feat(sandbox): PID 1 namespace lifecycle and orphan reaping #20

New issue

Open

opened 2026-09-09 10:15:32 +00:00 by larandar · 0 comments

larandar commented

2026-09-09 10:15:32 +00:00

Owner

Proposal

Run each sandbox with PID 1 lifecycle and orphan reaping.

Design

Use --unshare-pid and make supervisor PID 1 so orphaned descendants are reaped and namespace exits cleanly.

Tasks

Add PID flags; run supervisor as PID 1; handle child exit and teardown.

Gherkin Specification Delta

must.contracts.ting-workflows.deliverable-20

Scenario: Deliverable behavior

GIVEN the stated prerequisites and inputs
WHEN the feature is exercised
THEN an orphaned child, when sandbox exits, then PID 1 reaps it and namespace processes are cleaned up.

## Proposal Run each sandbox with PID 1 lifecycle and orphan reaping. ## Design Use --unshare-pid and make supervisor PID 1 so orphaned descendants are reaped and namespace exits cleanly. ## Tasks - Add PID flags; run supervisor as PID 1; handle child exit and teardown. ## Gherkin Specification Delta ### must.contracts.ting-workflows.deliverable-20 **Scenario: Deliverable behavior** - **GIVEN** the stated prerequisites and inputs - **WHEN** the feature is exercised - **THEN** an orphaned child, when sandbox exits, then PID 1 reaps it and namespace processes are cleaned up.

larandar added a new dependency

2026-09-09 10:15:35 +00:00

#16 feat(sandbox): probed NixOS mount table builder

larandar added a new dependency

2026-09-09 10:15:35 +00:00

#21 feat(sandbox): wall-clock timeout watcher and ownership reaper law

larandar added a new dependency

2026-09-09 10:15:37 +00:00

#2 Session: ting-workflow-executor — embedded Nushell, bwrap sandboxing, and OWS DSL 1.0