daemon: identify container exits by ProcessID

The Pid field of an exit event cannot be relied upon to differentiate
exits of the container's task from exits of other container processes,
i.e. execs. The Pid is reported by the runtime and is implementation-
defined so there is no guarantee that a task's pid is distinct from the
pids of any other process in the same container. In particular,
kata-containers reports the pid of the hypervisor for all exit events.
Update the daemon to differentiate container exits from exec exits by
inspecting the event's ProcessID.

The local_windows libcontainerd implementation already sets the
ProcessID to InitProcessName on container exit events. Update the remote
libcontainerd implementation to match. ContainerD guarantees that the
process ID of a task (container init process) is set to the
corresponding container ID, so use that invariant to distinguish task
exits from other process exits.

Signed-off-by: Cory Snider <csnider@mirantis.com>

daemon/monitor.go

@@ -148,7 +148,7 @@ func (daemon *Daemon) ProcessEvent(id string, e libcontainerdtypes.EventType, ei
 
 		daemon.LogContainerEvent(c, "oom")
 	case libcontainerdtypes.EventExit:
-		if int(ei.Pid) == c.Pid {
+		if ei.ProcessID == libcontainerdtypes.InitProcessName {
 			return daemon.handleContainerExit(c, &ei)
 		}
 

libcontainerd/remote/client.go

@@ -823,6 +823,9 @@ func (c *client) processEventStream(ctx context.Context, ns string) {
 					ExitCode:    t.ExitStatus,
 					ExitedAt:    t.ExitedAt,
 				}
+				if t.ID == t.ContainerID {
+					ei.ProcessID = libcontainerdtypes.InitProcessName
+				}
 			case *apievents.TaskOOM:
 				et = libcontainerdtypes.EventOOM
 				ei = libcontainerdtypes.EventInfo{