Repository navigation
Bump Substrate to 3a2ca623 (go.ate.dev/substrate): string sandbox class, required actor CPU and memory limits - #91
Merged
Conversation
This was referenced Oct 15, 2026
Tomer Glottmann (tomergee)
requested a review
from Vicente Ferrara (vicentefb)
October 15, 2026 19:29
This was referenced Oct 16, 2026
Tomer Glottmann (tomergee)
added a commit
to tomergee/env
that referenced
this pull request
Oct 16, 2026
…t flags for class, capabilities and limits Completes the integration around the M0 driver: - docs/openshell.md: the design page. Object model (which OpenShell object becomes which ate-env and Substrate object), the component diagram, how a sandbox comes up, the lifecycle vocabulary the gateway derives phases from, and what differs from OpenShell's own drivers (single actor, shared resolv.conf, credentials through the guest, capabilities, kernel). - ate-env manifest template --sandbox-class, --sandbox-config, --cap-add, --cpu, --memory, and ate-env manifest --sandbox-class/--sandbox-config for the worker pool, with tests. The OpenShell template no longer needs a hand-written YAML: the generated one is identical to the one verified on the cluster. Defaults keep today's gvisor output unchanged. Overlaps agent-substrate#91, which will turn the class into a string; the flag names are the same. - integrations/openshell: README rewritten as install, use, lifecycle, troubleshooting, development and known gaps; hack/install.sh (pool, template, gateway; re-runnable), hack/smoke.sh (create, exec, stop, start, ssh, forward, upload, download, delete, leak check with timings), deploy/workerpool.yaml, examples/agent_loop.py (OpenShell Python SDK driving a sandbox as a tool, policy built from the protobuf types) and examples/policy-example.yaml. make openshell-images builds the layer and the driver. - driver: the condition mapping is a pure function, conditionsFor, with table tests that mirror the gateway's derive_phase; observe() only fetches the live status. No behaviour change. Gateway manifest pinned to the image built from this tree. Verified on the cluster: install.sh re-run (pool updated, template kept, gateway rolled to the new image), smoke.sh all steps passed twice, the SDK example end to end (create 20 s, exec 0.1 s, stop 10 s, start 11 s).
Moves the Substrate pin from da35a983 (2026-10-13) to main at 6edd1fcc
(2026-10-15). Against that Substrate, env main's ActorTemplate is rejected
at registration:
- substrate#2586 made SandboxConfig.sandbox_class a string ("gvisor",
"microvm") at the same field number. The template now names it with
atev1alpha1.SandboxClassGvisor, the constant the WorkerPool already uses.
- substrate#2285 requires cpu and memory limits on every ActorTemplate.
`ate-env manifest template` writes them, from new --cpu and --memory
flags (Kubernetes quantities, default 2 and 4Gi, validated client-side).
Templates derived per rootfs image clone the base and inherit them.
Compile-only follow-ups:
- substrate#2575 renamed ContainerWakeupProbe to WakeupProbe; the field
number and JSON key are unchanged.
- substrate#2620 deleted ACTOR_STATE_PAUSED and _PAUSING: a paused actor
is SUSPENDED with a node-local snapshot. ate-env never pauses, so the
two cases leave ActorStatusToEnvStatus; the fake's PauseActor reports
SUSPENDED.
- substrate#2254 renamed the worker image ateom-gvisor to
ateworker-gvisor; the --worker-image help and error text follow, and
--ateom-image stays as an alias.
The README names the new pin and what the cluster must accept (string sandbox class, CPU and memory limits), says a Substrate older than 2026-10-14 needs an ate-env from before this bump, and documents the --cpu and --memory defaults. The worker image is ateworker-gvisor in the README, docs/release.md and the nemo-gym example.
…ifest template The README passed --guest-image and --snapshots-bucket to `ate-env manifest`, which fails with "unknown flag: --guest-image": those flags belong to `ate-env manifest template`. Deploy with `ate-env manifest --api-image --worker-image`, then register the template with `ate-env manifest template --guest-image --snapshots-bucket` once ate-env-api runs, as the root README does. Fixes #76.
…substrate Substrate main moved its module path to the vanity import go.ate.dev/substrate (substrate#2181, 68a082c3); go.ate.dev serves go-import metadata pointing at the GitHub repository. Every Substrate import moves to the new path, the dependabot rules follow it, and gofmt reorders two import blocks. Nothing else in env changes. Between 6edd1fcc and 3a2ca623 the ateapi proto only gains worker-side fields (Worker.worker_spiffe_id, WorkerAssignment.worker_spiffe_id, MintWorkerActorCertificateRequest.worker); no field env sends or decodes is removed or retyped. WorkerPool keeps its fields; a pool without a ServiceAccount now runs workers as "ateworker", which the controller creates in the pool's namespace (088381b6), so the manifest needs nothing. The renames in 3a2ca623 are in the atelet and ateom protos. The README names the new pin and the exact compatibility boundary: Substrate at or after 63a17a92 (2026-10-15), which accepts the string sandbox class (9ec49759) and requires the limits (c58f374a), and renamed the worker image.
