@outerlayer/cli 0.7.0 → 0.8.1

package/dist/{chunk-E4PIFIC3.js → chunk-M4ERCYDB.js}

@@ -1,24 +1,28 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CEBIA5FD.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-TTNFGMHO.js';
 import { startTimeOf, isSameProcess } from './chunk-N5FOE5PS.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, childEnvironment, spawnRun } from './chunk-774HEQL6.js';
+import { createDockerHost, childEnvironment, spawnRun } from './chunk-TEKZRTM3.js';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
+import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-2BRSMBBB.js';
+import { CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CX22S5BA.js';
 import { execCapture } from './chunk-ZOAEPWGL.js';
 import { GUEST_CID } from './chunk-R7STSBLC.js';
-import { WorkCommandError, postJson } from './chunk-DGAIVMMN.js';
-import { parseDuKilobytes, hostAllowed } from './chunk-F6GFZXZ3.js';
-import { RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT } from './chunk-OD2VTIHN.js';
-import { defaultGitRunner, materializeContext } from './chunk-5FWNEQNZ.js';
+import { WorkCommandError, postJson } from './chunk-KV47VQJZ.js';
+import { hostAllowed } from './chunk-UXYLWVTQ.js';
+import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
+import { RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING } from './chunk-OD2VTIHN.js';
+import { defaultGitRunner, materializeContext } from './chunk-BQFNZOMQ.js';
 import { readContextManifest, readSourceCache } from './chunk-ZZXLM64C.js';
-import { signingFetchFor } from './chunk-BCLJSQCV.js';
-import { signerFor } from './chunk-M5POMKKW.js';
-import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, stagedContextDir, contextHomeDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, runnerDir, RUNNER_DIR_MODE, vmAssetsDir } from './chunk-ZM2IMMYN.js';
-import { relative, join, dirname, resolve, basename } from 'path';
-import { readFileSync, existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, accessSync, constants, readdirSync, statSync, rmdirSync, realpathSync, renameSync, lstatSync, unlinkSync, openSync, closeSync, mkdtempSync, createWriteStream, createReadStream } from 'fs';
+import { signingFetchFor } from './chunk-YO4PSLVB.js';
+import { signerFor } from './chunk-V7NIVOFD.js';
+import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, stagedContextDir, contextHomeDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, vmAssetsDir } from './chunk-ZM2IMMYN.js';
+import { relative, join, dirname, basename } from 'path';
+import { readFileSync, existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, accessSync, constants, readdirSync, statSync, rmdirSync, renameSync, lstatSync, unlinkSync, openSync, closeSync, mkdtempSync, createWriteStream, createReadStream } from 'fs';
 import { spawnSync, spawn } from 'child_process';
-import { createHash, randomBytes } from 'crypto';
+import { availableParallelism, networkInterfaces } from 'os';
+import { randomBytes, createHash } from 'crypto';
 import { createServer, request } from 'http';
 import { request as request$1 } from 'https';
 import { Transform } from 'stream';
@@ -26,7 +30,6 @@ import { pipeline, finished } from 'stream/promises';
 import { createGunzip, gunzipSync, constants as constants$1 } from 'zlib';
 import { isIP, connect, createServer as createServer$1 } from 'net';
 import { lookup } from 'dns/promises';
-import { networkInterfaces } from 'os';
 
 createRequire(import.meta.url);
 function logStamp(at) {
@@ -86,7 +89,7 @@ function isRetryable(err) {
 }
 async function retrySend(send, deps = {}) {
   const now = deps.now ?? (() => /* @__PURE__ */ new Date());
-  const sleep = deps.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
+  const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
   const windowMs = deps.windowMs ?? RETRY_WINDOW_MS;
   const startedMs = now().getTime();
   let attempts = 0;
