empeira 0.1.0.pre.alpha.6 → 0.1.0.pre.alpha.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a6bd2bd179b9a3fa789f2342e0646d9e5d681941cd2df234770cf8a94a01f31
-  data.tar.gz: 8925fd4ded29c7206cfe6c1d2d072f7a41a649582504dbf1a29232543525aacf
+  metadata.gz: 3f0b0c2558d0799e27a8985ab84de156e8de49741ec078965338d0c1638ab0d3
+  data.tar.gz: 5607b7c52a5fb130b7a8534318aecb89c0093709ea7d9b65fcccef86da745fab
 SHA512:
-  metadata.gz: 988ab09ce7e604a6bddfe1f5acad7f2847939b96e33ad6b73d06a03d49a6aafc7048222f5bb2a26eddb412dd75442b6d57addddd9558cb974a675603c11a1fb6
-  data.tar.gz: 6d5c737b4f18f0d400f279c59b0b10f7e68bb3b564c649b42207e0f447ba7b68a2acd93b34258ca7d025252d91de4c2befcfc741b85195f23a8b8feecaa99e46
+  metadata.gz: 5a0eaa2c61a33c12d49632cfa4690f9e369bbae26a1d4cf4f9b1c5ae0d3178d6aed0f14f28721d1a83e1332319b02cf5a899f8f31287b88816b2e2e7ba3e8366
+  data.tar.gz: ed8ab5306f5948ed1f81c8e1b00121cb6360490e35daf915b95c441a42174552320b08fcc37a193eb2e1011b694eb1f85932739df3ee0d2274b182fded0b6957

data/config/defaults.yaml

@@ -55,6 +55,7 @@ network:
     infrastructure: []
   redirects: []
 proxy:
+  memory: 512
   nodes:
     enabled: false
     global: []

data/docs/architecture.md

@@ -93,6 +93,24 @@ system SSH. Guest commands use argument arrays and owned process groups; stdout
 and stderr stream in bounded frames without truncation. Timeouts, interrupts and
 host disconnects terminate those groups. Binary uploads are SHA-256 verified,
 staged privately and atomically installed in the real guest filesystem.
+The management supervisor and workers retain `umask 077`, private 0700 staging and
+explicit upload modes. Only executed commands (including Puppet and its children)
+and PTY shells start with `umask 022`. Previously the worker's private mask leaked
+into these children, causing ordinary file/directory creation to yield 0600/0700;
+APT could not read public keys created by commands that omitted an explicit mode.
+Commands still run as numeric root, and explicit private modes remain private.
+Empeira's native APT acquisition already copies its own signing key with mode 0644
+under `/var/tmp`; it does not create project repository keys under
+`/usr/share/keyrings` or `/etc/apt/keyrings`.
+
+This correction applies to newly seeded VMs. Recreate disposable existing VMs to
+receive the updated adapter; `up` does not replace seeded management code or repair
+existing files. No directory-wide chmod or post-Puppet keyring rewrite is performed.
+A catalog explicitly setting mode 0600, or a tool using private temporary files,
+still needs correction at its owning resource. Project-managed public APT keys
+should specify root:root and 0644, with searchable parent directories. The reported
+Docker/Elastic/project key names are absent from Empeira's source; their exact
+catalog resources require inspection in the affected project.
 
 The QEMU monitor verifies workspace/node/instance identity before management.
 A 0700 host directory and 0600 Unix socket restrict access; recorded device/inode

