feat(orch): distro-aware template base-image provisioning - #3411
Merged
Merged
Conversation
PR SummaryHigh Risk Overview Reviewed by Cursor Bugbot for commit 06f2fa9. Bugbot is set up for automated code reviews on this repo. Configure here. |
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
Resolve the base image's distro from its /etc/os-release ID and drive provisioning from a declared per-family profile (Debian/Ubuntu, the RHEL family, Arch, and Alpine on OpenRC) instead of probing for a package manager. Unsupported or identity-less images are rejected with a clear build-log error.
ionice/nice are util-linux/coreutils conveniences that minimal or busybox-based images may not ship; a missing helper now drops the priority adjustment instead of failing the spawn (exit 127 previously killed every process on such images).
tomassrnka
force-pushed
the
feat/multi-distro-base-images
branch
from
July 27, 2026 09:59
b3890dd to
c5c9f88
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Arch ships /etc/ssl/certs/ca-certificates.crt as a symlink to the p11-kit bundle that update-ca-trust extract regenerates, so the bundle lands at $E2B_CA_BUNDLE without an explicit ln -sf (unlike the RHEL family, whose update-ca-trust writes only under /etc/pki). Restores the rationale a prior comment trim dropped.
Alpine's busybox does not ship ionice; it comes from util-linux-misc. envd runs at realtime IO (supervise-daemon --ionice 1:4) and resets each spawned user process to best-effort via the binary, degrading to no reset when it is absent — so on Alpine user workloads inherited envd's realtime IO class.
…ding Both the finalize pack step and the boot-time seed fallback probed only for update-ca-certificates, which the RHEL family and Arch do not ship — the guard turned into a silent no-op there, so CAs added in later build layers never merged into the packed tar and a cold-start regeneration was impossible. Probe update-ca-trust as well, and on RHEL copy the bundle it writes under /etc/pki to the Debian-named path envd appends to.
Reverts the update-ca-trust branch added for the RHEL family: on Fedora, extract regenerates the extracted/pem/directory-hash tree that /etc/ssl/certs points at and replaces provisioning's absolute ca-certificates.crt symlink with a relative one, which tar -h packs as a link rather than dereferencing. Verified on real KVM — the packed bundle went from a 226489-byte regular file to a 20-byte symlink, breaking the real-file contract envd's egress-CA append needs. The seed-time fallback keeps its update-ca-trust path, where cp -L dereferences.
Member
Author
|
bugbot run |
tomassrnka
marked this pull request as ready for review
July 27, 2026 13:45
tomassrnka
requested review from
ValentaTomas,
dobrac and
jakubno
as code owners
July 27, 2026 13:45
chmod 777 -R relies on options being accepted after an operand, which POSIX does not require: GNU chmod only allows it when POSIXLY_CORRECT is unset, and non-GNU implementations may take -R as a filename and, under set -e, abort finalize. Busybox on Alpine happens to accept the current form, so nothing is broken today — this is the unconditionally correct spelling instead.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
wrapperPrefix now resolves ionice/nice through exec.LookPath and drops either helper when the image lacks it, instead of always exec'ing hardcoded /usr/bin paths — a behavioral change, which CLAUDE.md requires be reflected in pkg/version.go.
tomassrnka
marked this pull request as draft
July 27, 2026 14:15
provision.sh writes the sandbox sshd_config everywhere and the OpenRC branch runs rc-update add sshd, but the systemd branch never enabled a unit. Debian's postinst and the RHEL RPM scriptlet happen to do it themselves; Arch does not, so Arch sandboxes shipped with SSH fully configured and never started (is-enabled=disabled, no sshd process). Carry the unit name per profile the way E2B_TIMESYNC_UNIT already is (ssh on Debian, sshd elsewhere) and enable it.
Member
Author
|
bugbot run |
FROM-template builds reuse the parent rootfs without re-provisioning, so finalize and USER steps must not hard-require /usr/local/share/e2b/distro.env: fall back to probing the sudo/wheel groups when the file is absent.
tomassrnka
added a commit
that referenced
this pull request
Jul 29, 2026
Adds a unit test that holds every distro profile's package set to a shared capability map, and integration tests that build a template from an Ubuntu, Fedora, Arch and Alpine base image plus one unsupported image that must be rejected with a readable reason. Stacked on #3411 — retarget to main once that merges. Heads-up on cost: the first run pulls and provisions four new base images, so the templates package gets slower until the base-layer cache warms.
tomassrnka
added a commit
that referenced
this pull request
Jul 29, 2026
Stacks on #3411. Adds a `nixos` distro profile — premade images whose packages/services are declared in the image's own NixOS configuration rather than installed at provision time — plus the E2B NixOS base-image definition. ## Verification status Verified at tip on real KVM: the image was built with a nix builder from the committed `configuration.nix` (build.sh fixed — it was non-executable and staged from a hardcoded out-of-repo path, so the committed config was previously never the one built) and booted as sandboxes through the template pipeline. All previously inspection-only fixes now have observed evidence: envd unit parity (`Nice=-20`, `OOMScoreAdjust=-1000`, `GOMEMLIMIT=512MiB`, IO/CPU/memory weights), chrony source-select oneshot (pool branch live; PHC branch replay-verified — a real PHC lock needs `kvm-ptp`, not exposed on the verification host), firewall off with envd's port connected, CA bundle a regular file + `https=200`, default user + NOPASSWD sudo, hostname/hosts kept, shadow tools present, nix store DB valid (`--check-validity` OK, 532 paths). Note: sshd accepts connections ~1–2s after sandbox start — NixOS generates host keys per sandbox on first boot (unique keys per sandbox; the package-manager families bake shared per-template keys at provision time). Inherent to NixOS's design, left as-is. ## Known NixOS limitations - **Sudoers for non-default users.** A `USER` build step naming an account other than `user` fails: `commands/user.go` appends to `/etc/sudoers`, which is a read-only store symlink on NixOS. The fix is a drop-in under `/etc/sudoers.d`, which changes behaviour for every family and belongs in its own PR. - **No at-tip real-KVM coverage.** Building the premade image needs a nix builder; none is available on the current box or dev VM, so the NixOS-side changes here are reviewed but not runtime-verified. Draft: on-the-fly (nix-build at template-build time) is still open design; merge after #3411.
