@outerlayer/cli 0.24.0 → 0.25.1

package/dist/{chunk-GU4PKXN7.js → chunk-ENFBARQP.js}

@@ -1,26 +1,28 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-TTLVQZSH.js';
+import { runnerImageVersion } from './chunk-5222PA6S.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-Q435LWVN.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-5XCAPBE2.js';
-import { RecipeError, CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-3W333NFO.js';
-import { execCapture } from './chunk-LY2L3O2O.js';
-import { GUEST_CID } from './chunk-PDIM5T65.js';
-import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-TQ6Y7YV6.js';
-import { WorkCommandError } from './chunk-RVYOOYOA.js';
+import { createDockerHost, builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, childEnvironment, JUDGE_DIR, JUDGE_REPORT, MAX_REPORT_BYTES, spawnRun } from './chunk-N3VSI5ZI.js';
+import { hostHelperPinned, firecrackerArch, MICROVM_ARCHES, RecipeError, DOCKER_FEATURE, CLAUDE_CODE_VERSION, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, JAILER_BINARY_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION, DEFAULT_BASE_IMAGE } from './chunk-APBTVIM4.js';
+import { execCapture } from './chunk-HPOEVC2V.js';
+import { GUEST_CID } from './chunk-XGJUNNXL.js';
+import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-3FNPTQRH.js';
+import { WorkCommandError } from './chunk-CQRIZNE6.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
 import { sharedSkillNames, skillConflictMessage } from './chunk-VPEGE3QZ.js';
 import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-D4AMAEZ7.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-QE3UQAHK.js';
 import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-RKOTJQVG.js';
 import { downconvertSession } from './chunk-QZBXLLTV.js';
-import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, SHIM_DIR, vmAssetsDir } from './chunk-KF37SUDM.js';
-import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-BN3CSI7S.js';
-import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, MAX_OPEN_STREAMS, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-GISNHSYL.js';
-import { readFileSync, existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, readdirSync, lstatSync, copyFileSync, accessSync, constants, statSync, rmdirSync, renameSync, unlinkSync, openSync, closeSync, mkdtempSync, createWriteStream, createReadStream } from 'fs';
+import { vmAssetsDir, RUNNER_DIR_MODE, rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, SHIM_DIR } from './chunk-ZI2ZVWKT.js';
+import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-2K3TCQHW.js';
+import { RELAY_USER, RELAY_ID, UNKNOWN_TRANSPORT_REASON, DOCKER_DESKTOP_REASON, MAX_MALFORMED_SESSIONS, MALFORMED_REASON, MAX_OPEN_STREAMS, STREAM_WINDOW, SESSION_WINDOW, targetOfPath } from './chunk-JGD5TWQ2.js';
+import { readFileSync, mkdirSync, existsSync, mkdtempSync, rmSync, chmodSync, truncateSync, writeFileSync, readdirSync, lstatSync, copyFileSync, accessSync, constants, statSync, rmdirSync, renameSync, unlinkSync, openSync, closeSync, createWriteStream, createReadStream } from 'fs';
 import { join, dirname, basename } from 'path';
+import { isIP, createConnection, connect, createServer as createServer$1 } from 'net';
 import { spawnSync, spawn } from 'child_process';
 import { availableParallelism, networkInterfaces } from 'os';
 import { randomBytes, createHash } from 'crypto';
@@ -30,7 +32,6 @@ import { createServer, request } from 'http';
 import { request as request$1 } from 'https';
 import { pipeline, finished } from 'stream/promises';
 import { createGunzip, gunzipSync, constants as constants$1 } from 'zlib';
-import { isIP, connect, createServer as createServer$1 } from 'net';
 import { lookup } from 'dns/promises';
 
 createRequire(import.meta.url);
@@ -144,6 +145,101 @@ function realCgroupPort() {
     remove: (path) => removeBuildCgroup(fs, path)
   };
 }
