fix(fspy): use memfd for Linux shared memory

Co-authored-by: GPT-5.6 <gpt-5.6@openai.com>

Author: wan9chi

CHANGELOG.md

@@ -3,6 +3,7 @@
 - **Fixed** Windows automatic input tracking now records executable image reads when process creation performs the lookup inside `NtCreateUserProcess` ([#518](https://github.com/voidzero-dev/vite-task/pull/518)).
 - **Fixed** Failures while waiting for a started task process to exit no longer incorrectly say the process failed to spawn ([#515](https://github.com/voidzero-dev/vite-task/pull/515)).
 - **Fixed** Missing env vars requested through `@voidzero-dev/vite-task-client` now return `undefined` instead of `null`, preserving Vite production `NODE_ENV` semantics when builds run through `vp run` ([#508](https://github.com/voidzero-dev/vite-task/pull/508)).
+- **Fixed** Linux file-access tracking no longer consumes the `/dev/shm` mount used by containers and Kubernetes runners ([#353](https://github.com/voidzero-dev/vite-task/issues/353)).
 - **Fixed** Windows builds no longer hang on CI when a `node_modules/.bin` `.cmd` shim is routed through PowerShell: the npm/pnpm/yarn `.ps1` wrappers read stdin and block forever on a non-TTY pipe, so the PowerShell rewrite is now skipped when stdin is not an interactive terminal, falling back to the `.cmd` (which never reads stdin) ([#491](https://github.com/voidzero-dev/vite-task/pull/491)).
 - **Added** First-party support for caching `vite build` with zero cache config, giving Vite projects correct cache hits out of the box ([vitejs/vite#22453](https://github.com/vitejs/vite/pull/22453)).
 - **Added** Support for specifying tasks from dependency packages in `dependsOn`, such as `dependsOn: [{ "task": "build", "from": "dependencies" }]` ([#479](https://github.com/voidzero-dev/vite-task/pull/479)).

Cargo.lock

@@ -116,6 +116,7 @@ ref-cast = "1.0.24"
 regex = "1.11.3"
 rusqlite = "0.39.0"
 rustc-hash = "2.1.1"
+rustix = "1.1"
 # SeccompAction::UserNotif (SECCOMP_RET_USER_NOTIF) was added after the latest published release (v0.5.0)
 seccompiler = { git = "https://github.com/rust-vmm/seccompiler", rev = "08587106340b8e3cb361c7561411510039436857" }
 serde = "1.0.219"

Cargo.toml

@@ -28,6 +28,9 @@ ctor = { workspace = true }
 rustc-hash = { workspace = true }
 subprocess_test = { workspace = true }
 
+[target.'cfg(target_os = "linux")'.dev-dependencies]
+tokio = { workspace = true, features = ["net", "rt-multi-thread", "time"] }
+
 [lints]
 workspace = true
 

crates/fspy_shared/Cargo.toml

@@ -139,9 +139,12 @@ impl Deref for Sender {
     }
 }
 
-#[expect(
-    clippy::non_send_fields_in_send_ty,
-    reason = "`Sender` holds a shared file lock that ensures there's no reader, so `shm` can be safely written to"
+#[cfg_attr(
+    not(target_os = "linux"),
+    expect(
+        clippy::non_send_fields_in_send_ty,
+        reason = "`Sender` holds a shared file lock that ensures there's no reader, so `shm` can be safely written to"
+    )
 )]
 /// SAFETY: `Sender` holds a shared file lock that ensures there's no reader, so `shm` can be safely written to.
 unsafe impl Send for Sender {}
@@ -157,9 +160,12 @@ pub struct Receiver {
     shm: Shm,
 }
 
-#[expect(
-    clippy::non_send_fields_in_send_ty,
-    reason = "Receiver doesn't read or write `shm`. It only pass it to `ReceiverLockGuard` under the lock"
+#[cfg_attr(
+    not(target_os = "linux"),
+    expect(
+        clippy::non_send_fields_in_send_ty,
+        reason = "Receiver doesn't read or write `shm`. It only passes it to `ReceiverLockGuard` under the lock"
+    )
 )]
 /// SAFETY: `Receiver` doesn't read or write `shm`. It only passes it to `ReceiverLockGuard` under the lock.
 unsafe impl Send for Receiver {}
@@ -229,6 +235,8 @@ mod tests {
     #[test]
     fn smoke() {
         let created = channel(100).unwrap();
+        #[cfg(target_os = "linux")]
+        let (broker_runtime, broker_handle) = start_test_broker(created.broker);
         let conf = created.conf;
         let receiver = created.receiver;
         let cmd = command_for_fn!(conf, |conf: ChannelConf| {
@@ -239,6 +247,9 @@ mod tests {
         });
         assert!(std::process::Command::from(cmd).status().unwrap().success());
 
+        #[cfg(target_os = "linux")]
+        stop_test_broker(&broker_runtime, broker_handle);
+
         let lock = receiver.lock().unwrap();
         let mut frames = lock.iter_frames();
 
