rkt run: acquire lock on container directory and record pid

stage0 acquires an exclusive advisory lock on the container directory,
leaving the fd open when executing stage1/init with the fd value stored in
the environment variable RKT_LOCK_FD.

stage1's fakesdboot.so shim prevents closure of RKT_LOCK_FD in nspawn by
replacing the close with a O_CLOEXEC fcntl, retaining the lock handle until
nspawn exits.

fakesdboot.so has also been modified to intercept the clone syscall from
nspawn, recording the pid of the container's PID 1 in
"/var/lib/rkt/containers/$cuuid/pid"

With these changes one can do things like:

query container status:
 ```#!/bin/bash
 shopt -s nullglob
 for c in /var/lib/rkt/containers/*; do
  [ -e "$c/pid" ] || continue
  flock --exclusive --nonblock "$c" /bin/true || {
   cpid=$(cat "$c/pid")
   nsenter --mount --uts --ipc --pid --root --wd --target "${cpid}" systemctl status
  }
 done
```

gc dead containers:
 ```#!/bin/bash
 shopt -s nullglob
 for c in /var/lib/rkt/containers/*; do
  [ -e "$c/stage1" ] || continue
  flock --exclusive --nonblock "$c" rm -Rf "$c"
 done
```
Ok listen I,do remember going to this site but I really don't have any
ideal what it is or what it's about or what y'all keep texting me or what
it means so please stop thinking me... and again I'm sorry I....
On Dec 8, 2014 11:49 PM, "Vito Caputo" <notifications@github.com> wrote:

> In stage1/mkrootfs.sh:
>
> > +
> > +int close(int fd)
> > +{
> > +	if(lock_fd != -1 && fd == lock_fd)
> > +		return fcntl(fd, F_SETFD, FD_CLOEXEC);
> > +
> > +	return libc_close(fd);
> > +}
> > +
> > +long syscall(long number, ...)
> > +{
> > +	unsigned long	clone_flags;
> > +	va_list		ap;
> > +	long		ret;
> > +
> > +	if(number != __NR_clone)
>
> It should probably be an assert actually. This is not intended to be a
> general syscall() wrapper, it's specific to the clone syscall number, and
> in the case of systemd-nspawn that's perfectly ok.
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/coreos/rocket/pull/244/files#r21507003>.
>