fix(fspy): use memfd for Linux shared memory

Replace the Linux /dev/shm-backed adapter with a sealed memfd mapping.
The memfd is handed out to injected senders by a broker task that is an
internal implementation detail of the owner mapping: create() spawns it
onto the ambient tokio runtime, and dropping the owner stops it via a
cancellation drop-guard, with a per-request cancellation check making
post-drop opens fail deterministically. Client requests carry send/recv
timeouts so an unavailable broker fails senders instead of stalling
them.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: wan9chi

CHANGELOG.md

@@ -3,6 +3,7 @@
 - **Fixed** Windows automatic input tracking now records executable image reads when process creation performs the lookup inside `NtCreateUserProcess` ([#518](https://github.com/voidzero-dev/vite-task/pull/518)).
 - **Fixed** Failures while waiting for a started task process to exit no longer incorrectly say the process failed to spawn ([#515](https://github.com/voidzero-dev/vite-task/pull/515)).
 - **Fixed** Missing env vars requested through `@voidzero-dev/vite-task-client` now return `undefined` instead of `null`, preserving Vite production `NODE_ENV` semantics when builds run through `vp run` ([#508](https://github.com/voidzero-dev/vite-task/pull/508)).
+- **Fixed** Linux file-access tracking no longer consumes the `/dev/shm` mount used by containers and Kubernetes runners ([#353](https://github.com/voidzero-dev/vite-task/issues/353)).
 - **Fixed** Windows builds no longer hang on CI when a `node_modules/.bin` `.cmd` shim is routed through PowerShell: the npm/pnpm/yarn `.ps1` wrappers read stdin and block forever on a non-TTY pipe, so the PowerShell rewrite is now skipped when stdin is not an interactive terminal, falling back to the `.cmd` (which never reads stdin) ([#491](https://github.com/voidzero-dev/vite-task/pull/491)).
 - **Added** First-party support for caching `vite build` with zero cache config, giving Vite projects correct cache hits out of the box ([vitejs/vite#22453](https://github.com/vitejs/vite/pull/22453)).
 - **Added** Support for specifying tasks from dependency packages in `dependsOn`, such as `dependsOn: [{ "task": "build", "from": "dependencies" }]` ([#479](https://github.com/voidzero-dev/vite-task/pull/479)).

Cargo.lock

@@ -116,6 +116,7 @@ ref-cast = "1.0.24"
 regex = "1.11.3"
 rusqlite = "0.39.0"
 rustc-hash = "2.1.1"
+rustix = "1.1"
 # SeccompAction::UserNotif (SECCOMP_RET_USER_NOTIF) was added after the latest published release (v0.5.0)
 seccompiler = { git = "https://github.com/rust-vmm/seccompiler", rev = "08587106340b8e3cb361c7561411510039436857" }
 serde = "1.0.219"

Cargo.toml

@@ -28,6 +28,9 @@ ctor = { workspace = true }
 rustc-hash = { workspace = true }
 subprocess_test = { workspace = true }
 
+[target.'cfg(target_os = "linux")'.dev-dependencies]
+tokio = { workspace = true, features = ["net", "rt-multi-thread", "time"] }
+
 [lints]
 workspace = true
 

crates/fspy_shared/Cargo.toml

@@ -117,9 +117,12 @@ impl Deref for Sender {
     }
 }
 
-#[expect(
-    clippy::non_send_fields_in_send_ty,
-    reason = "`Sender` holds a shared file lock that ensures there's no reader, so `shm` can be safely written to"
+#[cfg_attr(
+    not(target_os = "linux"),
+    expect(
+        clippy::non_send_fields_in_send_ty,
+        reason = "`Sender` holds a shared file lock that ensures there's no reader, so `shm` can be safely written to"
+    )
 )]
 /// SAFETY: `Sender` holds a shared file lock that ensures there's no reader, so `shm` can be safely written to.
 unsafe impl Send for Sender {}
@@ -135,9 +138,12 @@ pub struct Receiver {
     shm: Shm,
 }
 
