Be careful making thread-aware syscalls in Go: lock the thread

A bug caused around 0.5% of container workloads to fail to start during load test. This post walks through the bug and its fix, an interesting mix of Linux namespaces, Go concurrency, and syscalls. The need to run a program in its own network namespace and mount namespace soci-snapshotter is an open-source containerd snapshotter plugin that enables pulling OCI images in lazy loading mode. It…