hotcell-server 0.2.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 50d90e8b9f7ecb2a139d9c678a3cfdb228288d590f33cdf19390b6cbd92a924e
-  data.tar.gz: 66c3bcb911c378507bc9623cb1badc8c3372b6a58c3cd0312eae81c72b003877
+  metadata.gz: 9b2d1b6a8296d8833188c1414bfeb70d7031c8601d520361b10110e832461992
+  data.tar.gz: ec7983987f989d78eeeefee5b3fa8b5c5a860d3ae1022ce414172ea553d64938
 SHA512:
-  metadata.gz: c489f02a8b5670abda9df8c52f62fc4657a725abf01c6e49a39ad1065671535f96942e9ed5168fed5062d9b1ce3f55cef5aba0c2dfab2ec2f1c9c35b14980490
-  data.tar.gz: 5b633520243d9f70ab9adfaa1f2427516012ca477e3acd4d5917cbfe5a02ca01dc830e6d6855faeda5e11e8d3b8978634cadfa39712938aeeaeb6560e9f8032c
+  metadata.gz: 112abfea26523d9592dd208455e70a824937c910f98d910990b2359e0530f8f9fd01348a57b4b067a80ee9a77cf64d36aaf7e4bf704c9cf9c88d99eb324e14f1
+  data.tar.gz: 99fbe2141dee8d99e385b3fe825476366bb56988f7ca508a8ff961d302052b3ab656b07b28cce2513e45012e8a8903aac916f62e31931871fb4a55d4dceb2314

data/lib/hot_cell/control.rb

@@ -39,8 +39,7 @@ module HotCell
     end
 
     # Static, and called once per registered cell at app boot. It is the cheapest way to catch a client
-    # pointed at a cell that does not carry the operation it wants, which is otherwise an `unsupported` on
-    # the first real request, and to catch a client whose own timeout is below what this cell may take.
+    # whose own timeout is below what this cell may take, and it is what `bin/hotcell describe` reads.
     def describe
       { v: PROTOCOL_VERSION, operations: Registry.names, groups: groups, **@configuration.to_h }
     end

data/lib/hot_cell/log.rb

@@ -65,9 +65,11 @@ module HotCell
       # deadline loop until the runtime resumed. A non-blocking write answers `:wait_writable` for the full
       # pipe instead, and the line is dropped like any other.
       #
-      # A short count would be a torn line, which a write at or under PIPE_BUF cannot produce. The one line
-      # that can exceed it is cell.boot's inventory, written once before the loop enforces anything and
-      # against an empty pipe.
+      # A short count would be a torn line, which a write at or under PIPE_BUF cannot produce. Torn is worse
+      # than dropped: the stub has no newline, so the next line written is glued to it and a reader loses
+      # both. cell.boot's inventory can exceed it, written once against an empty pipe before the loop
+      # enforces anything, and so can worker.killed — 512 bytes of stderr become 3072 when every one is a
+      # control character, and the operation name and envelope spend most of what is left.
       def emit(line)
         @io.write_nonblock line, exception: false
       rescue SystemCallError, IOError

data/lib/hot_cell/operation.rb

@@ -149,7 +149,8 @@ module HotCell
     # cost gigabytes of this worker's address space, and took RLIMIT_DATA with it — arriving as a `memory`
     # verdict, which is permanent, for a document whose only crime was being noisy.
     # `pass` hands the tool a set of the worker's own descriptors — an input to read, an output to write —
-    # at their existing fd numbers, so the tool reaches them as `/dev/fd/N` (Descriptor#fd_path) and no
+    # at their existing fd numbers, so the tool reaches them at `Descriptor#fd_path` — `/dev/fd/N`, or the
+    # file's own path on macOS, where opening `/dev/fd/N` would share the worker's offset — and no
     # byte is copied onto scratch to give it a filename. A fd handed to a child this way loses its
     # close-on-exec, which is exactly the inheritance wanted, and only for these; the worker's other
     # descriptors are untouched. Passing an fd at its own number cannot collide with the stdio pipes popen3
@@ -196,8 +197,12 @@ module HotCell
         kept
       end
 
