container: optionally isolate host abstract UNIX domain sockets via landlock

This allows setup that relies on per-thread state like securebits and landlock, from the parent side.

Signed-off-by: Ophestra <cat@gensokyo.uk>

container/container.go

@@ -235,6 +235,10 @@ func (p *Container) Serve() error {
 // Wait waits for the container init process to exit and releases any resources associated with the [Container].
 func (p *Container) Wait() error {
 	if p.wait == nil {
+		if p.cmd != nil {
+			// pass through error from Cmd
+			return p.cmd.Wait()
+		}
 		return EINVAL
 	}
 	defer func() { close(p.wait); p.cancel(); p.wait = nil }()