data/docs/configuration.md

@@ -159,6 +159,7 @@ release version. A partial project mapping may omit it and inherit the default.
 | `network.egress.nodes` | Node-only direct TCP host/port grants, `[]`; arrays replace |
 | `network.egress.infrastructure` | Infrastructure-only direct TCP host/port grants, `[]`; arrays replace |
 | `network.redirects` | Exact IPv4/protocol/port endpoints redirected to enabled internal services, `[]` |
+| `proxy.memory` | Positive integer MiB, `512` per Squid container; shared regular proxy and separate temporary bootstrap proxy each use this limit; does not enable either proxy |
 | `proxy.nodes.enabled` | Boolean, `false`; enables normal node HTTP/HTTPS proxy access |
 | `proxy.nodes.global` | DNS destination array, `[]` |
 | `proxy.nodes.rules` | Additive node hostname-glob rules with `hosts` and `allow` arrays, `[]` |
@@ -970,7 +971,10 @@ The default control plane has six containers, or seven with the proxy, plus the
 runtime's peer-network adapter. Requested limits
 are 1536 MiB for the server (768 MiB JVM heap), 768 MiB for PuppetDB (256 MiB heap),
 256 MiB for PostgreSQL, 64 MiB for DNS, 96 MiB for the database relay, 64 MiB
-for the gateway and 128 MiB for Squid. The control-plane memory ceiling is about
+for the gateway and 512 MiB for the regular Squid proxy (`proxy.memory`). A temporary
+bootstrap Squid container has its own additional limit of the same size while
+running. These are per-container limits, not reservations or measured peaks.
+The control-plane memory ceiling is about
 2.7 GiB without the proxy, excluding the peer adapter and nodes. The server gets two CPUs and each
 other service one. Actual idle use is lower and varies by provider and platform.
 `up` automatically pulls missing remote images and builds missing recipe images.

data/docs/nodes.md

@@ -296,12 +296,18 @@ Empeira uses the private privileged VirtIO channel internally to install the VM
 enroll certificates and run Puppet. User-facing SSH opens an ordinary interactive
 login without the internal provisioning command or automatic sudo.
 
-VM exec, shell, SSH and serial sessions release the workspace mutation lock after ownership and
-running-state checks. Parallel sessions and read-only status remain available. A
+Container SSH and VM exec, shell, SSH and serial sessions release the workspace
+mutation lock after ownership and running-state checks. Parallel sessions and read-only status remain available. A
 shared instance guard prevents `node stop`, `node destroy` or restart from replacing
-the VM while a session is attached; detach first and retry the conflicting operation.
+that node instance while a session is attached; detach first and retry the conflicting operation.
 Other nodes and workspace commands can proceed. Instance lock files stay stable;
 their open descriptors are released on detach, disconnect, errors and signals.
+Container SSH preparation remains inside the workspace transaction and pins the
+observed container ID before releasing that lock. Concurrent SSH sessions to the
+same or different nodes are allowed. Container `exec` and `shell` retain their
+existing workspace transaction. Mutations still use the exclusive workspace lock;
+`down` continues to require node removal, and destroy retains attached instances
+for a retry after sessions detach.
 