charlie-e2b
pushed a commit
that referenced
this pull request
Jul 29, 2026
🤖 I have created a release *beep* *boop* --- ## 0.0.1 (2026-07-29) ### Features * **envd:** add --no-cgroups flag to disable cgroup management ([#2811](#2811)) ([e10814c](e10814c)) * **envd:** add optional EntryInfo to watch FilesystemEvent ([#2930](#2930)) ([bbbc7c8](bbbc7c8)) * **envd:** allow opting into watching network mounts ([#2982](#2982)) ([9799dd0](9799dd0)) * **envd:** give envd realtime IO priority, reset for user processes ([#2681](#2681)) ([f4bd1b2](f4bd1b2)) * **envd:** split collapse stats into real migrations vs already-huge ([#3021](#3021)) ([0d77614](0d77614)) * **envd:** support user-defined file metadata via xattrs ([#2732](#2732)) ([da8fbe4](da8fbe4)) * freeze user cgroup across pause/resume to keep envd /init responsive ([#2688](#2688)) ([eceb741](eceb741)) * **orch:** collapse envd's heap into 2 MiB hugepages before pause to cut cold-resume faults ([#2997](#2997)) ([6677f73](6677f73)) * **orch:** distro-aware template base-image provisioning ([#3411](#3411)) ([f8c7b5b](f8c7b5b)) ### Bug Fixes * added envd to artifact repository ([#3432](#3432)) ([6c4f0e2](6c4f0e2)) * correct 3 CVES ([#3218](#3218)) ([076823b](076823b)) * **envd:** avoid Start deadlock after request cancellation ([#3256](#3256)) ([04317f8](04317f8)) * **envd:** bound the in-memory logs queue ([#2676](#2676)) ([05c9939](05c9939)) * **envd:** discard output when no subscriber is connected ([#2639](#2639)) ([8cf1795](8cf1795)) * **envd:** fall back to lazy unmount when forced NFS umount fails ([#2683](#2683)) ([5346a0d](5346a0d)) * **envd:** ignore closed pty read errors ([#2769](#2769)) ([6118672](6118672)) * **envd:** include suppressed count in exporter error logs ([#2680](#2680)) ([35c1141](35c1141)) * **envd:** make /init lock ctx-aware to prevent retry pile-up ([#2702](#2702)) ([173afd4](173afd4)) * **envd:** make CA install lock ctx-aware ([#2690](#2690)) ([83ee89f](83ee89f)) * **envd:** replace env vars in /init instead of merging ([#2706](#2706)) ([1b52e9a](1b52e9a)) * **envd:** replace time.Sleep with ticker in ScanAndBroadcast for prompt shutdown ([#3374](#3374)) ([002fd9f](002fd9f)) * **envd:** self-heal MMDS routing on /init lookup failure ([#2701](#2701)) ([90944d5](90944d5)) * **envd:** stop freezing socat cgroup across pause/resume ([#2923](#2923)) ([8b6f2b9](8b6f2b9)) * **envd:** stop misleading CA install cancel errors on rapid /init ([#3206](#3206)) ([91d09e4](91d09e4)) * **envd:** suppress repeat MMDS poll failures ([#2678](#2678)) ([73d691a](73d691a)) * **envd:** tolerate busy tmpfs cleanup in tests ([#2938](#2938)) ([a485834](a485834)) * **envd:** use constant-time comparison for signature validation ([#3145](#3145)) ([fcf92fa](fcf92fa)) * **envd:** use WithoutCancel for CA cleanup goroutine ctx ([#3207](#3207)) ([ee7bf84](ee7bf84)) ### Performance Improvements * **envd:** stop logging streamed payload content ([#2755](#2755)) ([db3868c](db3868c)) * **sandbox:** keep envd logging out of journald ([#2675](#2675)) ([f6943ca](f6943ca)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: e2b-release-please[bot] <298072688+e2b-release-please[bot]@users.noreply.github.com>
tomassrnka
added a commit
that referenced
this pull request
Jul 30, 2026
The three initSetup bodies leave their Go string literals for
init-{systemd,openrc,nixos}.sh, go:embed'd with the trailing newline
trimmed so they splice exactly like the literals did. Selector output
is unchanged apart from the entry comments moving in as # lines.
First half of the #3411 follow-up (dobrac: init.go:21).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
tomassrnka
added a commit
that referenced
this pull request
Jul 30, 2026
…plate
The selection structure (case arms, rejected-id guard, ID_LIKE loop,
error/warning text) moves verbatim from the ShellSelector string-builder
into provision.sh as inline template actions; the distro package now
contributes data only — distro.NewTemplateData(), with all shell-quoting
kept in Go. Fingerprint hashes the view data (%#v, so new fields are
covered automatically); the structure is already hashed via the raw
embedded template. Version 1 -> 2.
The render seam and its tests live in ungated files so they keep running
on darwin. Selection-text assertions move to base/provision_test.go
against the rendered script, with the guard-ordering anchor rewritten to
the fallback loop line (E2B_ID_LIKE is assigned earlier in the full
script). New guards: %q-vs-sh quoting assumptions pinned per profile
field, and a leftover-"{{" render check.
Rendered output verified byte-identical to ShellSelector modulo added
comments; customer-visible messages pinned byte-exact.
Completes the #3411 follow-up (dobrac: distro.go:160, provision.sh:29).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
tomassrnka
added a commit
that referenced
this pull request
Jul 30, 2026
The three initSetup bodies leave their Go string literals for
init-{systemd,openrc,nixos}.sh, go:embed'd with the trailing newline
trimmed so they splice exactly like the literals did. Selector output
is unchanged apart from the entry comments moving in as # lines.
First half of the #3411 follow-up (dobrac: init.go:21).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
tomassrnka
added a commit
that referenced
this pull request
Jul 30, 2026
…plate
The selection structure (case arms, rejected-id guard, ID_LIKE loop,
error/warning text) moves verbatim from the ShellSelector string-builder
into provision.sh as inline template actions; the distro package now
contributes data only — distro.NewTemplateData(), with all shell-quoting
kept in Go. Fingerprint hashes the view data (%#v, so new fields are
covered automatically); the structure is already hashed via the raw
embedded template. Version 1 -> 2.
The render seam and its tests live in ungated files so they keep running
on darwin. Selection-text assertions move to base/provision_test.go
against the rendered script, with the guard-ordering anchor rewritten to
the fallback loop line (E2B_ID_LIKE is assigned earlier in the full
script). New guards: %q-vs-sh quoting assumptions pinned per profile
field, and a leftover-"{{" render check.
Rendered output verified byte-identical to ShellSelector modulo added
comments; customer-visible messages pinned byte-exact.
