code: func processSetKeyReexec() {
  	var err error
  
  	// Return a failure to the calling process via ExitCode
  	defer func() {
  		if err != nil {
  			logrus.Fatalf("%v", err)
  		}
  	}()
  
  	execRoot := flag.String("exec-root", defaultExecRoot, "docker exec root")
  	flag.Parse()
  
  	// expecting 3 os.Args {[0]="libnetwork-setkey", [1]=<container-id>, [2]=<controller-id> }
  	// (i.e. expecting 2 flag.Args())
  	args := flag.Args()
  	if len(args) < 2 {
  		err = fmt.Errorf("Re-exec expects 2 args (after parsing flags), received : %d", len(args))
  		return
  	}
  	containerID, controllerID := args[0], args[1]
  
  	// We expect specs.State as a json string in <stdin>
  	stateBuf, err := ioutil.ReadAll(os.Stdin)
  	if err != nil {
  		return
  	}
  	var state specs.State
  	if err = json.Unmarshal(stateBuf, &state); err != nil {
  		return
  	}
  
  	err = SetExternalKey(controllerID, containerID, fmt.Sprintf("/proc/%d/ns/net", state.Pid), *execRoot)
  }
docs: // processSetKeyReexec is a private function that must be called only on an reexec path
  // It expects 3 args { [0] = "libnetwork-setkey", [1] = <container-id>, [2] = <controller-id> }
  // It also expects specs.State as a json string in <stdin>
  // Refer to https://github.com/opencontainers/runc/pull/160/ for more information
  // The docker exec-root can be specified as "-exec-root" flag. The default value is "/run/docker".