@@ -466,118 +469,62 @@ function lifecycleSteps(lifecycle) {
 function lifecycleFailureReason(step, exitCode) {
   return `lifecycle command ${step.name} (${step.source}) exited ${exitCode}`;
 }
-var BUILD_LABEL = "ai.outerlayer.build";
-var RUNNER_LABEL = "ai.outerlayer.runner";
-function resolvedRunnerDir(configPath) {
+function parseCpuList(text) {
+  const cores = /* @__PURE__ */ new Set();
+  for (const part of text.trim().split(",")) {
+    const match = /^(\d+)(?:-(\d+))?$/.exec(part.trim());
+    if (match === null) return void 0;
+    const low = Number(match[1]);
+    const high = match[2] === void 0 ? low : Number(match[2]);
+    if (high < low) return void 0;
+    for (let core = low; core <= high; core++) cores.add(core);
+  }
+  return [...cores].sort((a, b) => a - b);
+}
+function formatCpuList(cores) {
+  const sorted = [...new Set(cores)].sort((a, b) => a - b);
+  const parts = [];
+  for (let i = 0; i < sorted.length; i++) {
+    const start = sorted[i];
+    while (sorted[i + 1] === sorted[i] + 1) i++;
+    parts.push(start === sorted[i] ? String(start) : `${start}-${sorted[i]}`);
+  }
+  return parts.join(",");
+}
+function usableCpus(deps = {}) {
   try {
-    return realpathSync(runnerDir(configPath));
+    const status = (deps.readStatus ?? (() => readFileSync("/proc/self/status", "utf8")))();
+    const cores = parseCpuList(/^Cpus_allowed_list:\s*(.+)$/m.exec(status)?.[1] ?? "");
+    if (cores !== void 0) return cores;
   } catch {
-    try {
-      return join(realpathSync(dirname(resolve(configPath))), "runner");
-    } catch {
-      return resolve(runnerDir(configPath));
-    }
   }
+  return Array.from({ length: Math.max(1, (deps.parallelism ?? availableParallelism)()) }, (_unused, core) => core);
 }
-function runnerLabelValue(configPath) {
-  return createHash("sha256").update(resolvedRunnerDir(configPath)).digest("hex").slice(0, 12);
-}
-function hardened(input) {
-  const { memory, cpus, pids } = input.limits;
-  return [
-    "--label",
-    `${BUILD_LABEL}=${input.buildId}`,
-    "--label",
-    `${RUNNER_LABEL}=${input.runnerId}`,
-    "--network",
-    "none",
-    "--cap-drop",
-    "ALL",
-    "--security-opt",
-    "no-new-privileges",
-    "--read-only",
-    "--user",
-    input.user,
-    // The same figure for swap as for memory leaves the container none.
-    "--memory",
-    memory,
-    "--memory-swap",
-    memory,
-    "--cpus",
-    String(cpus),
-    "--pids-limit",
-    String(pids)
-  ];
-}
-function mountPath(path) {
-  if (/[",]/.test(path)) throw new Error(`${path} holds a comma or a quote, which a Docker mount cannot carry; move the runner's config file`);
-  return path;
-}
-function containerRunArgs(input) {
-  return [
-    "--detach",
-    "--name",
-    input.container,
-    ...hardened(input),
-    "--mount",
-    `type=volume,src=${input.volume},dst=/build`,
-    // `/tmp` is a directory of the same volume, so it is measured and limited with the rest of the build.
-    "--mount",
-    `type=volume,src=${input.volume},dst=/tmp,volume-subpath=tmp`,
-    "--mount",
-    `type=bind,src=${mountPath(input.buildDir)},dst=${JOB_MOUNT},readonly`,
-    "--entrypoint",
-    "/opt/outerlayer/bin/tini",
-    input.image,
-    "--",
-    "/opt/outerlayer/bin/node",
-    "/opt/outerlayer/cli/dist/index.js",
-    "broker-relay",
-    "--port",
-    String(RELAY_PORT),
-    "--socket",
-    `${JOB_MOUNT}/tunnel.sock`,
-    ...Array.from({ length: input.destinations ?? 0 }, (_unused, index) => [
-      "--forward",
-      `${DESTINATION_BASE_PORT + index}=${JOB_MOUNT}/dest-${index}.sock`
-    ]).flat(),
-    ...input.builtIns === true ? [
-      "--forward",
-      `${GATEWAY_PORT}=${JOB_MOUNT}/${GATEWAY_SOCKET}`,
-      "--forward",
-      `${CLAUDE_PORT}=${JOB_MOUNT}/${CLAUDE_SOCKET}`
-    ] : []
-  ];
-}
-function prepareRunArgs(input) {
-  return [
-    "--rm",
-    ...hardened(input),
-    "--mount",
-    `type=volume,src=${input.volume},dst=/build`,