 ## Root diagnostic commands and interactive shell
 

data/docs/proxy.md

@@ -6,6 +6,7 @@ the node scope makes its global and hostname rules available to nodes:
 
 ```yaml
 proxy:
+  memory: 512 # MiB per regular or temporary bootstrap Squid container
   nodes:
     enabled: true
     global:
@@ -48,6 +49,57 @@ The diagnostic resolves desired policy even for a hostname that does not exist.
 It reports when the normal proxy is disabled and does not claim that live
 infrastructure has already been reconciled.
 
+## Memory budget and startup diagnostics
+
+`proxy.memory` is a positive integer MiB limit per managed Squid container,
+defaulting to 512. Node access and infrastructure access share one regular proxy;
+the same limit applies when either or both scopes are enabled. The temporary,
+authenticated bootstrap proxy inherits this value as its own container limit.
+If both containers run simultaneously, each has a separate 512 MiB limit by
+default (1024 MiB combined), not one shared 512 MiB budget. These limits are
+neither memory reservations nor measured peak consumption.
+
+Existing configurations inherit the default. Setting `proxy.memory` alone does
+not enable a regular proxy or start a bootstrap proxy. Node and infrastructure
+access keep independent activation switches and destination grants. Bootstrap
+keeps its separate temporary activation, authentication and destination grants.
+Docker and Podman use the same native
+`--memory` argument, including rootless Podman. The engine host (or its Linux VM on
+macOS) still needs enough available memory and working cgroup memory controls.
+
+The former fixed 128 MiB limit was below the reported killed process's approximately
+139 MiB resident footprint (anonymous plus file RSS), before accounting for other
+cgroup charges. The 512 MiB default provides headroom for startup, concurrent
+requests, DNS and allocator overhead. It is a conservative budget, not a measured
+maximum or a guarantee for arbitrary workloads. Validate actual peak usage with
+native container stats and host cgroup/OOM diagnostics in the affected environment.
+
+Generated policy keeps `cache deny all`, sets `cache_mem 16 MB`, and explicitly uses
+`workers 1` together with `-N` for one foreground main process. An explicit
+`workers 0` causes Squid 7.7 to exit during startup with
+`FATAL: check failed: theProcessCount > 0`; `-N` already selects foreground mode.
+No disk cache is configured. Squid's [cache_mem documentation](https://www.squid-cache.org/Doc/config/cache_mem/)
+describes an object-memory target, not a cap on process RSS; in-flight requests can
+exceed it. The [workers setting](https://www.squid-cache.org/Doc/config/workers/)
+avoids multiplying main-process memory. These settings preserve DNS, source-bound
+client rules and the HTTP/HTTPS destination policy.
+
+If the regular proxy exits during startup or its readiness check, diagnostics
+include the native exit code, `OOMKilled` observation and actual inspected memory
+limit in bytes/MiB when available. Only `OOMKilled=true` confirms an OOM kill. Exit 137 alone does not:
+external SIGKILL can produce the same exit. Missing observations are explicitly
+reported as unavailable, and a runtime-reported zero limit is shown as unlimited.
+For confirmed proxy OOM, increase `proxy.memory`, check engine-host capacity, and
+run `empeira up`. Native logs remain available via the displayed runtime command.
+The temporary bootstrap proxy uses its own endpoint verification and readiness
+probe; the new regular-proxy OOM diagnostics do not apply to that separate path.
+
+A memory change replaces only the regular proxy on the next `up`; CA/database
+storage, nodes and unrelated services retain their identities. Unchanged runs
+reuse the proxy. Generated policy changes use the existing readiness/reload checkpoint.
+Replacing or reloading the proxy may interrupt active proxy connections.
+The next temporary bootstrap proxy receives the configured limit when created.
+
 ## Matching and destinations
 
 Defaults are `proxy.nodes.global: []` and `proxy.nodes.rules: []`. Every node receives

data/lib/empeira/build.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.0-alpha.6",
-  "revision": "398c47f3abc571dd3c6668f62399eb624b465019",
-  "build_time": "2026-10-23T07:29:14Z"
+  "version": "0.1.0-alpha.7",
+  "revision": "16b913976904b1abadca0ba55d571039e762b997",
+  "build_time": "2026-11-13T14:35:59Z"
 }

data/lib/empeira/configuration/schema.rb

@@ -22,7 +22,8 @@ module Empeira