+      # The OpenMP variables come from the cell's environment rather than being named here: the number
+      # belongs to the image, which is configured to match the container's CPU quota. Without them
+      # `unsetenv_others: true` would hand an exec'd tool the pool the image's bound was meant to take away.
       def tool_environment(overrides)
-        { "HOME" => ENV["HOME"], "PATH" => ENV["PATH"], "LANG" => "C.UTF-8", "LC_ALL" => "C.UTF-8" }
+        { "HOME" => ENV["HOME"], "PATH" => ENV["PATH"], "LANG" => "C.UTF-8", "LC_ALL" => "C.UTF-8",
+          "OMP_NUM_THREADS" => ENV["OMP_NUM_THREADS"], "OMP_THREAD_LIMIT" => ENV["OMP_THREAD_LIMIT"] }
           .merge(overrides.transform_keys(&:to_s))
           .compact
       end

data/lib/hot_cell/server/version.rb

@@ -2,6 +2,6 @@
 
 module HotCell
   module Server
-    VERSION = "0.2.0"
+    VERSION = "0.3.1"
   end
 end

data/lib/hot_cell/supervisor.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "socket"
+require "fcntl"
 require "fileutils"
 require "tmpdir"
 
@@ -13,6 +14,8 @@ module HotCell
   # the trusted side on a bounded buffer — but the supervisor does not need to, and staying out of the
   # request is what lets it dispatch a connection whose descriptors are still queued on it.
   #
+  # `peeked_op` is the exception, on the one path where no worker will read the request.
+  #
   # Dispatching rather than letting workers accept is what makes the rest work. The supervisor needs to own
   # the accept anyway, for the queue, for queued_ms, and to answer `capacity`. It also means the supervisor
   # knows when every worker started its current request, which is what the deadline needs.
@@ -21,16 +24,36 @@ module HotCell
     # `busy?` and the supervisor assigning the four fields `busy?` is computed from are the same fact. Spread
     # across the caller, a new field is one the next transition forgets to clear.
     Child = Struct.new(:slot, :pid, :control, :connection, :dispatched_at, :deadline, :served, :killed_for,
-                       :retired_at, :buffer, keyword_init: true) do
-      def self.build(slot:, pid:, control:, deadline:)
-        new slot: slot, pid: pid, control: control, deadline: deadline, served: 0, buffer: "".b
+                       :op, :retired_at, :buffer, :stderr, :captured, keyword_init: true) do
+      def self.build(slot:, pid:, control:, deadline:, stderr: nil)
+        new slot: slot, pid: pid, control: control, deadline: deadline, served: 0, buffer: "".b,
+            stderr: stderr, captured: "".b
+      end
+
+      # Keeps the last MAX_MESSAGE_BYTES rather than the first, because the line that ended the request is
+      # the last one written. Trimmed on every read, so a worker that never stops printing costs no more
+      # than that.
+      def capture_stderr(chunk)
+        captured << chunk
+        excess = captured.bytesize - Failure::MAX_MESSAGE_BYTES
+        captured.slice! 0, excess if excess.positive?
+      end
+
+      # A silent worker gets no field at all: `Log#document` does not compact the hotcell namespace, so a nil
+      # would put `"stderr":null` on every death a cell reports.
+      def stderr_field
+        captured.empty? ? {} : { stderr: Failure.sanitize(captured, keep: :tail) }
       end
 
       def dispatched(connection, deadline, at:)
+        # An earlier request's warning is not this request's death. Not a boundary, though: a descendant
+        # holding fd 2 writes whenever it likes, and a sibling can open /proc/<pid>/fd/2 and write there too.
+        captured.clear
         self.connection = connection
         self.dispatched_at = at
         self.deadline = deadline
         self.killed_for = nil
+        self.op = nil
         self.served += 1
       end
 
@@ -105,6 +128,12 @@ module HotCell
     # far above any real scrape rate rather than as a throttle.
     CONTROL_BACKLOG = 64
 
+    # What one pass reads off a worker's fd 2, and how many reads the reap's final drain gets. Sized to
+    # clear a full pipe rather than to bound memory — `Child#capture_stderr` does that — so reading further
+    # would only mean a fresher tail.
+    STDERR_READ_BYTES = 16 * 1024
+    STDERR_FINAL_READS = 8
+
     attr_reader :configuration, :counters, :log, :directory, :workspace
 
     def initialize(directory:, workspace: nil, configuration: HotCell.configuration, log: Log.new,
@@ -163,6 +192,7 @@ module HotCell
       def sources
         [ @signals ].tap do |list|
           list.concat @children.each_value.map { |child| child.control.socket }.reject(&:closed?)
+          list.concat @children.each_value.filter_map(&:stderr).reject(&:closed?)
           list.concat @control_pending.map { |pending| pending.connection.socket }.reject(&:closed?)
           list.push @work, @control unless @stopping
         end
@@ -187,8 +217,13 @@ module HotCell
         when @work then accept_work
         when @control then accept_control
         else
-          pending = pending_control(source)
-          pending ? read_control(pending) : child_reported(source)
+          if (pending = pending_control(source))
+            read_control pending
+          elsif (child = child_writing_stderr(source))
+            drain_stderr child
+          else
+            child_reported source
+          end
         end
       end
 