Completes the #3411 follow-up (dobrac: distro.go:160, provision.sh:29).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Jul 30, 2026
charlie-e2b
added a commit
that referenced
this pull request
Jul 30, 2026
🤖 I have created a release *beep* *boop* --- ## 0.0.1 (2026-07-30) ### Features * **api:** add sandbox IAM workload token configuration ([13ddb3d](13ddb3d)) * **api:** add sandbox workload identity permission ([#3319](#3319)) ([13ddb3d](13ddb3d)) * **api:** SOCKS5 egress proxy on sandbox network config (BYOP) ([#2642](#2642)) ([1fc3820](1fc3820)) * **cfg:** add DISABLE_STARTUP_RECLAIM flag ([#3081](#3081)) ([7677ca6](7677ca6)) * **clickhouse:** implement multi-cluster fan-out for events and stats ([#2925](#2925)) ([39594c6](39594c6)) * dynamic sandbox log routing and ClickHouse-backed log reads ([#3236](#3236)) ([1b19a3b](1b19a3b)) * **envd:** give envd realtime IO priority, reset for user processes ([#2681](#2681)) ([f4bd1b2](f4bd1b2)) * **envd:** split collapse stats into real migrations vs already-huge ([#3021](#3021)) ([0d77614](0d77614)) * **envd:** support user-defined file metadata via xattrs ([#2732](#2732)) ([da8fbe4](da8fbe4)) * **featureflags:** support per-service context providers ([#3100](#3100)) ([65297c1](65297c1)) * freeze user cgroup across pause/resume to keep envd /init responsive ([#2688](#2688)) ([eceb741](eceb741)) * **metrics:** break down pause-snapshot latency by step ([#3426](#3426)) ([657559e](657559e)) * **metrics:** label pause telemetry by fs_only ([#3425](#3425)) ([411b63e](411b63e)) * **observability:** add kill_reason to sandbox.lifecycle.killed ([#2833](#2833)) ([e45418f](e45418f)) * **observability:** include kill_reason in kill-path structured logs ([#2846](#2846)) ([33c49f7](33c49f7)) * **orch:** add envd-version to LaunchDarkly sandbox context ([#3051](#3051)) ([37d3b92](37d3b92)) * **orch:** add less, nftables, iputils-ping, and jq to base provisioning ([#2736](#2736)) ([a1e010e](a1e010e)) * **orch:** collapse envd's heap into 2 MiB hugepages before pause to cut cold-resume faults ([#2997](#2997)) ([6677f73](6677f73)) * **orch:** debug a sandbox guest kernel with resume-build -gdb ([#3040](#3040)) ([37bb0dc](37bb0dc)) * **orch:** decouple warm resume from memfile dedup ([#3166](#3166)) ([77f25a0](77f25a0)) * **orch:** distro-aware template base-image provisioning ([#3411](#3411)) ([f8c7b5b](f8c7b5b)) * **orchestrator/cgroup:** list and destroy leaked sandbox cgroups ([#3086](#3086)) ([bce1d84](bce1d84)) * **orchestrator/nbd:** inspect and disconnect connected devices ([#3087](#3087)) ([4d47148](4d47148)) * **orchestrator/network:** list slot namespaces ([#3089](#3089)) ([c23dbc7](c23dbc7)) * **orchestrator/network:** list slot namespaces ([#3090](#3090)) ([fbfce25](fbfce25)) * **orchestrator:** add -force-reboot to resume-build to cold-boot memory-snaphsot builds ([#3208](#3208)) ([cf8f15b](cf8f15b)) * **orchestrator:** add allocated resource metrics for sandboxes ([#2943](#2943)) ([95cb6d3](95cb6d3)) * **orchestrator:** add dummy orchestrator binary for local API dev ([#2744](#2744)) ([ab56e25](ab56e25)) * **orchestrator:** add NetworkAssignHook for sandbox lifecycle extensions ([#3290](#3290)) ([3261963](3261963)) * **orchestrator:** add soft-delete marker label to the check metric ([#3144](#3144)) ([1ce64f8](1ce64f8)) * **orchestrator:** add v4HeaderForUncompressed FF bit ([#2669](#2669)) ([1f459ee](1f459ee)) * **orchestrator:** always include execution metrics in sandbox webhook events ([#2852](#2852)) ([440edfe](440edfe)) * **orchestrator:** classify envd-init by exit type ([#3139](#3139)) ([1e39a4f](1e39a4f)) * **orchestrator:** graceful sandbox drain on shutdown ([#3069](#3069)) ([6ce68e3](6ce68e3)) * **orchestrator:** graceful template-build drain on shutdown ([#3079](#3079)) ([1b3001c](1b3001c)) * **orchestrator:** improved read-path telemetry ([#3063](#3063)) ([bc3fe84](bc3fe84)) * **orchestrator:** LD-gated ClickHouse write fan-out feature flag ([#3152](#3152)) ([f046fcf](f046fcf)) * **orchestrator:** make build-reserved-disk-space-mb default 256MB ([#3065](#3065)) ([d473f98](d473f98)) * **orchestrator:** record upload compression metrics ([#2761](#2761)) ([9092e35](9092e35)) * **orchestrator:** report hugepage metrics to API ([#3182](#3182)) ([7735bae](7735bae)) * **orchestrator:** run startup reclaim on boot ([#3123](#3123)) ([79b838e](79b838e)) * **orchestrator:** single-instance flock on startup ([#3143](#3143)) ([1320d6e](1320d6e)) * **orchestrator:** soft-delete consumer enforcement for storage index ([#3034](#3034)) ([fbfc918](fbfc918)) * **orchestrator:** tag envd-init meters with start_type ([#3125](#3125)) ([4466b48](4466b48)) * **orchestrator:** track and report last status change timestamp ([#2980](#2980)) ([f79be77](f79be77)) * **orchestrator:** track sandbox lifecycles ([#2998](#2998)) ([057f20c](057f20c)) * **orchestrator:** write layer sizes (logical/mapped/diff) to object metadata ([#3122](#3122)) ([11869c0](11869c0)) * **orch:** harvest resume-prefetch trace on pause ([#3067](#3067)) ([97bd4a5](97bd4a5)) * **orch:** last-cycle memory prefetch on resume ([#3258](#3258)) ([b22e820](b22e820)) * **orch:** make resume-build -gdb work on real nodes + add copy-build -gdb ([#3108](#3108)) ([c684bd2](c684bd2)) * **orch:** opt-in DSCP marker for sandbox egress (SANDBOX_EGRESS_DSCP) ([#3039](#3039)) ([a98cf2c](a98cf2c)) * **orch:** per-start UFFD startup working-set metric ([#2960](#2960)) ([dc386b2](dc386b2)) * **orch:** premade NixOS base-image support ([#3412](#3412)) ([776ba39](776ba39)) * **orch:** record envd init duration histogram on failure with success attribute ([#2749](#2749)) ([afa7458](afa7458)) * **orch:** snapshot fragmentation metrics ([#2931](#2931)) ([842b007](842b007)) * per-team events TTL limit (tier + addons) ([#3181](#3181)) ([f76b2cb](f76b2cb)) * **shared:** add OTEL instrumentation to AWS S3 storage client ([#3172](#3172)) ([25b0fd1](25b0fd1)) * **storage:** per-role storage URLs, env-free storage library ([#3246](#3246)) ([fcbe909](fcbe909)) * **storage:** stamp provenance custom metadata on uploaded objects (incl. headers) ([#3033](#3033)) ([ba8604e](ba8604e)) * **storage:** write-through compressed templates to NFS on upload ([#2827](#2827)) ([57503c1](57503c1)) ### Bug Fixes * added api and orch ([#3454](#3454)) ([fda5e45](fda5e45)) * **block:** rephrase misleading error message in pwritevAll ([#2816](#2816)) ([1555f1b](1555f1b)) * **cache:** use 512-byte units for stat.Blocks in FileSize ([#2949](#2949)) ([0f632a9](0f632a9)) * **clean-nfs-cache:** exclude zombies from delete_age ([#3191](#3191)) ([3fa2aeb](3fa2aeb)) * **compression:** correctness findings from compression audit ([#2803](#2803)) ([d21a6a9](d21a6a9)) * **copy-build:** resolve compression suffix for build data files ([#2859](#2859)) ([8966f7e](8966f7e)) * correct 3 CVES ([#3218](#3218)) ([076823b](076823b)) * **envd:** stop freezing socat cgroup across pause/resume ([#2923](#2923)) ([8b6f2b9](8b6f2b9)) * **inspect-build:** adapt validate to new Chunker upstream API ([#2989](#2989)) ([2e0d3da](2e0d3da)) * **nbd:** adjust status poll sleep from 100ns to 100µs ([02bf51b](02bf51b)) * **nbd:** change NBD status poll sleep from 100ns to 100µs to avoid useless busy spinning ([#2884](#2884)) ([02bf51b](02bf51b)) * **nfsproxy:** deflake TestRoundTrip EADDRINUSE ([#2987](#2987)) ([55f4d18](55f4d18)) * **orch:** denormalize upload metric file type ([#2865](#2865)) ([b1646ca](b1646ca)) * **orch:** disable the chronyd seccomp filter on Alpine when using PHC ([#3453](#3453)) ([e58af28](e58af28)) * **orchestrator:** anchor rsync CWD to root in template file copy ([#2835](#2835)) ([7160db9](7160db9)) * **orchestrator:** atomically replace metadata ([#3321](#3321)) ([0c4ad6b](0c4ad6b)) * **orchestrator:** avoid serializing upload headers twice ([#2762](#2762)) ([9b7b149](9b7b149)) * **orchestrator:** chunk readiness bug in P2P->compressed ([#3185](#3185)) ([74a6e5b](74a6e5b)) * **orchestrator:** deschedule flaky eviction-loop race in TestDiffSto… ([#3173](#3173)) ([88ff17c](88ff17c)) * **orchestrator:** discard poisoned nftables conn on firewall errors ([#3008](#3008)) ([03f10e0](03f10e0)) * **orchestrator:** drop stale pre-init logs ([#3297](#3297)) ([8ec4be5](8ec4be5)) * **orchestrator:** emit compression ratios as fractions, not BP ([#2772](#2772)) ([866f4c1](866f4c1)) * **orchestrator:** export dirty-page stall counter from process start ([#2992](#2992)) ([badc8ad](badc8ad)) * **orchestrator:** harden Firecracker process shutdown ([#2996](#2996)) ([df662e7](df662e7)) * **orchestrator:** harden shutdown network cleanup ([#3000](#3000)) ([de2f391](de2f391)) * **orchestrator:** implement Docker COPY merge semantics in template builds ([#3283](#3283)) ([9174104](9174104)) * **orchestrator:** keep dedup empty-pages telemetry scan-only ([#2991](#2991)) ([35d0832](35d0832)) * **orchestrator:** let build-cache threshold flag raise above its fal… ([#3175](#3175)) ([06393c3](06393c3)) * **orchestrator:** log missing egress proxy in startup reclaim instead of defaulting silently ([#3116](#3116)) ([6ca3163](6ca3163)) * **orchestrator:** make copy-build handle filesystem-only snapshots ([#3299](#3299)) ([62add04](62add04)) * **orchestrator:** measure ext4 free space from block groups ([#3282](#3282)) ([f18f05f](f18f05f)) * **orchestrator:** normalize upload metric file labels ([#2767](#2767)) ([6dec8b3](6dec8b3)) * **orchestrator:** order egress config/firewall updates to close BYOP enable race ([#3313](#3313)) ([7faa59e](7faa59e)) * **orchestrator:** order envd.service after local-fs.target ([#3043](#3043)) ([ea2663e](ea2663e)) * **orchestrator:** order envd.service after systemd-tmpfiles-setup ([#3130](#3130)) ([9481811](9481811)) * **orchestrator:** pause upload retain retry ([#2993](#2993)) ([4f81799](4f81799)) * **orchestrator:** pin tap device host-side MAC address ([#3271](#3271)) ([3c786ba](3c786ba)) * **orchestrator:** pin UFFD copy source buffers ([#2745](#2745)) ([837fa91](837fa91)) * **orchestrator:** preserve full ENV value across stdout chunks ([#2740](#2740)) ([4822e6d](4822e6d)) * **orchestrator:** read V3 ancestors as uncompressed instead of failing ([#2994](#2994)) ([c479dd3](c479dd3)) * **orchestrator:** reject standby while draining ([#3325](#3325)) ([475a7ee](475a7ee)) * **orchestrator:** report real V4 header compression ratio ([#2771](#2771)) ([ecd344e](ecd344e)) * **orchestrator:** resolve remaining P2P/compression/V5 issues ([#3015](#3015)) ([1e4379e](1e4379e)) * **orchestrator:** sanitize OCI pull errors ([#3096](#3096)) ([a3af6c0](a3af6c0)) * **orchestrator:** scope rootfs hash to provision default ([#3129](#3129)) ([475f955](475f955)) * **orchestrator:** stop Checks health-loop leaking ([#2739](#2739)) ([17e6e60](17e6e60)) * **orchestrator:** survive SIGBUS from failing disks under mmap'd caches ([#3385](#3385)) ([728bba3](728bba3)) * **orchestrator:** tolerate missing header for legacy templates ([#3026](#3026)) ([8a44bfe](8a44bfe)) * **orch:** fall back to ID_LIKE with a warning instead of rejecting ([#3459](#3459)) ([7167818](7167818)) * **orch:** prevent NBD dispatch read-loop stall on WRITE_ZEROES (behind flag) ([#3048](#3048)) ([efd3d4d](efd3d4d)) * **orch:** split scheduling base build id per artifact ([#2920](#2920)) ([3e35a2a](3e35a2a)) * **orch:** validate copy-build -gdb buckets before the snapshot copy ([#3446](#3446)) ([586ad74](586ad74)) * **shared:** never report a failed envd command stream as success ([#3281](#3281)) ([69c06b6](69c06b6)) * **storage:** compression upload & cache correctness fixes ([#3231](#3231)) ([980748f](980748f)) * **storage:** don't assume V4+ ancestor gaps are uncompressed ([#3447](#3447)) ([bfdbb24](bfdbb24)) * **uffd:** dedupe deferred page faults ([#2864](#2864)) ([9680a41](9680a41)) * WrapContextAsUserError should not misclassify internal timeouts as user cancellations ([#3155](#3155)) ([8f83959](8f83959)) ### Performance Improvements * **build:** cache resolved Diff per BuildId within File.ReadAt ([#2838](#2838)) ([53de07f](53de07f)) * **build:** parallelize fragmented backing reads ([#2872](#2872)) ([c7655a7](c7655a7)) * **clean-nfs-cache:** restore dirfd-relative statx ([#2766](#2766)) ([6bdbedb](6bdbedb)) * **header:** add V5 columnar varint header format ([#2847](#2847)) ([9dd931b](9dd931b)) * **header:** pack cached Header.Mapping into a compact form ([#2844](#2844)) ([7f0b13c](7f0b13c)) * **orchestrator:** add memfile dedup density threshold ([#2862](#2862)) ([7ccfa02](7ccfa02)) * **orchestrator:** avoid V3-ancestor header refresh ([#2999](#2999)) ([cb6aa0b](cb6aa0b)) * **orch:** metrics for dirty page throttling ([#2858](#2858)) ([d2aa554](d2aa554)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: e2b-release-please[bot] <298072688+e2b-release-please[bot]@users.noreply.github.com> Co-authored-by: Charlie Wyse <charlie.wyse@e2b.dev>
tomassrnka
added a commit
that referenced
this pull request
Jul 31, 2026
…time (#3440) `provision.sh` probed `/dev/ptp0` at build time and baked either the PHC refclock or the NTP pool into `chrony.conf`, assuming provisioning and runtime share a host — build and sandbox nodes are separate pools, so that probe doesn't belong in a durable template artifact (codex P1 on #3411). The source line is now written on every boot by `e2b-chrony-source` (systemd oneshot; OpenRC boot service on Alpine) and pulled in with an `include`, mirroring what the NixOS base image already does. Rebased over #3453, whose seccomp workaround keys off exactly the build-time PHC verdict this PR deletes — left alone it never fires, and under `set -eu` the now-unset var breaks every distro's build. Alpine's `-F 0` is therefore unconditional in the OpenRC init setup, which is free: on the pool line chronyd runs fine under the filter, while against a real PHC (an `igc` NIC clock) `-F 1` gives "Loaded seccomp filter (level 1)" then "Bad system call", and `-F 1 -F 0` selects PHC0 at ±55ns. Alpine and ubuntu re-verified on real KVM — 7/7 each, plus 7/7 seccomp checks. Cold boots only: memory-resumed sandboxes keep their snapshot's chronyd. Rollout needs a `build-provision-version` bump.
