fix(orchestrator): make copy-build handle filesystem-only snapshots

[arkamar]

copy-build unconditionally read memfile.header, but filesystem-only snapshots upload no memory snapshot (no memfile.header, memfile data, or snapfile), so copying one died with:

  failed to create reader for "<build-id>/memfile.header": object does not exist

Read metadata.json first and branch on its filesystem_only flag - the resume path's source of truth. A missing memfile.header on a full snapshot stays a hard error; fs-only builds skip memfile and snapfile.

Also drop //go:build linux from pkg/template/metadata and block/prefetch_tracker.go: the constraint was only inherited (metadata imports two pure data types from block) and would have made copy-build linux-only.

[cursor]

PR Summary

Low Risk
Narrow change to an orchestrator copy CLI using the existing metadata flag; full-snapshot copy behavior is unchanged aside from ordering metadata before memfile reads.

Overview
copy-build now loads build metadata up front and uses filesystem_only to decide whether to copy memory snapshot artifacts. Filesystem-only builds skip memfile headers/data and snapfile while still copying rootfs and metadata; full snapshots keep the previous behavior, so a missing memfile.header on a non–filesystem-only build remains a hard failure instead of being treated as filesystem-only.

^{Reviewed by Cursor Bugbot for commit a7ef94e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

❌ 9 Tests Failed:

Tests completed	Failed	Passed	Skipped
3413	9	3404	9

View the top 3 failed test(s) by shortest run time

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestCACertFromBuildSurvivesInBakedBundle

Stack Traces | 0s run time

=== RUN   TestCACertFromBuildSurvivesInBakedBundle
=== PAUSE TestCACertFromBuildSurvivesInBakedBundle
=== CONT  TestCACertFromBuildSurvivesInBakedBundle
--- FAIL: TestCACertFromBuildSurvivesInBakedBundle (0.00s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir/depth_1_lists_root_directory

Stack Traces | 0.01s run time

=== RUN   TestListDir/depth_1_lists_root_directory
=== PAUSE TestListDir/depth_1_lists_root_directory
=== CONT  TestListDir/depth_1_lists_root_directory
    filesystem_test.go:96: 
        	Error Trace:	.../tests/envd/filesystem_test.go:96
        	Error:      	Received unexpected error:
        	            	unavailable: 502 Bad Gateway
        	Test:       	TestListDir/depth_1_lists_root_directory
--- FAIL: TestListDir/depth_1_lists_root_directory (0.01s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)

Stack Traces | 0.01s run time

=== RUN   TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)
=== PAUSE TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)
=== CONT  TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)
    filesystem_test.go:96: 
        	Error Trace:	.../tests/envd/filesystem_test.go:96
        	Error:      	Received unexpected error:
        	            	unavailable: 502 Bad Gateway
        	Test:       	TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)
--- FAIL: TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory) (0.01s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir/depth_0_lists_only_root_directory

Stack Traces | 0.02s run time

=== RUN   TestListDir/depth_0_lists_only_root_directory
=== PAUSE TestListDir/depth_0_lists_only_root_directory
=== CONT  TestListDir/depth_0_lists_only_root_directory
    filesystem_test.go:96: 
        	Error Trace:	.../tests/envd/filesystem_test.go:96
        	Error:      	Received unexpected error:
        	            	unavailable: 502 Bad Gateway
        	Test:       	TestListDir/depth_0_lists_only_root_directory
--- FAIL: TestListDir/depth_0_lists_only_root_directory (0.02s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir

Stack Traces | 0.81s run time

=== RUN   TestListDir
=== PAUSE TestListDir
=== CONT  TestListDir
--- FAIL: TestListDir (0.81s)

github.com/e2b-dev/infra/tests/integration/internal/tests/api/sandboxes::TestFuseNonRootAccess

