OSS-Singularity/website
OSS-Singularity/website
Watch
5
0
Fork
You've already forked website
 0
Code Issues 2 Pull requests 6 Projects Releases Packages Wiki Activity Actions

WIP: Bound runtime output without restricting container files #18

Closed
ClaudiuSchuster wants to merge 1 commit from oss-oo/test50-bounded-capture-impl-20261013 into main
pull from: oss-oo/test50-bounded-capture-impl-20261013
merge into: OSS-Singularity:main
Conversation 1 Commits 1 Files changed 2 +184 -16
ClaudiuSchuster commented 2026-10-13 22:36:06 +00:00
Owner

The controller used RLIMIT_FSIZE to limit captured output, but rootless Podman propagated that limit into test containers. A regression fixture that deliberately creates an oversized file then failed with File too large before it could check rejection. Capture now drains stdout and stderr in the parent under the existing combined output budget; container file limits no longer inherit that capture-specific restriction. Timeout, output-overflow and runtime cleanup still fail closed.

Validation: 49 closure tests passed in normal and optimized Python, including capture regressions; independent source review passed. On the actual accepted Podman runtime, the original unchanged 46-test suite and revised 49-test suite passed, and real output-overflow and timeout cases removed their owned containers. Native PR CI remains required. This source PR does not itself change installed controller trust or enable publication.

The controller used RLIMIT_FSIZE to limit captured output, but rootless Podman propagated that limit into test containers. A regression fixture that deliberately creates an oversized file then failed with File too large before it could check rejection. Capture now drains stdout and stderr in the parent under the existing combined output budget; container file limits no longer inherit that capture-specific restriction. Timeout, output-overflow and runtime cleanup still fail closed. Validation: 49 closure tests passed in normal and optimized Python, including capture regressions; independent source review passed. On the actual accepted Podman runtime, the original unchanged 46-test suite and revised 49-test suite passed, and real output-overflow and timeout cases removed their owned containers. Native PR CI remains required. This source PR does not itself change installed controller trust or enable publication.
fix(closure): bound podman attach transcripts without inherited RLIMIT_FSIZE
All checks were successful
Repository checks / repository-baseline (pull_request) Successful in 24m18s
Details Explain this check
91462659be
ClaudiuSchuster commented 2026-10-20 20:26:22 +00:00
Author
Owner

Closing as superseded by #24, merged as 0818e78d9740e833fc23e3a22bddde5bc6a07811.

Current main uses parent-side pipe capture in bounded_run; it does not pass the capture-specific RLIMIT_FSIZE limit into Podman or its test containers. All three regression tests introduced by this PR remain present, as do all earlier test methods, alongside later capture/cleanup improvements.

The current source bootstrap also matches the independently accepted installed bootstrap recorded on 2026-10-18. This consolidation does not claim a fresh controller deployment or a current live readback; publication/policy maintenance retains its separate gates. The distinct data-only Git-output bound is not the propagated container-file limit fixed by this PR.

No second source merge is needed. The historical branch is retained for the inventory.

Closing as superseded by #24, merged as [0818e78d9740e833fc23e3a22bddde5bc6a07811](https://oss-oo.io/OSS-Singularity/website/commit/0818e78d9740e833fc23e3a22bddde5bc6a07811). Current main uses parent-side pipe capture in `bounded_run`; it does not pass the capture-specific `RLIMIT_FSIZE` limit into Podman or its test containers. All three regression tests introduced by this PR remain present, as do all earlier test methods, alongside later capture/cleanup improvements. The current source bootstrap also matches the independently accepted installed bootstrap recorded on 2026-10-18. This consolidation does not claim a fresh controller deployment or a current live readback; publication/policy maintenance retains its separate gates. The distinct data-only Git-output bound is not the propagated container-file limit fixed by this PR. No second source merge is needed. The historical branch is retained for the inventory.
ClaudiuSchuster closed this pull request 2026-10-20 20:26:22 +00:00
All checks were successful
Repository checks / repository-baseline (pull_request) Successful in 24m18s
Required
Details Explain this check

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
OSS-Singularity/website!18
No description provided.