tomassrnka
added a commit
that referenced
this pull request
Aug 1, 2026
The three initSetup bodies leave their Go string literals for
init-{systemd,openrc,nixos}.sh, go:embed'd with the trailing newline
trimmed so they splice exactly like the literals did. Selector output is
unchanged apart from the entry comments moving in as # lines.
Rebased over #3440, which added chrony-source wiring to both init blocks
after this was written: the systemd drop-in, OpenRC's e2b-chrony-source
install and the unconditional command_args="-F 0" move into the new
files verbatim, checked byte-for-byte against main's literals.
First half of the #3411 follow-up (dobrac: init.go:21).
tomassrnka
added a commit
that referenced
this pull request
Aug 1, 2026
…plate
The selection structure (case arms, rejected-id guard, ID_LIKE loop,
error/warning text) moves verbatim from the ShellSelector string-builder
into provision.sh as inline template actions; the distro package now
contributes data only — distro.NewTemplateData(), with all shell-quoting
kept in Go. Fingerprint hashes the view data (%#v, so new fields are
covered automatically); the structure is already hashed via the raw
embedded template. Version 1 -> 2.
The render seam and its tests live in ungated files so they keep running
on darwin. Selection-text assertions move to base/provision_test.go
against the rendered script, with the guard-ordering anchor rewritten to
the fallback loop line (E2B_ID_LIKE is assigned earlier in the full
script). New guards: %q-vs-sh quoting assumptions pinned per profile
field, a leftover-"{{" render check, and a test that every ProfileView
field — including the init-setup body now sourced from a file — reaches
the rendered case arm. A dropped template action would otherwise leave
the Go-side tests green while the guest hits an undefined variable under
set -u.
#3440's chrony-deferral test now asserts on the rendered script rather
than the raw template: the init blocks moved out, so only the rendered
form covers both halves.
Rendered output verified byte-identical to main's ShellSelector output
modulo the added comments; customer-visible messages pinned byte-exact.
Completes the #3411 follow-up (dobrac: distro.go:160, provision.sh:29).
jakubno
pushed a commit
that referenced
this pull request
Aug 3, 2026
Resolve the base image's distro from its `/etc/os-release` ID and drive provisioning from a declared per-family profile — Debian/Ubuntu (apt), the RHEL family (dnf/microdnf/yum), Arch (pacman), and Alpine on OpenRC (apk) — instead of probing for a package manager. Unsupported or identity-less images are rejected with a clear build-log error. Once merged, the biggest change is adduser -> useradd and introduction of /usr/local/bin/e2b-seed-certs instead of long one-liner for envd. Supersedes #3381 (reopened from a clean branch, no bot-thread churn). NixOS support follows in a stacked PR #3412.
jakubno
pushed a commit
that referenced
this pull request
Aug 3, 2026
Adds a unit test that holds every distro profile's package set to a shared capability map, and integration tests that build a template from an Ubuntu, Fedora, Arch and Alpine base image plus one unsupported image that must be rejected with a readable reason. Stacked on #3411 — retarget to main once that merges. Heads-up on cost: the first run pulls and provisions four new base images, so the templates package gets slower until the base-layer cache warms.
jakubno
pushed a commit
that referenced
this pull request
Aug 3, 2026
Stacks on #3411. Adds a `nixos` distro profile — premade images whose packages/services are declared in the image's own NixOS configuration rather than installed at provision time — plus the E2B NixOS base-image definition. ## Verification status Verified at tip on real KVM: the image was built with a nix builder from the committed `configuration.nix` (build.sh fixed — it was non-executable and staged from a hardcoded out-of-repo path, so the committed config was previously never the one built) and booted as sandboxes through the template pipeline. All previously inspection-only fixes now have observed evidence: envd unit parity (`Nice=-20`, `OOMScoreAdjust=-1000`, `GOMEMLIMIT=512MiB`, IO/CPU/memory weights), chrony source-select oneshot (pool branch live; PHC branch replay-verified — a real PHC lock needs `kvm-ptp`, not exposed on the verification host), firewall off with envd's port connected, CA bundle a regular file + `https=200`, default user + NOPASSWD sudo, hostname/hosts kept, shadow tools present, nix store DB valid (`--check-validity` OK, 532 paths). Note: sshd accepts connections ~1–2s after sandbox start — NixOS generates host keys per sandbox on first boot (unique keys per sandbox; the package-manager families bake shared per-template keys at provision time). Inherent to NixOS's design, left as-is. ## Known NixOS limitations - **Sudoers for non-default users.** A `USER` build step naming an account other than `user` fails: `commands/user.go` appends to `/etc/sudoers`, which is a read-only store symlink on NixOS. The fix is a drop-in under `/etc/sudoers.d`, which changes behaviour for every family and belongs in its own PR. - **No at-tip real-KVM coverage.** Building the premade image needs a nix builder; none is available on the current box or dev VM, so the NixOS-side changes here are reviewed but not runtime-verified. Draft: on-the-fly (nix-build at template-build time) is still open design; merge after #3411.