         'puppetdb' => { 'enabled' => :boolean, 'memory' => :positive_integer, 'runtime' => :puppetdb_runtime },
         'network' => { 'egress' => { 'nodes' => :network_egress, 'infrastructure' => :network_egress },
                        'redirects' => :network_redirects },
-        'proxy' => { 'nodes' => { 'enabled' => :boolean, 'global' => :allowlist, 'rules' => :proxy_rules },
+        'proxy' => { 'memory' => :positive_integer,
+                     'nodes' => { 'enabled' => :boolean, 'global' => :allowlist, 'rules' => :proxy_rules },
                      'infrastructure' => { 'enabled' => :boolean, 'allow' => :allowlist } },
         'vm' => { 'disk' => :vm_disk, 'interfaces' => :vm_interfaces,
                   'console' => { 'root_password' => :optional_string } },

data/lib/empeira/control_plane/controller.rb

@@ -528,8 +528,7 @@ module Empeira
       def require_started!(key, resource)
         return if resource.fetch('state') == 'running'
 
-        raise Error, "Managed service #{key} is #{resource.fetch('state')} after start; " \
-                     "inspect #{@context.container_engine} logs #{resource.fetch('id')}"
+        raise StartupFailure.new(key: key, resource: resource, engine: @context.container_engine)
       end
 
       def update_hosts(reload_proxy: false)

data/lib/empeira/control_plane/health.rb

@@ -14,6 +14,8 @@ module Empeira
         deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + @plan.config.dig('server', 'timeout')
         loop do
           return if ready?(key, resources)
+
+          verify_proxy_running!(resources) if key == 'proxy'
           if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
             raise Error,
                   "#{key} did not become ready within server.timeout; inspect empeira status and owned service logs\n" \
@@ -52,6 +54,15 @@ module Empeira
 
       private
 
+      def verify_proxy_running!(resources)
+        resource = @runtime.inspect_service(@plan.definitions.fetch('proxy'),
+                                            expected_id: resources.fetch('proxy').fetch('id'))
+        raise Error, 'Managed service proxy disappeared during readiness' unless resource
+        return if resource.fetch('state') == 'running'
+
+        raise StartupFailure.new(key: 'proxy', resource: resource, engine: @plan.context.container_engine)
+      end
+
       def puppetdb_ready?(server)
         path = '/pdb/query/v4/nodes'
         check(server, [*http_curl, "http://puppetdb.empeira.internal:8080#{path}"]) &&

data/lib/empeira/control_plane/plan.rb

@@ -330,7 +330,7 @@ module Empeira
         configured = config.dig('images', 'proxy')
         {
           **Images::Configuration.artifact(configured, registry: config.dig('images', 'registry')),
-          memory: 128, runtime_ip: subnet && Network::Gateway.address(subnet, 'proxy'),
+          memory: config.dig('proxy', 'memory'), runtime_ip: subnet && Network::Gateway.address(subnet, 'proxy'),
           sysctls: { 'net.ipv4.ip_forward' => '0', 'net.ipv6.conf.all.disable_ipv6' => '1',
                      'net.ipv6.conf.default.disable_ipv6' => '1' }, entrypoint: '/usr/sbin/squid-gnutls',
           command: ['-N', '-f', '/empeira-proxy/squid.conf'],

data/lib/empeira/control_plane/startup_failure.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Empeira
+  module ControlPlane
+    # Report only native observations; SIGKILL alone does not establish an OOM kill.
+    class StartupFailure < Error
+      def initialize(key:, resource:, engine:)
+        @resource = resource
+        message = "Managed service #{key} is #{resource.fetch('state')} after start; " \
+                  "inspect #{engine} logs #{resource.fetch('id')}; " \
+                  "#{exit_diagnostic}; #{oom_diagnostic}; #{memory_diagnostic}"
+        if key == 'proxy' && resource['oom_killed'] == true
+          message += '; increase proxy.memory (MiB) in .empeira.yaml and run empeira up; ' \
+                     'check available memory in the container engine host/VM'
+        end
+        super(Execution::Diagnostics.safe_text(message))
+      end
+
+      private
+
+      def exit_diagnostic
+        code = @resource['exit_code']
+        code.is_a?(Integer) ? "exit code #{code}" : 'exit code unavailable'
+      end
+
+      def oom_diagnostic
+        case @resource['oom_killed']
+        when true then 'confirmed OOM kill (OOMKilled=true)'
+        when false then 'OOMKilled=false'
+        else 'OOM status unavailable'