-    "--entrypoint",
-    "mkdir",
-    input.image,
-    "-p",
-    "-m",
-    "1777",
-    "/build/tmp",
-    "/build/home",
-    "/build/work"
-  ];
-}
-function containerExecArgs(input) {
-  const literals = Object.keys(input.env.literals).sort().flatMap((name) => ["-e", `${name}=${input.env.literals[name]}`]);
-  const passed = Object.keys(input.env.passed).filter((name) => input.env.passed[name] !== void 0).sort().flatMap((name) => ["-e", name]);
-  return [
-    "-u",
-    input.user,
-    ...input.workdir === void 0 ? [] : ["-w", input.workdir],
-    ...literals,
-    ...passed,
-    input.container,
-    ...input.argv
-  ];
+function createCpuAllocator(cores) {
+  const usable = [...new Set(cores)].sort((a, b) => a - b);
+  const held = /* @__PURE__ */ new Map();
+  const holders = (core) => {
+    let count = 0;
+    for (const set of held.values()) if (set.includes(core)) count++;
+    return count;
+  };
+  return {
+    acquire(buildId, cpus) {
+      const existing = held.get(buildId);
+      if (existing !== void 0) return existing;
+      const wanted = Math.min(Math.ceil(cpus), usable.length);
+      const ranked = usable.map((core) => ({ core, count: holders(core) })).sort((a, b) => a.count - b.count);
+      const chosen = ranked.slice(0, wanted).map(({ core }) => core).sort((a, b) => a - b);
+      held.set(buildId, chosen);
+      return chosen;
+    },
+    hold(buildId, set) {
+      held.set(buildId, [...set]);
+    },
+    release(buildId) {
+      held.delete(buildId);
+    }
+  };
 }
 var AssetError = class extends Error {
   constructor(file, message) {
@@ -693,7 +640,7 @@ function templateScript() {
   ].join("\n");
 }
 var ids = () => ({ uid: String(process.getuid?.() ?? 0), gid: String(process.getgid?.() ?? 0) });
-function converterArgs(dest, extra, script) {
+function converterArgs(dest, memoryBytes, extra, script) {
   const { uid, gid } = ids();
   return [
     "run",
@@ -701,6 +648,10 @@ function converterArgs(dest, extra, script) {
     "-i",
     "--network",
     "none",
+    "--memory",
+    String(memoryBytes),
+    "--memory-swap",
+    String(memoryBytes),
     "--mount",
     `type=bind,src=${dirname(dest)},dst=/out`,
     "-e",
@@ -719,7 +670,7 @@ function converterArgs(dest, extra, script) {
 }
 var firstLine2 = (text) => text.trim().split("\n")[0] ?? "";
 function exportInto(container, converter) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     const exporter = spawn("docker", ["export", container], { stdio: ["ignore", "pipe", "pipe"], env: childEnvironment(process.env) });
     const writer = spawn("docker", converter, { stdio: ["pipe", "ignore", "pipe"], env: childEnvironment(process.env) });
     const errors = [];
@@ -736,7 +687,7 @@ function exportInto(container, converter) {
       if (code !== 0 && failure === void 0) failure = `${name} exited ${code}`;
       exits += 1;
       if (exits < 2) return;
-      if (failure === void 0) resolve2();
+      if (failure === void 0) resolve();
       else reject(new Error(`${failure}: ${firstLine2(errors.join("\n"))}`));
     };
     exporter.once("exit", (code) => done("docker export", code));
@@ -746,18 +697,18 @@ function exportInto(container, converter) {
 function createRootfsHost() {
   const env = () => childEnvironment(process.env);
   return {
-    async convert({ imageId, dest }) {
+    async convert({ imageId, dest, memoryBytes }) {
       const created = await spawnRun("docker", ["create", imageId, "none"], { env: env() });
       if (created.status !== 0) throw new Error(`docker create ${imageId} failed: ${firstLine2(created.stderr)}`);
       const container = created.stdout.trim();
       try {
-        await exportInto(container, converterArgs(dest, [], converterScript()));
+        await exportInto(container, converterArgs(dest, memoryBytes, [], converterScript()));
       } finally {
