Regression: zombie runc:[1:CHILD] processes

[LittleLightLittleFire]

Whenever we execute code in nsenter.c and read back the child pid, we always need to be aware that the code in nsenter will spawn a zombie runc:[1:CHILD] process that needs to be cleaned up by the parent.

The code in process_linux.go was updated to support cgroup namespaces and uses the nsenter.c to spawn another process.

runc/libcontainer/process_linux.go

Lines 235 to 240 in f56b4cb

	if err := json.NewDecoder(p.parentPipe).Decode(&pid); err != nil {
	p.cmd.Wait()
	return -1, err
	}
	return pid.Pid, nil
	}

This does not clean up runc:[1:CHILD] as done here:

runc/libcontainer/process_linux.go

Lines 155 to 167 in f56b4cb

	if err := json.NewDecoder(p.parentPipe).Decode(&pid); err != nil {
	p.cmd.Wait()
	return newSystemErrorWithCause(err, "reading pid from init pipe")
	}
	// Clean up the zombie parent process
	firstChildProcess, err := os.FindProcess(pid.PidFirstChild)
	if err != nil {
	return err
	}
	// Ignore the error in case the child has already been reaped for any reason
	_, _ = firstChildProcess.Wait()

I've prepared a PR to address this.