[CI only] validate snapshot registry cleanup

.github/workflows/detect-changes.yml

@@ -64,7 +64,9 @@ jobs:
                 path.startsWith("components/execd/") ||
                 path.startsWith("components/egress/") ||
                 path.startsWith("sdks/") ||
-                path.startsWith("tests/"),
+                path.startsWith("tests/") ||
+                path === "scripts/python-execd-init-e2e.sh" ||
+                path === "scripts/python-execd-hardening-e2e.sh",
               egress: (path) =>
                 workflowChanged(path, "egress-test.yml") ||
                 path.startsWith("components/egress/") ||
@@ -74,6 +76,11 @@ jobs:
                 path === "scripts/python-k8s-e2e.sh" ||
                 path === "scripts/python-k8s-e2e-ingress.sh" ||
                 path === "scripts/common/kubernetes-e2e.sh" ||
+                path === "scripts/python-k8s-execd-init-e2e.sh" ||
+                path === "tests/python/tests/test_execd_init_e2e.py" ||
+                path === "tests/python/tests/test_execd_hardening_e2e.py" ||
+                path === "server/opensandbox_server/examples/e2e.batchsandbox-template.yaml" ||
+                path.startsWith("components/execd/") ||
                 path.startsWith("kubernetes/charts/"),
               ingress: (path) =>
                 workflowChanged(path, "ingress-test.yaml") ||

.github/workflows/execd-test.yml

@@ -55,6 +55,11 @@ jobs:
         run: |
           go test -v -coverpkg=./... -coverprofile=coverage.out -covermode=atomic ./pkg/...
 
+      - name: Run execd-ebpf variant tests
+        working-directory: components/execd
+        run: |
+          CGO_ENABLED=1 go test -tags ebpf -count=1 ./pkg/ebpf/
+
       - name: Calculate coverage and generate summary
         working-directory: components/execd
         id: coverage
@@ -130,6 +135,14 @@ jobs:
           chmod +x components/execd/tests/smoke_bwrap.sh
           bash components/execd/tests/smoke_bwrap.sh
 
+      - name: Init-mode container regression (OSEP-0018)
+        if: matrix.os == 'ubuntu-latest'
+        shell: bash
+        timeout-minutes: 30
+        run: |
+          chmod +x components/execd/tests/init_container.sh
+          bash components/execd/tests/init_container.sh
+
       - name: Show logs
         if: always()
         run: |
@@ -224,6 +237,17 @@ jobs:
         working-directory: components/execd
         run: sudo -E env "PATH=$PATH" go test -tags="linux,bwrap" -v -count=1 -timeout=5m ./pkg/runtime/bwrap_test/
 
+      - name: Run isolated session init-mode reaper integration test
+        working-directory: components/execd
+        run: |
+          # bwrap lifecycle under init-mode reaper dispatch (OSEP-0018 R-o):
+          # the pre-reap barrier must serialize process-group teardown with
+          # the reaper's observe/consume while execd owns wait4.
+          sudo -E env "PATH=$PATH" go test \
+            -tags="linux,bwrap" -v -count=1 -timeout=3m \
+            -run '^TestIsolatedSessionWithInitReaper$' \
+            ./pkg/runtime
+
   required:
     name: Execd CI
     if: always()

.github/workflows/kubernetes-nightly-build.yml

@@ -112,9 +112,82 @@ jobs:
         run: |
           kind delete cluster --name "${KIND_CLUSTER}" || true
 
