volumes: attach-only claims leave mounting to the workload - #80
Merged
Conversation
volumes_attach_only skips the guest mount entirely: sandboxd attaches the disks and the caller discovers them by virtio serial and mounts, umounts, and owns consistency itself. Admission exclusion is unchanged — it protects other claims. Attach-only rw neither writes nor clears dirty markers: the sandbox cannot verify the caller's umount, so it makes no promise it cannot keep.
CMGS
force-pushed
the
feat/lazy-volume-mount
branch
from
August 13, 2026 10:46
369203c to
2b7d4ee
Compare
finalizeBatch's quota arm still released admission holds before the VM was confirmed removed — the ordering the retain-holds commit fixed at the two apply-failure sites, and wider here since the volumes are fully mounted when the finalize re-check loses the quota race. One helper now owns the hand-off and the nil-out that keeps the deferred unreserve from double-releasing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #77 (the concurrent bring-up); only 369203c is this PR.
A claim may now set
volumes_attach_only: sandboxd attaches the catalogdisks and stops — no sysfs settle, no mkdir, no guest mount. The workload
discovers each device by its virtio serial (
/sys/block/*/serialcarriesthe attach name) and mounts, umounts, and owns filesystem consistency
itself. The whole delivery contract stays synchronous: attach failures
fail the claim exactly like today, and there is no pending state, no
readiness barrier, and no async failure surface.
What the sandbox keeps is exactly what protects OTHER claims: the
admission registry (a live attach-only rw writer still refuses readers
and second writers with 409s) and the hypervisor lock belt. What it
deliberately drops for attach-only entries is the consistency machinery
it could not honestly operate: dirty markers are neither written nor
cleared (the sandbox cannot verify the caller's umount, so a marker could
never be cleared truthfully), and teardown does nothing guest-side — VM
removal closes the devices. Releasing without a clean self-umount equals
a filesystem crash for that image: the next eager ro claim fails loudly
at mount time (500) instead of the marker's 409, and any rw cycle
recovers it. All documented, including the raw-block-device caveat.
Internal shape: validation skips mount defaulting under the flag, so the
applied and persisted entries carry an empty mount — that absence is the
one signal the pool branches on (apply: attach only; quiesce: skip). No
manager interface changes, no new persisted fields; a non-wire
json:"-"bool carries the flag between the server's validation and thepool's defensive re-validation, and is cleared before entries are
applied (the double-validation would otherwise re-default the mounts).
Surfaces: Go
WithVolumesAttachOnly(); Pythonmount=Falseon bothclaim entry points (default
mount=True— eager semantics are completelyunchanged, pinned byte-for-byte: eager replies carry the mount key and no
new keys; attach-only entries echo without a mount key and the flag never
leaks into replies). Engine-op pins: an attach-only rw claim records
attach and remove only — zero mount/umount/sync — and no
.dirtyfileever appears.
Gates: build +
-raceacross sandboxd (13 pkgs), sdk/go, e2e(GOWORK=off); ruff clean, pytest 151 (+4); dual-GOOS golangci-lint and
asl zero findings; gofmt/gofumpt clean. Hot path: volume-less and eager
claims pay one boolean test in validation, nothing else.