Run owned native zone workloads with bounded execution and recovery #7

Merged

toasterson merged 34 commits from codex/native-zone-workload-20261001 into main 2026-10-03 03:04:58 +00:00

Conversation 0 Commits 34 Files changed 36 +5807 -232

toasterson commented 2026-10-02 22:37:44 +00:00

Owner

Copy link

Native application workloads now run from a pinned image in owned illumos zones, with persistent ZFS volumes, bounded guest execution, workload SMF services, restart recovery and verified teardown. Execution uses a checked native process contract and preserves journals when cleanup is uncertain. Halted recovery reconciles the live and persistent default route without replacing unrelated routes.

Work item: 01a0f6e0-dc82-7fb2-9acf-617bf0ad6d80 (WI-3).

Validation at 8388b54da4 on oibldofgate: 261 native workspace tests, formatting, strict Clippy, API/example/helper builds, SMF parsing and four process suites passed. The separate real zone lifecycle passed in 599 seconds: literal arguments, minimal environment, exit status, timeout/cancellation, descendant cleanup, unrelated workload canary, SMF restart, writable volume preservation, running and halted reconstruction, teardown and explicit volume deletion. Final zone/link/dataset inventories matched the initial inventories; resource-cap returned to disabled. Source and failure-path changes received independent reviews.

This proves the single-VM native sandbox workload path. Combined package installation and the RedDwarf-hosted offline CI job remain WI-6 acceptance gates. Canonical review/CI and merge are separate from these native receipts.

Integration after PR6: head efe8e96fe967d839e0ba391bd95cafb27a238471 merges current main ed5c1f3af0caedb9dccafc4184d26401231533f6. The worker initializer retains both native-brand validation and owned-storage validation. 279 local workspace tests, formatting, strict all-target Clippy, and three network shell fixtures passed. Independent review verified all 105 tracked crates/tools/Cargo.lock files have identical bytes and modes to combined source 39d732ec381ed353bdfd41de93d32d33bb1a2b12, which passed 278 native workspace tests plus native API, SMF and process qualification. This reuses evidence for identical executable inputs; it is not a new native build or canonical CI receipt for the integration commit. The original real lifecycle evidence remains recorded against head 8388b54da448698c9f8453590f4f28eb941ab7d8. Anima exact-head review/CI/terminal reconciliation remain pending.

Native application workloads now run from a pinned image in owned illumos zones, with persistent ZFS volumes, bounded guest execution, workload SMF services, restart recovery and verified teardown. Execution uses a checked native process contract and preserves journals when cleanup is uncertain. Halted recovery reconciles the live and persistent default route without replacing unrelated routes. Work item: 01a0f6e0-dc82-7fb2-9acf-617bf0ad6d80 (WI-3). Validation at 8388b54da448698c9f8453590f4f28eb941ab7d8 on oibldofgate: 261 native workspace tests, formatting, strict Clippy, API/example/helper builds, SMF parsing and four process suites passed. The separate real zone lifecycle passed in 599 seconds: literal arguments, minimal environment, exit status, timeout/cancellation, descendant cleanup, unrelated workload canary, SMF restart, writable volume preservation, running and halted reconstruction, teardown and explicit volume deletion. Final zone/link/dataset inventories matched the initial inventories; resource-cap returned to disabled. Source and failure-path changes received independent reviews. This proves the single-VM native sandbox workload path. Combined package installation and the RedDwarf-hosted offline CI job remain WI-6 acceptance gates. Canonical review/CI and merge are separate from these native receipts. Integration after PR6: head `efe8e96fe967d839e0ba391bd95cafb27a238471` merges current main `ed5c1f3af0caedb9dccafc4184d26401231533f6`. The worker initializer retains both native-brand validation and owned-storage validation. 279 local workspace tests, formatting, strict all-target Clippy, and three network shell fixtures passed. Independent review verified all 105 tracked crates/tools/Cargo.lock files have identical bytes and modes to combined source `39d732ec381ed353bdfd41de93d32d33bb1a2b12`, which passed 278 native workspace tests plus native API, SMF and process qualification. This reuses evidence for identical executable inputs; it is not a new native build or canonical CI receipt for the integration commit. The original real lifecycle evidence remains recorded against head `8388b54da448698c9f8453590f4f28eb941ab7d8`. Anima exact-head review/CI/terminal reconciliation remain pending.

toasterson added 33 commits 2026-10-02 22:37:45 +00:00

Add bounded owned native image bootstrap and recovery 24c57aec7f

Remove login identities and lock native bootstrap accounts 8f8ece79d1

Omit transient zone runtime entries from pinned bootstrap 375346405a

Compress native bootstrap with normalized archive timestamps d3134e4884

Cancel the full native bootstrap command group on timeout 172b3d2f24

Wait for native zone SMF repository and manifest readiness 7f95e11dad

Implement pinned native zones with SMF processes and owned recovery da47d915a6

Retain checked native command diagnostics during rollback e24c41e954

fix: verify native bootstrap root no-login status d1f788c96f

fix: enforce saved workload contract on process recovery 6e05a0856c

fix: qualify native brand helper path check 85e5e14f0c

fix: preserve native sandbox on uncertain process or link ownership afcce5c115

fix: stage pinned native archives on bounded ZFS image storage f579b0c167

fix: inventory bootstrap special files and omit only cron runtime FIFO 80c6f96b2f

fix: preserve healthy native processes during reconciliation ac4c4fac27

fix: confine guest writes and validate archive hardlink targets c446339477

fix: omit exactly inventoried SAF runtime FIFO paths 08ea16117e

fix: enforce native workload generation and resource ownership invariants 8803722747

fix: keep native ownership test module after implementation items 24a8bb53c6

Merge main API identity and repair observed native image integration failures d7522e28c7

fix: preserve native helper diagnostics and require supported tar headers a17aedcc0c

fix: admit only native-compatible canonical USTAR records 0c49e26aeb

fix: preserve guest argv through zlogin shell invocation 9d6aa10eda

fix: supervise bounded guest exec with owned native contracts 2245cfdfa3

fix: preserve zone ownership when command cleanup is uncertain d0668c2e17

fix: link native contract libraries into standalone exec helper 49ee46fcb7

fix: preserve native witness sandbox after lifecycle failure cd9a55d296

fix: keep witness cleanup disabled through interrupted process handling f4f4171fcf

fix: sanitize native helper environment before entering guest zone 8fcac62d50

docs: describe resource-cap activation during native smoke 4d746f4c57

fix: open native contract files with exact access flags 198c297b49

test: time native lifecycle stages and bound full recovery budget 1380fe876c

Reconcile live and persistent native default routes 8388b54da4

toasterson added 1 commit 2026-10-03 03:02:31 +00:00

Merge owned networking while preserving native workload guards efe8e96fe9

toasterson merged commit 0fc0349820 into main 2026-10-03 03:04:58 +00:00

toasterson referenced this pull request from a commit 2026-10-03 03:05:01 +00:00

Merge pull request 'Run owned native zone workloads with bounded execution and recovery' (#7) from codex/native-zone-workload-20261001 into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

CloudNebulaProject/reddwarf!7

No description provided.