Repository navigation
fix(linux): harden CLI and network bridge lifetimes - #4
Merged
Merged
Conversation
initializeLinuxNetworkBridge checked for both socat sockets five times, with sleeps of 0, 100, 200 and 300 ms between checks, so a healthy socat that takes 0.9 s to bind failed every start. Wait until a five-second deadline instead, polling at most every 100 ms within the remaining budget, and keep the timeout's process cleanup. The new tests start real socat behind a delayed wrapper. They fail against main and pass with this change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* ci: drop some CA roots from the runners' trust store Each release job starts by dropping a fixed list of root certificates from the runner's trust store, has Node, npm and git read the cleaned store, and then checks the result. The test jobs drop the same list from the system store on Linux and Windows. * ci: check the CA file against the list of Node, and each Windows store The check on Windows compares the CA file with the certificates of the Node that wrote it, counts each store, and removes its own certificate by path. * ci: let the check's Node end by itself on Windows The helper sets an exit code and returns, and a host that is not reached is reported with the code Node gave.
EliasCodeFI
changed the title
EliasCodeFI
marked this pull request as ready for review
October 21, 2026 19:05
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On Linux, killing only the CLI can leave the sandbox workload alive: bubblewrap's immediate parent is an intermediate shell that remains waiting. The host socat bridges and the mux backend's filesystem socket can also outlive abrupt CLI termination. Separately, a healthy bridge which binds after the fixed readiness attempts is killed during startup.
This change replaces the Linux CLI's intermediate shell with the rendered sandbox invocation, adds an expected-parent supervisor for host socat, and uses abstract Unix sockets for the Linux mux backend. The supervisor waits for its child, forwards termination after the CLI dies, escalates if graceful shutdown is ignored, and removes the managed socket after child exit. Bridge readiness waits to a monotonic startup deadline and rejects an already-exited child promptly.
The launcher is capability-probed. An absent or older helper retains direct-socat startup, so complete bridge/socket cleanup after SIGKILL is not claimed for that fallback. The host launcher mode does not apply sandbox restrictions.
The regression cases wait for actual workload or proxy readiness before signaling only the CLI, then inspect workload/process identity and socket cleanup. The socat stand-in deliberately leaves its sockets behind, matching the residual file observed with socat1.8. Native checks cover parent validation, child exit/signal status, ignored graceful shutdown, and preservation of a regular file at the cleanup path. Additional cases delay each bridge and test stalled startup. Local CLI cases explicitly use
network.allowAllUnixSockets=true; they exercise the matching host launcher without validating nested seccomp setup.Independent read-only review accepted this revision. Local native/project build, typecheck, affected lint/formatting and checks pass, including a socat1.8 build and a final cleanup test observed failing against the earlier baseline after workload/proxy readiness. Default nested-helper and platform validation is running on this exact source in the fork.
Fork validation at
2d3ac54: combined branch PR #4, Tests, Release/package checks. The standalone startup-deadline prerequisite was also validated in fork PR #2.This is a draft fork validation PR. No package publication is requested. The branch includes the accepted startup-deadline prerequisite from fork PR #2; the final upstream submission combines these product changes.