Run gVisor sandboxes without a pause container

.golangci-kal.yaml

@@ -83,7 +83,7 @@ linters:
       - path: 'pkg/api/v1alpha1/sandboxconfig_types\.go'
         text: '^(optionalfields|requiredfields): .*\bSandboxConfigSpec\.SandboxClass\b'
       - path: 'pkg/api/v1alpha1/sandboxconfig_types\.go'
-        text: '^(nomaps|optionalfields): .*\bSandboxVersionConfig\.(Assets|PauseImage)\b'
+        text: '^(nomaps|optionalfields): .*\bSandboxVersionConfig\.Assets\b'
       - path: 'pkg/api/v1alpha1/sandboxconfig_types\.go'
         text: '^(nonpointerstructs|requiredfields): .*\bSandboxConfig\.Spec\b'
       - path: 'pkg/api/v1alpha1/csidriverconfig_types\.go'

benchmarking/analysis/README.md

@@ -85,7 +85,7 @@ restore between `volume_mount`, `manifest_fetch`, `sandbox_assets`,
 `prep` / `pause` / `snapshot` / `durable_dir` / `rootfs_upper` / `teardown`
 on a checkpoint and `prep` / … / `vm_restore` / `wakeup_probe` on a restore;
 for gVisor `pause` / `checkpoint` / `fs_checkpoint` / `resume` / `teardown` and
-`prep` / `net_setup` / … / `pause_restore` / `app_restore` /
+`prep` / `net_setup` / … / `sandbox_restore` / `app_restore` /
 `wakeup_probe` / `activate` (the full lists are in
 `cmd/ateworker-*/phaselog.go`). The ateworker
 records carry no sandbox class or kind of their own; a paired one takes both

benchmarking/analysis/phase_report.py

@@ -94,7 +94,7 @@
     # ateworker restore: micro-VM (cmd/ateworker-microvm/phaselog.go) and gVisor
     # (cmd/ateworker-gvisor/phaselog.go), each in its own sequential order
     "prep", "egress_prepare", "net_setup", "bundles", "upper_join", "lowers",
-    "pause_rootfs", "pause_create", "pause_restore",
+    "sandbox_create", "sandbox_restore",
     "app_rootfs", "app_create", "app_restore",
     "tap", "vmm_launch", "vm_restore", "resume", "wakeup_probe", "activate",
     # atelet + ateworker checkpoint

cmd/ate-setup/differences.md

@@ -121,9 +121,9 @@ The rewritten reference then keeps that tag and adds the digest it names, as
 tagged release. Resolving the digest is one HEAD request per image, cached for
 the install, so `--image-repo` needs read access to the registry from wherever
 `ate-setup` runs rather than only from the cluster. It is not optional: an
-ActorTemplate's container image, an image volume's reference, and a
-SandboxConfig's `pauseImage` each carry the CEL rule `self.contains('@')`, so an
-unpinned reference is rejected by admission and every demo fails to deploy.
+ActorTemplate's container image and an image volume's reference each carry the
+CEL rule `self.contains('@')`, so an unpinned reference is rejected by admission
+and every demo fails to deploy.
 Pinning also gives a pre-built install the property a `ko` install had for free,
 that a tag moving afterwards cannot change what is running.
 

cmd/ate-setup/internal/images/prebuilt.go

@@ -79,13 +79,13 @@ func (p *Prebuilt) ResolveBytes(ctx context.Context, manifest []byte) ([]byte, e
 // it, such as envoy-dataplane: a release publishes that under the same
 // repository and tag as the rest, so it is found the same way.
 //
-// The digest is not decoration. An ActorTemplate's container image, an image
-// volume's reference, and a SandboxConfig's pauseImage each carry the CEL rule
-// self.contains('@'), so a tag on its own is rejected by admission and every
-// demo would fail to deploy. Pinning also restores what ko gave the control
-// plane deployments for free: an install that cannot shift under a tag someone
-// moves later. Keeping the tag alongside the digest is ko's own output shape,
-// and leaves the reference legible in `kubectl get`.
+// The digest is not decoration. An ActorTemplate's container image and an image
+// volume's reference each carry the CEL rule self.contains('@'), so a tag on
+// its own is rejected by admission and every demo would fail to deploy. Pinning
+// also restores what ko gave the control plane deployments for free: an install
+// that cannot shift under a tag someone moves later. Keeping the tag alongside
+// the digest is ko's own output shape, and leaves the reference legible in
+// `kubectl get`.
 func (p *Prebuilt) Pin(ctx context.Context, image string) (string, error) {
 	tagged := p.src.Repo + "/" + image + ":" + p.src.Tag
 	// A tag that already carries one is pinned as it stands. Looking it up