@@ -358,7 +393,7 @@ module HotCell
         true
       rescue SystemCallError, IOError => error
         log.write "worker.undispatchable", pid: child.pid, slot: child.slot.number,
-                                           error: error.class.name
+                                           op: peeked_op(connection), error: error.class.name
 
         # Released rather than finished: this is the only path that hands the connection back to be answered
         # here, so the client connection must not be closed on the way out. `retire` closes the worker's
@@ -370,6 +405,20 @@ module HotCell
         false
       end
 
+      # Safe only because the dispatch failed: no worker will serve this request. A peek and a bytes-only
+      # `recv`, never `recvmsg` — a partial `send_message` can leave a worker holding this connection, and
+      # consuming the request would take it from that worker. `recv_nonblock` rather than `MSG_DONTWAIT`,
+      # whose blocking `recv` parks on an empty socket; it leaves O_NONBLOCK alone on 3.3, 3.4 and 4.0,
+      # which a worker's SCM_RIGHTS duplicate would otherwise share.
+      def peeked_op(connection)
+        peeked = connection.socket.recv_nonblock(MAX_REQUEST_BYTES, Socket::MSG_PEEK, exception: false)
+        return nil unless peeked.is_a?(String) && peeked.include?("\n")
+
+        Request.parse(peeked.force_encoding(Encoding::UTF_8)).op
+      rescue StandardError
+        nil
+      end
+
       def available_child
         @children.each_value.find(&:available?) || spawn
       end
@@ -378,34 +427,38 @@ module HotCell
         number = free_slot or return nil
         slot = Slot.build(workspace, number)
         supervisor_side, worker_side = UNIXSocket.pair(:STREAM)
+        stderr_reader, stderr_writer = IO.pipe
 
         # A fork that fails is a host under pressure, not a reason to stop serving. The request stays queued
         # and is either dispatched on a later pass or answered `capacity` when its wait runs out.
         pid = begin
           fork do
-            become_worker supervisor_side
+            become_worker supervisor_side, stderr_reader, stderr_writer
             Worker.new(slot: slot, configuration: configuration, control: Connection.new(worker_side),
                        log: log).run
           end
         rescue SystemCallError => error
           log.write "worker.unforkable", slot: number, error: error.class.name, message: error.message
-          supervisor_side.close
-          worker_side.close
+          [ supervisor_side, worker_side, stderr_reader, stderr_writer ].each(&:close)
           return nil
         end
 
+        # The write end goes now rather than at the reap. Held here, the pipe never reports end of stream,
+        # `sources` keeps a dead worker's read end forever, and a worker that said nothing is
+        # indistinguishable from one that has not finished saying it.
         worker_side.close
+        stderr_writer.close
         log.write "worker.forked", pid: pid, slot: number
 
         @children[number] = Child.build(slot: slot, pid: pid, control: Connection.new(supervisor_side),
-                                        deadline: configuration.limits.deadline)
+                                        deadline: configuration.limits.deadline, stderr: stderr_reader)
       end
 
       # Everything the supervisor holds and the worker must not: the listener, the signal pipe, the other
       # children's control sockets, and every connection the supervisor is still holding for somebody else.
       # The connection this worker is about to serve arrives over SCM_RIGHTS a moment from now, so closing
       # the inherited copy here costs nothing and stops it lingering for the worker's whole life.
-      def become_worker(supervisor_side)
+      def become_worker(supervisor_side, stderr_reader, stderr_writer)
         [ "CHLD", "INT", "TERM" ].each { |signal| trap signal, "DEFAULT" }
 