-#[expect(
-    clippy::non_send_fields_in_send_ty,
-    reason = "Receiver doesn't read or write `shm`. It only pass it to `ReceiverLockGuard` under the lock"
+#[cfg_attr(
+    not(target_os = "linux"),
+    expect(
+        clippy::non_send_fields_in_send_ty,
+        reason = "Receiver doesn't read or write `shm`. It only passes it to `ReceiverLockGuard` under the lock"
+    )
 )]
 /// SAFETY: `Receiver` doesn't read or write `shm`. It only passes it to `ReceiverLockGuard` under the lock.
 unsafe impl Send for Receiver {}
@@ -204,78 +210,102 @@ mod tests {
 
     use super::*;
 
+    /// Runs `test` with an ambient tokio runtime on Linux, where `channel`
+    /// spawns the shared-memory broker onto it. The test body runs on the
+    /// test thread, so it may block without starving the broker.
+    fn in_service_runtime<T>(test: impl FnOnce() -> T) -> T {
+        #[cfg(target_os = "linux")]
+        let runtime = tokio::runtime::Builder::new_multi_thread()
+            .worker_threads(1)
+            .enable_io()
+            .enable_time()
+            .build()
+            .unwrap();
+        #[cfg(target_os = "linux")]
+        let _guard = runtime.enter();
+        test()
+    }
+
     #[test]
     fn smoke() {
-        let (conf, receiver) = channel(100).unwrap();
-        let cmd = command_for_fn!(conf, |conf: ChannelConf| {
-            let sender = conf.sender().unwrap();
-            let frame_size = NonZeroUsize::new(2).unwrap();
-            let mut frame = sender.claim_frame(frame_size).unwrap();
-            frame.copy_from_slice(&[4, 2]);
-        });
-        assert!(std::process::Command::from(cmd).status().unwrap().success());
+        in_service_runtime(|| {
+            let (conf, receiver) = channel(100).unwrap();
+            let cmd = command_for_fn!(conf, |conf: ChannelConf| {
+                let sender = conf.sender().unwrap();
+                let frame_size = NonZeroUsize::new(2).unwrap();
+                let mut frame = sender.claim_frame(frame_size).unwrap();
+                frame.copy_from_slice(&[4, 2]);
+            });
+            assert!(std::process::Command::from(cmd).status().unwrap().success());
 
-        let lock = receiver.lock().unwrap();
-        let mut frames = lock.iter_frames();
+            let lock = receiver.lock().unwrap();
+            let mut frames = lock.iter_frames();
 
-        let received_frame = frames.next().unwrap();
-        assert_eq!(received_frame, &[4, 2]);
+            let received_frame = frames.next().unwrap();
+            assert_eq!(received_frame, &[4, 2]);
 
-        assert!(frames.next().is_none());
+            assert!(frames.next().is_none());
+        });
     }
 
     #[test]
     #[expect(clippy::print_stdout, reason = "test diagnostics")]
     fn forbid_new_senders_after_locked() {
-        let (conf, receiver) = channel(42).unwrap();
-        let _lock = receiver.lock().unwrap();
+        in_service_runtime(|| {
+            let (conf, receiver) = channel(42).unwrap();
+            let _lock = receiver.lock().unwrap();
 
-        let cmd = command_for_fn!(conf, |conf: ChannelConf| {
-            print!("{}", conf.sender().is_ok());
+            let cmd = command_for_fn!(conf, |conf: ChannelConf| {
+                print!("{}", conf.sender().is_ok());
+            });
+            let output = std::process::Command::from(cmd).output().unwrap();
+            assert_eq!(B(&output.stdout), B("false"));
         });
-        let output = std::process::Command::from(cmd).output().unwrap();
-        assert_eq!(B(&output.stdout), B("false"));
     }
 
     #[test]
     #[expect(clippy::print_stdout, reason = "test diagnostics")]
     fn forbid_new_senders_after_receiver_dropped() {
-        let (conf, receiver) = channel(42).unwrap();
-        drop(receiver);
+        in_service_runtime(|| {
+            let (conf, receiver) = channel(42).unwrap();
+            drop(receiver);
 
-        let cmd = command_for_fn!(conf, |conf: ChannelConf| {
-            print!("{}", conf.sender().is_ok());
+            let cmd = command_for_fn!(conf, |conf: ChannelConf| {
+                print!("{}", conf.sender().is_ok());
+            });
+            let output = std::process::Command::from(cmd).output().unwrap();
+            assert_eq!(B(&output.stdout), B("false"));
         });
-        let output = std::process::Command::from(cmd).output().unwrap();
-        assert_eq!(B(&output.stdout), B("false"));
     }
 
