Reliably using cgroups to prevent leaking (grand-)child processes from unprivileged programs

[KJTsanaktsidis]

I'm often it seems writing programs that need to spawn child processes and make sure the children don't leave any sub-processes of their own lying around; think things like:

• CI test runners where we want to fail the build if the test leaves junk background processes running, or
• Forking really badly behaved vendor provided binaries insist on daemonizing themselves after doing their task

cgroups of course provides an almost perfect solution to this:

• Look up the parent program's current group in /proc/self/cgroups,
• Parent process creates a new cgroup under /sys/fs/cgroup/my_cgroup/new-cgroup-abc
• betweenfork and exec of the child program, have the child add itself to new-cgroup-abc/cgroup.procs
• After waiting for the child program, the parent can inspect if there are any left-behind processes in new-cgroup-abc/cgroup.procs and kill them with new-cgroup-abc/cgroup.kill
• Remove the /sys/fs/cgroup/my_cgroup/new-cgroup-abc directory

(this doesn't fall afoul of the "no-internal-processes" rule because we set no resource limits or anything; we're purely using the cgroups for race-free process management here).

I say almost-perfect, because this requires the system administrator to have delegated the cgroup hierarchy to the service by chown'ing it to the user the service is running as (with Delegate= in systemd, or via appropriate options with docker/podman).

I guess the delegation by system administrator is required because it allows the process to muck around with resource assignments? However, it seems to me that this use-case of "I want to spawn a tree of children and reliably clean it up" isn't really something it makes sense to allow sysadmins to limit by policy; rather, this seems like it should be a universally available enhancement to the classic Unix process API.

I'm curious how other people are handling these sorts of use cases? Is there a better API I don't know about with less sysadmin overhead?