+var SUPPORTED_HELPER_PROTOCOLS = [1];
+var HELPER_ENV = "OUTERLAYER_HELPER_SOCKET";
+var HelperRefusal = class extends Error {
+  constructor(code, reason) {
+    super(reason);
+    this.code = code;
+  }
+};
+function helperSocketPath(unitName) {
+  return `/run/${unitName}-helper/helper.sock`;
+}
+var START_TIMEOUT_MS = 12e4;
+var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
+var MAX_REPLY_BYTES = 1024 * 1024;
+function ask(socketPath, request, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const conn = createConnection(socketPath);
+    let text = "";
+    let settled = false;
+    const settle = (finish) => {
+      if (settled) return;
+      settled = true;
+      conn.destroy();
+      finish();
+    };
+    conn.setTimeout(timeoutMs, () => settle(() => reject(new Error(`the helper at ${socketPath} did not answer within ${Math.round(timeoutMs / 1e3)} seconds`))));
+    conn.on("connect", () => conn.write(`${JSON.stringify(request)}
+`));
+    conn.on("data", (chunk) => {
+      text += chunk.toString("utf8");
+      if (text.length > MAX_REPLY_BYTES) return settle(() => reject(new Error(`the helper at ${socketPath} sent a reply that is too long`)));
+      const end = text.indexOf("\n");
+      if (end === -1) return;
+      settle(() => {
+        let reply;
+        try {
+          reply = JSON.parse(text.slice(0, end));
+        } catch {
+          return reject(new Error(`the helper at ${socketPath} sent a reply that is not JSON`));
+        }
+        if (reply.status === "refused") return reject(new HelperRefusal(String(reply.code ?? "refused"), String(reply.reason ?? "the helper refused the request")));
+        resolve(reply);
+      });
+    });
+    conn.on("error", (err) => settle(() => reject(new Error(`the helper at ${socketPath} did not answer: ${err.message}`))));
+    conn.on("close", () => settle(() => reject(new Error(`the helper at ${socketPath} closed the connection without a reply`))));
+  });
+}
+function helperClient(socketPath, options = {}) {
+  const REQUEST_TIMEOUT_MS = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  return {
+    async start({ build, kind }) {
+      const reply = await ask(socketPath, { v: 1, op: "start", build, kind }, START_TIMEOUT_MS);
+      return { unit: String(reply.unit), chroot: String(reply.chroot), vsock: String(reply.vsock) };
+    },
+    async stop(build) {
+      await ask(socketPath, { v: 1, op: "stop", build }, REQUEST_TIMEOUT_MS);
+    },
+    async state(build) {
+      const reply = await ask(socketPath, { v: 1, op: "state", build }, REQUEST_TIMEOUT_MS);
+      return { active: reply.active === true, oomKills: typeof reply.oomKills === "number" ? reply.oomKills : 0 };
+    },
+    async list() {
+      const reply = await ask(socketPath, { v: 1, op: "list" }, REQUEST_TIMEOUT_MS);
+      return Array.isArray(reply.builds) ? reply.builds.map(String) : [];
+    }
+  };
+}
+function reinstallMessage(protocol) {
+  const spoken = protocol === void 0 ? "a protocol it does not name" : `protocol ${protocol}`;
+  return `the root helper speaks ${spoken}, which this runner does not support, so microVM builds run without the jailer; run \`outerlayer runner install --service --replace\` to install the helper that goes with this release`;
+}
+async function probeHelper(socketPath, options = {}) {
+  if (socketPath === void 0 || socketPath === "") return { ok: false, reason: "absent", detail: `${HELPER_ENV} is not set, so this runner was not started by a service that has a helper` };
+  if (!(options.pinned ?? hostHelperPinned())) return { ok: false, reason: "unpinned", detail: "this release of the CLI pins no helper, so builds run without the jailer" };
+  try {
+    const reply = await ask(socketPath, { v: 1, op: "hello" }, options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS);
+    const protocol = typeof reply.protocol === "number" ? reply.protocol : void 0;
