Explore the use of clone to reduce the number of forks youki does in creating containers about youki

[Furisto]

Just a heads up, I am currently also making changes in this area, so please coordinate with me to avoid stepping on each others toes.

[utam0k]

5.7 is indeed too recent, so I think that when we support clone3, we should also support it to work with 5.4 at the same time.

[tsturzl]

What I got from @flxo's comment on #10, clone2 should give use benefits over the current fork strategy. I say we explore that first.

[utam0k]

I have implemented it with the following considerations in mind.
https://github.com/opencontainers/runc/blob/93a01cd4d0b7a0f08abc36c2ebc85a0543b25647/libcontainer/nsenter/nsexec.c#L680-L725

But now youki may get the advantage by using clone(2). I think this may be a challenge. This area has been well commented on by @YJDoc2 . If anyone wants to try it, I will support it.

[yihuaf]

Can I help to take look at this issue? My understanding is if we can enter user namespace and pid namespace together through a single clone(2), the resulting process can then become the init process (YP -> YI, instead of creating YC). We currently have to fork twice because we need to fork once to enter into user namespace, and fork again to enter into the correct pid namespace. Is this understanding correct?

[utam0k]

Can I help to take look at this issue? My understanding is if we can enter user namespace and pid namespace together through a single clone(2), the resulting process can then become the init process (YP -> YI, instead of creating YC). We currently have to fork twice because we need to fork once to enter into user namespace, and fork again to enter into the correct pid namespace. Is this understanding correct?

@yihuaf Thanks for your interest. Your understanding is correct. Would you like to take the challenge? However, I think we need to carefully explore whether the double fork had any security implications, and I'd like you to refer to the runc code and check that as well.
https://github.com/opencontainers/runc/blob/93a01cd4d0b7a0f08abc36c2ebc85a0543b25647/libcontainer/nsenter/nsexec.c#L680-L725

[utam0k]

Just a heads up, I am currently also making changes in this area, so please coordinate with me to avoid stepping on each others toes.

@Furisto I'm assuming this is finished, is that correct?

[yihuaf]

You can assign this to me then. I will keep the referenced runc code in mind.

[utam0k]

@yihuaf I'll assign you. I'm looking forward to your PR :)