feat(exec): Add --no-session flag for improved performance

Fixes: #26588

For use cases like HPC, where `podman exec` is called in rapid succession, the standard exec process can become a bottleneck due to container locking and database I/O for session tracking.

This commit introduces a new `--no-session` flag to `podman exec`. When used, this flag invokes a new, lightweight backend implementation (`ExecNoSession`) that:

- Skips container locking, reducing lock contention.
- Bypasses the creation, tracking, and removal of exec sessions in the database.
- Executes the command directly and retrieves the exit code without persisting session state.

Signed-off-by: Ryan McCann <ryan_mccann@student.uml.edu>
Signed-off-by: ryanmccann1024 <ryan_mccann@student.uml.edu>

Author: ryanmccann1024

cmd/podman/containers/exec.go

@@ -51,6 +51,7 @@ var (
 	execOpts          entities.ExecOptions
 	execDetach        bool
 	execCidFile       string
+	execNoSession     bool
 )
 
 func execFlags(cmd *cobra.Command) {
@@ -100,6 +101,10 @@ func execFlags(cmd *cobra.Command) {
 	flags.Int32(waitFlagName, 0, "Total seconds to wait for container to start")
 	_ = flags.MarkHidden(waitFlagName)
 
+	if !registry.IsRemote() {
+		flags.BoolVar(&execNoSession, "no-session", false, "Do not create a database session for the exec process")
+	}
+
 	if registry.IsRemote() {
 		_ = flags.MarkHidden("preserve-fds")
 	}
@@ -121,6 +126,12 @@ func init() {
 }
 
 func exec(cmd *cobra.Command, args []string) error {
+	if execNoSession {
+		if execDetach || cmd.Flags().Changed("detach-keys") {
+			return errors.New("--no-session cannot be used with --detach or --detach-keys")
+		}
+	}
+
 	nameOrID, command, err := determineTargetCtrAndCmd(args, execOpts.Latest, execCidFile != "")
 	if err != nil {
 		return err
@@ -168,17 +179,21 @@ func exec(cmd *cobra.Command, args []string) error {
 		}
 	}
 
-	if !execDetach {
-		streams := define.AttachStreams{}
-		streams.OutputStream = os.Stdout
-		streams.ErrorStream = os.Stderr
-		if execOpts.Interactive {
-			streams.InputStream = bufio.NewReader(os.Stdin)
-			streams.AttachInput = true
-		}
-		streams.AttachOutput = true
-		streams.AttachError = true
+	streams := define.AttachStreams{}
+	streams.OutputStream = os.Stdout
+	streams.ErrorStream = os.Stderr
+	if execOpts.Interactive {
+		streams.InputStream = bufio.NewReader(os.Stdin)
+		streams.AttachInput = true
+	}
+	streams.AttachOutput = true
+	streams.AttachError = true
 
+	if execNoSession {
+		exitCode, err := registry.ContainerEngine().ContainerExecNoSession(registry.Context(), nameOrID, execOpts, streams)
+		registry.SetExitCode(exitCode)
+		return err
+	} else if !execDetach {
 		exitCode, err := registry.ContainerEngine().ContainerExec(registry.Context(), nameOrID, execOpts, streams)
 		registry.SetExitCode(exitCode)
 		return err

docs/source/markdown/options/no-session.md

@@ -0,0 +1,7 @@
+####> This option file is used in:
+####>   podman exec
+####> If file is edited, make sure the changes
+####> are applicable to all of those.
+#### **--no-session**
+
+Do not create a database session for the exec process. This can improve performance but the exec session will not be visible to other podman commands.

docs/source/markdown/podman-exec.1.md.in

@@ -31,6 +31,8 @@ Start the exec session, but do not attach to it. The command runs in the backgro
 
