exec-sandbox 0.20.0__tar.gz → 0.22.0__tar.gz

{exec_sandbox-0.20.0 → exec_sandbox-0.22.0}/.github/actions/build-guest-agent/action.yml

@@ -5,26 +5,15 @@ inputs:
   arch:
     description: Target architecture (x86_64 or aarch64)
     required: true
-  rust-version:
-    description: Rust toolchain version (sourced from Makefile rust_version)
-    required: true
 
 runs:
   using: composite
   steps:
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
-
-    - name: Expose GitHub Actions cache variables
-      uses: actions/github-script@v7
-      with:
-        script: |
-          core.exportVariable('ACTIONS_CACHE_URL', process.env['ACTIONS_CACHE_URL'] || '');
-          core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env['ACTIONS_RUNTIME_TOKEN'] || '');
-          core.exportVariable('ACTIONS_RESULTS_URL', process.env['ACTIONS_RESULTS_URL'] || '');
+      uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
     # Try to restore from latest run on same branch (hash-based caching in build script will skip if unchanged)
     - name: Get latest run ID
@@ -43,7 +32,7 @@ runs:
 
     - name: Download previous build
       if: steps.latest-run.outputs.run_id != ''
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
       with:
         name: guest-agent-${{ inputs.arch == 'x86_64' && 'x64' || 'arm64' }}
         path: images/dist/
@@ -53,8 +42,4 @@ runs:
 
     - name: Build guest-agent
       shell: bash
-      env:
-        RUST_VERSION: ${{ inputs.rust-version }}
-        BUILDX_CACHE_FROM: type=gha,ignore-error=true
-        BUILDX_CACHE_TO: type=gha,mode=max,ignore-error=true
       run: ./scripts/build-guest-agent.sh ${{ inputs.arch }}

{exec_sandbox-0.20.0 → exec_sandbox-0.22.0}/.github/actions/build-gvproxy-wrapper/action.yml

@@ -11,7 +11,7 @@ runs:
   using: composite
   steps:
     - name: Install Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
       with:
         go-version: "1.24"
         cache-dependency-path: gvproxy-wrapper/go.sum

{exec_sandbox-0.20.0 → exec_sandbox-0.22.0}/.github/actions/build-tiny-init/action.yml

@@ -5,26 +5,15 @@ inputs:
   arch:
     description: Target architecture (x86_64 or aarch64)
     required: true
-  rust-version:
-    description: Rust toolchain version (sourced from Makefile rust_version)
-    required: true
 
 runs:
   using: composite
   steps:
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
-
-    - name: Expose GitHub Actions cache variables
-      uses: actions/github-script@v7
-      with:
-        script: |
-          core.exportVariable('ACTIONS_CACHE_URL', process.env['ACTIONS_CACHE_URL'] || '');
-          core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env['ACTIONS_RUNTIME_TOKEN'] || '');
-          core.exportVariable('ACTIONS_RESULTS_URL', process.env['ACTIONS_RESULTS_URL'] || '');
+      uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
     # Try to restore from latest run on same branch (hash-based caching in build script will skip if unchanged)
     - name: Get latest run ID
@@ -43,7 +32,7 @@ runs:
 
     - name: Download previous build
       if: steps.latest-run.outputs.run_id != ''
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
       with:
         name: tiny-init-${{ inputs.arch == 'x86_64' && 'x64' || 'arm64' }}
         path: images/dist/
@@ -53,8 +42,4 @@ runs:
 
     - name: Build tiny-init
       shell: bash
-      env:
-        RUST_VERSION: ${{ inputs.rust-version }}
-        BUILDX_CACHE_FROM: type=gha,ignore-error=true
-        BUILDX_CACHE_TO: type=gha,mode=max,ignore-error=true
       run: ./scripts/build-tiny-init.sh ${{ inputs.arch }}

{exec_sandbox-0.20.0 → exec_sandbox-0.22.0}/.github/actions/build-vm-images/action.yml

@@ -5,9 +5,6 @@ inputs:
   arch:
     description: Target architecture (x86_64 or aarch64)
     required: true
-  alpine-version:
-    description: Alpine Linux version (sourced from Makefile alpine_version)
-    required: true
   variant:
     description: Image variant (python, node, raw, or all)
     required: false
@@ -17,18 +14,10 @@ runs:
   using: composite
   steps:
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
-
-    - name: Expose GitHub Actions cache variables
-      uses: actions/github-script@v7
-      with:
-        script: |
-          core.exportVariable('ACTIONS_CACHE_URL', process.env['ACTIONS_CACHE_URL'] || '');
-          core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env['ACTIONS_RUNTIME_TOKEN'] || '');
-          core.exportVariable('ACTIONS_RESULTS_URL', process.env['ACTIONS_RESULTS_URL'] || '');
+      uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
     # Try to restore from latest run on same branch (hash-based caching in build script will skip if unchanged)
     - name: Get latest run ID
@@ -47,7 +36,7 @@ runs:
 