Stack Traces | 2.98s run time

=== RUN   TestFuseNonRootAccess
=== PAUSE TestFuseNonRootAccess
=== CONT  TestFuseNonRootAccess
    sandbox_fuse_test.go:45: Command [test] output: event:{start:{pid:1127}}
    sandbox_fuse_test.go:46: 
        	Error Trace:	.../api/sandboxes/sandbox_fuse_test.go:46
        	Error:      	Received unexpected error:
        	            	failed to execute command test in sandbox iuua5z3t3eoptfmzotq32: invalid_argument: protocol error: incomplete envelope: unexpected EOF
        	Test:       	TestFuseNonRootAccess
        	Messages:   	Non-root user should be able to read /dev/fuse
--- FAIL: TestFuseNonRootAccess (2.98s)

github.com/e2b-dev/infra/tests/integration/internal/tests/api/templates::TestTemplateBuildCOPY

Stack Traces | 164s run time

=== RUN   TestTemplateBuildCOPY
=== PAUSE TestTemplateBuildCOPY
=== CONT  TestTemplateBuildCOPY
    build_template_test.go:133: test-ubuntu-copy: [info] Building template uqar8c69rb1gy0ohg7os/7f5322f3-ff1d-4d18-a9e1-90543d7553ff
    build_template_test.go:133: test-ubuntu-copy: [info] [base] FROM ubuntu:24.04 [a9b3ad91e89daabce8685d67ae12aacb4a128e5aea703dc57457c0ef17079b25]
    build_template_test.go:133: test-ubuntu-copy: [info] Base Docker image size: 30 MB
    build_template_test.go:133: test-ubuntu-copy: [info] Creating file system and pulling Docker image
    build_template_test.go:133: test-ubuntu-copy: [info] Uncompressing layer sha256:ca2678b20700c15185707964d9211b1a6406196114bf675f568b6025d37b3888 30 MB
    build_template_test.go:133: test-ubuntu-copy: [info] Uncompressing layer sha256:47c4b2e1409dc1c699a615ac920fb73c2d0ade1775bd340c7c76d5c5aeb6a89b 13 MB
    build_template_test.go:133: test-ubuntu-copy: [info] Uncompressing layer sha256:8c4b1b28875140ed3abacaf16ad0d696f6bef912f52d2148f261a23e3349465b 168 B
    build_template_test.go:133: test-ubuntu-copy: [info] Layers extracted
    build_template_test.go:133: test-ubuntu-copy: [info] Root filesystem structure: bin, boot, dev, etc, home, lib, lib64, media, mnt, opt, proc, root, run, sbin, srv, sys, tmp, usr, var
    build_template_test.go:133: test-ubuntu-copy: [info] Provisioning sandbox template
    build_template_test.go:133: test-ubuntu-copy: [info] Provisioning was successful, cleaning up
    build_template_test.go:133: test-ubuntu-copy: [info] Sandbox template provisioned
    build_template_test.go:133: test-ubuntu-copy: [info] [base] DEFAULT USER user [f9aaa150221ef19e492ba626b8d9200ab9434ed5f63d02341f9e3be29c4b8760]
    build_template_test.go:133: test-ubuntu-copy: [info] [builder 1/2] COPY . /app/ [2449098e8b0a6a85d9aaa0edf0136f8bc69e9d618dac9611e42bba7c698fd629]
    build_template_test.go:133: test-ubuntu-copy: [info] [builder 2/2] RUN cat /app/hello.txt | grep 'Hello from COPY!' [2f22b685841af46c090bf872491df49e98da0615c4d2c99657645a92a5b4ee67]
    build_template_test.go:133: test-ubuntu-copy: [info] [builder 2/2] [stdout]: Hello from COPY!
    build_template_test.go:133: test-ubuntu-copy: [info] [finalize] Finalizing template build [d8abedde856dad9179d9e99f9778f17106da49a5286a30633b898c2e893b0482]
    build_template_test.go:133: test-ubuntu-copy: [error] Build failed: An internal error occurred. Please try again or contact support with the build ID.
    build_template_test.go:1156: Build failed: {<nil> An internal error occurred. Please try again or contact support with the build ID. <nil>}
--- FAIL: TestTemplateBuildCOPY (164.20s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestCACertFromBuildSurvivesInBakedBundle/installed_by_start_command_after_configure

