Soften hosted-runner claim + instrument the gate for debugging#5
Merged
Conversation
The first real hosted-runner run confirmed /dev/kvm is present but every VM errored on 'wait for SSH ... context deadline exceeded' (guest boots but never becomes reachable). Soften the README to not overclaim, and instrument the workflow to diagnose: - README: hosted lane framed as wired + KVM-confirmed but boot still being stabilized; self-hosted KVM is the validated path today. - chmod 0666 /dev/kvm safeguard (runner user may not be in the kvm group). - timeout 12m -> 5m so a stuck guest fails fast instead of burning the budget. - on failure, dump serial.log/validator output into the job log; upload the whole .bpfcompat/runs tree as an artifact. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The kvm-perms safeguard was the fix: the runner user couldn't open /dev/kvm, so -enable-kvm failed and the guest never booted (the SSH-readiness timeout). With chmod 0666 the hosted gate passes end-to-end in ~1m46s (simple-pass + functional-execve both pass, KVM hardware-accelerated). README updated from 'being stabilized' to proven, with the kvm-group gotcha documented. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Security review flagged the broad .bpfcompat/runs/** upload glob: the per-run dir holds the generated SSH private key (id_ed25519), cloud-init seed, and disk overlay. Restore an allowlist of just the log/result files (adding qemu.log for boot/KVM diagnosis) so secrets are never swept into a downloadable artifact. The on-failure dump already names specific log files only, not the key. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First real hosted-runner run:
/dev/kvmis present, but every VM errored withwait for SSH ... context deadline exceeded— the guest boots but never becomes SSH-reachable, burning the full 12m budget as an infra error.serial.logwasn't captured, so the cause is invisible.This PR (per maintainer decision: soften + debug cycle):
chmod 0666 /dev/kvmsafeguard in case the runner user isn't in the kvm group..bpfcompat/runstree, so the next run is diagnosable.No production code change — workflow + docs only.
🤖 Generated with Claude Code