This was a problem when running IVS in a container. IVS would begin the process
of closing controller connections on receiving SIGTERM, but often mininet would
have continued on and removed the control network interface from the container
before it could send the FIN. The controller wouldn't know the connection had
been closed until it timed out much later.
mnexec already puts the shell into its own process group. Killing the entire
process group cleans up after any background processes the user left running.
The sysfs filesystem is [tagged][1] with a set of namespaces when mounted, taken
from the mounting process. Among other things, this controls which network
devices will show up in /sys/class/net and /sys/class/net/bonding_masters.
Without this change, mininet will not mount sysfs in a node. Attempting to
configure a bond interface in a node will only affect the parent namespace.
This change mounts a new sysfs filesystem in each node. To prevent this mount
from affecting the parent namespace the mount namespace is also unshared.
[1]: https://www.kernel.org/doc/Documentation/filesystems/sysfs-tagging.txt
This change uses the `Node.cmd` method instead of `Popen`. The `cmd` method
sends the input to a shell which may be in another namespace (if --innamespace
is in use), while `Popen` would always run in the root namespace.
Rich Lane