--cidfile fails if file exists even if empty

[hydrargyrum]

Description

The best practice when creating a temporary file is not only to generate a filename of a file that does not already exist, but also to create/open the file with O_EXCL, to avoid TOCTOU, typically that's what mkstemp(3) does.
Unfortunately, docker-run's --cidfile prevents from passing it a safe temporary file, because docker-run will fail if the given file merely exists.

Reproduce

t=$(mktemp)
docker run --rm --cidfile=$t debian

Expected behavior

docker-run should fail only if the file given as --cidfile contains a PID (even better, check if the PID is alive by using kill(the_pid, 0) which is designed for that)

docker version

Client:
 Version:           20.10.24+dfsg1
 API version:       1.41
 Go version:        go1.19.8
 Git commit:        297e128
 Built:             Sat Oct 12 15:19:49 2024
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server:
 Engine:
  Version:          20.10.5+dfsg1
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.15.15
  Git commit:       363e9a8
  Built:            Mon May 30 18:34:49 2022
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.20~ds1
  GitCommit:        1.6.20~ds1-1+deb12u1
 runc:
  Version:          1.1.5+ds1
  GitCommit:        1.1.5+ds1-1+deb12u1
 docker-init:
  Version:          0.19.0
  GitCommit:

docker info

too much identifying info

Additional Info

No response

[nbiswal1]

Hello @hydrargyrum ,
I would like to work on this bug.

[thaJeztah]

docker-run should fail only if the file given as --cidfile contains a PID (even better, check if the PID is alive by using kill(the_pid, 0) which is designed for that)

Note that this file contains the container ID (not a PID); on docker run, it contains the ID that was generated after the container is created (as part of the docker run)

[hydrargyrum]

@thaJeztah indeed, that part about using kill() is completely mistaken (but it's still possible to check if the container is alive, if desired)