Fix monitoring stuff.

Author: jglogan

Makefile

@@ -187,7 +187,13 @@ integration: init-block
 	@echo Ensuring apiserver stopped before the CLI integration tests...
 	@bin/container system stop && sleep 3 && scripts/ensure-container-stopped.sh
 	@echo Running the integration tests...
-	bin/container system start $(SYSTEM_START_OPTS) && \
+	@if [ -n "$(LOG_ROOT)" ]; then \
+		echo "Starting startup monitor..."; \
+		scripts/monitor-startup.sh "$(LOG_ROOT)/startup-monitor.log" 30 & \
+		MONITOR_PID=$$!; \
+		echo "Monitor running with PID $$MONITOR_PID"; \
+	fi; \
+	bin/container system start --timeout 60 $(SYSTEM_START_OPTS) && \
 	echo "Starting CLI integration tests" && \
 	{ \
 		exit_code=0; \

scripts/monitor-startup.sh

@@ -0,0 +1,75 @@
+#! /bin/bash
+# Copyright © 2025-2026 Apple Inc. and the container project authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Monitor system startup for debugging CI delays
+# This script runs in the background and captures:
+# 1. Extended attributes on binaries (quarantine checks)
+# 2. launchd service state
+# 3. Process table every second
+
+LOG_FILE="${1:-/tmp/startup-monitor.log}"
+DURATION="${2:-30}"
+
+# Ensure the log directory exists
+LOG_DIR=$(dirname "$LOG_FILE")
+mkdir -p "$LOG_DIR"
+
+# Redirect all output to log file
+exec > "$LOG_FILE" 2>&1
+
+echo "=== Startup Monitor Started at $(date -u +"%Y-%m-%dT%H:%M:%SZ") ==="
+echo
+
+# Check for quarantine attributes on binaries
+echo "=== Extended Attributes on Binaries ==="
+for binary in bin/container-apiserver \
+              libexec/container/plugins/container-network-vmnet/bin/container-network-vmnet \
+              libexec/container/plugins/container-runtime-linux/bin/container-runtime-linux \
+              libexec/container/plugins/container-core-images/bin/container-core-images; do
+    if [ -f "$binary" ]; then
+        echo "--- $binary ---"
+        xattr -l "$binary" 2>&1 || echo "No extended attributes or error reading xattr"
+    fi
+done
+echo
+
+# Monitor loop
+echo "=== Process and Service Monitoring (every 1 second for ${DURATION}s) ==="
+for i in $(seq 1 $DURATION); do
+    echo "--- Snapshot $i at $(date -u +"%Y-%m-%dT%H:%M:%SZ") ---"
+
+    # Capture container-related processes
+    echo "Container processes:"
+    ps -ef | grep -E 'container-apiserver|container-network-vmnet|container-runtime|launchd' | grep -v grep || echo "No container processes found"
+
+    # Check launchd service state for network plugin
+    echo
+    echo "Launchd service state:"
+    DOMAIN=$(launchctl managername 2>/dev/null | tr '[:upper:]' '[:lower:]' | sed 's/aqua/gui/' | sed "s/background/user/" | sed "s/system/system/" )
+    if [ "$DOMAIN" = "gui" ] || [ "$DOMAIN" = "user" ]; then
+        DOMAIN="${DOMAIN}/$(id -u)"
+    fi
+
+    # Try to print state for default network service
+    launchctl print "${DOMAIN}/com.apple.container.network.container-network-vmnet.default" 2>&1 || echo "Service not registered yet"
+
+    echo
+    echo "---"
+    echo
+
+    sleep 1
+done
+
+echo "=== Startup Monitor Ended at $(date -u +"%Y-%m-%dT%H:%M:%SZ") ==="