feat(orchestrator/cgroup): list and destroy leaked sandbox cgroups

[wj-e2b]

Add Manager.Destroy to kill and remove an already-created sandbox cgroup,
plus IsSandboxCgroupName and ListSandboxCgroups helpers to enumerate leaked
sbx-* cgroups under the e2b root, with a matching noop implementation.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[cursor]

PR Summary

Medium Risk
Destroy can send cgroup.kill and remove host cgroups; wrong names or races with live sandboxes could affect running processes if reclaim is wired without guards.

Overview
This extends the sandbox cgroup manager so the orchestrator can clean up leaked sbx-* cgroups when a sandbox did not tear down normally. Manager.Destroy opens an existing cgroup (without the create-time memory.peak FD) and runs the same kill-and-remove path as a normal handle cleanup. IsSandboxCgroupName and ListSandboxCgroups scan a cgroup root for sandbox directories, and the noop manager implements Destroy as a no-op.

^{Reviewed by Cursor Bugbot for commit 2bedbdd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[gemini-code-assist]

Code Review

The OpenExisting method does not open the memory.peak file descriptor, which causes GetStats to always report zero for peak memory usage on the returned handle. To ensure correct resource tracking and consistency with Create, OpenExisting should open the memory.peak file and populate the memoryPeakFile field of the returned CgroupHandle.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[codecov]

❌ 11 Tests Failed:

Tests completed	Failed	Passed	Skipped
3080	11	3069	8

View the top 3 failed test(s) by shortest run time

github.com/e2b-dev/infra/tests/integration/internal/tests/api/templates::TestTemplateBuildRUN

Stack Traces | 0s run time

=== RUN   TestTemplateBuildRUN
=== PAUSE TestTemplateBuildRUN
=== CONT  TestTemplateBuildRUN
--- FAIL: TestTemplateBuildRUN (0.00s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir/depth_1_lists_root_directory

Stack Traces | 0.01s run time

=== RUN   TestListDir/depth_1_lists_root_directory
=== PAUSE TestListDir/depth_1_lists_root_directory
=== CONT  TestListDir/depth_1_lists_root_directory
    filesystem_test.go:96: 
        	Error Trace:	.../tests/envd/filesystem_test.go:96
        	Error:      	Received unexpected error:
        	            	unavailable: 502 Bad Gateway
        	Test:       	TestListDir/depth_1_lists_root_directory
--- FAIL: TestListDir/depth_1_lists_root_directory (0.01s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir/depth_3_lists_all_directories_and_files

Stack Traces | 0.01s run time

=== RUN   TestListDir/depth_3_lists_all_directories_and_files
=== PAUSE TestListDir/depth_3_lists_all_directories_and_files
=== CONT  TestListDir/depth_3_lists_all_directories_and_files
    filesystem_test.go:96: 
        	Error Trace:	.../tests/envd/filesystem_test.go:96
        	Error:      	Received unexpected error:
        	            	unavailable: 502 Bad Gateway
        	Test:       	TestListDir/depth_3_lists_all_directories_and_files
--- FAIL: TestListDir/depth_3_lists_all_directories_and_files (0.01s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir/depth_0_lists_only_root_directory

Stack Traces | 0.02s run time

=== RUN   TestListDir/depth_0_lists_only_root_directory
=== PAUSE TestListDir/depth_0_lists_only_root_directory
=== CONT  TestListDir/depth_0_lists_only_root_directory
    filesystem_test.go:96: 
        	Error Trace:	.../tests/envd/filesystem_test.go:96
        	Error:      	Received unexpected error:
        	            	unavailable: 502 Bad Gateway
        	Test:       	TestListDir/depth_0_lists_only_root_directory
--- FAIL: TestListDir/depth_0_lists_only_root_directory (0.02s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)

Stack Traces | 0.02s run time

=== RUN   TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)
=== PAUSE TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)
=== CONT  TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)
    filesystem_test.go:96: 
        	Error Trace:	.../tests/envd/filesystem_test.go:96
        	Error:      	Received unexpected error:
        	            	unavailable: 502 Bad Gateway
        	Test:       	TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)
--- FAIL: TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory) (0.02s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir

Stack Traces | 0.53s run time

=== RUN   TestListDir
=== PAUSE TestListDir
=== CONT  TestListDir
--- FAIL: TestListDir (0.53s)

github.com/e2b-dev/infra/tests/integration/internal/tests/api/templates::TestUpdateTemplateNotOwnedByTeam

