fix: resolve containerd pid reliably before sending SIGHUP

[jpschmitt02]

Description

Fixes #2126.

SignalContainerd resolves containerd's PID from socket peer credentials, but enables SO_PASSCRED after connect(). containerd's gRPC server writes its first frames immediately on accept, and the kernel only records peer credentials on data queued while SO_PASSCRED is set — so the credentials can parse as pid=0 (with overflow uid/gid 65534). The PID was passed to kill(2) unvalidated, and kill(0, SIGHUP) signals the calling process's own process group: the toolkit killed itself, logged "Successfully signaled containerd", and crash-looped, with the real containerd kill landing on a later retry — well after node startup had completed. Details, production evidence, and a standalone reproducer are in #2126.

This change:

• extracts PID resolution into a containerdPid helper and enables SO_PASSCRED before connect() via net.Dialer.Control, so every message from the server carries credentials;
• rejects non-positive peer PIDs with an error, which feeds the existing retry loop (6 attempts, 5s backoff) instead of a signal.

Checklist

• No secrets, sensitive information, or unrelated changes
• Unit tests passing (make test)
• Lint checks passing (make lint)
• Test cases are added for new code paths
• Commits are signed-off and cryptographically signed

Testing

• New unit tests: TestContainerdPid resolves the PID of a mock unix server that writes immediately on accept (the containerd behavior that triggers the race), and TestContainerdPidNeverZero runs 200 iterations as a regression test — on the previous code this resolves pid=0 for a fraction of attempts (1–3/200 on an idle machine; 200/200 with a 50ms delay before setsockopt), with the fix it is deterministic.
• go build, go vet, golangci-lint run (v2.6.1), and the package test suite pass on go 1.26 (linux/arm64 container).
• The standalone reproducer in [Bug]: SignalContainerd can SIGHUP its own process group: SO_PASSCRED enabled after connect can resolve ucred.Pid=0 #2126 shows the before/after kernel behavior against both a live containerd 2.2.7 socket and the mock server.

🤖 Generated with Claude Code

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[cdesiniotis]

@jpschmitt02 thank you for the contribution! I left some minor review comments.

[cdesiniotis]

/ok to test e9fd70f

[coveralls]

Coverage Report for CI Build 37847168109

Coverage increased (+0.2%) to 44.795%

Details

• Coverage increased (+0.2%) from the base build.
• Patch coverage: 19 uncovered changes across 1 file (24 of 43 lines covered, 55.81%).
• No coverage regressions found.

Uncovered Changes

File	Changed	Covered	%
cmd/nvidia-ctk-installer/container/runtime/containerd/containerd_linux.go	43	24	55.81%

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	13564
Covered Lines:	6076
Line Coverage:	44.8%
Coverage Strength:	0.45 hits per line

---

💛 - Coveralls