Wait for sandbox process when waiting for root container

Closes #71

PiperOrigin-RevId: 202532762
Change-Id: I80a446ff638672ff08e6fd853cd77e28dd05d540

runsc/container/container.go

@@ -449,7 +449,7 @@ func (c *Container) Destroy() error {
 
 	// If we are the first container in the sandbox, take the sandbox down
 	// as well.
-	if c.Sandbox != nil && c.Sandbox.ID == c.ID {
+	if c.Sandbox != nil && c.Sandbox.IsRootContainer(c.ID) {
 		if err := c.Sandbox.Destroy(); err != nil {
 			log.Warningf("Failed to destroy sandbox %q: %v", c.Sandbox.ID, err)
 		}

runsc/sandbox/sandbox.go

@@ -434,9 +434,29 @@ func (s *Sandbox) Wait(cid string) (syscall.WaitStatus, error) {
 	if err := conn.Call(boot.ContainerWait, &cid, &ws); err != nil {
 		return ws, fmt.Errorf("err waiting on container %q: %v", cid, err)
 	}
+
+	if s.IsRootContainer(cid) {
+		// If waiting for the root, give some time for the sandbox process to exit
+		// to prevent races with resources that might still be in use.
+		timeout := time.Now().Add(time.Second)
+		log.Debugf("Waiting for the sandbox process to exit")
+		for s.IsRunning() {
+			if time.Now().After(timeout) {
+				log.Debugf("Timeout waiting for sandbox process to exit")
+				break
+			}
+			time.Sleep(100 * time.Millisecond)
+		}
+	}
 	return ws, nil
 }
 
+// IsRootContainer returns true if the specified container ID belongs to the
+// root container.
+func (s *Sandbox) IsRootContainer(cid string) bool {
+	return s.ID == cid
+}
+
 // Stop stops the container in the sandbox.
 func (s *Sandbox) Stop(cid string) error {
 	// TODO: This should stop the container with the given ID