container: do not set static deadline

This usually ends up in the buffer, or completes well before the deadline, however this can still timeout on a very slow system.

Signed-off-by: Ophestra <cat@gensokyo.uk>

container/container.go

@@ -28,9 +28,6 @@ const (
 	// CancelSignal is the signal expected by container init on context cancel.
 	// A custom [Container.Cancel] function must eventually deliver this signal.
 	CancelSignal = SIGUSR2
-
-	// Timeout for writing initParams to Container.setup.
-	initSetupTimeout = 5 * time.Second
 )
 
 type (
@@ -434,6 +431,8 @@ func (p *Container) Serve() (err error) {
 	if p.setup[0] == nil || p.setup[1] == nil {
 		panic("invalid serve")
 	}
+
+	done := make(chan struct{})
 	defer func() {
 		if closeErr := p.setup[1].Close(); err == nil {
 			err = closeErr
@@ -442,6 +441,7 @@ func (p *Container) Serve() (err error) {
 		if err != nil {
 			p.cancel()
 		}
+		close(done)
 		p.setup[0], p.setup[1] = nil, nil
 	}()
 	if err = p.setup[0].Close(); err != nil {
@@ -453,15 +453,6 @@ func (p *Container) Serve() (err error) {
 		}
 	}
 
-	if err = p.setup[1].SetDeadline(time.Now().Add(initSetupTimeout)); err != nil {
-		return &StartError{
-			Fatal:       true,
-			Step:        "set init pipe deadline",
-			Err:         err,
-			Passthrough: true,
-		}
-	}
-
 	if p.Path == nil {
 		return &StartError{
 			Step:   "invalid executable pathname",
@@ -478,6 +469,20 @@ func (p *Container) Serve() (err error) {
 		p.SeccompRules = make([]std.NativeRule, 0)
 	}
 
+	t := time.Now().UTC()
+	go func(f *os.File) {
+		select {
+		case <-p.ctx.Done():
+			if cancelErr := f.SetWriteDeadline(t); cancelErr != nil {
+				p.msg.Verbose(err)
+			}
+
+		case <-done:
+			p.msg.Verbose("setup payload took", time.Since(t))
+			return
+		}
+	}(p.setup[1])
+
 	return gob.NewEncoder(p.setup[1]).Encode(&initParams{
 		p.Params,
 		Getuid(),