Tomer Glottmann (tomergee)
force-pushed
the
bump-substrate-6edd1fcc
branch
from
October 16, 2026 17:40
7858b29 to
84317c8
Compare
Tomer Glottmann (tomergee)
changed the title
…ounds; README upgrade note From review of #91: - --cpu and --memory now follow Substrate's resources.limits validation (internal/resources.ValidateLimit and the Limits.quantity maxLength): a positive quantity of at most 32 characters, cpu at most 999.999 cores, memory at most an int64 byte count. Before, --cpu=1000 printed a template the control plane rejects. The check moves out of resolveImages into validateResources. - An explicit --cpu= or --memory= is an error instead of silently meaning the default. - A test proves that a template derived for a rootfs image keeps the base's limits. - README: after upgrading across the boundary, delete and register base templates again (Substrate has no UpdateActorTemplate, and a base without limits makes each derived template fail resources: Required), and the cpu ceiling next to the --cpu docs.
Tomer Glottmann (tomergee)
requested review from
Jaana Dogan (rakyll) and
Sunny (sunnylovestiramisu)
October 16, 2026 17:47
Vicente Ferrara (vicentefb)
approved these changes
Oct 16, 2026
Vicente Ferrara (vicentefb)
left a comment
Vicente Ferrara (vicentefb)
left a comment
Collaborator
There was a problem hiding this comment.
/lgtm
Tomer Glottmann (tomergee)
added a commit
to tomergee/env
that referenced
this pull request
Oct 16, 2026
…t flags for class and capabilities Completes the integration around the M0 driver, rebased onto agent-substrate#91 (Substrate 3a2ca623 at go.ate.dev/substrate: string sandbox class, required limits, --cpu/--memory on manifest template). - docs/openshell.md: the design page. Object model (which OpenShell object becomes which ate-env and Substrate object), the component diagram, how a sandbox comes up, the lifecycle vocabulary the gateway derives phases from, and what differs from OpenShell's own drivers (single actor, shared resolv.conf, credentials through the guest, capabilities, kernel). - ate-env manifest template --sandbox-class, --sandbox-config and --cap-add next to agent-substrate#91's --cpu/--memory, and ate-env manifest --sandbox-class/ --sandbox-config for the worker pool, with tests. The OpenShell template no longer needs a hand-written YAML; defaults keep today's gvisor output. - third_party/openshell: options.proto leaves out the MethodOptions extension authorization = 50000. go.ate.dev/substrate registers ateapi.method on MethodOptions with the same number, and Go's protobuf registry panics at init when one binary links both; the compute-driver contract uses only the secret field option (50001). - integrations/openshell: README rewritten as install, use, lifecycle, troubleshooting, development and known gaps; hack/install.sh (pool, template, gateway; re-runnable), hack/smoke.sh (create, exec, stop, start, ssh, forward, upload, download, delete, leak check with timings), deploy/workerpool.yaml, examples/agent_loop.py (OpenShell Python SDK driving a sandbox as a tool, policy built from the protobuf types) and examples/policy-example.yaml. make openshell-images builds the layer and the driver. - driver: the condition mapping is a pure function, conditionsFor, with table tests that mirror the gateway's derive_phase; observe() only fetches the live status. No behaviour change. Gateway manifest pinned to the image built from this tree. Verified on the cluster after the rebase: the driver starts (no registry panic), smoke.sh passes end to end, install.sh re-runs cleanly, the SDK example runs (create 20 s, exec 0.1 s, stop 10 s, start 11 s). The generated template needs Substrate 63a17a92 or later on the cluster.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves the Substrate pin from
da35a983(2026-10-13, #84) tomainat3a2ca623(2026-10-16), about 106 upstream commits. First opened at6edd1fcc(2026-10-15); re-pinned on 2026-10-16, see Update below.A smoke test of env
main(1c08a7a) on a cluster running Substratemainfailed at ActorTemplate registration. Run through Substratemain's own path (kubectl-ate's parser,defaults.Apply,ValidateCreateActorTemplateRequest), the template frommainfails with:Review points addressed (7325ee3)
From an independent review of this PR:
