Don't wait for signalled processes if subreaper is enabled

[sboeuf]

In case the consumer of libcontainer sets a subreaper, we should not wait for processes when signalling them (https://github.com/opencontainers/runc/blob/master/libcontainer/init_linux.go#L467-L517). Otherwise, we have a race about the reaping, and in case the reaping is done from this function, our subreaper will not reap the expected process, meaning that we're gonna miss the exit code related to this process.

[sboeuf]

cc @mrunalp @crosbymichael @cyphar @sameo

[mrunalp]

Makes sense to me 👍

[sboeuf]

To be completely clear, there is no problem in this case with runc because runc does not care who reap the processes as long as they are reaped. But if we think about libcontainer as a real library, then there is a problem because I have no way to make sure my reaper will be able to reap those killed processes in my case. And this is a problem because I need the exit code so that I can send it from the agent on guest OS to the shim on host OS.
runc does not need that since the container process returns the exit code to the shim monitoring it.

[crosbymichael]

FYI

We handle a global subreaper in containerd with the reaper package here:

https://github.com/containerd/containerd/blob/master/reaper/reaper.go

You do have to modify your code with exec.Cmd usage to use the reaper wait functions but it works out in the long run. If this helps your issues.

[sboeuf]

@crosbymichael thanks for the link. I don't know if this can help since using this reaper code won't prevent this https://github.com/opencontainers/runc/blob/master/libcontainer/init_linux.go#L510 to be called. If something else (than my subreaper) reap the process, I have no way to tell what was the exit code of this process and I cannot send it back to the host as expected.
Am I missing something here ?

[sboeuf]

@mrunalp @crosbymichael #1678

[laijs]

Makes sense to me too