fixup! fix(orchestrator): enforce sandbox TTL on the node via WaitForExit

Author: adababys

packages/orchestrator/pkg/sandbox/sandbox.go

@@ -1721,7 +1721,8 @@ func (s *Sandbox) WaitForExit(ctx context.Context) error {
 	defer span.End()
 
 	for {
-		timeout := time.Until(s.GetEndAt())
+		endAt := s.GetEndAt()
+		timeout := time.Until(endAt)
 		if timeout <= 0 {
 			return errors.New("sandbox TTL expired")
 		}
@@ -1730,7 +1731,7 @@ func (s *Sandbox) WaitForExit(ctx context.Context) error {
 		select {
 		case <-timer.C:
 			// Re-check in case SetEndAt extended the deadline (e.g. via KeepAlive).
-			if time.Until(s.GetEndAt()) > 0 {
+			if s.GetEndAt().After(endAt) {
 				continue
 			}
 			return errors.New("waiting for exit took too long")

packages/orchestrator/pkg/server/sandboxes.go

@@ -1043,7 +1043,7 @@ func (s *Server) setupSandboxLifecycle(ctx context.Context, sbx *sandbox.Sandbox
 
 		waitErr := sbx.WaitForExit(ctx)
 		if waitErr != nil {
-			sbxlogger.I(sbx).Error(ctx, "sandbox TTL expired, stopping", zap.Error(waitErr))
+			sbxlogger.I(sbx).Error(ctx, "sandbox exit wait failed, stopping", zap.Error(waitErr))
 			if stopErr := sbx.Stop(ctx); stopErr != nil {
 				sbxlogger.I(sbx).Error(ctx, "failed to stop timed-out sandbox", zap.Error(stopErr))
 			}