         await spawnRun("docker", ["rm", "--force", "--volumes", container], { env: env() });
       }
     },
-    async makeTemplate({ bytes, dest }) {
-      const made = await spawnRun("docker", converterArgs(dest, ["-e", `BYTES=${bytes}`], templateScript()), { env: env() });
+    async makeTemplate({ bytes, dest, memoryBytes }) {
+      const made = await spawnRun("docker", converterArgs(dest, memoryBytes, ["-e", `BYTES=${bytes}`], templateScript()), { env: env() });
       if (made.status !== 0) throw new Error(`making the empty build disk failed: ${firstLine2(made.stderr)}`);
     },
     async imageConfig(imageId) {
@@ -806,14 +757,14 @@ async function ensureRootfs(input) {
   const path = rootfsPathFor(input.runnerDir, input.imageId);
   if (existsSync(path)) return path;
   const { uid, gid } = ids();
-  await madeAtomically(path, (temp) => input.host.convert({ imageId: input.imageId, dest: temp, uid: Number(uid), gid: Number(gid) }));
+  await madeAtomically(path, (temp) => input.host.convert({ imageId: input.imageId, dest: temp, uid: Number(uid), gid: Number(gid), memoryBytes: input.memoryBytes }));
   return path;
 }
 async function createBuildDisk(input) {
   const template = join(diskTemplatesDir(input.runnerDir), `${input.bytes}.ext4`);
   if (!existsSync(template)) {
     const { uid, gid } = ids();
-    await madeAtomically(template, (temp) => input.host.makeTemplate({ bytes: input.bytes, dest: temp, uid: Number(uid), gid: Number(gid) }));
+    await madeAtomically(template, (temp) => input.host.makeTemplate({ bytes: input.bytes, dest: temp, uid: Number(uid), gid: Number(gid), memoryBytes: input.memoryBytes }));
   }
   mkdirSync(dirname(input.dest), { recursive: true });
   if (input.host.copyTemplate) input.host.copyTemplate(template, input.dest);
@@ -885,7 +836,7 @@ function createFirecrackerHost(options = {}) {
         const failed = new Promise((_resolve, reject) => child.once("error", reject));
         const pid = child.pid;
         if (pid === void 0) return await failed;
-        exits.set(pid, new Promise((resolve2) => child.once("exit", () => resolve2())));
+        exits.set(pid, new Promise((resolve) => child.once("exit", () => resolve())));
         child.unref();
         const start = startTimeOf(pid);
         if (start === null) throw new Error(`${command} exited as soon as it started; its console is at ${input.consolePath}`);
@@ -902,8 +853,8 @@ function createFirecrackerHost(options = {}) {
       }
       const exited = exits.get(vm.pid);
       const deadline = Date.now() + STOP_WAIT_MS;
-      if (exited !== void 0) await Promise.race([exited, new Promise((resolve2) => setTimeout(resolve2, STOP_WAIT_MS))]);
-      while (alive(vm) && Date.now() < deadline) await new Promise((resolve2) => setTimeout(resolve2, POLL_MS));
+      if (exited !== void 0) await Promise.race([exited, new Promise((resolve) => setTimeout(resolve, STOP_WAIT_MS))]);
+      while (alive(vm) && Date.now() < deadline) await new Promise((resolve) => setTimeout(resolve, POLL_MS));
       exits.delete(vm.pid);
     },
     alive
@@ -913,7 +864,7 @@ function createFirecrackerHost(options = {}) {
 // src/runner/microvm/host.ts
 function createMicroVmPorts(over = {}) {
   return {
-    assets: over.assets ?? ((runnerDir2) => ensureAssets({ runnerDir: runnerDir2 })),
+    assets: over.assets ?? ((runnerDir) => ensureAssets({ runnerDir })),
     rootfs: over.rootfs ?? createRootfsHost(),
     firecracker: over.firecracker ?? createFirecrackerHost(),
     cgroup: over.cgroup ?? realCgroupPort(),
@@ -926,6 +877,10 @@ var aborted = () => ({ ok: false, reason: "", aborted: true });
 function firstLine3(text) {
   return text.trim().split("\n")[0] ?? "";
 }
+function gitErrorLine(text) {
+  const lines = text.split("\n").map((line) => line.trim()).filter((line) => line !== "");
+  return lines.find((line) => /^(fatal|error):/.test(line)) ?? lines.at(-1) ?? "";
+}
 function adoptionFailureReason(result) {
