UNDF: UNDF-2026-000000502

podman-0002: GetRunningPods O(n²) — slices.Contains dedup inside container loop

Severity

HIGH — called on the hot path for pod status queries; grows quadratically with container count

File

libpod/runtime_pod.go:148 — GetRunningPods

CWE

CWE-407: Algorithmic Complexity

Description

GetRunningPods iterates over all running containers and deduplicates pod IDs using a []string combined with slices.Contains. For each of the N containers, slices.Contains(pods, c.PodID()) scans the accumulated pods slice — O(1) to O(N) per iteration, O(N²) overall.

A cluster with 1,000 running containers across pods causes ~500,000 comparisons per call.

Defective code

// libpod/runtime_pod.go:147-153
for _, c := range containers {
    if !slices.Contains(pods, c.PodID()) {   // O(n) scan per container
        pods = append(pods, c.PodID())
        ...
    }
}

Fix

Replace []string dedup with a map[string]bool.

seen := make(map[string]bool, len(containers))
for _, c := range containers {
    if !seen[c.PodID()] {
        seen[c.PodID()] = true
        pod, err := r.GetPod(c.PodID())
        ...
        runningPods = append(runningPods, pod)
    }
}

Speedup

N=1000 containers: ~500,000 → ~1,000 comparisons (~500×) N=100: ~5,000 → ~100 (~50×)

1.3 KiB Raw Permalink Blame History Unescape Escape