container: optionally isolate host abstract UNIX domain sockets via landlock

container/container.go

@@ -9,7 +9,6 @@ import (
 	"io"
 	"os"
 	"os/exec"
-	"runtime"
 	"strconv"
 	. "syscall"
 	"time"
@@ -37,8 +36,6 @@ type (
 		setup *gob.Encoder
 		// cancels cmd
 		cancel context.CancelFunc
-		// closed after Wait returns
-		wait chan struct{}
 
 		Stdin  io.Reader
 		Stdout io.Writer
@@ -175,23 +172,11 @@ func (p *Container) Start() error {
 	}
 	p.cmd.ExtraFiles = append(p.cmd.ExtraFiles, p.ExtraFiles...)
 
-	done := make(chan error, 1)
+	msg.Verbose("starting container init")
-	go func() {
+	if err := p.cmd.Start(); err != nil {
-		runtime.LockOSThread()
+		return msg.WrapErr(err, err.Error())
-		p.wait = make(chan struct{})
+	}
-
+	return nil
-		done <- func() error { // setup depending on per-thread state must happen here
-			msg.Verbose("starting container init")
-			if err := p.cmd.Start(); err != nil {
-				return msg.WrapErr(err, err.Error())
-			}
-			return nil
-		}()
-
-		// keep this thread alive until Wait returns for cancel
-		<-p.wait
-	}()
-	return <-done
 }
 
 // Serve serves [Container.Params] to the container init.
@@ -232,14 +217,8 @@ func (p *Container) Serve() error {
 	return err
 }
 
-// Wait waits for the container init process to exit and releases any resources associated with the [Container].
+// Wait waits for the container init process to exit.
-func (p *Container) Wait() error {
+func (p *Container) Wait() error { defer p.cancel(); return p.cmd.Wait() }
-	if p.wait == nil {
-		return EINVAL
-	}
-	defer func() { close(p.wait); p.cancel(); p.wait = nil }()
-	return p.cmd.Wait()
-}
 
 func (p *Container) String() string {
 	return fmt.Sprintf("argv: %q, filter: %v, rules: %d, flags: %#x, presets: %#x",