     - name: Download previous build
       if: steps.latest-run.outputs.run_id != ''
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
       with:
         name: vm-images-${{ inputs.arch == 'x86_64' && 'x64' || 'arm64' }}
         path: images/dist/
@@ -57,16 +46,8 @@ runs:
 
     - name: Build kernel + initramfs
       shell: bash
-      env:
-        ALPINE_VERSION: ${{ inputs.alpine-version }}
-        BUILDX_CACHE_FROM: type=gha,ignore-error=true
-        BUILDX_CACHE_TO: type=gha,mode=max,ignore-error=true
       run: ./scripts/extract-kernel.sh ${{ inputs.arch }}
 
     - name: Build qcow2
       shell: bash
-      env:
-        ALPINE_VERSION: ${{ inputs.alpine-version }}
-        BUILDX_CACHE_FROM: type=gha,ignore-error=true
-        BUILDX_CACHE_TO: type=gha,mode=max,ignore-error=true
       run: ./scripts/build-qcow2.sh ${{ inputs.variant }} ${{ inputs.arch }}

exec_sandbox-0.22.0/.github/actions/setup-vm-infra/action.yml

@@ -0,0 +1,253 @@
+name: Setup VM infrastructure
+description: >
+  Setup for running QEMU VMs: install QEMU (from build artifact on Linux,
+  brew on macOS), KVM permissions, qemu-vm user, unprivileged user namespaces,
+  cgroup delegation, and system limits.
+  Used by test-python and CodSpeed benchmark jobs.
+
+inputs:
+  os:
+    description: Host OS (linux or macos)
+    required: true
+  arch:
+    description: Host architecture (x64 or arm64)
+    required: true
+  os-version:
+    description: Ubuntu codename for QEMU build artifact (noble or jammy)
+    required: false
+    default: noble
+  setup-cgroups:
+    description: Setup cgroup delegation (disable for sandboxed runners like CodSpeed)
+    required: false
+    default: "true"
+
+runs:
+  using: composite
+  steps:
+    # --- Install QEMU ---
+
+    - name: Install QEMU runtime libs (Linux)
+      if: inputs.os == 'linux'
+      shell: bash
+      run: |
+        # Remove Microsoft repos that can cause 403 errors (we don't need Azure CLI etc.)
+        # See: https://github.com/actions/runner-images/issues/9733
+        sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list /etc/apt/sources.list.d/azure-cli.list
+        sudo apt-get update
+        # Runtime shared libs for our QEMU build (--enable-fdt/linux-io-uring/seccomp/slirp/tools):
+        #   libfdt1 (libfdt.so.1), liburing2 (liburing.so.2), libseccomp2 (libseccomp.so.2),
+        #   libslirp0 (libslirp.so.0), libpixman-1-0
+        # No qemu-utils needed — our build includes qemu-img and qemu-storage-daemon (--enable-tools)
+        sudo apt-get install -y libfdt1 liburing2 libseccomp2 libslirp0 libpixman-1-0
+
+    - name: Download QEMU build (Linux)
+      if: inputs.os == 'linux'
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      with:
+        name: qemu-${{ inputs.arch }}-${{ inputs.os-version }}
+        path: ~/qemu-build/
+
+    - name: Install QEMU to PATH (Linux)
+      if: inputs.os == 'linux'
+      shell: bash
+      run: |
+        # Restore executable permissions (stripped by actions/download-artifact)
+        chmod +x ~/qemu-build/bin/*
+        # Uninstall any system-packaged QEMU to prevent PATH shadowing.
+        # Some runners (e.g. CodSpeed macro) ship Ubuntu's qemu-system-arm package,
+        # which lacks --enable-seccomp.  Just deleting the binaries (rm -f /usr/bin/qemu-*)
+        # is insufficient: the package remains registered in dpkg, so any subsequent
+        # apt operation (e.g. CodSpeed's valgrind .deb install via apt-get) can
+        # reinstall the missing files.  A clean apt remove ensures dpkg no longer
+        # considers the package installed.
+        if dpkg -l 'qemu-system-*' 2>/dev/null | grep -q '^ii'; then
+            echo "Removing system QEMU packages..."
+            sudo apt-get remove -y 'qemu-system-*' 2>/dev/null || true
+        fi
+        # Copy pre-built QEMU to /usr/local/
+        sudo cp -a ~/qemu-build/bin/* /usr/local/bin/
+        sudo cp -a ~/qemu-build/share/qemu /usr/local/share/qemu 2>/dev/null || true
+
+    - name: Install QEMU (macOS)
+      if: inputs.os == 'macos'
+      shell: bash
+      run: brew install qemu coreutils
+
+    # --- Linux-only VM isolation ---
+
+    - name: Setup KVM permissions (Linux)
+      if: inputs.os == 'linux'
+      shell: bash
+      run: |
+        # Make /dev/kvm accessible to all users for hardware acceleration
+        # Using direct chmod because udevadm trigger can fail on some runners
+        # See: https://github.com/actions/runner-images/issues/8542
+        if [ -e /dev/kvm ]; then
+          sudo chmod 666 /dev/kvm
