ADR-021 Exec joins the container through a second fork

ExecSync runs a command inside a running container: every exec probe and every kubectl exec without a terminal. The command must see what the container sees, so it joins the container's namespaces, enters its root through /proc/<pid>/root, is placed in its cgroup, and gets the same capabilities, no_new_privs and seccomp filter as the container's first process.

Joining a PID namespace moves only the caller's future children into it, so the joining process forks once more and waits for the command, passing on its exit status. The command dies with it (PR_SET_PDEATHSIG), which is how a timeout kills both. Output beyond 16 MiB per stream is read and dropped, so a chatty command can neither block nor fill memory.

The cost: two processes per exec, where runc's nsenter uses the same two. Streaming exec, attach and port forwarding need an HTTP server of their own and are not built.