Ref:opencontainers/runc#4620

sorry there's a lot to catch up on--when we see the cgroup.procs error, is the corresponding conmon still running? as in crio-conmon.scope still running despite crio-.scope not?

If so, then it may be a conmon issue of missing the container's exit. From the logs above, it looks like conmon may still be running though that would be very strange. If conmon missed the exit, then it wouldn't notify crio the container exited, which means crio's state wouldn't be updated, causing the kubelet to continue to do exec probes on the container (and for crictl to allow you to run exec on a container process that is gone).