+          echo "KVM permissions updated:"
+          ls -la /dev/kvm
+        else
+          echo "WARNING: /dev/kvm not found - KVM acceleration not available"
+        fi
+
+    - name: Create qemu-vm user (Linux)
+      if: inputs.os == 'linux'
+      shell: bash
+      run: |
+        # Create unprivileged user for QEMU process isolation
+        # Don't specify UID - let the system assign one to avoid conflicts
+        if ! id qemu-vm &>/dev/null; then
+          sudo useradd --system --no-create-home --shell /usr/sbin/nologin qemu-vm
+        fi
+        # Add qemu-vm to kvm group for hardware acceleration access
+        sudo usermod -aG kvm qemu-vm
+        # Add runner to qemu-vm group for socket access (sockets are 0660)
+        sudo usermod -aG qemu-vm runner
+        # Allow runner to run commands AS qemu-vm (for QEMU process)
+        # Note: runner already has full sudo via GitHub Actions, so chown works
+        echo "runner ALL=(qemu-vm) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/qemu-vm
+
+    - name: Enable unprivileged user namespaces (Linux)
+      if: inputs.os == 'linux'
+      shell: bash
+      run: |
+        # Ubuntu 24.04 restricts unprivileged user namespaces via AppArmor by default
+        # Disable this restriction to allow unshare for namespace isolation
+        # See: https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces
+        if [ -f /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]; then
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+        fi
+
+    - name: Setup cgroup delegation (Linux)
+      if: inputs.os == 'linux' && inputs.setup-cgroups == 'true'
+      shell: bash
+      run: |
+        # cgroupv2 delegation setup for VM resource limits.
+        #
+        # Hierarchy:
+        #   /sys/fs/cgroup/
+        #   └── code-exec/                  ← delegated root (runner-owned)
+        #       ├── cgroup.subtree_control  ← +memory +cpu +pids
+        #       ├── runner/                 ← runner process lives here
+        #       └── exec-sandbox/           ← created at runtime by exec_sandbox
+        #           └── session-xxx/        ← per-VM cgroup with resource limits
+        #
+        # The runner process must be moved into code-exec/runner/ (via sudo,
+        # before any sandboxed execution like CodSpeed/valgrind). Once inside,
+        # all child processes inherit the cgroup. exec_sandbox then moves QEMU
+        # from code-exec/runner/ to code-exec/exec-sandbox/session-xxx/.
+        # This intra-subtree migration only needs write to the common ancestor
+        # (code-exec/cgroup.procs), which is runner-owned — no sudo required.
+        # Ref: https://docs.kernel.org/admin-guide/cgroup-v2.html#delegation
+        #
+        sudo mkdir -p /sys/fs/cgroup/code-exec
+        # Enable controllers at root and code-exec levels for nested VM cgroups
+        echo "+memory +cpu +pids" | sudo tee /sys/fs/cgroup/cgroup.subtree_control
+        echo "+memory +cpu +pids" | sudo tee /sys/fs/cgroup/code-exec/cgroup.subtree_control
+        # Create runner cgroup (cgroups with subtree_control can't have processes directly)
+        sudo mkdir -p /sys/fs/cgroup/code-exec/runner
+        # Delegate ownership to runner user so tests can create sub-cgroups
+        sudo chown -R runner:runner /sys/fs/cgroup/code-exec
+
+    - name: Increase system limits (Linux)
+      if: inputs.os == 'linux' && inputs.setup-cgroups == 'true'
+      shell: bash
+      run: |
+        # Increase process/thread limits to prevent QEMU thread creation failures
+        # QEMU creates multiple threads per VM (iothread, vCPU, virtio workers)
+        # With parallel tests spawning multiple VMs, we can exhaust default limits
+        # References:
+        #   - https://access.redhat.com/solutions/350593 (QEMU pthread_create failures)
+        #   - https://www.baeldung.com/linux/max-threads-per-process (threads-max formula)
+        #   - https://github.com/systemd/systemd/issues/3211 (TasksMax=512 fallout)
+        echo "=== Current limits ==="
+        ulimit -a
+        echo ""
+        echo "=== System thread/process limits ==="
+        cat /proc/sys/kernel/threads-max
+        cat /proc/sys/kernel/pid_max
+        echo ""
+        # 1. Kernel-level: increase threads-max (default = RAM/128KB, ~60k on 7GB runner)
+        #    Formula: max_threads = totalram_pages / 16 (x86)
+        sudo sysctl -w kernel.threads-max=120000
+        # 2. File descriptors: raise soft limit to hard limit.