         # Its own process group, so the deadline reaches the tools this request started rather than only the
@@ -438,9 +491,66 @@ module HotCell
         @children.each_value do |child|
           child.control.close
           child.connection&.close
+          child.stderr&.close
         end
         @queue.each { |(connection, _)| connection.close }
         @control_pending.each { |pending| pending.connection.close }
+
+        # fd 2 becomes the pipe, and it stays non-blocking. `IO.pipe` already returns both ends O_NONBLOCK
+        # and `reopen` is a dup2, which shares the file description — so the flag would ride along on its
+        # own. It is set here anyway, because a decision this load-bearing should be in the code rather than
+        # only in a comment, and because it then survives a Ruby that stops handing out non-blocking pipes.
+        #
+        # A blocking fd 2 would put backpressure into the image-processing path, which was never designed
+        # for it: a warning written from inside libvips is a `write(2)` in a C call Ruby cannot interrupt, so
+        # the conversion would wait on the supervisor's scheduling — nearest exactly when the host is under
+        # pressure and the supervisor is scheduled least. That trade is refused; the conversion path must
+        # never wait on the supervisor. What non-blocking loses instead is in docs/LOGS.md, and a test pins
+        # the flag so that a well-meaning fix has to argue with it.
+        stderr_reader.close
+        stderr_writer.fcntl Fcntl::F_SETFL, stderr_writer.fcntl(Fcntl::F_GETFL) | Fcntl::O_NONBLOCK
+        $stderr.reopen stderr_writer
+        stderr_writer.close
+      end
+
+      # One bounded read per pass, never a loop until the pipe is empty: this runs inside the loop that
+      # enforces every request's deadline, and the peer is a worker that can print as fast as it likes.
+      #
+      # End of stream closes the read end. It has to: an EOF pipe is permanently readable, so leaving it in
+      # `sources` turns the run loop into a spin between the worker's exit and its reap.
+      def drain_stderr(child)
+        chunk = begin
+          child.stderr.read_nonblock(STDERR_READ_BYTES, exception: false)
+        rescue SystemCallError
+          nil
+        end
+        return if chunk == :wait_readable
+        return child.stderr.close if chunk.nil?
+
+        child.capture_stderr chunk
+      end
+
+      # A worker's last line sits in the pipe after the process is gone, so the reap reads once more — and
+      # under a flat bound rather than to end of stream. End of stream never arrives while a descendant
+      # holds the write end, and "until the pipe is momentarily empty" terminates only by winning a race
+      # against whoever is writing.
+      def drain_stderr_after_exit(child)
+        STDERR_FINAL_READS.times do
+          break if child.stderr.nil? || child.stderr.closed?
+
+          chunk = begin
+            child.stderr.read_nonblock(STDERR_READ_BYTES, exception: false)
+          rescue SystemCallError
+            nil
+          end
+          break if chunk.nil? || chunk == :wait_readable
+
+          child.capture_stderr chunk
+        end
+      end
+
+      def child_writing_stderr(source)
+        @children.each_value.find { |child| child.stderr.equal?(source) }
       end
 
       # Buffered and non-blocking, for the same reason read_control is, and more so: readability means a byte
@@ -529,6 +639,7 @@ module HotCell
 
         if message[:deadline]
           child.deadline = narrowed_deadline(message[:deadline])
+          child.op = reported_op(message[:op])
         elsif message[:idle]
           return unreadable_report child, "idle report from a worker with no request" unless child.busy?
 
@@ -579,6 +690,11 @@ module HotCell
           Codes::PERMANENT_BY_CAUSE.key?(cause)
       end
 
+      # Bounded to a registered name: this rides an untrusted worker report straight into a log line.
+      def reported_op(reported)
+        reported if reported.is_a?(String) && Registry.lookup(reported)
+      end
+
       def outcome_code(reported)
         return reported if reported.is_a?(String) && (reported == "ok" || Codes.known?(reported))
 
@@ -699,11 +815,19 @@ module HotCell
             child_reported child.control.socket
           end
 
+          # Sweep before the last drain, not after. fd 2 is never close-on-exec, so everything this worker
+          # spawned holds the write end too — swept first, what those wrote is waiting to be read rather
+          # than arriving after the last read. The sweep does not make the pipe quiet: SIGKILL is
+          # asynchronous, and a `setsid` descendant is deliberately never reached, so its final bytes are
+          # best effort like everything else here.
           sweep_group child
+          drain_stderr_after_exit child
+
           @children.delete child.slot.number
           answer_for child, status
           discard child
           child.control.close
+          child.stderr&.close
 
           log.write "worker.reaped", pid: pid, slot: child.slot.number, served: child.served,
                                      signal: signal_name(status), exit_code: status.exitstatus
@@ -740,11 +864,17 @@ module HotCell
         counters.record Codes::KILLED
         counters.record_kill cause
 