jakubno
pushed a commit
that referenced
this pull request
Aug 3, 2026
🤖 I have created a release *beep* *boop* --- ## 0.0.1 (2026-07-29) ### Features * **envd:** add --no-cgroups flag to disable cgroup management ([#2811](#2811)) ([e10814c](e10814c)) * **envd:** add optional EntryInfo to watch FilesystemEvent ([#2930](#2930)) ([bbbc7c8](bbbc7c8)) * **envd:** allow opting into watching network mounts ([#2982](#2982)) ([9799dd0](9799dd0)) * **envd:** give envd realtime IO priority, reset for user processes ([#2681](#2681)) ([f4bd1b2](f4bd1b2)) * **envd:** split collapse stats into real migrations vs already-huge ([#3021](#3021)) ([0d77614](0d77614)) * **envd:** support user-defined file metadata via xattrs ([#2732](#2732)) ([da8fbe4](da8fbe4)) * freeze user cgroup across pause/resume to keep envd /init responsive ([#2688](#2688)) ([eceb741](eceb741)) * **orch:** collapse envd's heap into 2 MiB hugepages before pause to cut cold-resume faults ([#2997](#2997)) ([6677f73](6677f73)) * **orch:** distro-aware template base-image provisioning ([#3411](#3411)) ([1abece1](1abece1)) ### Bug Fixes * added envd to artifact repository ([#3432](#3432)) ([b7024ba](b7024ba)) * correct 3 CVES ([#3218](#3218)) ([076823b](076823b)) * **envd:** avoid Start deadlock after request cancellation ([#3256](#3256)) ([04317f8](04317f8)) * **envd:** bound the in-memory logs queue ([#2676](#2676)) ([05c9939](05c9939)) * **envd:** discard output when no subscriber is connected ([#2639](#2639)) ([8cf1795](8cf1795)) * **envd:** fall back to lazy unmount when forced NFS umount fails ([#2683](#2683)) ([5346a0d](5346a0d)) * **envd:** ignore closed pty read errors ([#2769](#2769)) ([6118672](6118672)) * **envd:** include suppressed count in exporter error logs ([#2680](#2680)) ([35c1141](35c1141)) * **envd:** make /init lock ctx-aware to prevent retry pile-up ([#2702](#2702)) ([173afd4](173afd4)) * **envd:** make CA install lock ctx-aware ([#2690](#2690)) ([83ee89f](83ee89f)) * **envd:** replace env vars in /init instead of merging ([#2706](#2706)) ([1b52e9a](1b52e9a)) * **envd:** replace time.Sleep with ticker in ScanAndBroadcast for prompt shutdown ([#3374](#3374)) ([002fd9f](002fd9f)) * **envd:** self-heal MMDS routing on /init lookup failure ([#2701](#2701)) ([90944d5](90944d5)) * **envd:** stop freezing socat cgroup across pause/resume ([#2923](#2923)) ([8b6f2b9](8b6f2b9)) * **envd:** stop misleading CA install cancel errors on rapid /init ([#3206](#3206)) ([91d09e4](91d09e4)) * **envd:** suppress repeat MMDS poll failures ([#2678](#2678)) ([73d691a](73d691a)) * **envd:** tolerate busy tmpfs cleanup in tests ([#2938](#2938)) ([a485834](a485834)) * **envd:** use constant-time comparison for signature validation ([#3145](#3145)) ([fcf92fa](fcf92fa)) * **envd:** use WithoutCancel for CA cleanup goroutine ctx ([#3207](#3207)) ([ee7bf84](ee7bf84)) ### Performance Improvements * **envd:** stop logging streamed payload content ([#2755](#2755)) ([db3868c](db3868c)) * **sandbox:** keep envd logging out of journald ([#2675](#2675)) ([f6943ca](f6943ca)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: e2b-release-please[bot] <298072688+e2b-release-please[bot]@users.noreply.github.com>
jakubno
pushed a commit
that referenced
this pull request
Aug 3, 2026
🤖 I have created a release *beep* *boop* --- ## 0.0.1 (2026-07-30) ### Features * **api:** add sandbox IAM workload token configuration ([13ddb3d](13ddb3d)) * **api:** add sandbox workload identity permission ([#3319](#3319)) ([13ddb3d](13ddb3d)) * **api:** SOCKS5 egress proxy on sandbox network config (BYOP) ([#2642](#2642)) ([1fc3820](1fc3820)) * **cfg:** add DISABLE_STARTUP_RECLAIM flag ([#3081](#3081)) ([7677ca6](7677ca6)) * **clickhouse:** implement multi-cluster fan-out for events and stats ([#2925](#2925)) ([39594c6](39594c6)) * dynamic sandbox log routing and ClickHouse-backed log reads ([#3236](#3236)) ([1b19a3b](1b19a3b)) * **envd:** give envd realtime IO priority, reset for user processes ([#2681](#2681)) ([f4bd1b2](f4bd1b2)) * **envd:** split collapse stats into real migrations vs already-huge ([#3021](#3021)) ([0d77614](0d77614)) * **envd:** support user-defined file metadata via xattrs ([#2732](#2732)) ([da8fbe4](da8fbe4)) * **featureflags:** support per-service context providers ([#3100](#3100)) ([65297c1](65297c1)) * freeze user cgroup across pause/resume to keep envd /init responsive ([#2688](#2688)) ([eceb741](eceb741)) * **metrics:** break down pause-snapshot latency by step ([#3426](#3426)) ([f551118](f551118)) * **metrics:** label pause telemetry by fs_only ([#3425](#3425)) ([4be33ba](4be33ba)) * **observability:** add kill_reason to sandbox.lifecycle.killed ([#2833](#2833)) ([e45418f](e45418f)) * **observability:** include kill_reason in kill-path structured logs ([#2846](#2846)) ([33c49f7](33c49f7)) * **orch:** add envd-version to LaunchDarkly sandbox context ([#3051](#3051)) ([37d3b92](37d3b92)) * **orch:** add less, nftables, iputils-ping, and jq to base provisioning ([#2736](#2736)) ([a1e010e](a1e010e)) * **orch:** collapse envd's heap into 2 MiB hugepages before pause to cut cold-resume faults ([#2997](#2997)) ([6677f73](6677f73)) * **orch:** debug a sandbox guest kernel with resume-build -gdb ([#3040](#3040)) ([37bb0dc](37bb0dc)) * **orch:** decouple warm resume from memfile dedup ([#3166](#3166)) ([77f25a0](77f25a0)) * **orch:** distro-aware template base-image provisioning ([#3411](#3411)) ([1abece1](1abece1)) * **orchestrator/cgroup:** list and destroy leaked sandbox cgroups ([#3086](#3086)) ([bce1d84](bce1d84)) * **orchestrator/nbd:** inspect and disconnect connected devices ([#3087](#3087)) ([4d47148](4d47148)) * **orchestrator/network:** list slot namespaces ([#3089](#3089)) ([c23dbc7](c23dbc7)) * **orchestrator/network:** list slot namespaces ([#3090](#3090)) ([fbfce25](fbfce25)) * **orchestrator:** add -force-reboot to resume-build to cold-boot memory-snaphsot builds ([#3208](#3208)) ([cf8f15b](cf8f15b)) * **orchestrator:** add allocated resource metrics for sandboxes ([#2943](#2943)) ([95cb6d3](95cb6d3)) * **orchestrator:** add dummy orchestrator binary for local API dev ([#2744](#2744)) ([ab56e25](ab56e25)) * **orchestrator:** add NetworkAssignHook for sandbox lifecycle extensions ([#3290](#3290)) ([3261963](3261963)) * **orchestrator:** add soft-delete marker label to the check metric ([#3144](#3144)) ([1ce64f8](1ce64f8)) * **orchestrator:** add v4HeaderForUncompressed FF bit ([#2669](#2669)) ([1f459ee](1f459ee)) * **orchestrator:** always include execution metrics in sandbox webhook events ([#2852](#2852)) ([440edfe](440edfe)) * **orchestrator:** classify envd-init by exit type ([#3139](#3139)) ([1e39a4f](1e39a4f)) * **orchestrator:** graceful