Stack Traces | 300s run time

=== RUN   TestCACertFromBuildSurvivesInBakedBundle/installed_by_start_command_after_configure
=== PAUSE TestCACertFromBuildSurvivesInBakedBundle/installed_by_start_command_after_configure
=== CONT  TestCACertFromBuildSurvivesInBakedBundle/installed_by_start_command_after_configure
    template.go:43: test-fs-only-ca-startcmd: [info] Building template nvyga6o6s52lz8ep7swp/e29fbd7f-4f28-4129-85e3-5277d72ad49c
    template.go:43: test-fs-only-ca-startcmd: [info] [base] FROM ubuntu:22.04 [f9f564014e009a9561a82bf8c84f9314242971e833fb019936654ecba452f184]
    template.go:43: test-fs-only-ca-startcmd: [info] Base Docker image size: 30 MB
    template.go:43: test-fs-only-ca-startcmd: [info] Creating file system and pulling Docker image
    template.go:43: test-fs-only-ca-startcmd: [info] Uncompressing layer sha256:d6834b4a794c03efa2c998853e64969fa8851b11b2ade63292268872a37759d0 30 MB
    template.go:43: test-fs-only-ca-startcmd: [info] Uncompressing layer sha256:47c4b2e1409dc1c699a615ac920fb73c2d0ade1775bd340c7c76d5c5aeb6a89b 13 MB
    template.go:43: test-fs-only-ca-startcmd: [info] Uncompressing layer sha256:8c4b1b28875140ed3abacaf16ad0d696f6bef912f52d2148f261a23e3349465b 168 B
    template.go:43: test-fs-only-ca-startcmd: [info] Layers extracted
    template.go:43: test-fs-only-ca-startcmd: [info] Root filesystem structure: bin, boot, dev, etc, home, lib, lib32, lib64, libx32, media, mnt, opt, proc, root, run, sbin, srv, sys, tmp, usr, var
    template.go:43: test-fs-only-ca-startcmd: [info] Provisioning sandbox template
    template.go:43: test-fs-only-ca-startcmd: [info] Provisioning was successful, cleaning up
    template.go:43: test-fs-only-ca-startcmd: [info] Sandbox template provisioned
    template.go:43: test-fs-only-ca-startcmd: [info] CACHED [base] DEFAULT USER user [49e586c2171254c6bc4a09e84eedac32dbcf113a158c24248129af2f49cbed74]
    template.go:43: test-fs-only-ca-startcmd: [info] [finalize] Finalizing template build [70279e96eb6666b71a6809d34772050624973278a90ad784ad805d86ac1a7dd1]
    template.go:43: test-fs-only-ca-startcmd: [info] Running start command: echo 'LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJiakNDQVJXZ0F3SUJBZ0lCQVRBS0JnZ3Foa2pPUFFRREFqQWZNUjB3R3dZRFZRUURFeFJsTW1JdGRHVnoKZEMxallTMXpkR0Z5ZEdOdFpEQWVGdzB5TmpBM01UY3dOek14TXpCYUZ3MHlOakEzTVRjd09ETXlNekJhTUI4eApIVEFiQmdOVkJBTVRGR1V5WWkxMFpYTjBMV05oTFhOMFlYSjBZMjFrTUZrd0V3WUhLb1pJemowQ0FRWUlLb1pJCnpqMERBUWNEUWdBRThaZWhvZ1hGaUFoSVBjRFdpUEZmNXdoMUpWM2xqZU1tdEtXakkvNGM1WklFUWhRbGMzVGoKTGlRU0R6cFhFTmhLeXBDODYrZHZ0RlQ5Vzl2VXRvVEc1cU5DTUVBd0RnWURWUjBQQVFIL0JBUURBZ0lFTUE4RwpBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPQkJZRUZKSExWYlprdWwzNEhKMUFGQXFHL2QrOXhJajNNQW9HCkNDcUdTTTQ5QkFNQ0EwY0FNRVFDSUFkdWpVWkZLak1YVVAwYlphcWoyLzI5WWJUKzErcDMyakFqUDlFeGZPcDAKQWlCTnVQaU5vWU9GTXArRStqNkZDMzJuZzNvYWRYWUtNZFlta2VoMWgzVkVIQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K' | base64 -d > .../share/ca-certificates/e2b-startcmd-ca.crt && sleep infinity
    template.go:43: test-fs-only-ca-startcmd: [info] Waiting for template to be ready: for _ in $(seq 1 50); do test -f .../share/ca-certificates/e2b-startcmd-ca.crt && exit 0; sleep 0.2; done; exit 1
    template.go:43: test-fs-only-ca-startcmd: [info] Template is ready
    template.go:43: test-fs-only-ca-startcmd: [info] [optimize] Optimizing template [e60decced612b50c57ec74067fbd23b192a17bd777231a2d7e923fcbf8dc6505]
    ca_cert_build_test.go:123: Build timeout exceeded
--- FAIL: TestCACertFromBuildSurvivesInBakedBundle/installed_by_start_command_after_configure (300.03s)

