Repository navigation
Support runtime-only golden snapshots with shared volumes - #2683
Draft
Salah (spichen) wants to merge 13 commits into
Draft
Salah (spichen) wants to merge 13 commits into
Salah (spichen) wants to merge 13 commits into
Conversation
The ActorTemplate volume union now carries one CSI member, Volume.external (ExternalVolumeSource), whose template member replaces external_volume_template; a member for shared volumes follows after GA. The per-actor record on ActorStatus.external_volumes becomes ExternalVolumeRef, freeing the plain name for the atespace-scoped resource, and atelet's resolved handle becomes ExternalVolume to match its sibling volume messages. Templates that still carry external_volume_template must be recreated. Fixes agent-substrate#2407, agent-substrate#2436. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
An EmptyDirVolume is an empty host directory at the same path an external volume would be published to, mounted into the sandbox the same way. It lets a golden actor warm up against a placeholder for an external volume it must not mount, so the snapshot's mount table matches the real actor's on both gVisor and microVM. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
A SharedVolume is an atespace-scoped CSI volume whose lifetime is independent of any actor. It is provisioned from a StorageClass or registers a volume that already exists, carries an immutable access mode, and is removed either manually or when the last actor referencing it is deleted, according to its delete trigger. Deleting the record also deletes the storage. This adds the resource, its Postgres table and store methods, the create/get/list/update/delete RPCs, and kubectl-ate commands. Nothing references a volume yet; actor references arrive separately. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
A template volume whose external source names a shared_volume mounts a SharedVolume instead of provisioning one per actor. The reference names the volume, or leaves the name empty so each actor binds it at creation through Actor.shared_volume_bindings. Every actor referencing a volume is recorded in the volume's refs, with active set while the actor is resumed. Resume refuses a READ_WRITE_ONCE volume another actor holds active, pause and suspend mark the reference inactive, crash leaves it as is, and delete removes it and deletes a LAST_ACTOR volume that no actor references any more. Golden actors never reference a volume; they warm up against an empty directory at the same mount path. Depends on the empty_dir volume source and the SharedVolume resource. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The golden actor warms up against a local empty directory in place of a shared volume, but runsc derives the disable_file_handle_sharing mount option from the bind source's filesystem and refuses a restore whose mount options differ from the checkpoint's. On NFS the first resume of every such actor therefore failed with "Mounts" does not match across checkpoint restore. Actors created from a template that references a SharedVolume no longer seed from the golden tag: the first resume boots from the image and later resumes restore the actor's own snapshot, which was taken over the real volume. An explicit source tag is refused for these templates. Golden restores for shared volumes remain follow-up work, tracked by TODO(shared-volumes). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
Salah (spichen)
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Shared-volume deletion could race actor creation or release storage after failed node cleanup. This change makes actor creation and reference binding transactional, fences storage deletion with a persistent DELETING state and version guard, and retains ownership until termination and detach succeed.
Adds opt-in
GOLDEN_SNAPSHOT_MODE_RUNTIMEfor microVM and gVisor actors with shared CSI volumes. Capture precedes application startup; each clone attaches its selected volumes and starts fresh applications. Later own snapshots preserve application memory. Application-warm volume substitution remains out of scope.Review fixes
6edd1fcc, including the ateworker rename and current worker/proto APIs.Spec.RuntimeGolden, skip RUNTIME warmup, and compile the boot identity marker only withe2e_runtime_identity.externalVolumeTemplate→external.templateupgrade. Following the repository's pre-1.0 schema policy, no reserved field or compatibility decoder was added; stored templates are not automatically migrated.This draft includes the shared-volume prerequisite from #2567 in its diff against main.
Validation of review fixes (
c978b0d8)NO_COLOR=1; that package passed with the variable removed. The corrected PostgreSQL package also passed its race recheck.REQUIRE_DOCKER=trueagainst the existing Colima daemon.Historical runtime validation (
e3382628)The earlier OCI run passed API-level runtime-golden/NFS CSI tests for both runtimes with two actor bindings and two own-snapshot generations. gVisor preserved deleted-open contents and passed a separate low-level cross-host restore experiment. This evidence predates the review fixes.
Latency
4-OCPU/32-GB OCI E5.Flex primary, one kind node, two workers, real NFS CSI. Each runtime/mode has 100 successful measured activations plus five excluded warmups; all 600 measured activations succeeded. Modes were randomized, concurrency was one, and images/assets/caches were warm. Timing covers
ResumeActorthrough identity and successful NFS write/read. Builds/checks and cross-host work ran outside the measurement window.MicroVM runtime-golden median was 28% lower than cold boot, but its p95 was worse in this run. gVisor runtime-golden median was 10% higher than cold boot. These small-probe measurements do not establish a universal speedup or production SLA.
Remaining limitations
Resource cleanup
Both temporary OCI instances and their boot volumes are confirmed TERMINATED. The temporary network resources were deleted and independently checked after deletion.