+    if (protocol === void 0 || !SUPPORTED_HELPER_PROTOCOLS.includes(protocol)) return { ok: false, reason: "unsupported", detail: reinstallMessage(protocol) };
+    return { ok: true, client: helperClient(socketPath, { requestTimeoutMs: options.requestTimeoutMs }), firecracker: String(reply.firecracker ?? "") };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { ok: false, reason: "absent", unreachable: true, detail: message.includes(socketPath) ? message : `the helper at ${socketPath} did not answer: ${message}` };
+  }
+}
+function jailedAlive(unit, cgroupRoot = "/sys/fs/cgroup") {
+  try {
+    return /^populated 1$/m.test(readFileSync(join(cgroupRoot, "system.slice", `${unit}.service`, "cgroup.events"), "utf8"));
+  } catch {
+    return false;
+  }
+}
+function realHelperPort(env = process.env) {
+  return { probe: () => probeHelper(env[HELPER_ENV]), alive: (unit) => jailedAlive(unit) };
+}
 var BranchPrepareError = class extends Error {
 };
 var OWN_PREFIX = "outerlayer/";
@@ -353,7 +449,8 @@ function pinnedAssets(arch) {
     firecracker: {
       url: `${FIRECRACKER_RELEASES}/v${version}/firecracker-v${version}-${arch}.tgz`,
       sha256: FIRECRACKER_SHA256[arch],
-      binarySha256: FIRECRACKER_BINARY_SHA256[arch]
+      binarySha256: FIRECRACKER_BINARY_SHA256[arch],
+      jailerSha256: JAILER_BINARY_SHA256[arch]
     },
     kernel: { url: `${GUEST_ASSETS_BASE_URL}/vmlinux-${arch}`, sha256: GUEST_KERNEL_SHA256[arch] },
     helper: { url: `${GUEST_ASSETS_BASE_URL}/outerlayer-guest-${arch}`, sha256: GUEST_HELPER_SHA256[arch] }
@@ -392,14 +489,45 @@ async function ensureFile(dir, file, pin, fetchImpl, mode) {
   writeAtomic(path, bytes, mode);
   return path;
 }
-function extractWithTar(arch) {
-  const name = `firecracker-v${FIRECRACKER_VERSION}-${arch}`;
+function extractWithTar(arch, program = "firecracker") {
+  const name = `${program}-v${FIRECRACKER_VERSION}-${arch}`;
   return async (tarball, destDir) => {
     const result = spawnSync("tar", ["-xzf", tarball, "-C", destDir, "--strip-components=1", `release-v${FIRECRACKER_VERSION}-${arch}/${name}`], { encoding: "utf8" });
     if (result.status !== 0) throw new Error(`tar could not unpack ${tarball}: ${result.stderr.trim()}`);
     return join(destDir, name);
   };
 }
+async function ensureFirecracker(input) {
+  const { dir, arch, pins, fetchImpl } = input;
+  const firecracker = join(dir, "firecracker");
+  if (existsSync(firecracker)) {
+    const actual = sha256Of(readFileSync(firecracker));
+    if (actual !== pins.firecracker.binarySha256) throw pinProblem("firecracker", pins.firecracker.binarySha256, actual, `at ${firecracker}`);
+    return firecracker;
+  }
+  const tarballName = `firecracker-${arch}.tgz`;
+  const tarball = await ensureFile(dir, tarballName, pins.firecracker, fetchImpl, RUNNER_FILE_MODE);
+  const scratch = mkdtempSync(join(dir, ".extract-"));
+  try {
+    const extracted = await (input.extract ?? extractWithTar(arch))(tarball, scratch);
+    const bytes = readFileSync(extracted);
+    const actual = sha256Of(bytes);
+    if (actual !== pins.firecracker.binarySha256) throw pinProblem("firecracker", pins.firecracker.binarySha256, actual, `unpacked from ${tarballName}`);
+    writeAtomic(firecracker, bytes, 493);
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
+  }
+  return firecracker;
+}
+async function ensureFirecrackerAndJailer(options) {
+  const arch = options.arch ?? firecrackerArch(process.arch);
+  if (!MICROVM_ARCHES.includes(arch)) throw new AssetError("firecracker", `no Firecracker assets are pinned for ${arch}, so microVM builds run on ${MICROVM_ARCHES.join(" or ")} hosts only`);
+  const pins = options.pins ?? pinnedAssets(arch);
+  const dir = vmAssetsDir(options.runnerDir);
+  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
+  const firecracker = await ensureFirecracker({ dir, arch, pins, fetchImpl: options.fetchImpl ?? fetch, extract: options.extractFirecracker });