     #[test]
     fn concurrent_senders() {
-        let (conf, receiver) = channel(8192).unwrap();
-        for i in 0u16..200 {
-            let cmd = command_for_fn!((conf.clone(), i), |(conf, i): (ChannelConf, u16)| {
-                let sender = conf.sender().unwrap();
-                let data_to_send = i.to_string();
-                sender
-                    .claim_frame(NonZeroUsize::new(data_to_send.len()).unwrap())
-                    .unwrap()
-                    .copy_from_slice(data_to_send.as_bytes());
-            });
-            let output = std::process::Command::from(cmd).output().unwrap();
-            assert!(
-                output.status.success(),
-                "Failed to send in iteration {}: {:?}",
-                i,
-                B(&output.stderr)
-            );
-        }
-        let lock = receiver.lock().unwrap();
-        let mut received_values: Vec<u16> = lock
-            .iter_frames()
-            .map(|frame| from_utf8(frame).unwrap().parse::<u16>().unwrap())
-            .collect();
-        received_values.sort_unstable();
-        assert_eq!(received_values, (0u16..200).collect::<Vec<u16>>());
+        in_service_runtime(|| {
+            let (conf, receiver) = channel(8192).unwrap();
+            for i in 0u16..200 {
+                let cmd = command_for_fn!((conf.clone(), i), |(conf, i): (ChannelConf, u16)| {
+                    let sender = conf.sender().unwrap();
+                    let data_to_send = i.to_string();
+                    sender
+                        .claim_frame(NonZeroUsize::new(data_to_send.len()).unwrap())
+                        .unwrap()
+                        .copy_from_slice(data_to_send.as_bytes());
+                });
+                let output = std::process::Command::from(cmd).output().unwrap();
+                assert!(
+                    output.status.success(),
+                    "Failed to send in iteration {}: {:?}",
+                    i,
+                    B(&output.stderr)
+                );
+            }
+            let lock = receiver.lock().unwrap();
+            let mut received_values: Vec<u16> = lock
+                .iter_frames()
+                .map(|frame| from_utf8(frame).unwrap().parse::<u16>().unwrap())
+                .collect();
+            received_values.sort_unstable();
+            assert_eq!(received_values, (0u16..200).collect::<Vec<u16>>());
+        });
     }
 }

crates/fspy_shared/src/ipc/channel/mod.rs

@@ -672,6 +672,18 @@ mod tests {
 
         const SHM_SIZE: usize = 1024 * 1024;
 
+        // On Linux, `fspy_shm::create` spawns the mapping's broker onto the
+        // ambient tokio runtime, which serves the child processes' opens.
+        #[cfg(target_os = "linux")]
+        let runtime = tokio::runtime::Builder::new_multi_thread()
+            .worker_threads(1)
+            .enable_io()
+            .enable_time()
+            .build()
+            .unwrap();
+        #[cfg(target_os = "linux")]
+        let _guard = runtime.enter();
+
         let shm = fspy_shm::create(SHM_SIZE).unwrap();
         let shm_name = shm.id().to_owned();
 

crates/fspy_shared/src/ipc/channel/shm_io.rs

@@ -7,13 +7,25 @@ license.workspace = true
 publish = false
 rust-version.workspace = true
 
-[dependencies]
+[target.'cfg(not(target_os = "linux"))'.dependencies]
 shared_memory = { workspace = true, features = ["logging"] }
 
+[target.'cfg(target_os = "linux")'.dependencies]
+base64 = { workspace = true }
+memmap2 = { workspace = true }
+rustix = { workspace = true, features = ["fs", "net"] }
+tokio = { workspace = true, features = ["macros", "net", "rt", "time"] }
+tokio-util = { workspace = true }
+tracing = { workspace = true }
+uuid = { workspace = true, features = ["v4"] }
+
 [dev-dependencies]
 ctor = { workspace = true }
 subprocess_test = { workspace = true }
 
+[target.'cfg(target_os = "linux")'.dev-dependencies]
+tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
+
 [lints]
 workspace = true