cjagwani a991b8e369 fix(sandbox): preserve exec capacity under failure and load (#4324) ...

* fix(sandbox): reclaim failed exec waits

Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>

* test(e2e): cover exec recovery after policy denial

Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>

* fix(sandbox): preserve live descriptor headroom

Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>

* fix(sandbox): reclaim descriptors before exec

Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>

* fix(sandbox): separate exec and socket capacity

Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>

* fix(sandbox): stream Landlock baseline entries

Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>

---------

Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>

2026-10-09 01:26:31 +00:00

..

gpu

test(e2e): keep lifecycle sandboxes running (#3128)

2026-09-02 18:58:02 +00:00

bypass_detection.rs

feat(isolation): implement the RFC 0012 sandbox architecture (#2942)

2026-09-16 00:49:14 +00:00

core_dump_hardening.rs

fix(sandbox): disable child core dumps (#821)

2026-04-14 22:28:18 -07:00

credential_drivers.rs

fix(e2e): repair the credential driver test (#3565)

2026-09-22 20:55:04 +00:00

credential_gating.rs

feat(cli): promote profile commands to top level (#3258)

2026-09-21 17:18:55 +00:00

custom_image.rs

feat(isolation): implement the RFC 0012 sandbox architecture (#2942)

2026-09-16 00:49:14 +00:00

default_image.rs

refactor(runtime): retire Community image dependencies (#3386)

2026-09-22 14:43:51 +02:00

docker_corporate_proxy.rs

feat(docker): support corporate proxy CA bundles (#3549)

2026-09-29 05:15:02 +00:00

docker_preflight.rs

refactor(cli): remove gateway lifecycle management (#1221)

2026-05-07 09:54:13 -07:00

driver_config_volume.rs

fix(podman): restore host gateway alias mediation (#3606)

2026-09-24 18:41:59 +00:00

edge_tunnel_e2e.rs

fix(tasks): format all Rust workspaces (#2268)

2026-07-14 17:37:38 +00:00

ephemeral_cleanup.rs

fix(gateway): delete finalized ephemeral sandboxes while connected (#3984)

2026-10-01 00:09:08 +00:00

forward_proxy_graphql_l7.rs

feat(isolation): implement the RFC 0012 sandbox architecture (#2942)

2026-09-16 00:49:14 +00:00

forward_proxy_jsonrpc_l7.rs

feat(isolation): implement the RFC 0012 sandbox architecture (#2942)

2026-09-16 00:49:14 +00:00

forward_proxy_l7_bypass.rs

feat(isolation): implement the RFC 0012 sandbox architecture (#2942)

2026-09-16 00:49:14 +00:00

gateway_start.rs

feat(isolation): implement the RFC 0012 sandbox architecture (#2942)

2026-09-16 00:49:14 +00:00

gpu.rs

test(e2e): run gpu workloads from manifest (#1709)

2026-06-30 09:54:12 +02:00

host_gateway_alias.rs

fix(podman): restore host gateway alias mediation (#3606)

2026-09-24 18:41:59 +00:00

internet_network_perf.rs

feat(isolation): implement the RFC 0012 sandbox architecture (#2942)

2026-09-16 00:49:14 +00:00

kubernetes_corporate_proxy.rs

feat(kubernetes): support corporate proxy CA bundle (#3447)

2026-09-22 17:57:40 +00:00

kubernetes_ha_rebalancing.rs

feat(kubernetes): support HA gateway rebalancing (#1868)

2026-09-21 21:22:12 +00:00

landlock.rs

fix(supervisor): tailor Landlock rights by inode type (#2380)

2026-07-21 03:59:02 +00:00

live_internet_traffic_perf.rs

feat(isolation): implement the RFC 0012 sandbox architecture (#2942)

2026-09-16 00:49:14 +00:00

live_policy_update.rs

test(e2e): run podman suite with tmachine (#3637)

2026-09-28 11:15:33 +00:00

local_driver_token_restart.rs

test(podman): close rootful userns, resource-limit, and daemon-failure CI gaps (#3690)

2026-09-24 20:16:29 -07:00

mcp_sessionless.rs

feat(mcp): inspect requests with Tower-selected protocol profiles (#3335)

2026-09-28 20:48:50 +00:00

no_proxy.rs

feat(isolation): implement the RFC 0012 sandbox architecture (#2942)