+  return { firecracker, jailer: await ensureJailer(options) };
+}
 async function ensureAssets(options) {
   const arch = options.arch ?? firecrackerArch(process.arch);
   if (!MICROVM_ARCHES.includes(arch)) throw new AssetError("firecracker", `no Firecracker or guest assets are pinned for ${arch}, so microVM builds run on ${MICROVM_ARCHES.join(" or ")} hosts only`);
@@ -407,28 +535,40 @@ async function ensureAssets(options) {
   const fetchImpl = options.fetchImpl ?? fetch;
   const dir = vmAssetsDir(options.runnerDir);
   mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
-  const firecracker = join(dir, "firecracker");
-  if (existsSync(firecracker)) {
-    const actual = sha256Of(readFileSync(firecracker));
-    if (actual !== pins.firecracker.binarySha256) throw pinProblem("firecracker", pins.firecracker.binarySha256, actual, `at ${firecracker}`);
-  } else {
-    const tarballName = `firecracker-${arch}.tgz`;
-    const tarball = await ensureFile(dir, tarballName, pins.firecracker, fetchImpl, RUNNER_FILE_MODE);
-    const scratch = mkdtempSync(join(dir, ".extract-"));
-    try {
-      const extracted = await (options.extractFirecracker ?? extractWithTar(arch))(tarball, scratch);
-      const bytes = readFileSync(extracted);
-      const actual = sha256Of(bytes);
-      if (actual !== pins.firecracker.binarySha256) throw pinProblem("firecracker", pins.firecracker.binarySha256, actual, `unpacked from ${tarballName}`);
-      writeAtomic(firecracker, bytes, 493);
-    } finally {
-      rmSync(scratch, { recursive: true, force: true });
-    }
-  }
+  const firecracker = await ensureFirecracker({ dir, arch, pins, fetchImpl, extract: options.extractFirecracker });
   const kernel = await ensureFile(dir, `vmlinux-${arch}`, pins.kernel, fetchImpl, RUNNER_FILE_MODE);
   const helper = await ensureFile(dir, `outerlayer-guest-${arch}`, pins.helper, fetchImpl, 493);
   return { firecracker, kernel, helper, helperSha256: pins.helper.sha256 };
 }
+async function ensureJailer(options) {
+  const arch = options.arch ?? firecrackerArch(process.arch);
+  if (!MICROVM_ARCHES.includes(arch)) throw new AssetError("jailer", `no Firecracker assets are pinned for ${arch}, so microVM builds run on ${MICROVM_ARCHES.join(" or ")} hosts only`);
+  const pins = options.pins ?? pinnedAssets(arch);
+  const expected = pins.firecracker.jailerSha256;
+  if (expected === void 0) throw new AssetError("jailer", "this release pins no hash for the jailer, so it cannot be had");
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const dir = vmAssetsDir(options.runnerDir);
+  mkdirSync(dir, { recursive: true, mode: RUNNER_DIR_MODE });
+  const jailer = join(dir, "jailer");
+  if (existsSync(jailer)) {
+    const actual = sha256Of(readFileSync(jailer));
+    if (actual !== expected) throw pinProblem("jailer", expected, actual, `at ${jailer}`);
+    return jailer;
+  }
+  const tarballName = `firecracker-${arch}.tgz`;
+  const tarball = await ensureFile(dir, tarballName, pins.firecracker, fetchImpl, RUNNER_FILE_MODE);
+  const scratch = mkdtempSync(join(dir, ".extract-"));
+  try {
+    const extracted = await (options.extractJailer ?? extractWithTar(arch, "jailer"))(tarball, scratch);
+    const bytes = readFileSync(extracted);
+    const actual = sha256Of(bytes);
+    if (actual !== expected) throw pinProblem("jailer", expected, actual, `unpacked from ${tarballName}`);
+    writeAtomic(jailer, bytes, 493);
+  } finally {
+    rmSync(scratch, { recursive: true, force: true });
+  }
+  return jailer;
+}
 var STOP_GRACE_SECONDS = 15;
 function parseImageConfig(json) {
   const config = JSON.parse(json);
@@ -755,6 +895,7 @@ function createMicroVmPorts(over = {}) {
     rootfs: over.rootfs ?? createRootfsHost(),
     firecracker: over.firecracker ?? createFirecrackerHost(),
     cgroup: over.cgroup ?? realCgroupPort(),