Stack Traces | 167s run time

=== RUN   TestUpdateTemplateNotOwnedByTeam
=== PAUSE TestUpdateTemplateNotOwnedByTeam
=== CONT  TestUpdateTemplateNotOwnedByTeam
    template_update_test.go:205: Build failed: {<nil> build was cancelled <nil>}
--- FAIL: TestUpdateTemplateNotOwnedByTeam (167.44s)

github.com/e2b-dev/infra/tests/integration/internal/tests/api/templates::TestTemplateBuildRUN/Single_RUN_command

Stack Traces | 175s run time

=== RUN   TestTemplateBuildRUN/Single_RUN_command
=== PAUSE TestTemplateBuildRUN/Single_RUN_command
=== CONT  TestTemplateBuildRUN/Single_RUN_command
    build_template_test.go:133: test-ubuntu-run: [info] Building template 3fqy015qd5dudon2m331/add17f1d-fde6-4c05-bb89-b568773e35b6
    build_template_test.go:133: test-ubuntu-run: [info] [base] FROM ubuntu:22.04 [905bb9b1f7b3e631aa9d97d25385b3bb55c45687cb0f33deab700d7906575727]
    build_template_test.go:133: test-ubuntu-run: [info] Base Docker image size: 30 MB
    build_template_test.go:133: test-ubuntu-run: [info] Creating file system and pulling Docker image
    build_template_test.go:133: test-ubuntu-run: [info] Uncompressing layer sha256:40d16f30db405106ef8074779bdf41f012465c2a785bbeaa2eab9f2081099b47 30 MB
    build_template_test.go:133: test-ubuntu-run: [info] Uncompressing layer sha256:2788434eb70f9e0b0f6f07c26f0a4a479b435c0d481969183d7080172da3339e 13 MB
    build_template_test.go:133: test-ubuntu-run: [info] Uncompressing layer sha256:8c4b1b28875140ed3abacaf16ad0d696f6bef912f52d2148f261a23e3349465b 168 B
    build_template_test.go:133: test-ubuntu-run: [info] Layers extracted
    build_template_test.go:133: test-ubuntu-run: [info] Root filesystem structure: bin, boot, dev, etc, home, lib, lib32, lib64, libx32, media, mnt, opt, proc, root, run, sbin, srv, sys, tmp, usr, var
    build_template_test.go:133: test-ubuntu-run: [info] Provisioning sandbox template
    build_template_test.go:133: test-ubuntu-run: [info] Provisioning was successful, cleaning up
    build_template_test.go:133: test-ubuntu-run: [info] Sandbox template provisioned
    build_template_test.go:133: test-ubuntu-run: [info] [base] DEFAULT USER user [ea1d9e9a4e5e72b3edd251b28ade9fa6aa5a91811560507694d4964fdbac723b]
    build_template_test.go:133: test-ubuntu-run: [info] [builder 1/1] RUN echo 'Hello, World!' [3a7c1b087bdada710574e91a5484a97044150a027127d59c9b2df2bec44bdd33]
    build_template_test.go:133: test-ubuntu-run: [info] [builder 1/1] [stdout]: Hello, World!
    build_template_test.go:133: test-ubuntu-run: [info] [finalize] Finalizing template build [bf952c855fff6cfdd2ac81baf7c186afcaf50eaeee6b2a47b347408b7390e652]
    build_template_test.go:133: test-ubuntu-run: [error] Build failed: build was cancelled
    build_template_test.go:166: Build failed: {<nil> build was cancelled <nil>}
--- FAIL: TestTemplateBuildRUN/Single_RUN_command (175.29s)

github.com/e2b-dev/infra/tests/integration/internal/tests/api/templates::TestTemplateBuildCOPY

