feat(agent): enforce per-sandbox cgroup v2 memory limits - #3142

Open

daryllimyt wants to merge 15 commits into

mainfrom

feat/agent-sandbox-cgroup-limits

Commits on Jul 28, 2026

feat(agent): enforce per-sandbox cgroup v2 memory limits
daryllimyt
committed
94fa42c
fix(agent): clear stale readiness sentinel on startup
daryllimyt
committed
842e26f
fix(config): treat blank agent executor ready-file env as unset
daryllimyt
committed
886454a
fix(agent): derive cgroup root and enforce sandbox memory budget
daryllimyt
committed
72679fb
fix(agent): honor ready-file override in compose healthchecks
daryllimyt
committed
7a037f5
fix(agent): clear stale readiness sentinel before startup validation
daryllimyt
committed
ed5ce8b
feat(agent): delegate cgroup subtree to apiuser in sandbox overlay
daryllimyt
committed
ffbe671
fix(agent): set apiuser identity env when dropping privileges
daryllimyt
committed
17012bb
Merge origin/main: move cgroup delegation to dedicated entrypoint
daryllimyt
committed
080c889
fix(agent): harden cgroup detection edge cases
daryllimyt
committed
f544e7e
fix(agent): honor cgroup-enabled flag in delegation entrypoint
daryllimyt
committed
17c69a9
fix(agent): honor ancestor cgroup limits in memory budget
daryllimyt
committed
ab6c868
fix(agent): enforce sandbox cgroup limits
daryllimyt
committed
7276d2f
fix(agent): use sandbox overlay for compose nsjail
daryllimyt
committed
cb99c56
fix(agent): gate root cgroup delegation on nsjail being enabled
daryllimyt
committed
594c9c5