Root-cause and fix the four reported container regressions plus two
adjacent confirmed bugs.
- Memory balloon (CPU 100% + output freeze that never recovered): the
autoballoon drove the whole-VM target from a per-container cgroup figure
with no guest swap, spinning a swapless guest in perpetual direct
reclaim. Default memoryManagement to off; make the target whole-VM-aware
(reserveBytes) so it never inflates below the working set plus the
guest's non-cgroup footprint; deflate the balloon on a failed stats read
instead of freezing it inflated.
- Stop button: signal the agent's whole process group (new vendored
LinuxProcess.killProcessGroup, negative pid) so forked children die too;
replace the unbounded wait() in every teardown/shutdown with a bounded
terminate() that escalates SIGTERM -> SIGKILL; interrupt escalates to a
group kill so a wedged agent always stops.
- MCPApprovalServer port-0 race: single-flight start(host:) so concurrent
sessions sharing one control-container server all receive the real bound
port; publish listener+port only after .ready (a failed bind no longer
pins a stale port 0); guard the Claude call site against port 0.
- Container CPU metric: divide the CPU delta by the actual measured window
instead of a fixed 200 ms, so it stops over-reading under load.
- Command interceptor: drop the ~40 coreutil Node shims so cat/grep/etc
run their native binaries (no Node-per-command); the bash tracer still
records them as metadata.
- Make the bash command tracer opt-in (commandTracingEnabled, default
off) — the per-command DEBUG trap only activates when enabled; the
git/gh interception the conflict/merge system relies on stays always-on.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Switch the containerization dependency from the github URL to a vendored copy
(third_party/containerization, upstream commit 6b7b42ca) referenced by path, so
we can carry a small local patch that upstream lacks: LinuxContainer.Configuration
gains a `vmExtensions` field forwarded into VMConfiguration.extensions. Upstream
already supports VMConfiguration.extensions + the VZInstanceExtension hook, but
LinuxContainer — our only entry point — never forwarded them, so there was no way
to attach a device (e.g. a memory balloon) to a container's VM.
Tests/, docs/, examples/, images/ and the corresponding test targets are trimmed
for footprint (we never build the dependency's tests). See PATCHES.md for the full
diff vs. upstream and the re-vendoring procedure. Also adds the ContainerizationExtras
product to NucleicCore (AddressAllocator, named in the configureVZ signature).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
