idea: use CLONE_NEWCGROUP to fix racey cgroup assignment

[shoenig]

Instead of using a supervisor like the comment suggests, we should be able to just fork/exec the subprocess into
the cgroup created for it. Looks like this will be available in an upcoming version of Go

golang/go#51246
golang/go@3204e62

// Ideally we would fork a trusted helper, enter the cgroup ourselves, then
// exec into the user subprocess. This is fine for now.
return e.isolate()

[kolyshkin]

The proper link would be https://go.dev/cl/417695 (and the feature should be available in Go 1.20+).

Also please note this only works for cgroup v2 and requires Linux kernel >= v5.17.

[kolyshkin]

requires Linux kernel >= v5.17.

Just realized I made a typo, I meant Linux kernel >= 5.7 (released in June 2020).

Also, Go 1.20 is out :)

[shoenig]

Thanks @kolyshkin I should have time to pull this little project off the shelf again in the next couple of weeks. And also thanks for all the work you do!