Stack Traces | 181s run time

=== RUN   TestTemplateBuildCOPY
=== PAUSE TestTemplateBuildCOPY
=== CONT  TestTemplateBuildCOPY
    build_template_test.go:133: test-ubuntu-copy: [info] Building template 5ge70rx7s2dgswshjn4q/fbbc8a1d-efe2-4bd6-a7d1-aeb4639ea101
    build_template_test.go:133: test-ubuntu-copy: [info] [base] FROM ubuntu:24.04 [c39b5437504679a3bf3ba259cd432b64e76eb59a37a904738b53964916ce30d5]
    build_template_test.go:133: test-ubuntu-copy: [info] Base Docker image size: 30 MB
    build_template_test.go:133: test-ubuntu-copy: [info] Creating file system and pulling Docker image
    build_template_test.go:133: test-ubuntu-copy: [info] Uncompressing layer sha256:cb259a83ac3dd9fea0b394df41df2b298adf0df938fef5999475af18a751c257 30 MB
    build_template_test.go:133: test-ubuntu-copy: [info] Uncompressing layer sha256:2788434eb70f9e0b0f6f07c26f0a4a479b435c0d481969183d7080172da3339e 13 MB
    build_template_test.go:133: test-ubuntu-copy: [info] Uncompressing layer sha256:8c4b1b28875140ed3abacaf16ad0d696f6bef912f52d2148f261a23e3349465b 168 B
    build_template_test.go:133: test-ubuntu-copy: [info] Layers extracted
    build_template_test.go:133: test-ubuntu-copy: [info] Root filesystem structure: bin, boot, dev, etc, home, lib, lib64, media, mnt, opt, proc, root, run, sbin, srv, sys, tmp, usr, var
    build_template_test.go:133: test-ubuntu-copy: [info] Provisioning sandbox template
    build_template_test.go:133: test-ubuntu-copy: [info] Provisioning was successful, cleaning up
    build_template_test.go:133: test-ubuntu-copy: [info] Sandbox template provisioned
    build_template_test.go:133: test-ubuntu-copy: [info] [base] DEFAULT USER user [3da537a117dca86581b7ada95bd60bd622d9251689edd72ea31f576d71870989]
    build_template_test.go:133: test-ubuntu-copy: [info] [builder 1/2] COPY . /app/ [b68d7028b17386e4debf2f779f7e9fe80a664e3401f338e37621c8e9a1339c9e]
    build_template_test.go:133: test-ubuntu-copy: [info] [builder 2/2] RUN cat /app/hello.txt | grep 'Hello from COPY!' [42c96f33b688b5977efb52758632c7a749a455bd99d156205eafc5d884f8ffbc]
    build_template_test.go:133: test-ubuntu-copy: [info] [builder 2/2] [stdout]: Hello from COPY!
    build_template_test.go:133: test-ubuntu-copy: [info] [finalize] Finalizing template build [297e24b5987786ae506bda0af96675039461afed1fcd4ec7a1f51572f618eed3]
    build_template_test.go:133: test-ubuntu-copy: [error] Build failed: build was cancelled
    build_template_test.go:1156: Build failed: {<nil> build was cancelled <nil>}
--- FAIL: TestTemplateBuildCOPY (181.05s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestCommandKillNextApp

Stack Traces | 293s run time

=== RUN   TestCommandKillNextApp
=== PAUSE TestCommandKillNextApp
=== CONT  TestCommandKillNextApp
    process_test.go:30: Build failed: {<nil> build was cancelled <nil>}
--- FAIL: TestCommandKillNextApp (292.98s)

github.com/e2b-dev/infra/tests/integration/internal/tests/api/templates::TestTemplateBuildInstalledPackagesAvailable

