use chroot/umount/pivotroot instead of jailing (#2091)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>

Author: 3 people

.mockery.yaml

@@ -59,43 +59,6 @@ packages:
           filename: mockstorageprovider.go
           pkgname: providermocks
 
-  github.com/e2b-dev/infra/packages/orchestrator/internal/sandbox/build:
-    interfaces:
-      Diff:
-        config:
-          dir: packages/orchestrator/internal/sandbox/build/mocks
-          filename: mockdiff.go
-          pkgname: buildmocks
-
-  github.com/e2b-dev/infra/packages/orchestrator/internal/sandbox/block:
-    interfaces:
-      ReadonlyDevice:
-        config:
-          dir: packages/orchestrator/internal/sandbox/block/mocks
-          filename: mockreadonlydevice.go
-          pkgname: blockmocks
-
-  github.com/e2b-dev/infra/packages/orchestrator/internal/sandbox/template/peerserver:
-    interfaces:
-      Cache:
-        config:
-          dir: packages/orchestrator/internal/sandbox/template/peerserver/mocks
-          filename: mockcache.go
-          pkgname: peerservermocks
-
-  github.com/e2b-dev/infra/packages/orchestrator/internal/sandbox/template:
-    interfaces:
-      Template:
-        config:
-          dir: packages/orchestrator/internal/sandbox/template/mocks
-          filename: mocktemplate.go
-          pkgname: templatemocks
-      File:
-        config:
-          dir: packages/orchestrator/internal/sandbox/template/mocks
-          filename: mockfile.go
-          pkgname: templatemocks
-
 
   io:
     interfaces:
@@ -121,29 +84,3 @@ packages:
           filename: mockfeatureflagsclient.go
           pkgname: handlersmocks
           structname: MockFeatureFlagsClient
-
-  github.com/willscott/go-nfs:
-    interfaces:
-      Handler:
-        config:
-          dir: packages/orchestrator/internal/nfsproxy/mocks
-          filename: nfshandler.go
-          pkgname: nfsproxymocks
-
-  github.com/go-git/go-billy/v5:
-    interfaces:
-      Change:
-        config:
-          dir: packages/orchestrator/internal/nfsproxy/mocks
-          filename: billychange.go
-          pkgname: nfsproxymocks
-      File:
-        config:
-          dir: packages/orchestrator/internal/nfsproxy/mocks
-          filename: billyfile.go
-          pkgname: nfsproxymocks
-      Filesystem:
-        config:
-          dir: packages/orchestrator/internal/nfsproxy/mocks
-          filename: billyfs.go
-          pkgname: nfsproxymocks

iac/modules/job-orchestrator/jobs/orchestrator.hcl

@@ -119,6 +119,13 @@ job "orchestrator-${latest_orchestrator_job_id}" {
 %{ if persistent_volume_mounts != "" }
         PERSISTENT_VOLUME_MOUNTS     = "${persistent_volume_mounts}"
 %{ endif }
+
+%{ for key, value in job_env_vars }
+  %{ if value != "" }
+        ${ key } = "${ value }"
+  %{ endif }
+%{ endfor }
+
       }
 
       config {

iac/modules/job-orchestrator/main.tf

@@ -31,6 +31,7 @@ locals {
     artifact_source = var.artifact_source
 
     use_local_namespace_storage = var.use_local_namespace_storage
+    job_env_vars                = var.job_env_vars
   }
 
   # Render with placeholder to detect changes in job definition

iac/modules/job-orchestrator/variables.tf

@@ -143,3 +143,8 @@ variable "persistent_volume_mounts" {
   type    = map(string)
   default = {}
 }
+
+variable "job_env_vars" {
+  type    = map(string)
+  default = {}
+}

iac/provider-gcp/main.tf

@@ -61,25 +61,39 @@ locals {
   // Check if all clusters has size greater than 1
   template_manages_clusters_size_gt_1 = alltrue([for c in var.build_clusters_config : (c.cluster_size > 1)])
 
