Hacker News Reader

PR_SET_CHILD_SUBREAPER was added in linux 3.4 (2012) and does your points 1..3, you got to kill stuff manually.

Workes well, needs bo superuser or special filesystems, always composable. Not sure why people don't use it much.

It requires a bit of annoying machinery since you have to dedicate a process to being a subreaper. Still it's probably the best option, I made https://github.com/catern/supervise with it, see also https://catern.com/process.html