Call Prestart hook after namespaces have been set

This simply move the call to the Prestart hooks to be made once we
receive the procReady message from the client.

This is necessary as we had to move the setns calls within nsexec in
order to be accomodate joining namespaces that only affect future
children (e.g. NEWPID).

Signed-off-by: Kenfe-Mickael Laventure <[email protected]>

libcontainer/process_linux.go

@@ -249,19 +249,6 @@ func (p *initProcess) start() error {
 			p.manager.Destroy()
 		}
 	}()
-	if p.config.Config.Hooks != nil {
-		s := configs.HookState{
-			Version: p.container.config.Version,
-			ID:      p.container.id,
-			Pid:     p.pid(),
-			Root:    p.config.Config.Rootfs,
-		}
-		for _, hook := range p.config.Config.Hooks.Prestart {
-			if err := hook.Run(s); err != nil {
-				return newSystemError(err)
-			}
-		}
-	}
 	if err := p.createNetworkInterfaces(); err != nil {
 		return newSystemError(err)
 	}
@@ -287,6 +274,20 @@ loop:
 			if err := p.manager.Set(p.config.Config); err != nil {
 				return newSystemError(err)
 			}
+			// call prestart hooks
+			if p.config.Config.Hooks != nil {
+				s := configs.HookState{
+					Version: p.container.config.Version,
+					ID:      p.container.id,
+					Pid:     p.pid(),
+					Root:    p.config.Config.Rootfs,
+				}
+				for _, hook := range p.config.Config.Hooks.Prestart {
+					if err := hook.Run(s); err != nil {
+						return newSystemError(err)
+					}
+				}
+			}
 			// Sync with child.
 			if err := utils.WriteJSON(p.parentPipe, syncT{procRun}); err != nil {
 				return newSystemError(err)