-        log.write "worker.killed", pid: child.pid, slot: child.slot.number, cause: cause,
-                                   signal: signal_name(status), duration_ms: Clock.ms_since(child.dispatched_at)
+        captured = child.stderr_field
+
+        log.write "worker.killed", pid: child.pid, slot: child.slot.number, op: child.op, cause: cause,
+                                   signal: signal_name(status), duration_ms: Clock.ms_since(child.dispatched_at),
+                                   **captured
 
+        # The capture rides the verdict as well as the log line, so an application logs
+        # `killed: crashed (libgomp: ...)` rather than a bare `crashed`. Additive on the wire: `from_wire`
+        # reads named keys, so an old client ignores the field and a new one against an old cell meets nil.
         answer child.connection,
-               Failure.new(code: Codes::KILLED, cause: cause, signal: signal_name(status)),
+               Failure.new(code: Codes::KILLED, cause: cause, signal: signal_name(status), **captured),
                timing: { perform_ms: Clock.ms_since(child.dispatched_at) }
       end
 

data/lib/hot_cell/test_operations.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "digest"
+require "fcntl"
 require "fileutils"
 
 # Fixture operations, so the whole surface can be exercised in milliseconds, with no tool installed and no
@@ -124,6 +125,26 @@ module HotCell
       end
     end
 
+    # `Exception` so it escapes `serve`'s `rescue StandardError` and reaches `run`, the only path that
+    # writes `worker.crashed`.
+    class Fatal < HotCell::Operation
+      operation "test.fatal"
+
+      def perform(_inputs, _outputs)
+        raise Exception, "a worker cannot answer for this one"
+      end
+    end
+
+    # Hangs in the boot hook, which runs before the worker reports its operation.
+    class SlowBoot < HotCell::Operation
+      operation "test.slow_boot"
+      before_worker_boot { sleep 60 }
+
+      def perform(_inputs, _outputs)
+        {}
+      end
+    end
+
     class Undecodable < HotCell::Operation
       operation "test.undecodable"
 
@@ -461,5 +482,57 @@ module HotCell
         { slept: seconds, pid: Process.pid }
       end
     end
+
+    # Writes to fd 2 and then either dies the way a C library does — `exit()` with no Ruby exception, so
+    # there is no `worker.crashed` line and nothing on the connection — or returns normally, which is the
+    # warning a cell deliberately does not report. `noise:` goes out before `text:`, so a test can ask which
+    # end of an oversized transcript was kept.
+    class StderrWriter < HotCell::Operation
+      operation "test.stderr_writer"
+
+      def perform(_inputs, _outputs, text:, noise: 0, fatal: false)
+        $stderr.write "noise\n" * noise
+        $stderr.write text
+        $stderr.flush
+        exit! 1 if fatal
+
+        { wrote: text.bytesize }
+      end
+    end
+
+    # Bytes that are not valid UTF-8, which a payload cannot carry — so this is a fixture rather than an
+    # argument to StderrWriter. A decoder writing a filename out of a hostile file is where these come from.
+    class GarbledStderr < HotCell::Operation
+      operation "test.garbled_stderr"
+
+      def perform(_inputs, _outputs)
+        $stderr.write "libgomp: \xFF\xFE failed\n".b
+        $stderr.flush
+        exit! 1
+      end
+    end
+
+    # Reports whether fd 2 is non-blocking, which is the load-bearing decision behind the capture: a
+    # blocking fd 2 would put the supervisor's scheduling in the middle of a libvips `write(2)`.
+    class StderrFlags < HotCell::Operation
+      operation "test.stderr_flags"
+
+      def perform(_inputs, _outputs)
+        { nonblock: ($stderr.fcntl(Fcntl::F_GETFL) & Fcntl::O_NONBLOCK).positive? }
+      end
+    end
+
+    # A tool that keeps writing to fd 2 after the worker itself is gone. fd 2 is never close-on-exec, so
+    # everything a worker spawned holds the write end, and the pipe reports no end of stream until the
+    # reap's group sweep kills them.
+    class StderrDescendant < HotCell::Operation
+      operation "test.stderr_descendant"
+
+      def perform(_inputs, _outputs)
+        spawn "sh", "-c", "while :; do echo from the descendant >&2; done"
+        sleep 0.5
+        exit! 1
+      end
+    end
   end
 end

data/lib/hot_cell/worker.rb

@@ -21,6 +21,7 @@ module HotCell
       @log = log
       @booted = nil
       @effective = {}
+      @op = nil
     end
 
