Automate the installation #1
Loading…
Reference in a new issue
No description provided.
Delete branch "install-cgroup"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Previous installation instructions weren't clear. Have made install.sh into a full blown installation script that will add cgroup delegation (requires sudo) and also implement the correct deny and allow settings as well as the MCP into an opencode configuration file. If you're not using Opencode you'll still need to do those manual steps.
A stall ("commands stop coming back, a restart is the only way out") has three candidate mechanisms and no way to tell them apart after the fact: the cgroup counters reset when the container is recreated, so the evidence has to be captured while it is still stuck. Three probes, chosen because each mechanism leaves a distinct signature: - CPU starvation: cpu.stat nr_throttled/nr_periods, cpu.pressure, and a 5s probe-time delta. Lifetime counters cannot see an hour-healthy box that stalled a minute ago, so the delta is what separates them. - OOM kill: memory.events oom_kill plus the host kernel/journal logs. - Watchdog recreate loop: run.py retries recreate() forever and does not log it, so this is only visible host-side as concurrent `podman run/rm` or a cycling podman pid set. Read-only: it never restarts or mutates anything, and every probe degrades to a note when a tool or a mount is unavailable (the in-sandbox half has no podman/journalctl). Run it from the host; it reaches into each container itself via `podman exec --in-sandbox`, bounded by a 25s timeout whose expiry is itself evidence.Three reporting defects from the first clean host run, all of which made the script harder to trust rather than wrong about the sandbox: - podman refuses to exec into an Exited container with rc=255 ("can only create exec sessions on running containers: container state improper"), not the 125 I assumed from the shell convention. Match 255 as well, and the message too, so classification does not hinge on podman's numbering. - Non-running containers are now filtered out before probing (via podman inspect), and their state is reported as the finding it is: an Exited sandbox points at mechanism C, not at CPU starvation. Filtering also removes the spurious VERDICT paragraph per dead container. - REPORT.txt had per-container notes and the A/B/C summary sharing one flat list, so four stray "VERDICT:" paragraphs appeared ahead of the summary. Split into PER-CONTAINER PROBES and MECHANISM SUMMARY. Also: target_container_names runs in a command substitution, so its mechanism-C finding was being set in a subshell and silently discarded (the exited container never reached the summary). It now hands the finding back through a file. Its progress lines went to stdout, which is the return value there, so they leaked into the container list and produced a bogus "inside-(skipping ...).txt" artifact; they go to stderr now.merge_mcp_server no longer emits invalid JSON: - a top-level trailing separator (common .jsonc) is normalized and not doubled when inserting the mcp block; an empty {} body is handled too. - a non-object mcp.servers (array) has its whole value replaced with the canonical {umwelt: ...} object instead of splicing a key into the array. - strip swallows the whitespace-only line an entry leaves behind. Adds covering tests for all three inputs.