+        end
+      end
+
+      def memory_diagnostic
+        bytes = @resource.dig('host_config', 'Memory')
+        return 'memory limit unavailable' unless bytes.is_a?(Integer) && bytes >= 0
+        return 'memory limit unlimited (runtime reports 0)' if bytes.zero?
+
+        "memory limit #{bytes} bytes (#{format('%g', bytes.fdiv(1024 * 1024))} MiB)"
+      end
+    end
+  end
+end

data/lib/empeira/infrastructure/cleanup.rb

@@ -107,6 +107,12 @@ module Empeira
       end
 
       def remove_container(record)
+        return remove_container_instance(record) unless record['id']
+
+        Node::SessionLock.new(context: @context, record: record).exclusive { remove_container_instance(record) }
+      end
+
+      def remove_container_instance(record)
         name = record.fetch('hostname')
         path = @store.directory.join('containers', name)
         OwnedFiles.verify_removable!(path, root: @store.directory)

data/lib/empeira/infrastructure/session_lock.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module Empeira
+  module Infrastructure
+    # Pin one node instance during access without retaining the workspace mutation lock.
+    class SessionLock
+      def initialize(path:, subject:)
+        @path = path
+        @subject = subject
+      end
+
+      def acquire(shared:)
+        lock = open_lock
+        mode = shared ? File::LOCK_SH : File::LOCK_EX
+        unless lock.flock(mode | File::LOCK_NB)
+          raise Infrastructure::Locked,
+                "#{@subject} instance has active access or lifecycle operations; detach and retry"
+        end
+
+        lock.close_on_exec = true
+        acquired = true
+        lock
+      ensure
+        lock&.close unless acquired
+      end
+
+      def exclusive
+        lock = acquire(shared: false)
+        yield
+      ensure
+        lock&.close
+      end
+
+      private
+
+      def open_lock
+        if @path.dirname.symlink? || @path.symlink?
+          raise Providers::OwnershipError,
+                "#{@subject} session lock path is unsafe"
+        end
+
+        # A successful open passes descriptor ownership to acquire.
+        # rubocop:disable-next Style/FileOpen
+        lock = File.open(@path, File::RDWR | File::CREAT | File::NOFOLLOW, 0o600)
+        verify_lock!(lock.stat)
+
+        opened = true
+        lock
+      ensure
+        lock&.close unless opened
+      end
+
+      def verify_lock!(metadata)
+        return if metadata.file? && metadata.uid == Process.uid && metadata.mode.nobits?(0o077)
+
+        raise Providers::OwnershipError, "#{@subject} session lock ownership is invalid"
+      end
+    end
+  end
+end

data/lib/empeira/network/proxy_policy.rb

@@ -27,7 +27,7 @@ module Empeira
       def configuration
         [
           'dns_nameservers @EMPEIRA_DNS@', 'http_port 3128',
-          'visible_hostname empeira-proxy', 'cache deny all',
+          'visible_hostname empeira-proxy', 'cache deny all', 'cache_mem 16 MB', 'workers 1',
           'access_log none', 'cache_log /dev/null', 'pid_filename none',
           client_rule, 'http_access deny !clients',
           'request_header_access Proxy-Authorization deny all',

data/lib/empeira/node/container_lifecycle.rb

@@ -23,12 +23,15 @@ module Empeira
 
       def stop(name:)
         mutate do
-          resource = observed(fetch(name))
+          record = fetch(name)
+          resource = observed(record)
           raise Error, 'Node is missing; inspect node list' unless resource
 
-          changed = resource['state'] == 'running'
-          @runtime.stop_service(resource) if changed
-          lifecycle_result(name.downcase, :stopped, changed: changed)
+          SessionLock.new(context: context, record: record).exclusive do
+            changed = resource['state'] == 'running'
+            @runtime.stop_service(resource) if changed
+            lifecycle_result(name.downcase, :stopped, changed: changed)
+          end
         end
       end
 
@@ -73,27 +76,19 @@ module Empeira
         end
       end
 
-      # rubocop:disable-next Metrics/AbcSize, Metrics/MethodLength -- Verify the owned endpoint before selecting a guest tunnel.
       def ssh(name:, user: nil, identity: nil, port: nil)
-        mutate do
-          port = Configuration::SSHPreferences.port!(port || 22)
-          record = fetch(name)
-          resource = running(record)
-          unless record['ssh_host'] && record['ssh_port']
-            raise Error, 'Node has no managed SSH endpoint; destroy and recreate it with the current Empeira image'
