container: optionally isolate host abstract UNIX domain sockets via landlock

This allows setup that relies on per-thread state like securebits and landlock, from the parent side.

Signed-off-by: Ophestra <cat@gensokyo.uk>

container/container.go

@@ -234,16 +234,15 @@ func (p *Container) Serve() error {
 
 // Wait waits for the container init process to exit and releases any resources associated with the [Container].
 func (p *Container) Wait() error {
-	if p.cmd == nil {
+	if p.wait == nil {
+		if p.cmd != nil {
+			// pass through error from Cmd
+			return p.cmd.Wait()
+		}
 		return EINVAL
 	}
-
+	defer func() { close(p.wait); p.cancel(); p.wait = nil }()
-	err := p.cmd.Wait()
+	return p.cmd.Wait()
-	p.cancel()
-	if p.wait != nil && err == nil {
-		close(p.wait)
-	}
-	return err
 }
 
 func (p *Container) String() string {