+        #    Each QEMU VM needs ~7-10 fds from the orchestrator (subprocess pipes,
+        #    sockets, lock files). Default soft=1024 causes SIGABRT at ~85 concurrent VMs.
+        #    The Scheduler also does this at startup via raise_fd_limit(), but raising it
+        #    here ensures subprocesses and test harness also benefit.
+        echo "nofile soft/hard before: $(ulimit -Sn)/$(ulimit -Hn)"
+        ulimit -n "$(ulimit -Hn)"
+        echo "nofile soft/hard after:  $(ulimit -Sn)/$(ulimit -Hn)"
+        # 3. Memory mappings per process (QEMU uses many for virtio rings, RAM, etc.)
+        sudo sysctl -w vm.max_map_count=262144
+        # 3b. Overcommit: heuristic mode (0) causes kernel to reject mmap for QEMU
+        #     thread stacks during burst VM startup, even with ample free RAM.
+        #     glibc converts ENOMEM→EAGAIN, which QEMU treats as fatal (abort).
+        #     Mode 1 ("always allow") eliminates heuristic; OOM killer is the backstop.
+        sudo sysctl -w vm.overcommit_memory=1
+        # 4. PAM limits for qemu-vm user (nproc = threads + processes per UID)
+        echo "qemu-vm soft nproc unlimited" | sudo tee -a /etc/security/limits.d/90-qemu.conf
+        echo "qemu-vm hard nproc unlimited" | sudo tee -a /etc/security/limits.d/90-qemu.conf
+        echo "runner soft nproc unlimited" | sudo tee -a /etc/security/limits.d/90-qemu.conf
+        echo "runner hard nproc unlimited" | sudo tee -a /etc/security/limits.d/90-qemu.conf
+        # 5. systemd TasksMax: default is 15% of pid_max (~4915), can limit cgroup tasks
+        #    See: https://github.com/systemd/systemd/issues/3211
+        sudo mkdir -p /etc/systemd/system/user-.slice.d
+        echo -e "[Slice]\nTasksMax=infinity" | sudo tee /etc/systemd/system/user-.slice.d/90-tasksmax.conf
+        sudo systemctl daemon-reload
+        # 6. Diagnostic: dump all thread/pids limits for debugging
+        echo ""
+        echo "=== Cgroup pids limits (current session) ==="
+        CGROUP_PATH=$(cat /proc/self/cgroup | sed 's/0:://')
+        echo "Current cgroup: $CGROUP_PATH"
+        DIR="/sys/fs/cgroup${CGROUP_PATH}"
+        while [ "$DIR" != "/sys/fs/cgroup" ] && [ "$DIR" != "/" ]; do
+          PIDS_MAX=$(cat "$DIR/pids.max" 2>/dev/null || echo "N/A")
+          PIDS_CUR=$(cat "$DIR/pids.current" 2>/dev/null || echo "N/A")
+          echo "  $DIR: pids.max=$PIDS_MAX pids.current=$PIDS_CUR"
+          DIR=$(dirname "$DIR")
+        done
+        echo ""
+        echo "=== RLIMIT_NPROC and RLIMIT_NOFILE for runner and qemu-vm ==="
+        cat /proc/self/limits | grep -E "Max processes|Max open files"
+        sudo -u qemu-vm cat /proc/self/limits 2>/dev/null | grep -E "Max processes|Max open files" || echo "Cannot read qemu-vm limits"
+        echo ""
+        echo "=== systemd TasksMax for user slices ==="
+        systemctl show "user-$(id -u).slice" --property=TasksMax 2>/dev/null || true
+        echo ""
+        echo "=== io_uring availability ==="
+        cat /proc/sys/kernel/io_uring_disabled 2>/dev/null || echo "sysctl not present (io_uring enabled)"
+        # 7. Remove pids.max limits from runner's cgroup hierarchy
+        #    TasksMax=infinity drop-in only affects new sessions; directly write to live cgroup
+        CGROUP_PATH=$(cat /proc/self/cgroup | sed 's/0:://')
+        DIR="/sys/fs/cgroup${CGROUP_PATH}"
+        while [ "$DIR" != "/sys/fs/cgroup" ] && [ "$DIR" != "/" ]; do
+          if [ -f "$DIR/pids.max" ] && [ -w "$DIR/pids.max" ]; then
+            echo max | sudo tee "$DIR/pids.max" > /dev/null 2>&1 || true
+          fi
+          DIR=$(dirname "$DIR")
+        done
+
+    # --- Verify installation ---
+
+    - name: Verify QEMU installation
+      shell: bash
+      run: |
+        echo "=== QEMU binaries ==="
+        which qemu-system-x86_64 || echo "qemu-system-x86_64 not found"
+        which qemu-system-x86_64-microvm || echo "qemu-system-x86_64-microvm not found"
+        which qemu-system-aarch64 || echo "qemu-system-aarch64 not found"
+        echo ""
+        echo "=== QEMU version ==="
+        QEMU_BIN="${{ inputs.arch == 'x64' && 'qemu-system-x86_64' || 'qemu-system-aarch64' }}"
+        "$QEMU_BIN" --version
+        echo ""
+        echo "=== Available machine types (first 20) ==="
+        "$QEMU_BIN" -machine help | head -20
+        echo ""
+        echo "=== Hardware acceleration ==="
+        if [ "${{ inputs.os }}" = "linux" ]; then
+          ls -la /dev/kvm || echo "/dev/kvm not available"
+        else
+          sysctl kern.hv_support || echo "HVF not available"
+        fi

