[johntmyers]

Summary

Release the network broker's descriptor after a successful listen so a listener disappears when its last workload descriptor closes or its owning process exits. Keep broker source sockets close-on-exec while preserving the workload's requested inheritance flags.

Related Issue

Closes #4407. Related duplicate: #4331.

Changes

• Make Listening registry entries metadata-only; preserve native repeated listen and Linux errors for bind/connect attempts on a listener.
• Create broker source sockets with SOCK_CLOEXEC, including the descriptor-exhaustion retry, independently of injected descriptor flags.
• Add four Linux regression tests and two Docker-capable CLI E2E tests covering close, exit, duplicate ownership, backlog changes, implicit/failed listen, IPv4/IPv6, accept, port reuse, and descriptor inheritance.
• Document socket descriptor ownership in the sandbox crate README.

Testing

• Rust formatting, diff checks, Linux-target sandbox Clippy and focused E2E Clippy pass with warnings denied.
• Unit tests added: all four new Linux tests pass; the focused network broker suite passes 38/38 under Docker's default seccomp profile as uid 1000.
• E2E tests added: both new CLI tests pass against an isolated Docker gateway using the branch-built static musl runtime. The lifetime test fails against the original docker-dev runtime at the stale LISTEN assertion.
• Static musl runtime and Linux/glibc test harness cross-compilation pass.
• The repository's full pre-commit hook passes, including workspace Clippy, sandbox perf-harness Clippy, lockfile checks, formatting, Markdown, license, Helm, Python, protobuf, and TypeScript checks.
• Full Linux library run: 244/245 pass. The existing AF_ALG-family test expects EAFNOSUPPORT, but Docker's outer seccomp filter returns EPERM; an unmediated native AF_ALG socket probe returns the same EPERM.
• Docker conformance file transfer (3), policy advisor (3), and smoke (1) pass. The stop/start scenario initially failed with ContainerExited; targeted reruns pass on both the original and fixed runtime images. The initial aggregate E2E command therefore exited nonzero before its focused Rust test stage; the new CLI tests were run separately and pass.
• The existing musl unit-test harness does not compile because of test-only libc ioctl/msghdr ABI assumptions; Linux/glibc tests were used. The shipped musl runtime builds successfully.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Crate documentation updated

The user's running docker-dev sandbox was left on its existing runtime. Validation used temporary gateways and sandboxes, which were cleaned up.

[github-actions]

Label test:e2e applied for 9520604. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[johntmyers]

gator-agent

PR Review Status

The independent review found no blocking issues in the listener ownership fix, close-on-exec handling, or added Linux and CLI regression coverage. The required E2E workflow has been rerun as instructed by E2E Label Help and is running on the current head.

Blocking findings: None.
Carried findings: None.

Gator metadata

• Validation: Focused sandbox bug fix for accepted issue bug(sandbox): a loopback listener keeps accepting connections after the workload closes it #4407; restores listener cleanup after the last workload descriptor closes or its owner exits.
• Docs: Crate README documents descriptor ownership. This restores native socket semantics without adding a new user workflow, configuration, or published API contract; no Fern update is needed.
• Checks: Current-head Branch Checks, Helm Lint, and Trivy Changes are green; E2E remains pending.
• E2E: test:e2e is applied. Branch E2E Checks run 38298088836, attempt 2, is running on the current head.
• Head SHA: 9520604c8b4ea22ae7754c60b970f84b48c93d63
• Base SHA: f6a39833c34f2ff9b74d07c8c87370f86ffc2a49
• Merge base SHA: e585b49173c70e28273c11bacb9f4b8f4df3b8e3
• Patch ID: 3684b4915f822ee4680de757c46f38c28ada0e5d
• Gator payload: 12
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:watch-pipeline

[johntmyers]

gator-agent

Monitoring Complete

Monitoring is complete because this PR has merged. The last Gator state was gator:merge-ready, and the independent review recorded no blocking findings.

I am removing the active gator:* label because there is nothing left for Gator to monitor on this PR.

Gator metadata

• Head SHA: 9520604c8b4ea22ae7754c60b970f84b48c93d63
• Gator payload: 12