container: optionally isolate host abstract UNIX domain sockets via landlock

This allows setup that relies on per-thread state like securebits and landlock, from the parent side.

Signed-off-by: Ophestra <cat@gensokyo.uk>

container/container.go

@@ -234,15 +234,16 @@ func (p *Container) Serve() error {
 
 // Wait waits for the container init process to exit and releases any resources associated with the [Container].
 func (p *Container) Wait() error {
-	if p.wait == nil {
-		if p.cmd != nil {
-			// pass through error from Cmd
-			return p.cmd.Wait()
-		}
+	if p.cmd == nil {
 		return EINVAL
 	}
-	defer func() { close(p.wait); p.cancel(); p.wait = nil }()
-	return p.cmd.Wait()
+
+	err := p.cmd.Wait()
+	p.cancel()
+	if p.wait != nil && err == nil {
+		close(p.wait)
+	}
+	return err
 }
 
 func (p *Container) String() string {