Fix shim fully drain stdin on close IO

[austinvazquez]

This change addresses and edge case where draining stdin on close will truncate data.

Ref: https://github.com/containerd/nerdbox/actions/runs/28613973997/job/84853144969?pr=245

--- FAIL: TestShim (44.19s)
    --- FAIL: TestShim/LargeStdioRoundTrip (0.48s)
        exec_suite.go:743: got 20959232 bytes, want 20971520 (truncated by 12288 bytes)

[Copilot]

Pull request overview

This PR updates the shim’s stdin forwarding logic to ensure that when CloseIO fires, any remaining bytes already buffered on the stdin reader are fully drained and forwarded before the shim sends an in-band EOF (CloseWrite) to the guest.

Changes:

• Replace the single “drain one read” behavior on CloseIO with a loop that continues reading/writing until the stdin reader returns EOF or an error.
• Expand the in-code rationale to document why a single read can truncate stdin under backpressure (e.g., slow guest consumption / vsock credit).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

internal/shim/task/service.go:794

• CloseIO now blocks waiting for stdin drain/EOF via stdinEOF(ctx). If the incoming RPC context has no deadline (common in tests and potentially in callers), and the FIFO write end is never closed, this can block indefinitely and tie up a shim handler goroutine. Consider applying a server-side timeout when ctx has no deadline (similar to forwardIO's ioShutdown safety net), so CloseIO can't hang forever on a misbehaving peer.

		if stdinEOF != nil {
			if err := stdinEOF(ctx); err != nil {
				log.G(ctx).WithError(err).WithFields(log.Fields{
					"id":   r.ID,
					"exec": r.ExecID,
				}).Error("failed to send stdin EOF")
				return nil, errgrpc.ToGRPC(err)
			}
			return empty, nil

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.