Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

nvx-rs: lock sandbox stores without a dedicated lock file

Open
  • Is something wrong?
#647 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
linux, rust
Domain
backend, operating-systems

Research direction

Start by reading SandboxStore::lock in nvx-rs/src/host/store/mod.rs and the lock tests, especially the_lock_excludes_other_holders; the issue links the implementation and specifies tests/store.rs for validation. Evaluate locking the store directory and a long-lived sandbox record against the stated process, crash, timeout, and privacy guarantees on Linux and Windows. Done means cargo test --all-features and the check-nvx-rs checks pass on both platforms, or the issue records why neither option meets the requirements.

Written by the indexing model from the issue text.

Description

Follow-up to #628, from its review. It waits for #628 to merge.

Summary

SandboxStore::lock serializes the lifecycle transitions of a sandbox through a dedicated lock file in the store's directory: it opens or creates the file, refuses it unless it is private to the current user, takes File::lock on it, and retries when the file was removed or replaced while it waited. The file stays in the directory after the lock is released. Replace the lock file with file-system locking on an object that the store already has, so the store needs no extra file and none of the code that handles one.

Options to evaluate

  • Lock the store's directory itself. On Linux, flock works on a directory opened read-only. On Windows, a directory handle cannot take a byte-range lock, so this needs another mechanism there, such as an exclusive share mode on the directory handle.
  • Lock a record that the store keeps for the sandbox's lifetime, if the atomic replacement of records by rename can coexist with the lock.

Requirements

  • Keep the guarantees of the current lock: it excludes holders in other processes, including an orchestrator and its successor; a crash releases it; a deadline bounds the wait with ErrorKind::TimedOut; and others cannot take or hold it, as the privacy check of the lock file ensures today.
  • Keep behavior identical on Linux and Windows, or document any difference.
  • Keep the_lock_excludes_other_holders and the lock tests passing, and add coverage for any new failure mode.

If no option meets these requirements on both platforms, record why in this issue and close it.

Validation

cargo test --all-features for nvx-rs/Cargo.toml on Linux and Windows, including tests/store.rs, and the rest of check-nvx-rs.

Dominant language
Python
Stars
408
Forks
28
Avg merge
15h 20m
Merged PRs (30d)
301

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from microsoft/nvx

All issues in microsoft/nvx

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.