+  execd-init-e2e:
+    name: Execd-Init + Hardening E2E
+    needs: changes
+    if: needs.changes.outputs.relevant == 'true'
+    runs-on: ubuntu-latest
+    env:
+      KIND_CLUSTER: opensandbox-e2e
+      KIND_K8S_VERSION: v1.30.4
+      KUBECONFIG_PATH: /tmp/opensandbox-kind-kubeconfig
+      KUBECONFIG: /tmp/opensandbox-kind-kubeconfig
+      OPENSANDBOX_E2E_SANDBOX_CPU: 250m
+      OPENSANDBOX_E2E_SANDBOX_MEMORY: 512Mi
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: "1.25.0"
+
+      - name: Add Go bin to PATH
+        run: echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          version: "latest"
+
+      - name: Set up kubectl
+        uses: azure/setup-kubectl@v4
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+
+      - name: Run execd-init + hardening E2E
+        run: bash scripts/python-k8s-execd-init-e2e.sh
+
+      - name: Dump kind diagnostics
+        if: always()
+        run: |
+          kubectl get pods -A -o wide || true
+          kubectl get batchsandboxes -A || true
+          kubectl describe deployment -n opensandbox-system opensandbox-server || true
+
+      - name: Eval in-cluster server logs
+        if: always()
+        run: |
+          kubectl logs -n opensandbox-system deployment/opensandbox-server || true
+          cat /tmp/opensandbox-server-port-forward.log || true
+
+      - name: Upload Python test artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: execd-init-e2e-logs
+          path: |
+            /tmp/opensandbox-server-port-forward.log
+            /tmp/opensandbox-e2e-pods.yaml
+            /tmp/opensandbox-e2e-batchsandboxes.yaml
+          if-no-files-found: ignore
+          retention-days: 5
+
+      - name: Clean up Kind cluster
+        if: always()
+        run: |
+          kind delete cluster --name "${KIND_CLUSTER}" || true
+
   publish-nightly-latest:
     name: Publish latest (${{ matrix.component }} nightly)
-    needs: k8s-mini-e2e
+    needs: [k8s-mini-e2e, execd-init-e2e]
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     strategy:
@@ -179,21 +252,22 @@ jobs:
   required:
     name: Kubernetes Mini E2E CI
     if: ${{ always() && github.event_name == 'pull_request' }}
-    needs: [changes, k8s-mini-e2e]
+    needs: [changes, k8s-mini-e2e, execd-init-e2e]
     runs-on: ubuntu-latest
     steps:
       - name: Verify required jobs
         env:
           RELEVANT: ${{ needs.changes.outputs.relevant }}
           CHANGES_RESULT: ${{ needs.changes.result }}
           E2E_RESULT: ${{ needs.k8s-mini-e2e.result }}
+          EXECD_INIT_RESULT: ${{ needs.execd-init-e2e.result }}
         run: |
           if [[ "$CHANGES_RESULT" != "success" ]]; then
             echo "Change detection failed: $CHANGES_RESULT"
             exit 1
           fi
           if [[ "$RELEVANT" == "true" ]]; then
-            [[ "$E2E_RESULT" == "success" ]]
+            [[ "$E2E_RESULT" == "success" && "$EXECD_INIT_RESULT" == "success" ]]
           else
-            [[ "$RELEVANT" == "false" && "$E2E_RESULT" == "skipped" ]]
+            [[ "$RELEVANT" == "false" && "$E2E_RESULT" == "skipped" && "$EXECD_INIT_RESULT" == "skipped" ]]
           fi

.github/workflows/kubernetes-test.yml

@@ -94,6 +94,11 @@ jobs:
         run: |
           make lint
 
+      - name: Lint Helm charts
+        working-directory: kubernetes
+        run: |
+          make helm-lint
+
       - name: Build binary
         working-directory: kubernetes
         run: |

.github/workflows/publish-helm-chart.yml

@@ -13,13 +13,17 @@ on:
           - opensandbox
           - opensandbox-node-agent
         default: 'opensandbox-controller'
+      chart_version:
+        description: 'Chart version to release (without v prefix, e.g., 0.1.0)'
+        required: true
+        default: '0.1.0'
       app_version:
         description: 'App version (without v prefix, e.g., 0.1.0)'
         required: true
         default: '0.1.0'
   push:
     tags:
-      - 'helm/**'  # Format: helm/<component>/<app_version>, e.g., helm/opensandbox-controller/0.1.0
+      - 'helm/**'  # Format: helm/<component>/<chart_version>, e.g., helm/opensandbox-controller/0.1.0
 
 jobs:
   release-preflight:
@@ -63,12 +67,13 @@ jobs:
             VERSION=${VERSION#v}
 
