.append(tap_name) |
| 196 | + if tap_devices: |
| 197 | + print(f"Would delete {len(tap_devices)} TAP devices:") |
| 198 | + for tap in tap_devices: |
| 199 | + print(f" - {tap}") |
| 200 | + else: |
| 201 | + print("No TAP devices to delete") |
| 202 | + |
| 203 | + # Flush nftables rules |
| 204 | + if not args.dry_run: |
| 205 | + flush_nftables_rules() |
| 206 | + else: |
| 207 | + print("Would flush nftables chains:") |
| 208 | + print(" - ip filter FORWARD") |
| 209 | + print(" - ip nat PREROUTING") |
| 210 | + print(" - ip nat POSTROUTING") |
| 211 | + |
| 212 | + # Clean up directories if requested |
| 213 | + if args.clean_dirs: |
| 214 | + if not args.dry_run: |
| 215 | + cleanup_firecracker_dirs() |
| 216 | + else: |
| 217 | + firecracker_dir = Path("/var/lib/firecracker") |
| 218 | + if firecracker_dir.exists(): |
| 219 | + subdirs = [d for d in firecracker_dir.iterdir() if d.is_dir()] |
| 220 | + if subdirs: |
| 221 | + print(f"Would remove {len(subdirs)} Firecracker directories") |
| 222 | + else: |
| 223 | + print("No Firecracker directories to clean") |
| 224 | + |
| 225 | + print("\n" + "=" * 60) |
| 226 | + print("Cleanup complete!") |
| 227 | + print("=" * 60) |
| 228 | + |
| 229 | + # Show summary |
| 230 | + if not args.dry_run: |
| 231 | + remaining_pids = check_firecracker_processes() |
| 232 | + tap_result = run_command("ip link show | grep tap_") |
| 233 | + |
| 234 | + print("\nSummary:") |
| 235 | + print(f" - Firecracker processes: {'Running' if remaining_pids else 'None'}") |
| 236 | + print( |
| 237 | + f" - TAP devices: {'Found' if tap_result and tap_result.returncode == 0 else 'None'}" |
| 238 | + ) |
| 239 | + print(f" - nftables: Flushed") |
| 240 | + |
| 241 | + if remaining_pids: |
| 242 | + print("\nWARNING: Some Firecracker processes are still running!") |
| 243 | + print("You may need to manually kill them with: sudo pkill -9 firecracker") |
| 244 | + |
| 245 | + |
| 246 | +if __name__ == "__main__": |
| 247 | + main() |
0 commit comments