+  // for more docs, see https://linux.die.net/man/5/nfs
+  default_persistent_volume_type_nfs_mount_options = [
+    // network
+    "hard",       // retry nfs requests indefinitely until they succeed, never fail
+    "async",      // write eventually
+    "nconnect=7", // use multiple connections
+    "noresvport", // use a non-privileged source port
+    "retrans=3",  // retry two times before performing recovery actions
+    "timeo=600",  // wait 60 seconds (measured in deci-seconds) before retrying a failed request
+
+    // resiliency
+    "fg",              // wait for mounts to finish before exiting
+    "cto",             // enable "close-to-open" attribute checks
+    "lock",            // enable network locking
+    "local_lock=none", // all locks are network locks
+
+    // caching
+    "noac",             // disable attribute caching. slower, but more reliable
+    "lookupcache=none", // disable lookup caching
+
+    // security
+    "noacl",   // do not use an acl
+    "sec=sys", // use AUTH_SYS for all requests
+  ]
+
   persistent_volume_types = {
     for key, config in var.persistent_volume_types : key => {
       local_mount_path = "/mnt/persistent-volume-types/${key}"
       nfs_location     = module.persistent-volume-types[key].nfs_location
-      nfs_mount_opts = join(",", [ // for more docs, see https://linux.die.net/man/5/nfs
-        format("nfsvers=%s", module.persistent-volume-types[key].nfs_version),
-        "sync",             // write immediately
-        "hard",             // retry nfs requests indefinitely until they succeed, never fail
-        "lookupcache=none", // disable the lookup cache
-        "nconnect=7",       // use multiple connections
-        "noac",             // disable attribute cache
-        "noacl",            // do not use an acl
-        "cto",              // enable "close-to-open" attribute checks
-        "nolock",           // do not use locking
-        "noresvport",       // use a non-privileged source port
-        "retrans=2",        // retry two times before performing recovery actions
-        "sec=sys",          // use AUTH_SYS for all requests
-        "timeo=600",        // wait 60 seconds (measured in deci-seconds) before retrying a failed request
-      ])
+      nfs_mount_opts = join(",", concat(
+        [format("nfsvers=%s", module.persistent-volume-types[key].nfs_version)],
+        config.mount_options != null ? config.mount_options : local.default_persistent_volume_type_nfs_mount_options,
+      ))
     }
   }
 }
@@ -272,6 +286,7 @@ module "nomad" {
   envd_timeout                   = var.envd_timeout
   persistent_volume_mounts       = { for key, config in local.persistent_volume_types : key => config["local_mount_path"] }
   default_persistent_volume_type = var.default_persistent_volume_type
+  orchestrator_env_vars          = var.orchestrator_env_vars
 
   # Template manager
   builder_node_pool                   = var.build_node_pool

iac/provider-gcp/nomad/main.tf

@@ -434,6 +434,8 @@ module "orchestrator" {
   domain_name             = var.domain_name
   shared_chunk_cache_path = var.shared_chunk_cache_path
   launch_darkly_api_key   = trimspace(data.google_secret_manager_secret_version.launch_darkly_api_key.secret_data)
+
+  job_env_vars = var.orchestrator_env_vars
 }
 
 data "google_storage_bucket_object" "template_manager" {

iac/provider-gcp/nomad/variables.tf

@@ -477,3 +477,8 @@ variable "gcs_grpc_connection_pool_size" {
   description = "Number of gRPC connections in the GCS connection pool"
   type        = number
 }
+
+variable "orchestrator_env_vars" {
+  type    = map(string)
+  default = {}
+}

iac/provider-gcp/persistent-volume-types/main.tf

@@ -21,4 +21,13 @@ resource "google_filestore_instance" "persistent-volumes" {
     modes   = ["MODE_IPV4"]
     network = var.network_name
   }
+
+  dynamic "performance_config" {
+    for_each = var.performance_config == null ? [] : [var.performance_config]
+    content {
+      fixed_iops {
+        max_iops = performance_config.value.max_iops
+      }
+    }
+  }
 }

iac/provider-gcp/persistent-volume-types/variables.tf

@@ -37,3 +37,10 @@ variable "capacity_gb" {
 variable "network_name" {
   type = string
 }
+
+variable "performance_config" {
+  type = object({
+    max_iops = optional(number)
+  })
+  default = null
+}

iac/provider-gcp/persistent-volumes.tf

@@ -3,12 +3,13 @@ module "persistent-volume-types" {
 
   for_each = var.persistent_volume_types
 
-  allow_deletion = each.value.allow_deletion
-  capacity_gb    = each.value.capacity_gb
-  key            = each.key
-  location       = each.value.location
-  network_name   = var.network_name
-  nfs_version    = each.value.nfs_version
-  prefix         = var.prefix
-  tier           = each.value.tier
+  allow_deletion     = each.value.allow_deletion
+  capacity_gb        = each.value.capacity_gb
+  key                = each.key
+  location           = each.value.location
+  network_name       = var.network_name
+  nfs_version        = each.value.nfs_version
+  prefix             = var.prefix
+  tier               = each.value.tier
+  performance_config = each.value.performance_config
 }