CreateContainer: pass TerminationGracePeriod

Enable passing of kubernetes termination grace period
down to OCI runtime, as an annotation for systemd.

This builds on top of

* opencontainers/runc#2224
  (or containers/crun#266)

and is part of the fix for

* kubernetes/kubernetes#77873

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

server/container_create_linux.go

@@ -41,6 +41,9 @@ import (
 // A lower value would result in the container failing to start.
 const minMemoryLimit = 12582912
 
+// Copied from k8s.io/kubernetes/pkg/kubelet/kuberuntime/labels.go
+const podTerminationGracePeriodLabel = "io.kubernetes.pod.terminationGracePeriod"
+
 var (
 	_cgroupv2HasHugetlbOnce sync.Once
 	_cgroupv2HasHugetlb     bool
@@ -534,6 +537,15 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID, contai
 		}
 		specgen.SetLinuxCgroupsPath(cgPath)
 
+		if t, ok := kubeAnnotations[podTerminationGracePeriodLabel]; ok {
+			// currently only supported by systemd, see
+			// https://github.com/opencontainers/runc/pull/2224
+			if useSystemd {
+				specgen.AddAnnotation("org.systemd.property.TimeoutStopUSec",
+					"uint64 "+t+"000000") // sec to usec
+			}
+		}
+
 		if privileged {
 			specgen.SetupPrivileged(true)
 		} else {