fix(node): handle linked exits in trap_exit device servers

ThinPool, Img.Server, Layer.Server and Img.Mutable each run privileged
commands through `System.cmd`, which links a transient port to the caller
and returns only once the command has finished. Because these servers trap
exits (for `terminate/2` teardown), the now-defunct port's exit is then
delivered as `{:EXIT, port, :normal}` (empirically always `:normal` -- the
port closes cleanly even when the command is SIGKILLed). None of these
servers define a catch-all handle_info, so an unmatched `{:EXIT, ...}`
raised a FunctionClauseError and crash-looped the server -- Layer.Server
crashed while mounting a layer, which surfaced to create_vm as
:no_capacity.

Handle the EXIT class exhaustively:

  * `{:EXIT, port, _}` when is_port(port) -> ignore. The synchronous
    `System.cmd` already consumed the command's result, so the trailing
    port exit is stale by construction whatever its reason.
  * `{:EXIT, _pid, reason}` -> {:stop, reason, state}. No process is
    deliberately linked here beyond those command ports, so a linked
    process exit is a genuine fault: propagate its real reason (terminate/2
    still runs teardown) instead of crashing opaquely on an unmatched
    message.

Author: markovejnovic

lib/hyper/node/img/mutable.ex

@@ -119,6 +119,20 @@ defmodule Hyper.Node.Img.Mutable do
   @impl true
   def handle_info(:idle_timeout, state), do: {:noreply, state}
 
+  @impl true
+  # Each privileged command runs through `System.cmd`, which links a transient
+  # port to this process and returns only once that command has finished. Because
+  # we trap exits (for `terminate/2` teardown), the now-defunct port's exit lands
+  # here afterwards -- stale by construction, whatever its reason -- so ignore it.
+  def handle_info({:EXIT, port, _reason}, state) when is_port(port), do: {:noreply, state}
+
+  @impl true
+  # No process is deliberately linked here beyond those transient command ports,
+  # so a linked *process* EXIT is a genuine fault: propagate its reason (so
+  # terminate/2 still runs teardown) rather than crash opaquely on an unmatched
+  # message.
+  def handle_info({:EXIT, _pid, reason}, state), do: {:stop, reason, state}
+
   @impl true
   def terminate(_reason, state) do
     # Destroy the thin volume, then release the image (its monitor on us also

lib/hyper/node/img/server.ex

@@ -128,6 +128,20 @@ defmodule Hyper.Node.Img.Server do
     {:noreply, state}
   end
 
+  @impl true
+  # Each privileged command runs through `System.cmd`, which links a transient
+  # port to this process and returns only once that command has finished. Because
+  # we trap exits (for `terminate/2` teardown), the now-defunct port's exit lands
+  # here afterwards -- stale by construction, whatever its reason -- so ignore it.
+  def handle_info({:EXIT, port, _reason}, state) when is_port(port), do: {:noreply, state}
+
+  @impl true
+  # No process is deliberately linked here beyond those transient command ports,
+  # so a linked *process* EXIT is a genuine fault: propagate its reason (so
+  # terminate/2 still runs teardown) rather than crash opaquely on an unmatched
+  # message.
+  def handle_info({:EXIT, _pid, reason}, state), do: {:stop, reason, state}
+
   @impl true
   def terminate(_reason, %State{dm_names: dm_names}) do
     # Remove top-down (a snapshot's origin is the device below it). Layers are

lib/hyper/node/img/thin_pool.ex

@@ -94,6 +94,20 @@ defmodule Hyper.Node.Img.ThinPool do
     {:reply, :ok, id_free(state, id)}
   end
 
+  @impl true
+  # Each privileged command runs through `System.cmd`, which links a transient
+  # port to this process and returns only once that command has finished. Because
+  # we trap exits (for `terminate/2` teardown), the now-defunct port's exit lands
+  # here afterwards -- stale by construction, whatever its reason -- so ignore it.
+  def handle_info({:EXIT, port, _reason}, state) when is_port(port), do: {:noreply, state}
+
+  @impl true
+  # No process is deliberately linked here beyond those transient command ports,
+  # so a linked *process* EXIT is a genuine fault: propagate its reason (so
+  # terminate/2 still runs teardown) rather than crash opaquely on an unmatched
+  # message.
+  def handle_info({:EXIT, _pid, reason}, state), do: {:stop, reason, state}
+
   @impl true
   def terminate(_reason, state) do
     _ = SuidHelper.Dmsetup.remove(@pool_name)

lib/hyper/node/layer/server.ex

@@ -119,6 +119,20 @@ defmodule Hyper.Node.Layer.Server do
     {:noreply, state}
   end
 
+  @impl true
+  # Each privileged command runs through `System.cmd`, which links a transient
+  # port to this process and returns only once that command has finished. Because
+  # we trap exits (for `terminate/2` teardown), the now-defunct port's exit lands
+  # here afterwards -- stale by construction, whatever its reason -- so ignore it.
+  def handle_info({:EXIT, port, _reason}, state) when is_port(port), do: {:noreply, state}
+
+  @impl true
+  # No process is deliberately linked here beyond those transient command ports,
+  # so a linked *process* EXIT is a genuine fault: propagate its reason (so
+  # terminate/2 still runs teardown) rather than crash opaquely on an unmatched
+  # message.
+  def handle_info({:EXIT, _pid, reason}, state), do: {:stop, reason, state}
+
   @impl true
   def terminate(_reason, %State{blk_path: blk_path}) do
     case SuidHelper.Losetup.detach(blk_path) do