run symlink #63

New issue

Closed

opened 2026-10-29 14:19:00 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-29 14:19:00 +00:00

Owner

Originally created by @ethe on GitHub (Aug 21, 2026).
Original GitHub issue: https://github.com/kvcache-ai/AgentENV/issues/202

Affected component

Firecracker runtime

AgentENV version

Version or commit: 547c1a8a515382cfc2ba02cb8aeb1bd134b7327f (the same line is present on current main)
Local modifications: none

Host environment

OS: EKS node based on Ubuntu
Architecture: x86_64
Bare metal, VM, or cloud: AWS bare-metal node running Firecracker
Guest image: official ubuntu:24.04 OCI rootfs
Guest kernel: Linux 6.1.175

Operation and configuration

# Create a cold sandbox using the official Ubuntu 24.04 OCI rootfs.
POST /sandboxes-cold
{"image":"ubuntu:24.04@sha256:...","secure":true,"autoPause":false}

Steps to reproduce

Build the AgentENV tools drive from the affected commit.
Cold-start a sandbox from the official Ubuntu 24.04 rootfs.
Inspect the sandbox's Firecracker serial log.
Observe the pre-pivot mkdir error for /mnt/user/var/run.

Ubuntu supplies /var/run as an absolute symlink to /run. Before pivot_root, mkdir -p /mnt/user/var/run follows that symlink against the tools-drive root rather than the mounted user root.

Expected behavior

The pre-pivot bootstrap prepares only real mount targets and starts an official Ubuntu rootfs without emitting a filesystem error. /var/run can be handled after pivot_root, where its absolute /run target resolves inside the user rootfs.

Actual behavior

The pre-pivot directory preparation includes /mnt/user/var/run and emits:

mkdir: can't create directory '/mnt/user/var/run': No such file or directory

The init script intentionally does not use set -e, so the observed sandbox continued booting and envd became reachable. This report does not claim the warning is fatal. It is nevertheless a deterministic compatibility error, makes serial diagnostics misleading, and means that one member of the grouped directory preparation did not do what its comment says.

Logs and diagnostics

[    0.347784] Run /init as init process
[    0.351834] EXT4-fs (vdb): mounted filesystem without journal. Quota mode: none.
mkdir: can't create directory '/mnt/user/var/run': No such file or directory
/bin/sh: 0: can't access tty; job control turned off
#

Relevant source:

$BB mkdir -p \
    /mnt/user/proc \
    /mnt/user/dev \
    /mnt/user/sys \
    /mnt/user/run \
    /mnt/user/tmp \
    /mnt/user/var/run \
    /mnt/user/var/log/agentenv \
    /mnt/user/agentenv

A minimal fix is to omit /mnt/user/var/run from the pre-pivot list. pivot-init already runs mkdir -p /var/run after the root switch, where Ubuntu's /var/run -> /run resolves correctly.

Reproduction frequency

Always

Regression information

Last known good: unknown
First known bad: 547c1a8a515382cfc2ba02cb8aeb1bd134b7327f or earlier

Additional context

The same pre-pivot pattern may affect other distro rootfs images that use an absolute /var/run -> /run symlink.

Pre-submission checklist

I searched existing open and closed issues and did not find a duplicate.
I provided a minimal reproduction.
I removed credentials, tokens, private image references, and other sensitive information.
This is not a security vulnerability.

Originally created by @ethe on GitHub (Aug 21, 2026). Original GitHub issue: https://github.com/kvcache-ai/AgentENV/issues/202 ### Affected component Firecracker runtime ### AgentENV version - Version or commit: `547c1a8a515382cfc2ba02cb8aeb1bd134b7327f` (the same line is present on current `main`) - Local modifications: none ### Host environment - OS: EKS node based on Ubuntu - Architecture: x86_64 - Bare metal, VM, or cloud: AWS bare-metal node running Firecracker - Guest image: official `ubuntu:24.04` OCI rootfs - Guest kernel: Linux 6.1.175 ### Operation and configuration ```shell # Create a cold sandbox using the official Ubuntu 24.04 OCI rootfs. POST /sandboxes-cold {"image":"ubuntu:24.04@sha256:...","secure":true,"autoPause":false} ``` ### Steps to reproduce 1. Build the AgentENV tools drive from the affected commit. 2. Cold-start a sandbox from the official Ubuntu 24.04 rootfs. 3. Inspect the sandbox's Firecracker serial log. 4. Observe the pre-pivot `mkdir` error for `/mnt/user/var/run`. Ubuntu supplies `/var/run` as an absolute symlink to `/run`. Before `pivot_root`, `mkdir -p /mnt/user/var/run` follows that symlink against the tools-drive root rather than the mounted user root. ### Expected behavior The pre-pivot bootstrap prepares only real mount targets and starts an official Ubuntu rootfs without emitting a filesystem error. `/var/run` can be handled after `pivot_root`, where its absolute `/run` target resolves inside the user rootfs. ### Actual behavior The pre-pivot directory preparation includes `/mnt/user/var/run` and emits: ```text mkdir: can't create directory '/mnt/user/var/run': No such file or directory ``` The init script intentionally does not use `set -e`, so the observed sandbox continued booting and envd became reachable. This report does not claim the warning is fatal. It is nevertheless a deterministic compatibility error, makes serial diagnostics misleading, and means that one member of the grouped directory preparation did not do what its comment says. ### Logs and diagnostics ```text [ 0.347784] Run /init as init process [ 0.351834] EXT4-fs (vdb): mounted filesystem without journal. Quota mode: none. mkdir: can't create directory '/mnt/user/var/run': No such file or directory /bin/sh: 0: can't access tty; job control turned off # ``` Relevant source: ```shell $BB mkdir -p \ /mnt/user/proc \ /mnt/user/dev \ /mnt/user/sys \ /mnt/user/run \ /mnt/user/tmp \ /mnt/user/var/run \ /mnt/user/var/log/agentenv \ /mnt/user/agentenv ``` A minimal fix is to omit `/mnt/user/var/run` from the pre-pivot list. `pivot-init` already runs `mkdir -p /var/run` after the root switch, where Ubuntu's `/var/run -> /run` resolves correctly. ### Reproduction frequency Always ### Regression information - Last known good: unknown - First known bad: `547c1a8a515382cfc2ba02cb8aeb1bd134b7327f` or earlier ### Additional context The same pre-pivot pattern may affect other distro rootfs images that use an absolute `/var/run -> /run` symlink. ### Pre-submission checklist - [x] I searched existing open and closed issues and did not find a duplicate. - [x] I provided a minimal reproduction. - [x] I removed credentials, tokens, private image references, and other sensitive information. - [x] This is not a security vulnerability.

bsakaguchi closed this issue

2026-10-29 14:19:01 +00:00

bsakaguchi referenced this issue

2026-10-29 14:20:36 +00:00

[PR #86] [MERGED] feat: add ARM64 support for AgentENV #169

bsakaguchi referenced this issue

2026-10-29 14:20:40 +00:00

[PR #94] [CLOSED] feat: add ARM (aarch64) platform support #176