Linux sandbox with cgroup support [ignoring sandbox in MacOS]#5
Merged
Linux sandbox with cgroup support [ignoring sandbox in MacOS]#5
Conversation
HackStrix
force-pushed
the
feature/sandbox-template
branch
from
2d26098 to
d69c759
Compare
- Layer 1 (sandbox_linux_test.go): unit tests for applySandboxFlags and cgroupHandle using temp cgroup root (activeCgroupRoot injection) — no real cgroup privileges needed - Layer 2 (factory_cgroup_test.go): unit tests for ProcessFactory builder methods (WithMemoryLimit, WithCPULimit, WithPIDsLimit) — runs on all platforms - Layer 3 (sandbox_integration_test.go): integration tests spawning real processes to verify born-in-cgroup, directory lifecycle, and limit file enforcement (gated with HERD_CGROUP_TEST=1, requires root/cgroup delegation on Linux) - testdata/healthworker/main.go: minimal HTTP server for integration test spawning - sandbox.go: shared types (sandboxConfig, sandboxHandle) used by all sandbox impls
Add activeCgroupRoot package variable (defaults to herdCgroupRoot) so tests can redirect all cgroup operations to a temp directory without requiring real cgroup privileges. All references to herdCgroupRoot in applySandboxFlags now use activeCgroupRoot, enabling fast unit tests via t.TempDir() redirection.
- Drop 1.21.x from test matrix (incompatible with go.mod requirement of >= 1.22) - Add new cgroup-integration job: detects cgroupv2 availability, builds testdata, and runs Layer 3 integration tests as root with HERD_CGROUP_TEST=1 gate - Existing test job in matrix covers Layer 1 (Linux-only unit tests) and Layer 2 (portable factory tests) automatically via normal go test
…r startup The previous limit of 5 PIDs was too tight for a Go HTTP server to start, causing pthread_create to fail. This demonstrates the limit works, but isn't a realistic test. Changed to 30 PIDs which allows the healthworker to start while still verifying that the pids.max cgroup file is written and enforced at the kernel level. Also added logging to show actual pids.current usage.
HackStrix
changed the title
HackStrix
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces cgroup v2 resource isolation support for worker processes, along with comprehensive tests and CI integration. The main changes include adding cgroup configuration options to the
ProcessFactory, implementing sandbox resource management, and providing both unit and integration tests to verify kernel-level enforcement. The CI pipeline and Docker setup are also updated to support these features.Cgroup resource isolation and sandboxing:
ProcessFactory(cgroupMemory,cgroupCPU,cgroupPIDs,enableSandbox) and corresponding builder methods (WithMemoryLimit,WithCPULimit,WithPIDsLimit,WithInsecureSandbox) to allow per-worker cgroup resource limits. These values are passed to the sandbox layer when spawning workers. (process_worker_factory.go[1] [2] [3] [4] [5] [6]sandboxConfigstruct andsandboxHandleinterface to abstract resource constraints and lifecycle management for sandboxes. (sandbox.gosandbox.goR1-R16)process_worker_factory.go[1] [2]Testing improvements:
factory_cgroup_test.gofactory_cgroup_test.goR1-R137)sandbox_integration_test.gosandbox_integration_test.goR1-R242)CI and build updates:
go.modand all workflow jobs, removing 1.21.x from the matrix due to new requirements. (go.mod[1].github/workflows/ci.yml[2] [3].github/workflows/ci.yml.github/workflows/ci.ymlR39-R74)Docker and Compose enhancements:
Dockerfilethat builds theplaywrightexample with Go and sets up Playwright with Chromium in a multi-stage build. (DockerfileDockerfileR1-R24)docker-compose.yamlfor the Playwright service. (docker-compose.yamldocker-compose.yamlR1-R5)