-          end
-
-          proxy = if port != 22
-                    @runtime.ssh_proxy_command(resource, port: port)
-                  elsif record['ssh_transport'] == 'tunnel'
-                    @runtime.ssh_proxy_command(resource)
-                  end
-          record = record.merge('ssh_port' => port) if port != 22
-          UserSSH.new(runner: @runner, credentials: ssh_credentials(record.fetch('hostname')),
-                      proxy_command: proxy, home: context.locations.home).session(
-                        record, user: user, identity: identity
-                      )
+        lock = nil
+        client, record = mutate do
+          current = fetch(name)
+          resource = running(current)
+          lock = SessionLock.new(context: context, record: current).acquire(shared: true)
+          prepare_ssh(current, resource, port)
         end
+        Execution::Terminal.with_interrupts do
+          @progress.streaming { client.session(record, user: user, identity: identity) }
+        end
+      ensure
+        lock&.close
       end
 
       def logs(name:)
@@ -107,6 +102,22 @@ module Empeira
 
       private
 
+      def prepare_ssh(record, resource, port)
+        port = Configuration::SSHPreferences.port!(port || 22)
+        unless record['ssh_host'] && record['ssh_port']
+          raise Error, 'Node has no managed SSH endpoint; destroy and recreate it with the current Empeira image'
+        end
+
+        proxy = if port != 22
+                  @runtime.ssh_proxy_command(resource, port: port)
+                elsif record['ssh_transport'] == 'tunnel'
+                  @runtime.ssh_proxy_command(resource)
+                end
+        client = UserSSH.new(runner: @runner, credentials: ssh_credentials(record.fetch('hostname')),
+                             proxy_command: proxy, home: context.locations.home)
+        [client, port == 22 ? record : record.merge('ssh_port' => port)]
+      end
+
       def require_provisioned!(record)
         return if record['provisioned']
 
@@ -117,6 +128,13 @@ module Empeira
         record = @nodes[name]
         return unless record
 
+        SessionLock.new(context: context, record: record).exclusive do
+          remove_node_instance(name, record, certificates: certificates)
+        end
+      end
+
+      # rubocop:disable-next Naming/PredicateMethod -- Removes an owned instance and persists its absence.
+      def remove_node_instance(name, record, certificates:)
         observed(record)
         if certificates && record['certificate_key']
           Certificates.new(runtime: @runtime, server: ready_server).clean(record)

data/lib/empeira/node/session_lock.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require 'digest'
+
+module Empeira
+  module Node
+    # Native container IDs pin access to an observed instance, never just its reusable name.
+    class SessionLock < Infrastructure::SessionLock
+      def initialize(context:, record:)
+        id = record.fetch('id')
+        raise Providers::OwnershipError, 'Container session requires a recorded instance ID' unless
+          id.is_a?(String) && !id.empty?
+
+        directory = context.locations.workspace(context.workspace)
+        super(path: directory.join("container-session-#{Digest::SHA256.hexdigest(id)}.lock"), subject: 'Container')
+      end
+    end
+  end
+end

data/lib/empeira/runtime/service_inspection.rb

@@ -147,7 +147,11 @@ module Empeira
           'networks' => data.fetch('NetworkSettings').fetch('Networks'),
           'host_config' => data['HostConfig'], 'image_id' => data['Image'],
           'mounts' => data.fetch('Mounts'), 'dns' => data.dig('HostConfig', 'Dns') || [],
-          **port_observations(data) }
+          **port_observations(data), **exit_observations(data) }
+      end
+
+      def exit_observations(data)
+        { 'exit_code' => data.dig('State', 'ExitCode'), 'oom_killed' => data.dig('State', 'OOMKilled') }
       end
 
       def port_observations(data)

data/lib/empeira/vm/session_lock.rb

@@ -2,54 +2,10 @@
 
 module Empeira
   module VM
-    # Pin one node instance during access without retaining the workspace mutation lock.
-    class SessionLock
+    class SessionLock < Infrastructure::SessionLock
       def initialize(context:, record:)
         directory = context.locations.workspace(context.workspace)
-        @path = directory.join("vm-session-#{record.fetch('peer').fetch('token')}.lock")
-      end
-
-      def acquire(shared:)