cmd/ate-setup/internal/images/prebuilt_test.go

@@ -370,10 +370,10 @@ func TestResolveEveryInstallManifest(t *testing.T) {
 			if refs := koRefPattern.FindAllString(string(out), -1); len(refs) > 0 {
 				t.Errorf("unresolved references survived: %v", refs)
 			}
-			// Every reference has to name a digest. ActorTemplate images,
-			// image volume references, and a SandboxConfig's pauseImage all
-			// carry the CEL rule self.contains('@'), so an unpinned reference
-			// is not applied at all, it is rejected by admission.
+			// Every reference has to name a digest. ActorTemplate images and
+			// image volume references carry the CEL rule self.contains('@'), so
+			// an unpinned reference is not applied at all, it is rejected by
+			// admission.
 			for _, ref := range resolvedRef.FindAllString(string(out), -1) {
 				if !strings.Contains(ref, "@sha256:") {
 					t.Errorf("%s is not pinned to a digest", ref)

cmd/atecontroller/internal/controllers/workerpool_sandboxconfig_test.go

@@ -48,8 +48,6 @@ import (
 // testGvisorDefault is the gvisor class default TestMain creates.
 const testGvisorDefault = "gvisor-default-test"
 
-const testPauseImage = "registry.k8s.io/pause:3.10.2@sha256:f548e0e8e3dc1896ca956272154dde3314e8cc4fde0a57577ee9fa1c63f5baf4"
-
 // testHoldFinalizer keeps a SandboxConfig on the API server after it is
 // deleted, so a test can observe how a config that is being deleted is treated.
 const testHoldFinalizer = "test.ate.dev/hold"
@@ -2397,9 +2395,6 @@ func TestAddProtectionFinalizer(t *testing.T) {
 
 func makeSandboxConfig(name string, class atev1alpha1.SandboxClass, isDefault bool) *atev1alpha1.SandboxConfig {
 	v := atev1alpha1.SandboxVersionConfig{Name: "v1"}
-	if class == atev1alpha1.SandboxClassGvisor {
-		v.PauseImage = testPauseImage
-	}
 	sc := &atev1alpha1.SandboxConfig{
 		ObjectMeta: metav1.ObjectMeta{Name: name},
 		Spec: atev1alpha1.SandboxConfigSpec{

cmd/atelet/internal/apivalidation/validation_test.go

@@ -471,7 +471,7 @@ func TestValidateCheckpointRequest(t *testing.T) {
 	}, {
 		name: "spec errors surface at the spec's path",
 		obj: valid(func(r *ateletpb.CheckpointRequest) {
-			r.Spec = &ateletpb.WorkloadSpec{Containers: []*ateletpb.Container{{Name: "_pause", Image: testDigestImage}}}
+			r.Spec = &ateletpb.WorkloadSpec{Containers: []*ateletpb.Container{{Name: "_sandbox", Image: testDigestImage}}}
 		}),
 		want: field.ErrorList{field.Invalid(field.NewPath("spec", "containers").Index(0).Child("name"), nil, "").WithOrigin("format=k8s-short-name")},
 	}, {
@@ -647,7 +647,7 @@ func TestValidateRestoreRequest(t *testing.T) {
 	}, {
 		name: "spec errors surface at the spec's path",
 		obj: valid(func(r *ateletpb.RestoreRequest) {
-			r.Spec = &ateletpb.WorkloadSpec{Containers: []*ateletpb.Container{{Name: "_pause", Image: testDigestImage}}}
+			r.Spec = &ateletpb.WorkloadSpec{Containers: []*ateletpb.Container{{Name: "_sandbox", Image: testDigestImage}}}
 		}),
 		want: field.ErrorList{field.Invalid(field.NewPath("spec", "containers").Index(0).Child("name"), nil, "").WithOrigin("format=k8s-short-name")},
 	}, {
@@ -928,7 +928,7 @@ func TestValidateTerminateRequest(t *testing.T) {
 	}, {
 		name: "spec errors surface at the spec's path",
 		obj: valid(func(r *ateletpb.TerminateRequest) {
-			r.Spec = &ateletpb.WorkloadSpec{Containers: []*ateletpb.Container{{Name: "_pause", Image: testDigestImage}}}
+			r.Spec = &ateletpb.WorkloadSpec{Containers: []*ateletpb.Container{{Name: "_sandbox", Image: testDigestImage}}}
 		}),
 		want: field.ErrorList{field.Invalid(field.NewPath("spec", "containers").Index(0).Child("name"), nil, "").WithOrigin("format=k8s-short-name")},
 	}, {