Comment 5 for bug 1645680

We discussed alternatives and options and agreed that we first have to file an upstream bug.

We should file a bug upstream and link it here.
Target is to understand if there is - or ever will be - something like a --oneshot option to exit it immediately. Preferably also controlled by an environment variable that can be inherited.

Another option - but probably over-engineering for that - could be a comeback of lxc-nschroot.
And clean up all in it when leaving, but that would be a major change and still error prone.
Some more background on alternatives: http://unix.stackexchange.com/questions/124162/reliable-way-to-jail-child-processes-using-nsenter

Fallback for now could be to add on the path out of the chroot (where we already clean the changed we made to rc.d policy) in curtin that does the cleanup "killall dirmngr |:" and not needed but maybe also the same for gpg-agent maybe.
A step further to be protected could be to add --younger-than and --user to the killall.
Add a comment that once gnupg came up with something official we should migrate to use that (long term).

Actions:
- gnupg upstream discussion
- The workaround into yakkety as fixup for now
- mid Term discussion on team sprint about using namespaces to solve it more generally