`RUN <process>` can leave processes running in the background

[fabiokung]

Some RUN instructions on Dockerfiles can leave processes running in the background (e.g. daemons). If these daemons are writting to files in the context dir, tar will fail with:

archive/tar: write too long

... when the layer is being snapshotted, because files were modified after the tar header was written.

One idea to prevent this is to execute RUN instructions in a nested PID namespace, and kill -9 its PID 1 before proceeding to the next instruction. Or perhaps a poor man's version of it with process groups to minimize the problem on environments that can't unshare a nested PID namespace.

It is easy to reproduce this when building Dockerfiles that use gradlew, which spawns a daemon by default, and is constantly writting to a log file inside the layer.

[dlorenc]

Yeah we should definitely fix this one. I think we'll need to use the process group technique.