fix(shim): kubectl exec works end-to-end on RuntimeClass=a3s-box

Makes the containerd-shim-a3s-box-v2 path actually serve `kubectl exec`
against libkrun MicroVMs, plus the v2.6.0 network/block-IO stats feature.

containerd shim:
- Stage container env in a rootfs file (BOX_EXEC_ENV_FILE) instead of
  inlining it: Kubernetes injects ~150 service env vars per pod, which
  overflow the guest kernel cmdline (COMMAND_LINE_SIZE) and silently
  break boot. Only a small pointer rides the cmdline now.
- Gate Task.wait()'s inspect-poll on the box being confirmed running:
  containerd calls Wait() concurrently with (and before) Start finishes,
  during which `inspect` returns "No such container"; treating that as a
  terminal exit made containerd kill the box it was still starting.
- Launch the box as a transient systemd unit so it runs under a clean
  rlimit/memlock context (libkrun must mlock guest RAM for KVM).
- Hold the CRI stdout/stderr FIFO write ends open so the task persists.

Also includes the network + block-IO stats feature for
`a3s-box stats/top/ps` (net_stats_path threaded through vmm/netproxy/passt).

Validated: kubectl exec end-to-end 4/4 on the production cluster; full
`src` workspace lib tests green (cargo test --workspace --lib).

Author: Roy Lin

containerd-shim/Cargo.toml

@@ -21,6 +21,7 @@ containerd-shim-protos = { version = "0.11", features = ["async"] }
 async-trait = "0.1"
 tokio = { version = "1", features = ["rt-multi-thread", "macros", "process", "sync", "io-util", "fs", "time"] }
 log = "0.4"
+libc = "0.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 

containerd-shim/src/logic.rs

@@ -39,18 +39,31 @@ pub fn parse_spec(spec: &Value) -> ParsedSpec {
         .and_then(|v| v.as_u64())
         .map(|b| (b / (1024 * 1024)).max(1));
     let cpus = match (
-        spec.pointer("/linux/resources/cpu/quota").and_then(|v| v.as_i64()),
-        spec.pointer("/linux/resources/cpu/period").and_then(|v| v.as_u64()),
+        spec.pointer("/linux/resources/cpu/quota")
+            .and_then(|v| v.as_i64()),
+        spec.pointer("/linux/resources/cpu/period")
+            .and_then(|v| v.as_u64()),
     ) {
         (Some(q), Some(p)) if q > 0 && p > 0 => Some(((q as f64 / p as f64).ceil()) as u32),
         _ => None,
     };
-    ParsedSpec { is_sandbox, image, args, env, cpus, memory_mb }
+    ParsedSpec {
+        is_sandbox,
+        image,
+        args,
+        env,
+        cpus,
+        memory_mb,
+    }
 }
 
 fn string_array(v: Option<&Value>) -> Vec<String> {
     v.and_then(|a| a.as_array())
-        .map(|a| a.iter().filter_map(|x| x.as_str().map(String::from)).collect())
+        .map(|a| {
+            a.iter()
+                .filter_map(|x| x.as_str().map(String::from))
+                .collect()
+        })
         .unwrap_or_default()
 }
 
@@ -63,12 +76,12 @@ pub fn run_args(
     env: &[String],
     cmd: &[String],
 ) -> Vec<String> {
-    let mut v = vec![
-        "run".to_string(),
-        "-d".to_string(),
-        "--name".to_string(),
-        id.to_string(),
-    ];
+    // Foreground `run` (no -d). This is launched as the main process of a transient
+    // systemd unit (see service.rs): foreground run blocks until the box exits, so
+    // the unit stays active for the container's whole life. A detached `run -d`
+    // would exit right after boot, the unit would deactivate, and that exit gets
+    // reported as the container exiting — tearing the task down seconds after start.
+    let mut v = vec!["run".to_string(), "--name".to_string(), id.to_string()];
     if let Some(c) = cpus {
         v.push("--cpus".to_string());
         v.push(c.to_string());
@@ -120,21 +133,6 @@ pub fn a3s_home() -> String {
     std::env::var("A3S_HOME").unwrap_or_else(|_| "/var/lib/a3s-box".to_string())
 }
 
-/// Numeric box status -> name (mirrors the protobuf Status enum we report).
-pub fn status_name(s: i32) -> &'static str {
-    match s {
-        1 => "created",
-        2 => "running",
-        3 => "stopped",
-        _ => "unknown",
-    }
-}
-
-/// Parse an exit code printed by `a3s-box wait` (its stdout is the integer code).
-pub fn parse_wait_exit_code(stdout: &str) -> u32 {
-    stdout.trim().parse::<i32>().unwrap_or(0) as u32
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -199,7 +197,7 @@ mod tests {
     fn run_args_minimal() {
         assert_eq!(
             run_args("box1", "alpine", None, None, &[], &[]),
-            vec!["run", "-d", "--name", "box1", "alpine"]
+            vec!["run", "--name", "box1", "alpine"]
         );
     }
 
@@ -216,8 +214,20 @@ mod tests {
         assert_eq!(
             v,
             vec![
-                "run", "-d", "--name", "box1", "--cpus", "2", "--memory", "256m", "-e", "A=1",
-                "redis:7", "--", "redis-server", "--port", "0"
+                "run",
+                "--name",
+                "box1",
+                "--cpus",
+                "2",
+                "--memory",
+                "256m",
+                "-e",
+                "A=1",
+                "redis:7",
+                "--",
+                "redis-server",
+                "--port",
+                "0"
             ]
         );
     }
@@ -247,23 +257,6 @@ mod tests {
         assert!(!is_running(""));
     }
 
-    #[test]
-    fn status_name_maps() {
-        assert_eq!(status_name(1), "created");
-        assert_eq!(status_name(2), "running");
-        assert_eq!(status_name(3), "stopped");
-        assert_eq!(status_name(0), "unknown");
-        assert_eq!(status_name(99), "unknown");
-    }
-
-    #[test]
-    fn parse_wait_exit_code_handles_garbage() {
-        assert_eq!(parse_wait_exit_code("0\n"), 0);
-        assert_eq!(parse_wait_exit_code("  137 "), 137);
-        assert_eq!(parse_wait_exit_code("notanumber"), 0);
-        assert_eq!(parse_wait_exit_code(""), 0);
-    }
-
     #[test]
     fn a3s_home_default() {
         // Default applies when unset (don't mutate global env in parallel tests).

containerd-shim/src/main.rs

@@ -21,5 +21,17 @@ use service::Service;
 
 #[tokio::main]
 async fn main() {
-    containerd_shim::asynchronous::run::<Service>("io.containerd.a3s-box.v2", None).await;
+    // Pass the Config via `opts` (NOT from Shim::new — the framework reads it to
+    // set up signals + subreaper BEFORE calling Shim::new, so changes there are
+    // no-ops). Disable the framework's child reaper and subreaper: it sets
+    // PR_SET_CHILD_SUBREAPER and a SIGCHLD `waitpid(-1)` loop that reaps the
+    // short-lived `a3s-box run -d` CLI and publishes a spurious container-exit
+    // seconds after start, making containerd kill the still-running box. We hold
+    // each task's process as a tokio Child and reap it ourselves in Task.wait().
+    let config = containerd_shim::Config {
+        no_reaper: true,
+        no_sub_reaper: true,
+        ..Default::default()
+    };
+    containerd_shim::asynchronous::run::<Service>("io.containerd.a3s-box.v2", Some(config)).await;
 }