-        lock = open_lock
-        mode = shared ? File::LOCK_SH : File::LOCK_EX
-        unless lock.flock(mode | File::LOCK_NB)
-          raise Infrastructure::Locked, 'VM instance has active access or lifecycle operations; detach and retry'
-        end
-
-        lock.close_on_exec = true
-        acquired = true
-        lock
-      ensure
-        lock&.close unless acquired
-      end
-
-      def exclusive
-        lock = acquire(shared: false)
-        yield
-      ensure
-        lock&.close
-      end
-
-      private
-
-      def open_lock
-        raise Providers::OwnershipError, 'VM session lock path is unsafe' if @path.dirname.symlink? || @path.symlink?
-
-        # A successful open passes descriptor ownership to acquire.
-        # rubocop:disable-next Style/FileOpen
-        lock = File.open(@path, File::RDWR | File::CREAT, 0o600)
-        verify_lock!(lock.stat)
-
-        opened = true
-        lock
-      ensure
-        lock&.close unless opened
-      end
-
-      def verify_lock!(metadata)
-        return if metadata.file? && metadata.uid == Process.uid && metadata.mode.nobits?(0o077)
-
-        raise Providers::OwnershipError, 'VM session lock ownership is invalid'
+        super(path: directory.join("vm-session-#{record.fetch('peer').fetch('token')}.lock"), subject: 'VM')
       end
     end
   end

data/lib/empeira.rb

@@ -94,7 +94,9 @@ require_relative 'empeira/vm/image_cache'
 require_relative 'empeira/vm/disk'
 require_relative 'empeira/vm/root_disk'
 require_relative 'empeira/vm/qemu_runtime'
+require_relative 'empeira/infrastructure/session_lock'
 require_relative 'empeira/vm/session_lock'
+require_relative 'empeira/node/session_lock'
 require_relative 'empeira/vm/removal'
 require_relative 'empeira/node/ssh_credentials'
 require_relative 'empeira/node/ssh_client'
@@ -190,6 +192,7 @@ require_relative 'empeira/infrastructure/status'
 require_relative 'empeira/control_plane/health'
 require_relative 'empeira/control_plane/storage'
 require_relative 'empeira/control_plane/discovery'
+require_relative 'empeira/control_plane/startup_failure'
 require_relative 'empeira/control_plane/controller'
 require_relative 'empeira/infrastructure/service'
 require_relative 'empeira/updates/images'

data/resources/nodes/management/guest_agent.py

@@ -159,6 +159,8 @@ def start_exec(message):
     try:
         process = subprocess.Popen(argv, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE,
                                    stderr=subprocess.PIPE, start_new_session=True,
+                                   # Workers are single-threaded; support guest Python 3.6 as well.
+                                   preexec_fn=lambda: os.umask(0o022),
                                    env={**{key: value for key, value in os.environ.items() if key != 'RUNTIME_DIRECTORY'}, 'PATH': '/opt/puppetlabs/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'})
     except OSError as error:
         send({'type': 'stderr', 'data': base64.b64encode((os.strerror(error.errno) + '\n').encode()).decode()})
@@ -211,6 +213,8 @@ def start_shell(message):
     pid, master = pty.fork()
     if pid == 0:
         try:
+            # Keep management staging private without changing ordinary guest file creation.
+            os.umask(0o022)
             fcntl.ioctl(0, termios.TIOCSWINSZ, size)
             try:
                 home = pwd.getpwuid(0).pw_dir

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: empeira
 version: !ruby/object:Gem::Version
-  version: 0.1.0.pre.alpha.6
+  version: 0.1.0.pre.alpha.7
 platform: ruby
 authors:
 - Christian Meißner (c8m6)
@@ -108,6 +108,7 @@ files:
 - lib/empeira/control_plane/files.rb
 - lib/empeira/control_plane/health.rb
 - lib/empeira/control_plane/plan.rb
+- lib/empeira/control_plane/startup_failure.rb
 - lib/empeira/control_plane/storage.rb
 - lib/empeira/errors.rb
 - lib/empeira/execution/console.rb
@@ -128,6 +129,7 @@ files:
 - lib/empeira/infrastructure/owned_files.rb
 - lib/empeira/infrastructure/recovery_inventory.rb
 - lib/empeira/infrastructure/service.rb
+- lib/empeira/infrastructure/session_lock.rb
 - lib/empeira/infrastructure/status.rb
 - lib/empeira/infrastructure/store.rb
 - lib/empeira/modules/events.rb
@@ -192,6 +194,7 @@ files:
 - lib/empeira/node/run_request.rb
 - lib/empeira/node/runtime_proxy.rb
 - lib/empeira/node/service.rb
+- lib/empeira/node/session_lock.rb
 - lib/empeira/node/ssh_client.rb
 - lib/empeira/node/ssh_credentials.rb
 - lib/empeira/node/ssh_endpoint.rb