--cpu/--memoryfollow Substrate'sresources.limitsvalidation: positive, at most 32 characters, cpu at most999.999cores, memory at most an int64 byte count. Before,--cpu=1000printed a template the control plane rejects. The check moved fromresolveImagesintovalidateResources; tests cover each bound and both accepted maxima.--cpu=or--memory=is an error instead of silently meaning the default.TestDeriveImageTemplateKeepsResources: a template derived for a rootfs image keeps the base's limits.63a17a92, with9ec49759andc58f374a), an upgrade note (Substrate has noUpdateActorTemplate, and a base registered before the upgrade has no limits, thus each derived template failsresources: Required: delete the base and its derived templates and register the base again), and the cpu ceiling next to the--cpudocs.Verified at 7325ee3:
go build,go vet,go test -race ./...twice (12 packages ok),make verify-gofmt verify-boilerplate, staticcheck clean. The CLI refuses--cpu=1000and--cpu=, and accepts--cpu=999.999and--memory=1Ei. Substrate main is one commit past the pin, with no API or CRD change.Update 2026-10-16: re-pinned to
3a2ca623, module pathgo.ate.dev/substrateRebased onto
mainat 7be7449 (after #86) and bumped from6edd1fccto3a2ca623, 34 more commits.go.ate.dev/substrate(substrate#2181); go.ate.dev serves go-import metadata for the GitHub repository. All Substrate imports move to the new path, and the dependabot rules follow it. No other code change.ateapi.protobetween the two pins shows only three new worker-side fields (Worker.worker_spiffe_id,WorkerAssignment.worker_spiffe_id,MintWorkerActorCertificateRequest.worker). Nothing env sends or decodes is removed or retyped.ateworker, which the controller creates in the pool's namespace (088381b6), so the manifest needs nothing. The renames in3a2ca623itself are in the atelet and ateom protos.63a17a92, which has the string class from9ec49759, the required limits fromc58f374a, and the worker image rename).go build,go vet,go test -race ./...(12 packages),make verify-gofmt verify-boilerplate, staticcheck clean,go mod tidya no-op. The templates from this branch (default,--cpu 500m --memory 8Gi,--rootfs-image) pass Substrate3a2ca623's kubectl-ate parse,defaults.ApplyandValidateCreateActorTemplateRequest.TestGuestCallWaitsForWakeunder a parallelgo test ./...reproduces onmaintoo. Three tests inguest/process/service_test.gouseDefaultConfig(""), which resolves to the shared$TMPDIR/ate-jobs, and their cleanup removes that directory while other test binaries write to it (creating stdout log: … no such file or directory). A separate test-only fix.What env needed
Breaks registration:
SandboxConfig.sandbox_classa string at the same field number. The template now usesatev1alpha1.SandboxClassGvisor, the constant the WorkerPool already uses, so pool and template share one value.ate-env manifest templategains--cpuand--memory(Kubernetes quantities, default2and4Gi, the Python client'sResourceLimitsdefault). Bad or non-positive quantities fail client-side. Templates derived per rootfs image clone the base and inherit the limits; no change inDeriveImageTemplate.Compile-only:
ContainerWakeupProbetoWakeupProbe. Field number, message body and JSON key are unchanged, so the YAML is the same.ACTOR_STATE_PAUSEDand_PAUSING: a paused actor isSUSPENDEDwith a node-local snapshot. ate-env never pauses, so the two cases leaveActorStatusToEnvStatuswith a comment, and the fake'sPauseActorreportsSUSPENDED.ENVIRONMENT_STATUS_PAUSED/_PAUSINGstay in env's proto for wire compatibility; they are no longer produced.ateom-gvisortoateworker-gvisor. Help text, the missing-flag error and docs follow;--ateom-imagestays as an alias.Checked and not relevant to env: the
List*requests movepage_size/page_tokenintoListOptions(substrate#2593), but env calls no List RPC. A descriptor diff ofateapi.protobetween the two pins shows no other same-number type change or removed field in a message env sends or decodes. The WorkerPool CRD fields are unchanged.Compatibility
After this PR, ate-env needs Substrate from 2026-10-14 or later: an older control plane rejects
sandboxClass: gvisor. The README says so. A release cut after this PR targets current Substrate; one cut before targetsda35a983.Verification
go build,go vet,go test -race ./...: 12 packages ok.make verify-gofmt verify-boilerplatepass. staticcheck clean.go mod tidyis a no-op. Python client: 119 passed.gvisorclass on the template, custom limits, rejection oftwo,4GB!,0and-1Gi, and--cpu/--memorythrough the command into the YAML.6edd1fcc(kubectl-ate parse,defaults.Apply,ValidateCreateActorTemplateRequest): templates from this branch with default limits, with--cpu 500m --memory 8Gi, and with--rootfs-imageare all valid; the template frommainfails as quoted above.main.Also
--guest-imageand--snapshots-buckettoate-env manifest, which rejects them. It is nowate-env manifest --api-image --worker-image, thenate-env manifest template --guest-image --snapshots-bucketonce ate-env-api runs. Both commands verified against this branch's CLI; the old one still fails withunknown flag: --guest-image.