2026-09-16 00:49:14 +00:00

ocsf_console.rs

feat(ocsf): emit full JSON records to supervisor stderr (#4323)

2026-10-08 05:36:19 +00:00

oidc_pkce.rs

refactor(providers)!: make provider profiles import-only (#3383)

2026-09-17 22:59:27 +00:00

podman_corporate_proxy.rs

fix(podman): restore host gateway alias mediation (#3606)

2026-09-24 18:41:59 +00:00

podman_gateway_start.rs

fix(drivers): normalize label namespace (#3609)

2026-09-23 14:30:27 +00:00

podman_host_gateway.rs

fix(podman): restore host gateway alias mediation (#3606)

2026-09-24 18:41:59 +00:00

podman_oci_identity.rs

feat(podman): honor OCI image working directories (#3982)

2026-10-07 21:29:58 +00:00

podman_resource_limits.rs

test(podman): close rootful userns, resource-limit, and daemon-failure CI gaps (#3690)

2026-09-24 20:16:29 -07:00

policy_activation.rs

feat(sandbox): validate configuration before workload activation (#3259)

2026-09-18 00:16:18 +00:00

port_forward.rs

fix(tasks): format all Rust workspaces (#2268)

2026-07-14 17:37:38 +00:00

provider_auto_create.rs

fix(podman): restore host gateway alias mediation (#3606)

2026-09-24 18:41:59 +00:00

provider_files.rs

fix(sandbox): restrict provider file mode (#4093)

2026-10-02 06:35:15 +00:00

provider_readiness.rs

fix(e2e): override provider readiness supervisor image via environment (#4207)

2026-10-05 17:54:48 +00:00

provider_refresh_handles.rs

fix(podman): restore host gateway alias mediation (#3606)

2026-09-24 18:41:59 +00:00

provider_token_exchange.rs

fix(providers): prepare dynamic credentials across HTTP relay paths (#4152)

2026-10-07 23:48:40 +00:00

proxy_egress_pipeline.rs

fix(network): honor HTTP response connection closure (#3581)

2026-09-23 12:01:46 -07:00

rootfs_tar.rs

feat(sandbox): support rootfs tar as --from source for VM driver (#2863)

2026-09-08 22:36:40 +00:00

sandbox_labels.rs

fix(e2e): stop sandbox leaks from async Drop cleanup (#3750)

2026-09-29 10:10:29 +00:00

sandbox_lifecycle.rs

fix(compute): revalidate late exit events after restart (#4235)

2026-10-06 15:25:53 +00:00

sandbox_templates.rs

feat(server): add sandbox templates (#2833)

2026-09-02 00:55:29 +00:00

service_bearer_passthrough.rs

refactor(auth): separate sandbox identity from TLS (#3110)

2026-10-01 04:33:25 +00:00

settings_management.rs

fix(tasks): format all Rust workspaces (#2268)

2026-07-14 17:37:38 +00:00

ssh_host_identity.rs

fix(ssh): persist sandbox host identities (#4094)

2026-10-06 20:09:20 +00:00

transparent_tcp.rs

fix(sandbox): preserve exec capacity under failure and load (#4324)

2026-10-09 01:26:31 +00:00

upload_create.rs

fix(tasks): format all Rust workspaces (#2268)

2026-07-14 17:37:38 +00:00

user_namespaces.rs

feat(isolation): implement the RFC 0012 sandbox architecture (#2942)

2026-09-16 00:49:14 +00:00

vm_corporate_proxy.rs

fix(e2e): reserve distinct corporate proxy fixture ports (#3761)

2026-09-28 07:10:23 +00:00

vm_gateway_start.rs

refactor(compute): unify gateway restart reconciliation (#2743)

2026-08-20 10:12:41 +00:00

vm_overlay.rs

fix(vm): reject conflicting workload identity selectors (#4036)

2026-10-03 20:03:39 +00:00

websocket_conformance.rs

feat(cli): promote profile commands to top level (#3258)

2026-09-21 17:18:55 +00:00

workspace_lifecycle.rs

feat(providers): make profiles authoritative (#2962)

2026-09-01 19:22:07 +00:00

workspace_namespace_managed.rs

fix(helm)!: reduce gateway Secret privileges (#3616)

2026-09-23 21:35:22 +00:00

workspace_namespace_operator.rs

fix(helm)!: reduce gateway Secret privileges (#3616)

2026-09-23 21:35:22 +00:00