Problem
The current Linux marker and PID-identity supervisor cannot close one kernel-level race.
A provider can fork a child that clears its environment and creates a new session, then exit before the first user-space snapshot observes that child.
After the parent is reaped, the marker, parent PID, process group, and session links are all gone.
Polling, PR_SET_PDEATHSIG, and post-spawn cgroup placement cannot make this boundary strict.
Proposed direction
Launch each provider through a small Linux guardian before the provider can fork.
Make the guardian a child subreaper with PR_SET_CHILD_SUBREAPER, keep it alive for the provider tree, and reap adopted descendants.
Use a delegated cgroup v2 subtree when the deployment exposes one, while keeping the subreaper path usable without writable cgroups.
Do not use Bun FFI for the production guardian while Bun documents that API as experimental.
Acceptance criteria
- Clean up a normal provider tree after cooperative exit.
- Clean up a child that clears its environment, calls
setsid, and outlives a fast-exiting provider.
- Clean up the tree after abrupt driver termination.
- Keep concurrent provider trees isolated from each other.
- Revalidate process identity before signaling and never target a reused PID.
- Preserve exit-before-release event ordering and bounded shutdown behavior.
- Cover the behavior with non-privileged Linux integration tests.
References
Related
Follow-up to #83 and #84.
Problem
The current Linux marker and PID-identity supervisor cannot close one kernel-level race.
A provider can fork a child that clears its environment and creates a new session, then exit before the first user-space snapshot observes that child.
After the parent is reaped, the marker, parent PID, process group, and session links are all gone.
Polling,
PR_SET_PDEATHSIG, and post-spawn cgroup placement cannot make this boundary strict.Proposed direction
Launch each provider through a small Linux guardian before the provider can fork.
Make the guardian a child subreaper with
PR_SET_CHILD_SUBREAPER, keep it alive for the provider tree, and reap adopted descendants.Use a delegated cgroup v2 subtree when the deployment exposes one, while keeping the subreaper path usable without writable cgroups.
Do not use Bun FFI for the production guardian while Bun documents that API as experimental.
Acceptance criteria
setsid, and outlives a fast-exiting provider.References
PR_SET_CHILD_SUBREAPERRelated
Follow-up to #83 and #84.