fix:fifo leak

cmd/nerdctl/container/container_run_test.go

@@ -40,6 +40,7 @@ import (
 	"github.com/containerd/nerdctl/mod/tigron/tig"
 
 	"github.com/containerd/nerdctl/v2/cmd/nerdctl/helpers"
+	"github.com/containerd/nerdctl/v2/pkg/rootlessutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil"
 	"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
 )
@@ -1058,3 +1059,47 @@ HEALTHCHECK --interval=30s --timeout=10s CMD wget -q --spider http://localhost:8
 
 	testCase.Run(t)
 }
+
+func countFIFOFiles(root string) (int, error) {
+	count := 0
+	err := filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if info.Mode()&os.ModeNamedPipe != 0 {
+			count++
+		}
+		return nil
+	})
+	return count, err
+}
+func TestCleanupFIFOs(t *testing.T) {
+	if rootlessutil.IsRootless() {
+		t.Skip("/run/containerd/fifo/ doesn't exist on rootless")
+	}
+	if runtime.GOOS == "windows" {
+		t.Skip("test is not compatible with windows")
+	}
+	testutil.DockerIncompatible(t)
+	testCase := nerdtest.Setup()
+	testCase.NoParallel = true
+	testCase.Setup = func(data test.Data, helpers test.Helpers) {
+		cmd := helpers.Command("run", "-it", "--rm", testutil.CommonImage, "date")
+		cmd.WithPseudoTTY()
+		cmd.Run(&test.Expected{
+			ExitCode: 0,
+		})
+		oldNumFifos, err := countFIFOFiles("/run/containerd/fifo/")
+		assert.NilError(t, err)
+
+		cmd = helpers.Command("run", "-it", "--rm", testutil.CommonImage, "date")
+		cmd.WithPseudoTTY()
+		cmd.Run(&test.Expected{
+			ExitCode: 0,
+		})
+		newNumFifos, err := countFIFOFiles("/run/containerd/fifo/")
+		assert.NilError(t, err)
+		assert.Equal(t, oldNumFifos, newNumFifos)
+	}
+	testCase.Run(t)
+}

pkg/cioutil/container_io.go

@@ -85,7 +85,9 @@ func (c *ncio) Close() error {
 
 		select {
 		case err := <-done:
-			return err
+			if err != nil {
+				lastErr = fmt.Errorf("faied to run cmd.wait: %w", err)
+			}
 		case <-time.After(binaryIOProcTermTimeout):
 
 			err := c.cmd.Process.Kill()