@@ -252,6 +263,8 @@ mod tests {
     #[expect(clippy::print_stdout, reason = "test diagnostics")]
     fn forbid_new_senders_after_locked() {
         let created = channel(42).unwrap();
+        #[cfg(target_os = "linux")]
+        let (broker_runtime, broker_handle) = start_test_broker(created.broker);
         let conf = created.conf;
         let receiver = created.receiver;
         let _lock = receiver.lock().unwrap();
@@ -261,12 +274,16 @@ mod tests {
         });
         let output = std::process::Command::from(cmd).output().unwrap();
         assert_eq!(B(&output.stdout), B("false"));
+        #[cfg(target_os = "linux")]
+        stop_test_broker(&broker_runtime, broker_handle);
     }
 
     #[test]
     #[expect(clippy::print_stdout, reason = "test diagnostics")]
     fn forbid_new_senders_after_receiver_dropped() {
         let created = channel(42).unwrap();
+        #[cfg(target_os = "linux")]
+        let (broker_runtime, broker_handle) = start_test_broker(created.broker);
         let conf = created.conf;
         let receiver = created.receiver;
         drop(receiver);
@@ -276,11 +293,15 @@ mod tests {
         });
         let output = std::process::Command::from(cmd).output().unwrap();
         assert_eq!(B(&output.stdout), B("false"));
+        #[cfg(target_os = "linux")]
+        stop_test_broker(&broker_runtime, broker_handle);
     }
 
     #[test]
     fn concurrent_senders() {
         let created = channel(8192).unwrap();
+        #[cfg(target_os = "linux")]
+        let (broker_runtime, broker_handle) = start_test_broker(created.broker);
         let conf = created.conf;
         let receiver = created.receiver;
         for i in 0u16..200 {
@@ -300,6 +321,8 @@ mod tests {
                 B(&output.stderr)
             );
         }
+        #[cfg(target_os = "linux")]
+        stop_test_broker(&broker_runtime, broker_handle);
         let lock = receiver.lock().unwrap();
         let mut received_values: Vec<u16> = lock
             .iter_frames()
@@ -308,4 +331,23 @@ mod tests {
         received_values.sort_unstable();
         assert_eq!(received_values, (0u16..200).collect::<Vec<u16>>());
     }
+
+    #[cfg(target_os = "linux")]
+    fn start_test_broker(
+        broker: ShmBroker,
+    ) -> (tokio::runtime::Runtime, tokio::task::JoinHandle<std::io::Result<()>>) {
+        let runtime =
+            tokio::runtime::Builder::new_multi_thread().enable_io().enable_time().build().unwrap();
+        let handle = runtime.spawn(broker);
+        (runtime, handle)
+    }
+
+    #[cfg(target_os = "linux")]
+    fn stop_test_broker(
+        runtime: &tokio::runtime::Runtime,
+        broker: tokio::task::JoinHandle<std::io::Result<()>>,
+    ) {
+        broker.abort();
+        assert!(runtime.block_on(broker).unwrap_err().is_cancelled());
+    }
 }

crates/fspy_shared/src/ipc/channel/mod.rs

@@ -674,7 +674,10 @@ mod tests {
 
         let created = fspy_shm::create(SHM_SIZE).unwrap();
         #[cfg(target_os = "linux")]
-        let _broker = created.broker;
+        let broker_runtime =
+            tokio::runtime::Builder::new_multi_thread().enable_io().enable_time().build().unwrap();
+        #[cfg(target_os = "linux")]
+        let broker_handle = broker_runtime.spawn(created.broker);
         let shm = created.shm;
         let shm_name = shm.id().to_owned();
 
@@ -703,6 +706,12 @@ mod tests {
             assert!(status.success());
         }
 
+        #[cfg(target_os = "linux")]
+        {
+            broker_handle.abort();
+            assert!(broker_runtime.block_on(broker_handle).unwrap_err().is_cancelled());
+        }
+
         // SAFETY: All child processes have exited (waited above), so no concurrent writers exist.
         // The shared memory is valid and fully written.
         let shm = unsafe { shm.as_slice() };

crates/fspy_shared/src/ipc/channel/shm_io.rs

@@ -7,13 +7,23 @@ license.workspace = true
 publish = false
 rust-version.workspace = true
 
-[dependencies]
+[target.'cfg(not(target_os = "linux"))'.dependencies]
 shared_memory = { workspace = true, features = ["logging"] }
 
+[target.'cfg(target_os = "linux")'.dependencies]
+base64 = { workspace = true }
+memmap2 = { workspace = true }
+rustix = { workspace = true, features = ["fs", "net"] }
+tokio = { workspace = true, features = ["macros", "net", "rt", "time"] }
+uuid = { workspace = true, features = ["v4"] }
+
 [dev-dependencies]
 ctor = { workspace = true }
 subprocess_test = { workspace = true }
 
+[target.'cfg(target_os = "linux")'.dev-dependencies]
+tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
+
 [lints]
 workspace = true