 @@option latest
 
+@@option no-session
+
 @@option preserve-fd
 
 @@option preserve-fds

libpod/container_exec.go

@@ -1306,3 +1306,60 @@ func justWriteExecExitCode(c *Container, sessionID string, exitCode int, emitEve
 	// Finally, save our changes.
 	return c.save()
 }
+
+// ExecNoSession is a high-level wrapper for execNoSession.
+func (c *Container) ExecNoSession(config *ExecConfig, streams *define.AttachStreams, resize <-chan resize.TerminalSize) (int, error) {
+	return c.execNoSession(config, streams, resize, false)
+}
+
+// execNoSession executes a command in a container without creating a persistent exec session.
+// It skips database operations and minimizes container locking for performance.
+func (c *Container) execNoSession(config *ExecConfig, streams *define.AttachStreams, _ <-chan resize.TerminalSize, _ bool) (exitCode int, retErr error) {
+	sessionID := stringid.GenerateRandomID()
+
+	session := &ExecSession{
+		Id:     sessionID,
+		Config: config,
+	}
+
+	if !c.batched {
+		c.lock.Lock()
+		if err := c.syncContainer(); err != nil {
+			c.lock.Unlock()
+			return -1, err
+		}
+	}
+
+	opts, err := prepareForExec(c, session)
+
+	if !c.batched {
+		c.lock.Unlock()
+	}
+
+	if err != nil {
+		return -1, err
+	}
+
+	defer func() {
+		if err := c.cleanupExecBundle(sessionID); err != nil {
+			logrus.Errorf("cleanup of no-session exec %s failed: %v", sessionID, err)
+		}
+	}()
+
+	_, attachChan, err := c.ociRuntime.ExecContainer(c, sessionID, opts, streams, nil)
+	if err != nil {
+		return -1, err
+	}
+
+	err = <-attachChan
+	if err != nil && !errors.Is(err, define.ErrDetach) {
+		return -1, err
+	}
+
+	exitCode, err = c.readExecExitCode(sessionID)
+	if err != nil {
+		return -1, fmt.Errorf("retrieving no-session exec %s exit code: %w", sessionID, err)
+	}
+
+	return exitCode, nil
+}

pkg/domain/entities/engine_container.go

@@ -26,6 +26,7 @@ type ContainerEngine interface { //nolint:interfacebloat
 	ContainerCopyToArchive(ctx context.Context, nameOrID string, path string, writer io.Writer) (ContainerCopyFunc, error)
 	ContainerCreate(ctx context.Context, s *specgen.SpecGenerator) (*ContainerCreateReport, error)
 	ContainerExec(ctx context.Context, nameOrID string, options ExecOptions, streams define.AttachStreams) (int, error)
+	ContainerExecNoSession(ctx context.Context, nameOrID string, options ExecOptions, streams define.AttachStreams) (int, error)
 	ContainerExecDetached(ctx context.Context, nameOrID string, options ExecOptions) (string, error)
 	ContainerExists(ctx context.Context, nameOrID string, options ContainerExistsOptions) (*BoolReport, error)
 	ContainerExport(ctx context.Context, nameOrID string, options ContainerExportOptions) error

pkg/domain/infra/abi/containers.go

@@ -913,6 +913,20 @@ func (ic *ContainerEngine) ContainerExec(ctx context.Context, nameOrID string, o
 	return define.TranslateExecErrorToExitCode(ec, err), err
 }
 
+func (ic *ContainerEngine) ContainerExecNoSession(ctx context.Context, nameOrID string, options entities.ExecOptions, streams define.AttachStreams) (int, error) {
+	ctr, err := ic.Libpod.LookupContainer(nameOrID)
+	if err != nil {
+		return 0, err
+	}
+
+	execConfig, err := makeExecConfig(options, ic.Libpod)
+	if err != nil {
+		return define.ExecErrorCodeGeneric, err
+	}
+
+	return ctr.ExecNoSession(execConfig, &streams, nil)
+}
+
 func (ic *ContainerEngine) ContainerExecDetached(ctx context.Context, nameOrID string, options entities.ExecOptions) (string, error) {
 	err := checkExecPreserveFDs(options)
 	if err != nil {

pkg/domain/infra/tunnel/containers.go

@@ -624,6 +624,10 @@ func (ic *ContainerEngine) ContainerExec(ctx context.Context, nameOrID string, o
 	return inspectOut.ExitCode, nil
 }
 
+func (ic *ContainerEngine) ContainerExecNoSession(ctx context.Context, nameOrID string, options entities.ExecOptions, streams define.AttachStreams) (int, error) {
+	return 0, errors.New("--no-session is not supported for the remote client")
+}
+
 func (ic *ContainerEngine) ContainerExecDetached(ctx context.Context, nameOrID string, options entities.ExecOptions) (retSessionID string, retErr error) {
 	createConfig := makeExecConfig(options)