exec_sandbox-0.22.0/.github/runs-on.yml

@@ -0,0 +1,54 @@
+# RunsOn runner profiles — diversify EC2 instance families for faster spot allocation.
+# Docs: https://runs-on.com/configuration/runner-profiles/
+#
+# RAM range: cpu×2 to cpu×4 (1:2–1:4 ratio). AWS Fleet picks lowest spot price
+# within that band. Without a floor, Fleet picks t4g.nano (0.5GB) and OOMs.
+# r-series (1:8) excluded — never matches the 1:4 ceiling.
+
+runners:
+  # ARM64 (Graviton) — compute + general-purpose + burstable
+  1cpu-linux-arm64: &arm64
+    cpu: 1
+    ram: [ 2, 4 ]
+    image: ubuntu24-full-arm64
+    family: [ "c7g", "m7g", "r7g", "c8g", "m8g", "t4g" ]
+
+  2cpu-linux-arm64:
+    <<: *arm64
+    cpu: 2
+    ram: [ 4, 8 ]
+
+  4cpu-linux-arm64:
+    <<: *arm64
+    cpu: 4
+    ram: [ 8, 16 ]
+
+  8cpu-linux-arm64:
+    <<: *arm64
+    cpu: 8
+    ram: [ 16, 32 ]
+
+  # x64 — Intel + AMD
+  # Note: nested-virt (KVM) only works on c8i, m8i, r8i (Intel Xeon 6).
+  # RunsOn intersects this list with nested-virt-capable families at runtime,
+  # so jobs with /nested-virt effectively use {c8i, m8i, r8i} only.
+  1cpu-linux-x64: &x64
+    cpu: 1
+    ram: [ 2, 4 ]
+    image: ubuntu24-full-x64
+    family: [ "c7i", "m7i", "r7i", "c7a", "m7a", "c8i", "m8i", "r8i", "c8a", "m8a" ]
+
+  2cpu-linux-x64:
+    <<: *x64
+    cpu: 2
+    ram: [ 4, 8 ]
+
+  4cpu-linux-x64:
+    <<: *x64
+    cpu: 4
+    ram: [ 8, 16 ]
+
+  8cpu-linux-x64:
+    <<: *x64
+    cpu: 8
+    ram: [ 16, 32 ]