Repository navigation
Conversation
plotnick
force-pushed
the
illumos-fixes
branch
2 times, most recently
from
October 24, 2026 16:58
74c50f7 to
6a4c40e
Compare
plotnick
changed the title
plotnick
force-pushed
the
illumos-fixes
branch
from
October 24, 2026 21:37
ea9ad6d to
2e748d1
Compare
plotnick
force-pushed
the
verify-chain
branch
from
October 25, 2026 03:35
cb57cd5 to
19c71a6
Compare
plotnick
force-pushed
the
illumos-fixes
branch
4 times, most recently
from
October 25, 2026 05:28
24e04d4 to
8d5bf62
Compare
plotnick
force-pushed
the
verify-chain
branch
from
October 25, 2026 15:34
19c71a6 to
599b8fe
Compare
Fixes #102. Co-Authored-By: Claude <noreply@anthropic.com>
Before illumos 18395[1], files in ctfs fail open(2) with `EINVAL` when `O_CLOEXEC` is set, and Rust's `std::fs` always sets it. So instead we open the contract files with `rustix` and set `FD_CLOEXEC` after. To be reverted once we're up to date with [2]. [1] https://www.illumos.org/issues/18395 [2] oxidecomputer/illumos-gate@460f7917fa4f Co-Authored-By: Claude <noreply@anthropic.com>
Forking sled-agent to start a job copies its large address space and stops all of its threads. On illumos, posix_spawn builds the child in the kernel instead, and does neither. posix_spawn runs none of our code in the child, so a small bash shim sets the job's limits before it execs the job. JobLimits::clamp now also lowers each limit to our own hard limit, which a job cannot exceed. JobChild replaces tokio's Child, and reaps the job when SIGCHLD arrives. Errors from libcontract and posix_spawn now go through one check_errno, which names the call that failed. Co-Authored-By: Claude <noreply@anthropic.com>
A stop used to signal the job's process group, so a descendant that started its own process group escaped it. Signalling the job's contract reaches every process in the job. Co-Authored-By: Claude <noreply@anthropic.com>
plotnick
force-pushed
the
illumos-fixes
branch
from
October 25, 2026 15:36
8d5bf62 to
7c9bca5
Compare
On illumos, after a pty's subsidiary closes, polling the master for both reading and writing can report nothing but a write error, even though an EOF is ready to read. The job's pty reader was previously registered for both directions, so it never saw the EOF, and the drain timeout expired instead. Co-authored-by: Claude <noreply@anthropic.com>
plotnick
force-pushed
the
illumos-fixes
branch
from
October 25, 2026 22:01
3636308 to
bdc30df
Compare
plotnick
marked this pull request as ready for review
October 26, 2026 04:14
danmcd
reviewed
Oct 26, 2026
danmcd
left a comment
danmcd
left a comment
There was a problem hiding this comment.
I get the feeling a Rust front-end to ctfs(4FS) should be something available in a crate. Happy to be corrected, however.
Co-authored-by: Claude <noreply@anthropic.com>
plotnick
force-pushed
the
illumos-fixes
branch
from
October 26, 2026 19:16
969ea99 to
917bf6b
Compare
danmcd
reviewed
Oct 26, 2026
danmcd
left a comment
danmcd
left a comment
There was a problem hiding this comment.
Pass 0 results: I'll be interested in seeing contract.rs get further shrunk or even moved into something shareable by others. For now, this is an improvement, thank you.
I need to give this pass 1 before I can approve. Pardon latency.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #102 by launching each job in its own contract (like
sshddoes). This means thatsushjobs can outlivesled-agent, and so, e.g.,svcadm disable sled-agentwill not kill running jobs. Verified fix on Dublin, where arebootjob was able to successfully reboot a sled. When it came back up (versionall green),sushcorrectly reported the job as interrupted:Also switches job launch from fork/exec to posix_spawn(3C), so that we don't copy
sled-agent's entire address space and block its threads with every job launch.Commit f13d246 is a work-around for illumos 18395, which was fixed in oxidecomputer/illumos-gate@460f7917fa4f but has not yet made it into buildomat images; see oxidecomputer/meta#1148. It should be reverted once that lands.
Commit bdc30df is a work-around for illumos 18596. It is perfectly safe on all platforms and may remain even after that issue is fixed.