先保存容器状态，再允许初始化进程继续

169	// Tell our parent that we're ready to exec. This must be done before the170	// Seccomp rules have been applied, because we need to be able to read and171	// write to a socket.172	if err := syncParentReady(l.pipe); err != nil {173		return fmt.Errorf("sync ready: %w", err)174	}175	if err := selinux.SetExecLabel(l.config.ProcessLabel); err != nil {176		return fmt.Errorf("can't set process label: %w", err)177	}178	defer selinux.SetExecLabel("") //nolint: errcheck

414// syncParentReady sends to the given pipe a JSON payload which indicates that415// the init is ready to Exec the child process. It then waits for the parent to416// indicate that it is cleared to Exec.417func syncParentReady(pipe *syncSocket) error {418	// Tell parent.419	if err := writeSync(pipe, procReady); err != nil {420		return err421	}422	// Wait for parent to give the all-clear.423	return readSync(pipe, procRun)424}

710		case procReady:711			seenProcReady = true712			// Set rlimits, this has to be done here because we lose permissions713			// to raise the limits once we enter a user-namespace714			if err := setupRlimits(p.config.Rlimits, p.pid()); err != nil {715				return fmt.Errorf("error setting rlimits for ready process: %w", err)716			}717718			// generate a timestamp indicating when the container was started719			p.container.created = time.Now().UTC()720			p.container.state = &createdState{721				c: p.container,722			}

724			// NOTE: If the procRun state has been synced and the725			// runc-create process has been killed for some reason,726			// the runc-init[2:stage] process will be leaky. And727			// the runc command also fails to parse root directory728			// because the container doesn't have state.json.729			//730			// In order to cleanup the runc-init[2:stage] by731			// runc-delete/stop, we should store the status before732			// procRun sync.733			state, uerr := p.container.updateState(p)734			if uerr != nil {735				return fmt.Errorf("unable to store init state: %w", uerr)736			}737			p.container.initProcessStartTime = state.InitProcessStartTime738739			// Sync with child.740			if err := writeSync(p.comm.syncSockParent, procRun); err != nil {741				return err742			}

825	err = utils.WriteJSON(tmpFile, s)826	if err != nil {827		return err828	}829	err = tmpFile.Close()830	if err != nil {831		return err832	}833834	stateFilePath := filepath.Join(c.stateDir, stateFilename)835	return os.Rename(tmpFile.Name(), stateFilePath)

780	if err := p.comm.syncSockParent.Shutdown(unix.SHUT_WR); err != nil && ierr == nil {781		return err782	}783	if !seenProcReady && ierr == nil {784		ierr = errors.New("procReady not received")785	}786	if ierr != nil {787		return fmt.Errorf("error during container init: %w", ierr)788	}789	return nil