   const line = result.stdout.trim().split("\n").at(-1) ?? "";
   try {
@@ -940,7 +895,10 @@ async function runBuildSteps(input) {
   const rewrite = await exec(["git", "config", "--global", `url.http://127.0.0.1:${RELAY_PORT}/github.com/.insteadOf`, "https://github.com/"], "/build/work");
   if (rewrite.status !== 0) return { ok: false, reason: `configuring the build's git remote failed (exit ${rewrite.status})` };
   const clone = await exec(["git", "clone", "--filter=blob:none", "--single-branch", `https://github.com/${repository}.git`, CHECKOUT_DIR], "/build/work");
-  if (clone.status !== 0) return { ok: false, reason: `the clone of ${repository} failed (exit ${clone.status})` };
+  if (clone.status !== 0) {
+    const detail = gitErrorLine(clone.stderr);
+    return { ok: false, reason: `the clone of ${repository} failed (exit ${clone.status})${detail === "" ? "" : `: ${detail}`}` };
+  }
   try {
     const prepared = await prepareBranch({
       workdir: CHECKOUT_DIR,
@@ -1155,9 +1113,9 @@ async function git(args, cwd, env, input) {
     if (size < maxOutputBytes) out.push(chunk);
     size += chunk.length;
   });
-  const closed = new Promise((resolve2, reject) => {
+  const closed = new Promise((resolve, reject) => {
     child.once("error", reject);
-    child.once("close", (status) => resolve2(status));
+    child.once("close", (status) => resolve(status));
   });
   if (input !== void 0) {
     await pipeline(input, child.stdin).catch(() => void 0);
@@ -1354,14 +1312,14 @@ async function drain(req) {
   }
 }
 function readPrefix(req, gzip) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     const held = [];
     const finish = (section) => {
       req.off("data", onData);
       req.off("end", onEnd);
       req.off("error", reject);
       req.pause();
-      resolve2({ held, section });
+      resolve({ held, section });
     };
     const onData = (chunk) => {
       held.push(chunk);
@@ -1375,19 +1333,19 @@ function readPrefix(req, gzip) {
   });
 }
 function readBody(req, limit) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     const chunks = [];
     let size = 0;
     req.on("data", (chunk) => {
       size += chunk.length;
       if (size > limit) {
         req.pause();
-        resolve2(void 0);
+        resolve(void 0);
         return;
       }
       chunks.push(chunk);
     });
-    req.once("end", () => resolve2(Buffer.concat(chunks)));
+    req.once("end", () => resolve(Buffer.concat(chunks)));
     req.once("error", reject);
   });
 }
@@ -1400,7 +1358,7 @@ function createGitRemote(options) {
     const { route, res } = input;
     const url = new URL(`${gitUrl}/${route.owner}/${route.name}.git/${route.kind === "info-refs" ? "info/refs" : route.kind === "lfs-batch" ? "info/lfs/objects/batch" : `git-${route.kind}`}${route.search === "" ? "" : `?${route.search}`}`);
     const send = url.protocol === "https:" ? request$1 : request;
-    return new Promise((resolve2) => {
+    return new Promise((resolve) => {
       const upstream = send(url, { method: input.method, headers: { ...input.headers, connection: "close" } }, (answer) => {
         const headers = {};
         for (const [name, value] of Object.entries(answer.headers)) {
@@ -1422,18 +1380,18 @@ function createGitRemote(options) {
         });
         answer.once("end", () => {
           res.end();
-          resolve2();
+          resolve();
         });
         answer.once("error", () => {
           res.destroy();
-          resolve2();
+          resolve();
         });
       });
       upstream.on("error", (err) => {
         log(`could not reach GitHub for ${route.kind}: ${err.message}`);
         if (res.headersSent) res.destroy();
         else plain(res, 502, "the runner could not reach GitHub\n");
-        resolve2();
+        resolve();
       });
       res.once("close", () => upstream.destroy());
       input.feed(upstream);
