fix(healthcheck): release exec process resources after probe

[haytok]

Each invocation of a health check runs the user-defined command inside the container via containerd's task.Exec() API.

We can verify this in the probeHealthCheck section of the healthcheck package as follows:

func probeHealthCheck(ctx context.Context, task containerd.Task, hc *Healthcheck, processSpec *specs.Process) (*HealthcheckResult, error) {

...

	process, err := task.Exec(ctx, execID, processSpec, cio.NewCreator(
		cio.WithStreams(nil, outputBuf, outputBuf),
	))

...

	if err := process.Start(ctx); err != nil {
		log.G(ctx).Debugf("failed to start health check: %v", err)
		return nil, fmt.Errorf("start error: %w", err)
	}

	exitStatusC, err := process.Wait(ctx)
	if err != nil {
		return nil, fmt.Errorf("failed to wait for health check: %w", err)
	}

However, the current implementation does not release the resources allocated during the health check once the check is complete.

As a result, for example, pipes that should normally be deleted are not removed and continue to accumulate over time.

We can verify this behavior using the following command:

$ sudo nerdctl run -d --name=health --health-cmd="curl -f http://localhost" --health-interval=1s --health-timeout=1m0s --health-retries=3 --health-start-period=2s nginx:alpine
f2fdd8346a546bc6ef446980efdce1132a436fa63bd64a8ce6756c6197e7ec3f

$ TASK_PID=$(sudo nerdctl inspect health --format '{{.State.Pid}}')

$ SHIM_PID=$(ps -o ppid= -p $TASK_PID | tr -d ' ')

$ sudo ls -la /proc/$SHIM_PID/fd | grep pipe | head -3
lr-x------ 1 root root  64 May 17 20:51 100 -> pipe:[1093131]
lr-x------ 1 root root  64 May 17 20:52 101 -> pipe:[1092248]
lr-x------ 1 root root  64 May 17 20:52 102 -> pipe:[1092228]

$ sudo ls -la /proc/$SHIM_PID/fd | grep pipe | wc -l
16

$ sleep 10

$ sudo ls -la /proc/$SHIM_PID/fd | grep pipe | wc -l
26

So, this change adds a deferred process.Delete() after task.Exec() so that the allocated resources are released when the exec process completes.