container: optionally isolate host abstract UNIX domain sockets via landlock

This allows setup that relies on per-thread state like securebits and landlock, from the parent side.

Signed-off-by: Ophestra <cat@gensokyo.uk>

container/container.go

@@ -235,10 +235,6 @@ func (p *Container) Serve() error {
 // Wait waits for the container init process to exit and releases any resources associated with the [Container].
 func (p *Container) Wait() error {
 	if p.wait == nil {
-		if p.cmd != nil {
-			// pass through error from Cmd
-			return p.cmd.Wait()
-		}
 		return EINVAL
 	}
 	defer func() { close(p.wait); p.cancel(); p.wait = nil }()