@@ -1728,7 +1686,7 @@ async function startTunnel(socketPath, opts = {}) {
   if (Buffer.byteLength(socketPath) > MAX_SOCKET_PATH_BYTES) {
     throw new Error(`${socketPath} is too long for a Unix socket; keep the runner's config file nearer the root of the filesystem`);
   }
-  const resolve2 = opts.resolve ?? systemResolve;
+  const resolve = opts.resolve ?? systemResolve;
   const openConnection = opts.connect ?? ((t) => connect({ host: t.address, port: t.port }));
   const ownAddresses = opts.hostAddresses ?? systemHostAddresses;
   const connectTimeoutMs = opts.connectTimeoutMs ?? CONNECT_TIMEOUT_MS;
@@ -1812,7 +1770,7 @@ async function startTunnel(socketPath, opts = {}) {
     }
     let addresses;
     try {
-      addresses = await resolve2(host);
+      addresses = await resolve(host);
     } catch {
       return { ok: false, status: 502, body: `could not resolve ${host}
 ` };
@@ -1983,6 +1941,7 @@ function createContainerRuntime(opts = {}) {
   const { cli, remoteFor } = opts;
   return {
     host: opts.host ?? createContainerHost(),
+    cpus: opts.cpus ?? createCpuAllocator(usableCpus()),
     tunnels: opts.tunnels ?? /* @__PURE__ */ new Map(),
     buildImage: opts.buildImage ?? ((build) => buildRepositoryImage(
       {
@@ -1991,13 +1950,14 @@ function createContainerRuntime(opts = {}) {
         configPath: build.configPath,
         cli: cli ?? currentCliBuild(),
         readToken: build.readToken,
-        guestHelper: build.guestHelper
+        guestHelper: build.guestHelper,
+        log: build.log
       },
-      { host: opts.imageHost ?? createDockerHost() }
+      { host: opts.imageHost ?? createDockerHost({ builder: builderSpec(build.configPath, build.buildMemory, opts.hostEnv ?? process.env) }) }
     )),
     startTunnel: opts.startTunnel ?? startTunnel,
     tunnelOptions: opts.tunnelOptions,
-    sleep: opts.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms))),
+    sleep: opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))),
     hostEnv: opts.hostEnv ?? process.env,
     credentials: opts.credentials ?? /* @__PURE__ */ new Map(),
     github: { gitUrl: opts.github?.gitUrl ?? "https://github.com", apiUrl: opts.github?.apiUrl ?? "https://api.github.com" },
@@ -2068,7 +2028,17 @@ async function obtainImage(input) {
       };
     }
     try {
-      return { ok: true, built: await runtime.buildImage({ repository, configPath: config.configPath, readToken, guestHelper: input.guestHelper }) };
+      return {
+        ok: true,
+        built: await runtime.buildImage({
+          repository,
+          configPath: config.configPath,
+          buildMemory: config.build?.memory ?? "8g",
+          readToken,
+          guestHelper: input.guestHelper,
+          log: (line) => log.line(`${tag} ${line}`)
+        })
+      };
     } catch (err) {
       if (err instanceof RecipeError && err.code === "build_in_progress" && (input.now?.() ?? /* @__PURE__ */ new Date()).getTime() < input.deadlineMs) {
         log.line(`${tag} waiting for another build of ${repository}'s image`);
@@ -2077,7 +2047,8 @@ async function obtainImage(input) {
       }
       if (err instanceof RecipeError) {
         log.error(`${tag} image build for ${repository} failed: ${err.code}: ${err.message}`);
-        return { ok: false, reason: err.code };
+        const says = err.code === "image_build_out_of_memory" || err.code === "image_builder_unavailable";
+        return { ok: false, reason: says ? err.message : err.code };
       }
       return { ok: false, reason: `the image build failed: ${describeCallFailure(err)}` };
     }
@@ -2118,7 +2089,8 @@ async function provisionContainer(input) {
     imageId: report.imageId,
     containerEnv: report.apply.containerEnv,
     builtIns: true,
-    lifecycle: report.apply.lifecycle
+    lifecycle: report.apply.lifecycle,
+    cpuset: formatCpuList(runtime.cpus.acquire(buildId, config.build?.cpus ?? 4))
   };
   const env = buildEnvironment({