             echo "component=$COMPONENT" >> $GITHUB_OUTPUT
-            echo "app_version=$VERSION" >> $GITHUB_OUTPUT
+            echo "chart_version=$VERSION" >> $GITHUB_OUTPUT
             echo "release_tag=$TAG_PATH" >> $GITHUB_OUTPUT
           else
             echo "component=${{ inputs.component }}" >> $GITHUB_OUTPUT
+            echo "chart_version=${{ inputs.chart_version }}" >> $GITHUB_OUTPUT
             echo "app_version=${{ inputs.app_version }}" >> $GITHUB_OUTPUT
-            echo "release_tag=helm/${{ inputs.component }}/${{ inputs.app_version }}" >> $GITHUB_OUTPUT
+            echo "release_tag=helm/${{ inputs.component }}/${{ inputs.chart_version }}" >> $GITHUB_OUTPUT
           fi
 
       - name: Verify release tag on origin
@@ -120,10 +125,18 @@ jobs:
         run: |
           CHART_PATH="${{ steps.chart_path.outputs.path }}"
           CHART_VERSION=$(grep '^version:' $CHART_PATH/Chart.yaml | awk '{print $2}')
+          EXPECTED_CHART_VERSION="${{ steps.parse_tag.outputs.chart_version }}"
+
+          if [ "$CHART_VERSION" != "$EXPECTED_CHART_VERSION" ]; then
+            echo "::error::Chart.yaml version '$CHART_VERSION' does not match requested chart version '$EXPECTED_CHART_VERSION'."
+            exit 1
+          fi
+
           echo "version=$CHART_VERSION" >> $GITHUB_OUTPUT
-          echo "Chart version: $CHART_VERSION"
+          echo "Verified chart version: $CHART_VERSION"
 
-      - name: Update Chart.yaml with app version
+      - name: Update Chart.yaml with app version for manual release
+        if: ${{ github.event_name == 'workflow_dispatch' }}
         run: |
           APP_VERSION="${{ steps.parse_tag.outputs.app_version }}"
           CHART_PATH="${{ steps.chart_path.outputs.path }}"
@@ -134,6 +147,14 @@ jobs:
           echo "Updated Chart.yaml:"
           cat $CHART_PATH/Chart.yaml
 
+      - name: Get app version from Chart.yaml
+        id: app_version
+        run: |
+          CHART_PATH="${{ steps.chart_path.outputs.path }}"
+          APP_VERSION=$(grep '^appVersion:' $CHART_PATH/Chart.yaml | awk '{print $2}' | tr -d '"')
+          echo "version=$APP_VERSION" >> $GITHUB_OUTPUT
+          echo "App version: $APP_VERSION"
+
       - name: Build dependencies (for opensandbox all-in-one chart)
         if: ${{ steps.parse_tag.outputs.component == 'opensandbox' }}
         run: |
@@ -160,12 +181,12 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ steps.parse_tag.outputs.release_tag }}
-          name: Helm Chart ${{ steps.parse_tag.outputs.component }} ${{ steps.chart_version.outputs.version }} (App v${{ steps.parse_tag.outputs.app_version }})
+          name: Helm Chart ${{ steps.parse_tag.outputs.component }} ${{ steps.chart_version.outputs.version }} (App v${{ steps.app_version.outputs.version }})
           body: |
             ## ${{ steps.parse_tag.outputs.component }} Helm Chart
 
             **Chart Version:** ${{ steps.chart_version.outputs.version }}
-            **App Version:** ${{ steps.parse_tag.outputs.app_version }}
+            **App Version:** ${{ steps.app_version.outputs.version }}
 
             ### Installation
 
@@ -195,7 +216,7 @@ jobs:
             ### What's Changed
 
             - Chart version: ${{ steps.chart_version.outputs.version }}
-            - App version: ${{ steps.parse_tag.outputs.app_version }}
+            - App version: ${{ steps.app_version.outputs.version }}
           files: |
             ${{ steps.parse_tag.outputs.component }}-*.tgz
           draft: false