add hack tool to run Substrate against a locally-built runsc - #726
add hack tool to run Substrate against a locally-built runsc#726Jing (milantracy) wants to merge 2 commits into
Conversation
| hack/gvisor-hack/stage-to-gcs.sh | ||
| fi | ||
|
|
||
| # Two defaults for one sandbox class make every actor launch fail to resolve its |
There was a problem hiding this comment.
🤖 should-fix 🟡 – Demoting before applying swaps a two-default cluster for a zero-default one, and if the apply on line 130 fails the cluster stays that way. TestResolveSandboxAssetsErrors pins both as failures ("multiple default SandboxConfigs" and "no default SandboxConfig"), so every gVisor pool relying on the default stops resolving assets either way — but the two-default window closes on the next patch, while a failed apply leaves zero defaults until someone notices.
That is reachable: NAME is an unvalidated env var, so a name the API server rejects gets you there, as does any transient apply failure. The script exits on the apply error without mentioning that it just cleared gvisor-default, and the README's Reverting section only covers the success path.
A server-side dry run before the demote loop would close it — the ValidatingAdmissionPolicy runs under --dry-run=server, so the config is known good before the incumbent is touched.
atelet fetches runsc at runtime from a url + sha256 on a cluster-scoped SandboxConfig, so trying an unreleased build needs no image rebuild — but there was no supported way to stage one, and the resolution path it would rely on was untested. hack/gvisor-hack/ adds it, modelled on hack/microvm-assets/: deploy.sh hashes a local runsc, stages it (rustfs on kind, GCS on GKE), applies a SandboxConfig pinning it, and optionally repoints a WorkerPool. gvisor-default is left untouched; pools opt in via sandboxConfigName. Objects are content-addressed so a rebuild cannot serve new bytes behind an old digest, and MAKE_DEFAULT demotes the incumbent default first, since two defaults for one class break asset resolution.
2 participants
atelet fetches runsc at runtime from a url + sha256 on a cluster-scoped SandboxConfig, so trying an unreleased build needs no image rebuild — but there was no supported way to stage one, and the resolution path it would rely on was untested.
the tool is modelled on hack/microvm-assets/: deploy.sh hashes a local runsc, stages it (rustfs on kind, GCS on GKE), applies a SandboxConfig pinning it, and optionally repoints a WorkerPool. gvisor-default is left untouched; pools opt in via sandboxConfigName.
So an unreleased gVisor feature can be tested in a cluster without hand-staging binaries or hand-writing a SandboxConfig.