Use a dedicated zygote process per container

[jprendes]

This PR creates a dedicated zygote process per container.
This fixes issues with libcontainer changing the shim process global state (like chdir), which leads to race conditions on multithreaded programs.
This also helps with throughput, as the global zygote process was a bottleneck (since it's single threaded).

TODO: Add tests

[Mossaka]

Great performance increase! I just ran a stress test on 1000 containers and with concurrency=32

Before
999 tasks succeeded, 0 tasks failed, 1 tasks didn't finish
elapsed time: 5s 898ms 226us 35ns

After
1000 tasks succeeded, 0 tasks failed, 0 tasks didn't finish
elapsed time: 2s 48ms 936us 565ns

[Mossaka]

Strangely, the labeler does not work for this PR.

This is the error msg:

An unknown config option was under C-containerd-shim-wasm: any-glob-to-any-file

Hope this PR could fix it: #829

---

Fixed it

[Copilot]

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

crates/containerd-shim-wasm/src/sys/unix/container/container.rs:39

• The error message 'Failed to obtain PID' could be more descriptive to help with debugging.

.context("Failed to obtain PID")

[Mossaka]

I think this change is worth a CHANGELOG mentioning how the perf is now different.