[bug-bash] Track gVisor / microVM parity gaps for 1.0 #3226

Since #2780 a template doesn't pick its sandbox class, so these show up as the same template behaving differently depending on where it lands. We should fix or document each before 1.0.

Found with an AI-assisted sweep of both workers. Links are pinned to 93ec720, kata 4.3.1 and gVisor release-20261019.0.

Behavior Changes

rc1 is cut, so these need an exception now, otherwise we document them:

• Same /dev/shm, /run and /tmp on both. [M3]
  • microVM swaps our mounts for kata's set, with a 64MiB tmpfs on /dev/shm and on /run (microvm.go). gVisor gets runsc's devfs, where shm is a plain 0755 directory (dev.go), and runsc's own tmpfs on /tmp when the image's /tmp is empty (vfs.go). Existing MEMORY snapshots and goldens would need recutting.
  • Documented in docs: document sandbox class differences and fix stale passages #3468, no fix PR.
• Reject unknown capability names at admission. [M3]
  • We only check the shape (validate.go), and kata-agent panics on a name it can't parse (trans.rs). Should drop be validated too? An unknown name there is a no-op today (oci.go), so rejecting it is breaking, but a typo silently leaves the capability granted.
  • [bug bash] Unknown Linux capability names in an ActorTemplate are rejected at admission #3487, which validates drop too. Merged, needs a cherry-pick to release-1.0.
• Handle VOLUMES fidelity without a durable dir. [M3?]
  • gVisor fails the checkpoint (main.go) and crashes the actor, including goldens since Run golden snapshots in the template's atespace #2543. microVM writes an empty snapshot for CSI-only (checkpoint.go). The worker fix is a bugfix.
  • ateworker: write an empty VOLUMES snapshot without durable-dir volumes #3343 writes an empty snapshot on both. ateapi: reject VOLUMES snapshots without supported volume mounts #1972 was closed in favor of it, see also Reject ActorTemplates with unmounted volumes #3096 and Actor with DATA scope but no durable-dir volumes fail to suspend / pause #1936.

Bugfixes

rc1 is cut, so these also need a cherry-pick to release-1.0:

• microVM: close the container's stdin. [v1.0.x]
  • kata-agent creates a stdin pipe for every non-tty process and keeps the write end (process.rs), and we never call CloseStdin, so reading stdin blocks forever. gVisor gets /dev/null.
  • microVM: close the container's stdin before start #3265
• microVM: forward container logs as each container starts. [v1.0.x]
  • Today forwarding starts only after the wakeup probe passes (run.go, L630).
  • [Bug Bash] microVM: show container logs from before the wakeup probe passes #3263
• microVM: set masked and read-only paths like containerd's defaults. [M3]
  • We set none, so specconv forwards empty lists (specconv.go) and a uid 0 container can write the guest's /proc/sys (proc_sysctl.c).
  • [Bug Bash] microVM: set containerd's default masked and read-only paths #3249
• microVM: pass the pids limit to the guest. [v1.0.x]
  • mergeKataResources keeps it (microvm.go), but specconv only converts devices, memory and CPU (specconv.go).
  • Needs libs: Keep the pids limit when converting LinuxResources kata-containers/kata-containers#14141 and a kata release first.
• microVM: sysctls and privileged ports. [M3]
  • microvm: forward sysctls and lift the guest's privileged-port limit to match gVisor #1904
• gVisor: / is 0700. [v1.0.x]
  • Run containers as the image's USER and WORKDIR, with layer file owners kept #2392 sets the bundle's upper and rootfs to 0755, which should fix it. Once that's confirmed on gVisor we can close Actor rootfs / is mode 0700, so non-root users cannot traverse the root filesystem #2035 and Non-root actor workloads can traverse the root filesystem #2430.
• gVisor: make the durable dir root 0777, as the API guide says. [v1.0.x]
  • It's 01777 today. The mount hint has no mode (gvisor.go), so it gets the tmpfs default (tmpfs.go).
  • ocispec: make gVisor durable directory root mode 0777 #3457
• gVisor: stop leaving sandboxes behind. [v1.0.x]
  • A re-hosted actor's old sandbox keeps running, and a crash leaves the sandbox behind, A crash leaves the actor's sandbox running on its worker; a gVisor re-host then loses track of it #2355.
  • Checking whether this needs a gVisor fix.
• gVisor: bound runsc kill during drain. [v1.0.x]
  • It has no timeout (main.go), microVM uses 10s (shutdown.go).
  • ateworker: share SignalDeliveryTimeout and bound runsc kill in gVisor shutdown #3248
• Tests: compare both shaped specs in parity_test.go. [whenever]
  • Against a list of intended differences, so new ones fail the test.
  • No PR yet.

Decide Or Document

Docs and tests can land after rc1:

• gVisor VOLUMES and ROOTFS snapshots across runsc versions.
  • They're runsc fscheckpoint bundles, restored by whatever runsc the worker has, and the skew policy says a restore across runtime versions keeps the file systems (version-skew-policy.md). We need gVisor to commit to that format, or we change the policy.
  • docs: document sandbox class differences and fix stale passages #3468 documents that substrate doesn't check this and a failed restore crashes the actor.
• CPU count.
  • runsc floors at 2 (sandbox.go), microVM is ceil(cpu), so a 500m actor sees 2 vs 1.
  • Documented in docs: document sandbox class differences and fix stale passages #3468.
• NET_RAW.
  • runsc strips it by default (flags.go), microVM grants it.
  • Documented in docs: document sandbox class differences and fix stale passages #3468.
• Docs: a page on what differs between sandbox classes.
  • Plus fixing the stale passages, docs: document sandbox class differences and fix stale passages #3468.

Already Fixed

• make gVisor write resolv.conf into the rootfs like micro-VM #2763 (write resolv.conf into the gVisor rootfs like micro-VM #2765)
• [bug] single character container names break microvm actors #2800 ([bug] fix microVM actors with one character container names #2801)
• ROOTFS on gVisor (Support splitting container rootfs and SNAPSHOT_FIDELITY_ROOTFS on gVisor #2673)
• ROOTFS fallback (ateapi: Downgrade runtime-incompatible durable resumes to ROOTFS #2880)
• sandbox death reporting (report actors whose sandbox dies on its own as crashed #2695)
• CRNG reseed timeout (ateworker-microvm: give the guest CRNG reseed 60s on restore #2743)