sandbox drain on shutdown ([#3069](#3069)) ([6ce68e3](6ce68e3)) * **orchestrator:** graceful template-build drain on shutdown ([#3079](#3079)) ([1b3001c](1b3001c)) * **orchestrator:** improved read-path telemetry ([#3063](#3063)) ([bc3fe84](bc3fe84)) * **orchestrator:** LD-gated ClickHouse write fan-out feature flag ([#3152](#3152)) ([f046fcf](f046fcf)) * **orchestrator:** make build-reserved-disk-space-mb default 256MB ([#3065](#3065)) ([d473f98](d473f98)) * **orchestrator:** record upload compression metrics ([#2761](#2761)) ([9092e35](9092e35)) * **orchestrator:** report hugepage metrics to API ([#3182](#3182)) ([7735bae](7735bae)) * **orchestrator:** run startup reclaim on boot ([#3123](#3123)) ([79b838e](79b838e)) * **orchestrator:** single-instance flock on startup ([#3143](#3143)) ([1320d6e](1320d6e)) * **orchestrator:** soft-delete consumer enforcement for storage index ([#3034](#3034)) ([fbfc918](fbfc918)) * **orchestrator:** tag envd-init meters with start_type ([#3125](#3125)) ([4466b48](4466b48)) * **orchestrator:** track and report last status change timestamp ([#2980](#2980)) ([f79be77](f79be77)) * **orchestrator:** track sandbox lifecycles ([#2998](#2998)) ([057f20c](057f20c)) * **orchestrator:** write layer sizes (logical/mapped/diff) to object metadata ([#3122](#3122)) ([11869c0](11869c0)) * **orch:** harvest resume-prefetch trace on pause ([#3067](#3067)) ([97bd4a5](97bd4a5)) * **orch:** last-cycle memory prefetch on resume ([#3258](#3258)) ([ea94196](ea94196)) * **orch:** make resume-build -gdb work on real nodes + add copy-build -gdb ([#3108](#3108)) ([5385594](5385594)) * **orch:** opt-in DSCP marker for sandbox egress (SANDBOX_EGRESS_DSCP) ([#3039](#3039)) ([a98cf2c](a98cf2c)) * **orch:** per-start UFFD startup working-set metric ([#2960](#2960)) ([dc386b2](dc386b2)) * **orch:** premade NixOS base-image support ([#3412](#3412)) ([4bd42d2](4bd42d2)) * **orch:** record envd init duration histogram on failure with success attribute ([#2749](#2749)) ([afa7458](afa7458)) * **orch:** snapshot fragmentation metrics ([#2931](#2931)) ([842b007](842b007)) * per-team events TTL limit (tier + addons) ([#3181](#3181)) ([f76b2cb](f76b2cb)) * **shared:** add OTEL instrumentation to AWS S3 storage client ([#3172](#3172)) ([25b0fd1](25b0fd1)) * **storage:** per-role storage URLs, env-free storage library ([#3246](#3246)) ([fcbe909](fcbe909)) * **storage:** stamp provenance custom metadata on uploaded objects (incl. headers) ([#3033](#3033)) ([ba8604e](ba8604e)) * **storage:** write-through compressed templates to NFS on upload ([#2827](#2827)) ([57503c1](57503c1)) ### Bug Fixes * added api and orch ([#3454](#3454)) ([d56e0a8](d56e0a8)) * **block:** rephrase misleading error message in pwritevAll ([#2816](#2816)) ([1555f1b](1555f1b)) * **cache:** use 512-byte units for stat.Blocks in FileSize ([#2949](#2949)) ([0f632a9](0f632a9)) * **clean-nfs-cache:** exclude zombies from delete_age ([#3191](#3191)) ([3fa2aeb](3fa2aeb)) * **compression:** correctness findings from compression audit ([#2803](#2803)) ([d21a6a9](d21a6a9)) * **copy-build:** resolve compression suffix for build data files ([#2859](#2859)) ([8966f7e](8966f7e)) * correct 3 CVES ([#3218](#3218)) ([076823b](076823b)) * **envd:** stop freezing socat cgroup across pause/resume ([#2923](#2923)) ([8b6f2b9](8b6f2b9)) * **inspect-build:** adapt validate to new Chunker upstream API ([#2989](#2989)) ([2e0d3da](2e0d3da)) * **nbd:** adjust status poll sleep from 100ns to 100µs ([02bf51b](02bf51b)) * **nbd:** change NBD status poll sleep from 100ns to 100µs to avoid useless busy spinning ([#2884](#2884)) ([02bf51b](02bf51b)) * **nfsproxy:** deflake TestRoundTrip EADDRINUSE ([#2987](#2987)) ([55f4d18](55f4d18)) * **orch:** denormalize upload metric file type ([#2865](#2865)) ([b1646ca](b1646ca)) * **orch:** disable the chronyd seccomp filter on Alpine when using PHC ([#3453](#3453)) ([dfa9764](dfa9764)) * **orchestrator:** anchor rsync CWD to root in template file copy ([#2835](#2835)) ([7160db9](7160db9)) * **orchestrator:** atomically replace metadata ([#3321](#3321)) ([0c4ad6b](0c4ad6b)) * **orchestrator:** avoid serializing upload headers twice ([#2762](#2762)) ([9b7b149](9b7b149)) * **orchestrator:** chunk readiness bug in P2P->compressed ([#3185](#3185)) ([74a6e5b](74a6e5b)) * **orchestrator:** deschedule flaky eviction-loop race in TestDiffSto… ([#3173](#3173)) ([88ff17c](88ff17c)) * **orchestrator:** discard poisoned nftables conn on firewall errors ([#3008](#3008)) ([03f10e0](03f10e0)) * **orchestrator:** drop stale pre-init logs ([#3297](#3297)) ([8ec4be5](8ec4be5)) * **orchestrator:** emit compression ratios as fractions, not BP ([#2772](#2772)) ([866f4c1](866f4c1)) * **orchestrator:** export dirty-page stall counter from process start ([#2992](#2992)) ([badc8ad](badc8ad)) * **orchestrator:** harden Firecracker process shutdown ([#2996](#2996)) ([df662e7](df662e7)) * **orchestrator:** harden shutdown network cleanup ([#3000](#3000)) ([de2f391](de2f391)) * **orchestrator:** implement Docker COPY merge semantics in template builds ([#3283](#3283)) ([9174104](9174104)) * **orchestrator:** keep dedup empty-pages telemetry scan-only ([#2991](#2991)) ([35d0832](35d0832)) * **orchestrator:** let build-cache threshold flag raise above its fal… ([#3175](#3175)) ([06393c3](06393c3)) * **orchestrator:** log missing egress proxy in startup reclaim instead of defaulting silently ([#3116](#3116)) ([6ca3163](6ca3163)) * **orchestrator:** make copy-build handle filesystem-only snapshots ([#3299](#3299)) ([62add04](62add04)) * **orchestrator:** measure ext4 free space from block groups ([#3282](#3282)) ([f18f05f](f18f05f)) * **orchestrator:** normalize upload metric file labels ([#2767](#2767)) ([6dec8b3](6dec8b3)) * **orchestrator:** order egress config/firewall updates to close BYOP enable race ([#3313](#3313)) ([7faa59e](7faa59e)) * **orchestrator:** order envd.service after local-fs.target ([#3043](#3043)) ([ea2663e](ea2663e)) * **orchestrator:** order envd.service after systemd-tmpfiles-setup ([#3130](#3130)) ([9481811](9481811)) * **orchestrator:** pause upload retain retry ([#2993](#2993)) ([4f81799](4f81799)) * **orchestrator:** pin tap device host-side MAC address ([#3271](#3271)) ([3c786ba](3c786ba)) * **orchestrator:** pin UFFD copy source buffers ([#2745](#2745)) ([837fa91](837fa91)) * **orchestrator:** preserve full ENV value across stdout chunks ([#2740](#2740)) ([4822e6d](4822e6d)) * **orchestrator:** read V3 ancestors as uncompressed instead of failing ([#2994](#2994)) ([c479dd3](c479dd3)) * **orchestrator:** reject standby while draining ([#3325](#3325)) ([475a7ee](475a7ee)) * **orchestrator:** report