in any case where we want to directly manipulate a pid on the host. this is unsafe, as we can encounter pid wrap.
for those cases, we need to check the pid is the one we want to access, whether it's creating a namespace path with /proc
or directly killing a container

also, add unit tests for this fix, as well as refactor a few of the oci tests

Signed-off-by: Peter Hunt <[email protected]>

pid namespaces were special cased as a namespace that was not managed, because they function differently

For the other namespaces, we can pass a new namespace to the runtime when that namespace is private to the pod
However, it would be a bother creating a new pid namespace (conmon would have to unshare the namespace, then do the bind mount)

Instead, mount the pid namespace *after* the sandbox is created. This way, the infra container's runtime config doesn't list the namespace (more on that below)
but subsequent containers created can join the namespace, instead of the proc entry. This further protects us from pid wrap

A consequence of not adding the file to the config is the restore case is a bit odd. The other namespaces can join the namespace listed in the restored config.json,
but the pid namespace is not saved in its config json.

Work around this by saving the pidns location to the infra container's runDir

this PR also adds unit tests, and refactors a couple of things to make tests pass

Signed-off-by: Peter Hunt <[email protected]>

Signed-off-by: Peter Hunt <[email protected]>

some changes this includes:
- allow for the infra container to not be created by the runtime, if sb.NeedsInfra() is false
- add concept of a 'spoofed' container. This allows us to make calls to ID(), Name(), and Description() without having the runtime create the container
- using spoof, change checks of podInfraContainer == nil to Spoofed(), as well as re-add Description() calls
- reorder some infra container creation code
- add unit tests for NeedsInfra and Spoofed
- add integration test for drop infra
- sysctls are configured in the runtime after the process unshares in the shared namespaces. since we aren't using a runtime, we need to repeat this step.
	- After unsharing, but before binding, configure the sysctls for the namespace.
- spoof container state

Signed-off-by: Peter Hunt <[email protected]>

Signed-off-by: Peter Hunt <[email protected]>

Signed-off-by: Peter Hunt <[email protected]>