Merge branch 'main' into rebase/upstream-2026-08-05

Author: stubbi

packages/plugins/sandbox-providers/kubernetes/src/sandbox-cr-builder.ts

@@ -16,6 +16,8 @@
  * release path is explicit delete via sandboxCrOrchestrator.release().
  */
 
+import { TENANT_CONTAINER_MIN_RESOURCES } from "./utils.js";
+
 // Where the seed init container mounts the home volume. Deliberately not
 // /home/paperclip: mounting there would shadow the image's baked home in the
 // init container too, leaving nothing to copy.
@@ -117,8 +119,11 @@ export function buildSandboxCrManifest(
                 allowPrivilegeEscalation: false,
                 capabilities: { drop: ["ALL"] },
               },
+              // The tenant LimitRange rejects any container asking for less
+              // than its floor, and a rejected init container means the pod is
+              // never created at all.
               resources: {
-                requests: { cpu: "50m", memory: "64Mi" },
+                requests: { ...TENANT_CONTAINER_MIN_RESOURCES },
                 limits: { cpu: "500m", memory: "256Mi" },
               },
               volumeMounts: [{ name: "home", mountPath: SEED_HOME_STAGING_PATH }],

packages/plugins/sandbox-providers/kubernetes/src/tenant-orchestrator.ts

@@ -1,6 +1,7 @@
 import type { KubeClients } from "./kube-client.js";
 import { buildNetworkPolicyManifests } from "./network-policy.js";
 import { buildCiliumNetworkPolicyManifest } from "./cilium-network-policy.js";
+import { TENANT_CONTAINER_MIN_RESOURCES } from "./utils.js";
 
 export interface EnsureTenantInput {
   namespace: string;
@@ -201,7 +202,7 @@ async function ensureLimitRange(clients: KubeClients, input: EnsureTenantInput):
               {
                 type: "Container",
                 max: { cpu: input.limitRange.maxCpu, memory: input.limitRange.maxMemory },
-                min: { cpu: "100m", memory: "128Mi" },
+                min: { ...TENANT_CONTAINER_MIN_RESOURCES },
                 // The k8s client-node type names this `_default` but the actual
                 // Kubernetes API field is `default`. We produce a JSON-shape
                 // manifest so the cast is safe.

packages/plugins/sandbox-providers/kubernetes/src/utils.ts

@@ -59,3 +59,19 @@ export function paperclipLabels(input: LabelsInput): Record<string, string> {
     "paperclip.io/managed-by": "paperclip-k8s-plugin",
   };
 }
+
+/**
+ * The per-container resource floor the tenant LimitRange enforces
+ * (`ensureLimitRange`, min for type `Container`). Every container this plugin
+ * puts in a tenant namespace, init containers included, has to request at
+ * least this much or the apiserver rejects the whole pod at admission.
+ *
+ * Shared rather than written out twice: a seed init container that asked for
+ * less than the floor its own plugin installs took down every hosted run for
+ * three days, and the two literals sitting in different files is what let the
+ * drift happen silently.
+ */
+export const TENANT_CONTAINER_MIN_RESOURCES = {
+  cpu: "100m",
+  memory: "128Mi",
+} as const;

packages/plugins/sandbox-providers/kubernetes/test/unit/sandbox-cr-builder.test.ts

@@ -1,5 +1,6 @@
 import { describe, it, expect } from "vitest";
 import { buildSandboxCrManifest } from "../../src/sandbox-cr-builder.js";
+import { TENANT_CONTAINER_MIN_RESOURCES } from "../../src/utils.js";
 
 const baseInput = {
   namespace: "paperclip-acme",
@@ -181,6 +182,20 @@ describe("buildSandboxCrManifest: baked home seeding", () => {
     expect(seed.securityContext.capabilities.drop).toEqual(["ALL"]);
   });
 
+  // Every container in a tenant namespace is admitted against the LimitRange
+  // this same plugin installs. An init container below that floor is not a
+  // degraded pod, it is no pod at all: the apiserver refuses the create, the
+  // Sandbox never materializes, and every exec the server tries afterwards
+  // goes unanswered until the probe budget runs out. That is exactly how
+  // hosted runs failed from 2026-08-04 to 2026-08-07, on every adapter, with
+  // "the sandbox never answered the runtime probe" as the only symptom.
+  it("requests at least the LimitRange floor for the seed container", () => {
+    const cr = buildSandboxCrManifest(baseInput);
+    const seed = cr.spec.podTemplate.spec.initContainers[0];
+    expect(seed.resources.requests.cpu).toBe(TENANT_CONTAINER_MIN_RESOURCES.cpu);
+    expect(seed.resources.requests.memory).toBe(TENANT_CONTAINER_MIN_RESOURCES.memory);
+  });
+
   it("does not let a seed failure block the run", () => {
     // An image with nothing baked into its home is the normal case for four of
     // the five harnesses. That must not be a CrashLoopBackOff.