Failure to remove container after successful command run (runc regression?)

Contributing guidelines and issue reporting guide

• I've read the contributing guidelines and wholeheartedly agree. I've also read the issue reporting guide.

Well-formed report checklist

• I have found a bug that the documentation does not mention anything about my problem
• I have found a bug that there are no open or closed issues that are related to my problem
• I have provided version/information about my environment and done my best to provide a reproducer

Description of bug

Bug description

Failure to remove container after successful command

I'm running a GitLab job that starts buildkitd using rootlesskit as a service and runs buildctl in another container.

This works on 0.17.3, but fails on 0.18.0.

Reproduction

Parameters to buildkitd: --oci-worker-no-process-sandbox

Dockerfile to reproduce the issue:

FROM debian:bookworm

RUN apt-get update

RUN apt-get install -y gpg

RUN mkdir --mode 700 /root/.gnupg

COPY <<EOF /key-params.txt
Key-Type: RSA
Key-Length: 4096
Subkey-Type: RSA
Subkey-Length: 4096
Name-Real: Your Name
Name-Email: your-email@example.com
Expire-Date: 2y
Passphrase: your-secure-passphrase
%commit
EOF

RUN gpg --batch --gen-key /key-params.txt

Error:

error: failed to solve: process "/bin/sh -c gpg --batch --gen-key /key-params.txt" did not complete successfully: buildkit-runc did not terminate successfully: exit status 1: unable to destroy container: unable to remove container's cgroup: rmdir /sys/fs/cgroup/ppispbbsap6h2q62rrceo2gtl: device or resource busy`

Version information

buildctl github.com/moby/buildkit v0.18.0 95d190ef4f18b57c717eaad703b67cb2be781ebb
buildkitd github.com/moby/buildkit v0.18.0 95d190ef4f18b57c717eaad703b67cb2be781ebb
Docker version 28.3.0, build 38b7060
Host: Ubuntu 22.04.3 LTS