Stack Traces | 300s run time

=== RUN   TestTemplateBuildInstalledPackagesAvailable
=== PAUSE TestTemplateBuildInstalledPackagesAvailable
=== CONT  TestTemplateBuildInstalledPackagesAvailable
    build_template_test.go:133: test-ubuntu-packages-available: [info] Building template rqoiz95u75fqcbreku05/c9d17d03-bd62-45c9-a999-03cdb544b6db
    build_template_test.go:133: test-ubuntu-packages-available: [info] [base] FROM ubuntu:22.04 [905bb9b1f7b3e631aa9d97d25385b3bb55c45687cb0f33deab700d7906575727]
    build_template_test.go:133: test-ubuntu-packages-available: [info] Base Docker image size: 30 MB
    build_template_test.go:133: test-ubuntu-packages-available: [info] Creating file system and pulling Docker image
    build_template_test.go:133: test-ubuntu-packages-available: [info] Uncompressing layer sha256:40d16f30db405106ef8074779bdf41f012465c2a785bbeaa2eab9f2081099b47 30 MB
    build_template_test.go:133: test-ubuntu-packages-available: [info] Uncompressing layer sha256:2788434eb70f9e0b0f6f07c26f0a4a479b435c0d481969183d7080172da3339e 13 MB
    build_template_test.go:133: test-ubuntu-packages-available: [info] Uncompressing layer sha256:8c4b1b28875140ed3abacaf16ad0d696f6bef912f52d2148f261a23e3349465b 168 B
    build_template_test.go:133: test-ubuntu-packages-available: [info] Layers extracted
    build_template_test.go:133: test-ubuntu-packages-available: [info] Root filesystem structure: bin, boot, dev, etc, home, lib, lib32, lib64, libx32, media, mnt, opt, proc, root, run, sbin, srv, sys, tmp, usr, var
    build_template_test.go:133: test-ubuntu-packages-available: [info] Provisioning sandbox template
    build_template_test.go:133: test-ubuntu-packages-available: [info] Provisioning was successful, cleaning up
    build_template_test.go:133: test-ubuntu-packages-available: [info] Sandbox template provisioned
    build_template_test.go:133: test-ubuntu-packages-available: [info] [base] DEFAULT USER user [ea1d9e9a4e5e72b3edd251b28ade9fa6aa5a91811560507694d4964fdbac723b]
    build_template_test.go:133: test-ubuntu-packages-available: [info] [builder 1/15] RUN dpkg-query -W -f='${Status}' systemd | grep -q 'install ok installed' [5bd78c18502125455838301caab3681c2c6b4ca60d9fa68da6413d114e66fcd1]
    build_template_test.go:133: test-ubuntu-packages-available: [info] [builder 2/15] RUN dpkg-query -W -f='${Status}' systemd-sysv | grep -q 'install ok installed' [c70304f4cb528579ea2367f953ab7261ab1f19d6decf29076e77004f5ea7ce69]
    build_template_test.go:133: test-ubuntu-packages-available: [info] [builder 3/15] RUN dpkg-query -W -f='${Status}' openssh-server | grep -q 'install ok installed' [b879a42a745c94dca27f0015e8d81dd26cde37c282d1d7d59b2b18a2fb2e8a46]
    build_template_test.go:133: test-ubuntu-packages-available: [info] [builder 4/15] RUN dpkg-query -W -f='${Status}' sudo | grep -q 'install ok installed' [1232efbed1e6d688f5a6835c7243bd2f124084bfe470b90b76ec30e5f9a5a073]
    build_template_test.go:133: test-ubuntu-packages-available: [info] [builder 5/15] RUN dpkg-query -W -f='${Status}' chrony | grep -q 'install ok installed' [3accb35cf9f39a8471fdbf4f7d96d37db47b82386e11bfda3fa3cec34cc035b0]
    build_template_test.go:133: test-ubuntu-packages-available: [info] [builder 6/15] RUN dpkg-query -W -f='${Status}' socat | grep -q 'install ok installed' [6ddc2345ec57bb1e9f9aa369ef2377600d467bc6a97341bddd6ea1276fbaf1a1]
    build_template_test.go:133: test-ubuntu-packages-available: [info] [builder 7/15] RUN dpkg-query -W -f='${Status}' curl | grep -q 'install ok installed' [ceea99953b949ee5dd0187af82efeb45fcdc0da7a2ed6b504a860f301d2e521a]
    build_template_test.go:133: test-ubuntu-packages-available: [info] [builder 8/15] RUN dpkg-query -W -f='${Status}' ca-certificates | grep -q 'install ok installed' [74c42c8d3421991ff88bae29ad98d00d603a68be8804c54eefed2217573f1ecb]
    build_template_test.go:133: test-ubuntu-packages-available: [info] [builder 9/15] RUN dpkg-query -W -f='${Status}' fuse3 | grep -q 'install ok installed' [c9eb2c947b7871404f9eeb25daafff06d932a97a43a6c548efce5246346fede3]
    build_template_test.go:133: test-ubuntu-packages-available: [info] [builder 10/15] RUN dpkg-query -W -f='${Status}' iptables | grep -q 'install ok installed' [347aef91443b0c5ff4a224916f0f95ca927f9f0620dfd613b6826252da72b16e]
    build_template_test.go:133: test-ubuntu-packages-available: [info] [builder 11/15] RUN dpkg-query -W -f='${Status}' git | grep -q 'install ok installed' [eb2a9975124b77eb4821be117dd05a80f9d1323c7eeddb6649782e2d8eeb3557]
    build_template_test.go:133: test-ubuntu-packages-available: [info] [builder 12/15] RUN dpkg-query -W -f='${Status}' less | grep -q 'install ok installed' [afcb1768b77dcf4558d2911f8067304e3115f332c9abc79f91f40f071a55ccbb]
    build_template_test.go:133: test-ubuntu-packages-available: [info] [builder 13/15] RUN dpkg-query -W -f='${Status}' nftables | grep -q 'install ok installed' [844f8d0c5e681a243974788aa5d2c1a1eb030b0596337995e91ad44448d60cd1]
    build_template_test.go:133: test-ubuntu-packages-available: [info] [builder 14/15] RUN dpkg-query -W -f='${Status}' iputils-ping | grep -q 'install ok installed' [97ccd6cd6a17033a5244b9885f7ffd8ede36a7c41e644c76d11f3942a5e6423f]
    build_template_test.go:133: test-ubuntu-packages-available: [info] [builder 15/15] RUN dpkg-query -W -f='${Status}' jq | grep -q 'install ok installed' [91994f0fbdcccde7d1a09a16df56175728e6c1b460ba7f651a50d08db35082bb]
    build_template_test.go:133: test-ubuntu-packages-available: [info] [finalize] Finalizing template build [65fe54f643a2363d5aef06871c739d8f0a7848fbe3d30d1e89cbd68410b18b37]
    build_template_test.go:133: test-ubuntu-packages-available: [info] [optimize] Optimizing template [0ebbd76eaf0fc4f471a2470b1b09cb8cd3bc75b31f6d0e8fade7551e51aa5204]
    build_template_test.go:1060: 
        	Error Trace:	.../api/templates/build_template_test.go:96
        	            				.../api/templates/build_template_test.go:1060
        	Error:      	Received unexpected error:
        	            	Get "http://localhost:.../builds/c9d17d03-bd62-45c9-a999-03cdb544b6db/status?logsOffset=30&level=info": context deadline exceeded
        	Test:       	TestTemplateBuildInstalledPackagesAvailable
--- FAIL: TestTemplateBuildInstalledPackagesAvailable (300.35s)