+    helper: over.helper ?? realHelperPort(),
     exec: over.exec ?? execCapture
   };
 }
@@ -2343,6 +2484,7 @@ function createContainerRuntime(opts = {}) {
     tunnelOptions: opts.tunnelOptions,
     sleep: opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))),
     hostEnv: opts.hostEnv ?? process.env,
+    platform: opts.platform ?? process.platform,
     credentials: opts.credentials ?? /* @__PURE__ */ new Map(),
     github: { gitUrl: opts.github?.gitUrl ?? "https://github.com", apiUrl: opts.github?.apiUrl ?? "https://api.github.com" },
     remoteFor,
@@ -2531,8 +2673,8 @@ async function provisionContainer(input) {
   if (!(Number.parseInt(engine, 10) >= MIN_ENGINE_MAJOR)) {
     return fail(`Docker Engine ${engine} is too old: container builds need Engine ${MIN_ENGINE_MAJOR} or later`);
   }
-  if (/docker desktop/i.test(await host.operatingSystem() ?? "")) {
-    return fail("Docker Desktop cannot pass the tunnel's socket into a container, so container builds need Docker Engine: install it (on Windows, inside WSL2) or use builtin:process");
+  if (/docker desktop/i.test(await host.operatingSystem() ?? "") && !(runnerImageVersion(runtime.hostEnv) !== void 0 && runtime.platform === "linux")) {
+    return fail(DOCKER_DESKTOP_REASON);
   }
   const governing = await resolveGoverningSource({ config, repository, fetchImpl: input.fetchImpl });
   if (!governing.ok) return fail(governing.reason);
@@ -2587,11 +2729,16 @@ async function provisionContainer(input) {
   if (env.skippedTokenVariables.length > 0) {
     log.line(`${tag} not passing ${env.skippedTokenVariables.join(", ")} from runner.build.variables into the build: its repository token comes from the runner`);
   }
+  const ignoredProperties = report.ignored.map(({ property, source }) => ({ property, source }));
+  if (report.docker) {
+    ignoredProperties.push({ property: "docker daemon", source: `feature ${DOCKER_FEATURE}` });
+    log.line(`${tag} container builds have no Docker daemon, so steps that run Docker will fail`);
+  }
   const environment = {
     isolation: "container",
     recipe: { sourceCommit: report.sourceCommit, key: report.recipeKey, path: report.recipe },
     imageId: report.imageId,
-    ignoredProperties: report.ignored.map(({ property, source }) => ({ property, source })),
+    ignoredProperties,
     variables: env.variables,
     cliVersion: input.cliVersion
   };
@@ -3157,4 +3304,4 @@ async function startCheckContainer(input) {
   };
 }
 
-export { ADDED_USER, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, LEASE_SECONDS, MIN_ENGINE_MAJOR, cleanupContainer, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, deleteBuildDisk, deliverContainerHooks, ensureRootfs, ensureTunnel, filesAreCopied, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, leaseExpiresAtMs, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, provisionContainer, resolveAgentUser, runBuildSteps, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startServicesFor, stopContainer, syncInContainer, writeEvalInput };
+export { ADDED_USER, AgentUserError, AssetError, DeliveryFailure, EVAL_INPUT_NAME, GH_CONFIG_YML, HelperRefusal, LEASE_SECONDS, MIN_ENGINE_MAJOR, cleanupContainer, containerCommandExec, containerJudgeEnvironment, containerSenderCommand, copyJudgeTree, copyTranscripts, copyTranscriptsFromContainer, createBuildDisk, createContainerRuntime, deleteBuildDisk, deliverContainerHooks, ensureFirecrackerAndJailer, ensureRootfs, ensureTunnel, filesAreCopied, ghHostsYml, gitRemoteFor, helperSocketPath, isLiteralAddress, keepGhConfigCurrent, leaseExpiresAtMs, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, probeHelper, provisionContainer, resolveAgentUser, runBuildSteps, senderAliveScript, senderSignalScript, setUpRunnerCgroup, shellQuote, signalInContainer, startCheckContainer, startServicesFor, stopContainer, syncInContainer, writeEvalInput };