     # exit! rather than exit, so that no finalizer and no library teardown ever runs. There is deliberately no
@@ -48,8 +49,8 @@ module HotCell
 
       exit! 0
     rescue Exception => error
-      log.write "worker.crashed", pid: Process.pid, slot: slot.number, error: error.class.name,
-                                  message: Failure.sanitize(error.message)
+      log.write "worker.crashed", pid: Process.pid, slot: slot.number, op: @op,
+                                  error: error.class.name, message: Failure.sanitize(error.message)
       exit! 1
     end
 
@@ -88,6 +89,9 @@ module HotCell
       # called recvmsg, so the caller's own descriptors are still queued on it and this worker's recvmsg
       # is what installs them.
       def await_dispatch
+        # Not in `serve`'s ensure: `worker.crashed` is written from `run`, past it.
+        @op = nil
+
         line, descriptors = control.receive_message(limit: DISPATCH_BYTES)
         return nil if line.nil?
 
@@ -174,6 +178,7 @@ module HotCell
 
       def handle(line, received, timing)
         request = Request.parse(line)
+        @op = request.op
 
         unless request.current_version?
           return refuse("protocol", request.version_mismatch, timing)
@@ -264,8 +269,22 @@ module HotCell
       # The supervisor enforces the deadline and never reads a request, so it cannot know that this
       # operation asked for less than the cell's maximum. The worker is the only thing that knows, and it
       # says so before it touches an untrusted byte.
+      #
+      # The name rides along because a killed worker cannot write its own `worker.killed`.
       def report_deadline(operation)
-        tell deadline: effective(operation).deadline
+        named = { deadline: effective(operation).deadline, op: @op }
+
+        tell(**(fits?(named) ? named : named.merge(op: nil)))
+      end
+
+      # The supervisor drops an over-limit report whole, so an oversized name would take the narrowed
+      # deadline with it. Measured on the encoded line and not the name's length, because escaping decides:
+      # JSON writes a NUL as six bytes. Dropped rather than truncated, which can end mid-character and
+      # raise out of `tell`, or match the registry as a different operation.
+      def fits?(message)
+        (JSON.generate(message) << "\n").bytesize <= DISPATCH_BYTES
+      rescue StandardError
+        false
       end
 
       # The cause travels with the code so the supervisor can still count a kill by cause. It used to read
@@ -299,7 +318,7 @@ module HotCell
 
         connection.write_line line_for(response)
       rescue SystemCallError, IOError
-        log.write "request.abandoned", pid: Process.pid, slot: slot.number
+        log.write "request.abandoned", pid: Process.pid, slot: slot.number, op: @op
       end
 
       def line_for(response)
@@ -311,7 +330,8 @@ module HotCell
       def record(response, timing)
         return if response.nil?
 
-        log.write "request", pid: Process.pid, slot: slot.number, code: response.failure&.code || "ok",
+        log.write "request", pid: Process.pid, slot: slot.number, op: @op,
+                             code: response.failure&.code || "ok",
                              permanent: response.failure&.permanent?,
                              outcome: response.failure ? "failure" : "success",
                              duration_ms: timing.elapsed_ms, timing: response.timing

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hotcell-server
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Mike Dalessio
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.2.0
+        version: 0.3.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.2.0
+        version: 0.3.1
 description: |
   Runs a HotCell container. A supervisor listens on two Unix sockets, forks a worker for each request,
   and enforces a wall clock deadline and resource limits on it. Write the work as a subclass of
@@ -61,8 +61,8 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/basecamp/hotcell
-  source_code_uri: https://github.com/basecamp/hotcell/tree/v0.2.0/hotcell-server
-  changelog_uri: https://github.com/basecamp/hotcell/blob/v0.2.0/CHANGELOG.md
+  source_code_uri: https://github.com/basecamp/hotcell/tree/v0.3.1/hotcell-server
+  changelog_uri: https://github.com/basecamp/hotcell/blob/v0.3.1/CHANGELOG.md
   bug_tracker_uri: https://github.com/basecamp/hotcell/issues
   rubygems_mfa_required: 'true'
 rdoc_options: []