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[claude]

LGTM — small additive change introducing OpenExisting and the sbx-* enumeration helpers with no callers yet.

Extended reasoning...

Overview

This PR adds three additive cgroup helpers in packages/orchestrator/pkg/sandbox/cgroup: Manager.OpenExisting (returns a handle for an existing cgroup directory without opening clone/peak FDs), IsSandboxCgroupName (checks for non-empty sbx- prefix), and ListSandboxCgroups (reads a directory and returns sorted sbx-* subdirectory names). The noop manager grows a matching OpenExisting. A new reclaim_test.go covers the two helpers.

Security risks

None meaningful. OpenExisting does a stat-and-return with no privilege changes; ListSandboxCgroups only reads from a caller-supplied root and filters by directory + name prefix. No path traversal surface beyond what the underlying filepath.Join(RootCgroupPath, name) already does, and the prefix check rejects empty suffixes.

Level of scrutiny

Low. The existing create-and-attach sandbox path is untouched, and there are no callers of the new APIs yet — the description notes they exist to enable future reclaim of leaked sbx-* cgroups. The noop implementation correctly mirrors Create semantics so the interface stays satisfied on non-Linux/disabled paths.

Other factors

The handle returned by OpenExisting has file/memoryPeakFile as nil, which is correctly handled by the existing GetFD, ReleaseCgroupFD, GetStats (peak skipped when nil), and Remove (nil-guarded closes) methods. The bug hunting system found no issues, and the test covers the non-obvious edge cases (empty suffix, prefix-only match, non-directory entries).

[claude]

LGTM — small, additive cgroup teardown helpers with clear scoping.

Extended reasoning...

Overview

This PR adds three additive helpers to the orchestrator cgroup package: Manager.OpenExisting (attaches to an already-created sandbox cgroup), IsSandboxCgroupName (prefix check), and ListSandboxCgroups (enumerates sbx-* directories under a root). The noop manager gets a matching OpenExisting implementation, and a small test file covers the two new helpers. No existing code paths are modified.

Security risks

None of note. ListSandboxCgroups reads a directory passed by the caller (in practice RootCgroupPath), filters to sbx-* directory entries, and returns a sorted list of names — no path traversal because the names are not joined back into paths here. OpenExisting only stats the computed cgroup path and constructs a handle; teardown via Kill/Remove already exists and is unchanged.

Level of scrutiny

Low. This is leaked-cgroup cleanup machinery in orchestrator-internal code, not a hot path or security boundary. The deliberate omission of the memory.peak FD on OpenExisting is called out in the doc comment and confirmed by the author in the PR thread (the value isn't read on the teardown path), so the Gemini bot's high-priority comment is a non-issue here.

Other factors

The codecov failures are integration tests hitting 502 Bad Gateway against envd — unrelated infra flake. The new test file is build-tagged linux and covers both helpers' happy paths and the non-directory filter case.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 1ca4f17. Configure here.}