Sandbox: say so, or refuse to start, when it cannot see a command's processes
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 58/100
Research direction
Start with sandbox/resource_contract.py and sandbox/executor_server.py to trace how command processes are found and how service health is reported; then read tests/infrastructure/test_execution_resource_contract.py. Check how CI can make the process list unreadable on Linux without skipping the test. Done means the self-check, health state, background-child handling, and docs/SETUP.md requirement are covered as specified.
Written by the indexing model from the issue text.
Description
What is wrong
The sandbox service finds the processes of a command by reading
/proc (sandbox/resource_contract.py). On a host without /proc
it finds none. Then its memory ceiling and its process limit do
nothing, and the orphans of a command are not cleaned up. Only the
time limit is left. The service starts and runs commands as usual,
and it does not say so.
In the container setups the container's own limits stand behind this
(memory, process count and CPU in the compose file). The bare-metal
method of docs/SETUP.md is for Linux, which has /proc. So no
documented setup is affected. The case is a host outside them: a
developer who starts the service on macOS, and the tests that do so.
This guard is new on dev. The 3.1 line does not have it. A guard
should check at start that it can see what it guards, and say so when
it cannot.
What needs doing
- A self-check at start: the service starts one child and finds it
by the same route it uses for a command. - When the check fails, the service refuses to start, or every
result and the health answer say "resource limits not enforced".
Say in the pull request which of the two and why. - The children of a command that go to the background are still
counted and cleaned up.
Done when
- A test of the self-check runs on Linux in CI with the process
list made unreadable. It is not one of the tests that are skipped
on a host without/proc. - The health answer shows the state.
-
docs/SETUP.mdsays what the bare-metal method needs for the
limits to work.
Where to start
sandbox/resource_contract.py,sandbox/executor_server.py,
tests/infrastructure/test_execution_resource_contract.py.- No GPU or model is needed.
- Dominant language
- Python
- Stars
- 2.1k
- Forks
- 197
- Avg merge
- 12h 11m
- Merged PRs (30d)
- 146
Getting set up
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from inferstep/ATLAS
-
Bootstrap: the last two steps run as the user who owns the installMay be free again @assassinationss claimed this 8 days ago, and no pull request is open. Openarea/install reliability
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
inferstep/ATLAS#412 · 4 comments ·
Maintainers usually reply within 1 day
-
Installer and setup guide: say what the docker group givesPossibly taken @se1vapriya claimed this 9 days ago. Openarea/install documentation good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
inferstep/ATLAS#411 · 5 comments · 1 assignee ·
Maintainers usually reply within 1 day
-
area/cli
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Maintainers usually reply within 1 day
-
A `sandbox_subdir` the proxy does not accept is refused, not ignoredPossibly taken @mvanhorn claimed this 4 days ago. Openarea/proxy reliability
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
inferstep/ATLAS#364 · 1 comment · 1 assignee ·
Maintainers usually reply within 1 day
-
area/cli area/lens status/ready
Difficulty 2/5 Half a day Newbie friendliness 66/100
Maintainers usually reply within 1 day
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
aws-samples/sample-per-model-bedrock#295 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 76/100
pyrevitlabs/pyRevit#3792 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 69/100
zephyrproject-rtos/reqmgmt#177 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
polarsource/polar#15580 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
521xueweihan/HelloGitHub#4011 ·