Very interesting issue, I think containerd cri need clean them up after restart.

I think the process created by crictl/kubectl exec should have the same lifecycle as the stream connection.

The current CRI plugin will keep waiting for the process to exit even if the connection is disconnected, this design also causes the exec sh process to leak

It's not just containerd restarts that cause exec processes to leak,kubectl exec and crictl exec that don't use the -ti flags, and use CTRL-C will cause exec processes to still be running. These processes can never be exited

Any exec without -d option will leak after containerd restart. It happens because exec client stop opening namedpipe and shim doesn't know that. I think a notify mechanism should be implemented, so that shim can close usingless exec actively.