View the full list of 1 ❄️ flaky test(s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir/depth_3_lists_all_directories_and_files

Flake rate in main: 30.77% (Passed 9 times, Failed 4 times)

Stack Traces | 0.01s run time

=== RUN   TestListDir/depth_3_lists_all_directories_and_files
=== PAUSE TestListDir/depth_3_lists_all_directories_and_files
=== CONT  TestListDir/depth_3_lists_all_directories_and_files
    filesystem_test.go:96: 
        	Error Trace:	.../tests/envd/filesystem_test.go:96
        	Error:      	Received unexpected error:
        	            	unavailable: 502 Bad Gateway
        	Test:       	TestListDir/depth_3_lists_all_directories_and_files
--- FAIL: TestListDir/depth_3_lists_all_directories_and_files (0.01s)

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[gemini-code-assist]

Code Review

This pull request updates the build copying process in packages/orchestrator/cmd/copy-build/main.go to conditionally skip copying the memfile and snapfile if the build is a filesystem-only snapshot, determined by loading the build metadata early in the execution. Feedback suggests simplifying the metadata loading logic to eliminate redundant variables and unify error handling. Additionally, the reviewer notes that loading this metadata early makes a later block of code that re-reads the same metadata file redundant, presenting an opportunity to clean up unnecessary I/O.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[claude]

LGTM — straightforward fix that reorders logic to check filesystem_only from metadata.json before deciding whether to read memfile/snapfile artifacts, correctly using the existing tested metadata.IsFilesystemOnly() helper.

What was reviewed: the branching logic for filesystem-only vs full snapshots, confirmed metadata.FromBuildID/FromFile/IsFilesystemOnly are existing, tested functions used correctly, and confirmed rootfs/metadata copying is unchanged. One nit-level issue was found (inline comment) around cross-compilation of this dev CLI on non-Linux hosts, but it doesn't affect the core fix or any CI/production path.

Extended reasoning...

Overview

Single-file change to packages/orchestrator/cmd/copy-build/main.go, a standalone dev/self-host CLI tool for copying template builds between storage backends. The fix reorders the copy logic to read metadata.json first and branch on FilesystemOnly, skipping memfile/snapfile reads for filesystem-only snapshots (which never uploaded those artifacts) while preserving the existing hard-failure behavior for genuine full snapshots missing a memfile header. Rootfs and metadata copying logic is unchanged aside from being pulled out of the removed inline snapfile-append block.

Security risks

None. This is an offline CLI operator tool that reads/writes GCS objects or local files based on operator-supplied flags; no new attack surface, auth, or trust boundary changes are introduced.

Level of scrutiny

Low-to-moderate is appropriate: this is a narrow, mechanical fix to non-production-critical tooling (not part of the sandbox creation/runtime hot path), confined to one file, and the new logic correctly reuses existing, unit-tested metadata helpers (IsFilesystemOnly, FromBuildID, FromFile) rather than introducing new parsing logic.

Other factors

The bug-hunting pass surfaced one real but nit-severity regression: importing pkg/template/metadata (which carries a transitive //go:build linux constraint) breaks cross-compilation of this CLI for non-Linux GOOS targets. This doesn't affect any CI or production build path (all of which target Linux) and is confined to a niche, unautomated local dev-tooling scenario, so it doesn't rise to blocking severity for this PR.