real V4 header compression ratio ([#2771](#2771)) ([ecd344e](ecd344e)) * **orchestrator:** resolve remaining P2P/compression/V5 issues ([#3015](#3015)) ([1e4379e](1e4379e)) * **orchestrator:** sanitize OCI pull errors ([#3096](#3096)) ([a3af6c0](a3af6c0)) * **orchestrator:** scope rootfs hash to provision default ([#3129](#3129)) ([475f955](475f955)) * **orchestrator:** stop Checks health-loop leaking ([#2739](#2739)) ([17e6e60](17e6e60)) * **orchestrator:** survive SIGBUS from failing disks under mmap'd caches ([#3385](#3385)) ([8694d08](8694d08)) * **orchestrator:** tolerate missing header for legacy templates ([#3026](#3026)) ([8a44bfe](8a44bfe)) * **orch:** fall back to ID_LIKE with a warning instead of rejecting ([#3459](#3459)) ([73399b3](73399b3)) * **orch:** prevent NBD dispatch read-loop stall on WRITE_ZEROES (behind flag) ([#3048](#3048)) ([efd3d4d](efd3d4d)) * **orch:** split scheduling base build id per artifact ([#2920](#2920)) ([3e35a2a](3e35a2a)) * **orch:** validate copy-build -gdb buckets before the snapshot copy ([#3446](#3446)) ([9be382f](9be382f)) * **shared:** never report a failed envd command stream as success ([#3281](#3281)) ([69c06b6](69c06b6)) * **storage:** compression upload & cache correctness fixes ([#3231](#3231)) ([980748f](980748f)) * **storage:** don't assume V4+ ancestor gaps are uncompressed ([#3447](#3447)) ([f828d12](f828d12)) * **uffd:** dedupe deferred page faults ([#2864](#2864)) ([9680a41](9680a41)) * WrapContextAsUserError should not misclassify internal timeouts as user cancellations ([#3155](#3155)) ([8f83959](8f83959)) ### Performance Improvements * **build:** cache resolved Diff per BuildId within File.ReadAt ([#2838](#2838)) ([53de07f](53de07f)) * **build:** parallelize fragmented backing reads ([#2872](#2872)) ([c7655a7](c7655a7)) * **clean-nfs-cache:** restore dirfd-relative statx ([#2766](#2766)) ([6bdbedb](6bdbedb)) * **header:** add V5 columnar varint header format ([#2847](#2847)) ([9dd931b](9dd931b)) * **header:** pack cached Header.Mapping into a compact form ([#2844](#2844)) ([7f0b13c](7f0b13c)) * **orchestrator:** add memfile dedup density threshold ([#2862](#2862)) ([7ccfa02](7ccfa02)) * **orchestrator:** avoid V3-ancestor header refresh ([#2999](#2999)) ([cb6aa0b](cb6aa0b)) * **orch:** metrics for dirty page throttling ([#2858](#2858)) ([d2aa554](d2aa554)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: e2b-release-please[bot] <298072688+e2b-release-please[bot]@users.noreply.github.com> Co-authored-by: Charlie Wyse <charlie.wyse@e2b.dev>
jakubno
pushed a commit
that referenced
this pull request
Aug 3, 2026
…time (#3440) `provision.sh` probed `/dev/ptp0` at build time and baked either the PHC refclock or the NTP pool into `chrony.conf`, assuming provisioning and runtime share a host — build and sandbox nodes are separate pools, so that probe doesn't belong in a durable template artifact (codex P1 on #3411). The source line is now written on every boot by `e2b-chrony-source` (systemd oneshot; OpenRC boot service on Alpine) and pulled in with an `include`, mirroring what the NixOS base image already does. Rebased over #3453, whose seccomp workaround keys off exactly the build-time PHC verdict this PR deletes — left alone it never fires, and under `set -eu` the now-unset var breaks every distro's build. Alpine's `-F 0` is therefore unconditional in the OpenRC init setup, which is free: on the pool line chronyd runs fine under the filter, while against a real PHC (an `igc` NIC clock) `-F 1` gives "Loaded seccomp filter (level 1)" then "Bad system call", and `-F 1 -F 0` selects PHC0 at ±55ns. Alpine and ubuntu re-verified on real KVM — 7/7 each, plus 7/7 seccomp checks. Cold boots only: memory-resumed sandboxes keep their snapshot's chronyd. Rollout needs a `build-provision-version` bump.
jakubno
pushed a commit
that referenced
this pull request
Aug 3, 2026
The three initSetup bodies leave their Go string literals for
init-{systemd,openrc,nixos}.sh, go:embed'd with the trailing newline
trimmed so they splice exactly like the literals did. Selector output is
unchanged apart from the entry comments moving in as # lines.
Rebased over #3440, which added chrony-source wiring to both init blocks
after this was written: the systemd drop-in, OpenRC's e2b-chrony-source
install and the unconditional command_args="-F 0" move into the new
files verbatim, checked byte-for-byte against main's literals.
First half of the #3411 follow-up (dobrac: init.go:21).
jakubno
pushed a commit
that referenced
this pull request
Aug 3, 2026
…plate
The selection structure (case arms, rejected-id guard, ID_LIKE loop,
error/warning text) moves verbatim from the ShellSelector string-builder
into provision.sh as inline template actions; the distro package now
contributes data only — distro.NewTemplateData(), with all shell-quoting
kept in Go. Fingerprint hashes the view data (%#v, so new fields are
covered automatically); the structure is already hashed via the raw
embedded template. Version 1 -> 2.
The render seam and its tests live in ungated files so they keep running
on darwin. Selection-text assertions move to base/provision_test.go
against the rendered script, with the guard-ordering anchor rewritten to
the fallback loop line (E2B_ID_LIKE is assigned earlier in the full
script). New guards: %q-vs-sh quoting assumptions pinned per profile
field, a leftover-"{{" render check, and a test that every ProfileView
field — including the init-setup body now sourced from a file — reaches
the rendered case arm. A dropped template action would otherwise leave
the Go-side tests green while the guest hits an undefined variable under
set -u.
#3440's chrony-deferral test now asserts on the rendered script rather
than the raw template: the init blocks moved out, so only the rendered
form covers both halves.
Rendered output verified byte-identical to main's ShellSelector output
modulo the added comments; customer-visible messages pinned byte-exact.
Completes the #3411 follow-up (dobrac: distro.go:160, provision.sh:29).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolve the base image's distro from its
/etc/os-releaseID and drive provisioning from a declared per-family profile — Debian/Ubuntu (apt), the RHEL family (dnf/microdnf/yum), Arch (pacman), and Alpine on OpenRC (apk) — instead of probing for a package manager. Unsupported or identity-less images are rejected with a clear build-log error.Once merged, the biggest change is adduser -> useradd and introduction of /usr/local/bin/e2b-seed-certs instead of long one-liner for envd.
Supersedes #3381 (reopened from a clean branch, no bot-thread churn). NixOS support follows in a stacked PR #3412.