     config,
@@ -2170,7 +2142,7 @@ async function provisionContainer(input) {
   } catch (err) {
     return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
   }
-  const limits2 = { memory: config.build?.memory ?? "8g", cpus: config.build?.cpus ?? 4, pids: config.build?.pids ?? 4096 };
+  const limits2 = { memory: config.build?.memory ?? "8g", cpus: config.build?.cpus ?? 4, pids: config.build?.pids ?? 4096, cpuset: state.cpuset };
   const runnerId = runnerLabelValue(config.configPath);
   const volume = await host.createVolume(name, { [BUILD_LABEL]: buildId, [RUNNER_LABEL]: runnerId });
   if (volume.status !== 0) return dockerFailed("creating the build's volume", volume);
@@ -2401,6 +2373,7 @@ async function cleanupContainer(runtime, state, jobDir) {
     await tunnel.close();
   }
   rmSync(state.buildDir, { recursive: true, force: true });
+  runtime.cpus.release(state.buildId);
   if (failures.length > 0) throw new Error(failures.join("; "));
 }
 async function startCheckContainer(input) {
@@ -2416,7 +2389,8 @@ async function startCheckContainer(input) {
   const name = `outerlayer-check-${buildId}`;
   const buildDir2 = buildDir(config.configPath, buildId);
   const agentUser = built.agentUser ?? ADDED_USER;
-  const state = { buildId, container: name, volume: name, buildDir: buildDir2, repository, imageId: built.imageId, agentUser };
+  const cpuset = built.cpuset ?? formatCpuList(runtime.cpus.acquire(buildId, config.build?.cpus ?? 4));
+  const state = { buildId, container: name, volume: name, buildDir: buildDir2, repository, imageId: built.imageId, agentUser, cpuset };
   const checksDir = join(jobDir, "checks");
   mkdirSync(checksDir, { recursive: true });
   const logPath = join(checksDir, "environment.log");
@@ -2438,7 +2412,7 @@ async function startCheckContainer(input) {
   } catch (err) {
     return fail(`the tunnel could not start: ${describeCallFailure(err)}`);
   }
-  const limits2 = { memory: config.build?.memory ?? "8g", cpus: config.build?.cpus ?? 4, pids: config.build?.pids ?? 4096 };
+  const limits2 = { memory: config.build?.memory ?? "8g", cpus: config.build?.cpus ?? 4, pids: config.build?.pids ?? 4096, cpuset };
   const runnerId = runnerLabelValue(config.configPath);
   const volume = await host.createVolume(name, { [BUILD_LABEL]: buildId, [RUNNER_LABEL]: runnerId });
   if (volume.status !== 0) return dockerFailed("creating the check environment's volume", volume);
@@ -2474,4 +2448,4 @@ async function startCheckContainer(input) {
   };
 }
 
-export { ADDED_USER, AgentUserError, AssetError, BUILD_LABEL, BuildTokens, GH_CONFIG_YML, MIN_ENGINE_MAJOR, RUNNER_LABEL, classifyRefusal, cleanupContainer, containerCommandLine, containerSenderCommand, createBuildDisk, createContainerRuntime, createRunnerLog, deleteBuildDisk, describeCallFailure, ensureRootfs, ensureTunnel, formatClock, formatDuration, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, prepareBranch, provisionContainer, refusalCode, relativeToRunner, removeStagedContext, resolveAgentUser, retrySend, runBuildSteps, runnerLabelValue, senderSignalScript, setUpRunnerCgroup, shellQuote, shortClaim, signalInContainer, stageGovernedContext, startCheckContainer, startServicesFor, stopContainer, syncInContainer };
+export { ADDED_USER, AgentUserError, AssetError, BuildTokens, GH_CONFIG_YML, MIN_ENGINE_MAJOR, classifyRefusal, cleanupContainer, containerCommandLine, containerSenderCommand, createBuildDisk, createContainerRuntime, createRunnerLog, deleteBuildDisk, describeCallFailure, ensureRootfs, ensureTunnel, formatClock, formatDuration, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, provisionContainer, refusalCode, relativeToRunner, removeStagedContext, resolveAgentUser, retrySend, runBuildSteps, senderSignalScript, setUpRunnerCgroup, shellQuote, shortClaim, signalInContainer, stageGovernedContext, startCheckContainer, startServicesFor, stopContainer, syncInContainer };