amadan
cgroup: test a fallback that before refuses after agreeing at the shim (#272)
Whole-branch review triage. before agrees at the shim, the shim fails before exec, and before refuses at the flat PID-move fallback: nothing starts, nothing stays registered, the host dir is removed, and the start answers before's own error, not joined with the placement failure. Mutants that keep the dir or join the errors both fail it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+46
−0
internal/cgroup/cgroup_linux_test.go+46 −0
diff --git a/internal/cgroup/cgroup_linux_test.go b/internal/cgroup/cgroup_linux_test.go| index de01fb20b..60530fc39 100644 |
| --- a/internal/cgroup/cgroup_linux_test.go |
| +++ b/internal/cgroup/cgroup_linux_test.go |
| @@ -85,6 +85,52 @@ func TestFlatPlacementFailureFallsBackToPIDMove(t *testing.T) { |
| } |
| } |
| +// The fallback asks before again, and that second answer stands on its |
| +// own (whole-branch review triage): before agrees at the shim, the shim then |
| +// fails before exec, and before refuses at the PID-move fallback. Nothing |
| +// starts, the host dir this spawn made is removed, and the start answers |
| +// before's own error, unjoined with the placement failure. |
| +func TestFlatFallbackRefusedByBeforeStartsNothing(t *testing.T) { |
| + root := newDelegatedRoot(t) |
| + m, err := SetupAt(root, t.Logf) |
| + if err != nil { |
| + t.Fatal(err) |
| + } |
| + quietOOM(t) |
| + placementFailed := &placementError{errors.New("the shim exited before exec")} |
| + stubPlacement(t, func(_ *Manager, _ string, _ *exec.Cmd, before func() error) (bool, error) { |
| + if err := before(); err != nil { |
| + return true, err |
| + } |
| + return false, placementFailed |
| + }) |
| + calls := fakeStart(t, func(*exec.Cmd) error { return nil }) |
| + refusal := errors.New("ownership changed between the two attempts") |
| + builds, asked := 0, 0 |
| + cmd, err := m.StartGated("h.example.com", Limit{}, func() *exec.Cmd { builds++; return buildTrue() }, func() error { |
| + asked++ |
| + if asked == 1 { |
| + return nil |
| + } |
| + return refusal |
| + }) |
| + if cmd != nil || err != refusal { |
| + t.Fatalf("StartGated = %v, %v: want no command and before's own error, unjoined", cmd, err) |
| + } |
| + if errors.Is(err, placementFailed) || isPlacementError(err) { |
| + t.Fatalf("the refusal %v carries the placement failure", err) |
| + } |
| + if builds != 2 || asked != 2 || len(*calls) != 0 { |
| + t.Fatalf("built %d, asked %d, started %d: want two builds, two asks and nothing started", builds, asked, len(*calls)) |
| + } |
| + if n := m.placementsUnder(root); n != 0 { |
| + t.Fatalf("%d placements left registered", n) |
| + } |
| + if _, err := os.Stat(m.hostDir("h.example.com")); !os.IsNotExist(err) { |
| + t.Fatalf("host dir after a refused fallback: %v, want it removed", err) |
| + } |
| +} |
| + |
| // A failure that is the command's own (a missing binary) is returned as |
| // is, with no PID-move retry: a retry would fail the same way, and an |
| // uncertain start must never run a tenant twice. |