sandbox: Stop and clean up containers that fail to create

A container that is created and added to a sandbox can still fail
the final creation steps. In this case, the container must be stopped
and have its resources cleaned up to prevent leaking sandbox mounts.

Fixes #2816

Signed-off-by: Evan Foster <efoster@adobe.com>

virtcontainers/sandbox.go

@@ -1,4 +1,5 @@
 // Copyright (c) 2016 Intel Corporation
+// Copyright (c) 2020 Adobe Inc.
 //
 // SPDX-License-Identifier: Apache-2.0
 //
@@ -1166,6 +1167,11 @@ func (s *Sandbox) CreateContainer(contConfig ContainerConfig) (VCContainer, erro
 	defer func() {
 		// Rollback if error happens.
 		if err != nil {
+			s.Logger().Warningf("Container %q could not be created, stopping it", contConfig.ID)
+			if err = c.stop(true); err != nil {
+				s.Logger().WithError(err).WithField("container-id", c.id).WithField("sandboxid", s.id).Warning("Could not delete container")
+			}
+			s.Logger().WithField("container-id", c.id).WithField("sandboxid", s.id).Info("Container was stopped. Removing from sandbox store")
 			s.removeContainer(c.id)
 		}
 	}()