Backend handlers now return errors through a shared apperr catalog
instead of ad-hoc strings, so every error has a stable code, a
human message, and a request ID. The frontend API client understands
this new error shape and surfaces the code/request ID to callers so
error messages (and support requests) are more useful.
envd (0.6.0):
- Run blocking syscalls (sync/drop_caches, directory walks and
removals, stdin/pty writes) on the blocking pool so health checks
and exec streams don't stall during snapshot quiesce or large-tree
operations
- Stop writing sandbox metadata into envd's own environment at init;
it was undefined behavior with the async runtime running
- Retry a memory preload that previously failed or was cancelled
instead of blocking every future pause until the next init
- Match RAM ranges against kernel core segments on page boundaries so
preload no longer rejects kernels with unaligned low-memory ranges
- Tolerate a concurrent request creating a directory first
host agent:
- Detach the copy-on-write loop device when snapshot removal fails so
deleting its backing file can no longer orphan it permanently
- Clean the sandbox directory on pause rollback, and skip paused
restore for directories still owned by a live VM that failed to
re-attach
Snapshotting or pausing a sandbox restored with
memory_restore_mode=ondemand silently zeroed all never-faulted guest
memory: envd's preload walked the vmalloc region instead of physical
RAM (/proc/kcore exposes one PT_LOAD per RAM range, never one segment
covering all of RAM), so no pages were materialised and ch.snapshot
wrote holes that read back as zeros on the next restore.
- match kcore segments to /proc/iomem ranges via a derived direct-map
base; hard-error instead of walking the wrong segment
- guard preload state with a lifecycle generation so a loader thread
frozen across pause/resume cannot publish a stale "done"
- verify preload against envd before pause/snapshot: self-heal from
idle, hard-fail on failure; persist the lazy-restore flag so the
guard survives host-agent restarts and re-attach
- fix loop refcount double-release on pause-then-destroy that detached
the shared base image under sibling sandboxes
- release runtime resources when a VM dies mid-pause
- detach CoW loops before deleting their backing files; never release
a live CH process's slot or loop on a failed re-attach
Guest images must be rebuilt (scripts/update-minimal-rootfs.sh);
snapshots taken before this fix carry the old envd and stay unsafe.
Relocate the sandbox runtime (sandbox, vm, network, devicemapper,
envdclient, layout, models) from internal/ to pkg/ so external
consumers like the wr CLI can embed the orchestration layer without
a control plane. Add cross-process re-attach support for running
sandboxes (state files, restore_running) and bump agent/cp versions.
