From 24a742665082a056d08ba0091de2843281c63d1c Mon Sep 17 00:00:00 2001
From: Bill Njoroge <williamsriunge@gmail.com>
Date: Wed, 19 Aug 2026 17:09:50 -0400
Subject: [PATCH] fix(orchestrator): create /dev/fuse for dockerd; runner
 parity refinements
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-ups to the conformance campaign fixes (PR #151):

- docker: the krunfw guest kernel has fuse built in, but /dev boots as a
  plain tmpfs with no device nodes, so fuse-overlayfs (dockerd's fallback
  when its overlay probe fails) dies with 'fuse: device not found'. The
  hook now creates /dev/fuse when the kernel lists fuse, letting dockerd
  auto-pick fuse-overlayfs (CoW) — on this kernel dockerd's overlay2 probe
  mount gets EINVAL and overlay2 is never viable, so the earlier fix was
  falling back to vfs. vfs is now forced only when overlay fails AND fuse
  is absent.
- RLIMIT_NOFILE: 524288 instead of 1048576 — systemd's built-in hard
  default, which is what GitHub's runner service inherits (exact parity).
- guest PATH: cargo bin dir matches the runner user (/home/<user>/.cargo)
  instead of hardcoded /root/.cargo/bin, which the unprivileged runner
  cannot stat (nodejs/ci EACCES).
- multiarch shim: add libsystemd0:amd64 (valkey's x86_64 tarballs link
  libsystemd.so.0).

Verified live on the golden VM: hook creates /dev/fuse, dockerd 28.0.4
reports Storage Driver: fuse-overlayfs, and hello-world runs. 61
orchestrator tests pass.
---
 crates/preloop-orchestrator/src/lib.rs | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/crates/preloop-orchestrator/src/lib.rs b/crates/preloop-orchestrator/src/lib.rs
index 45032cb7..3c4cfd2f 100644
--- a/crates/preloop-orchestrator/src/lib.rs
+++ b/crates/preloop-orchestrator/src/lib.rs
@@ -1304,15 +1304,30 @@ fn docker_start_command() -> Vec<String> {
              mkdir -p {DOCKER_DATA_ROOT}; \
              modprobe overlay >/dev/null 2>&1 || true; \
              modprobe fuse >/dev/null 2>&1 || true; \
+             # The krunfw guest kernel has fuse built in, but the VM boots
+             # /dev as a plain tmpfs with only the image's baked nodes, so
+             # /dev/fuse is missing and fuse-overlayfs (dockerd's fallback
+             # when its overlay probe fails) dies with 'fuse: device not
+             # found'). Create the node when the kernel supports fuse; dockerd
+             # then auto-picks fuse-overlayfs (CoW) on kernels whose overlay
+             # probe fails, and overlay2 on stock kernels where it succeeds.
+             if grep -q fuse /proc/filesystems; then \
+               [ -e /dev/fuse ] || mknod /dev/fuse c 10 229; \
+             fi; \
              mkdir -p /tmp/.preloop-ovprobe; \
              if mount -t overlay overlay -o lowerdir=/tmp:/usr /tmp/.preloop-ovprobe 2>/dev/null; then \
                umount /tmp/.preloop-ovprobe 2>/dev/null || true; \
-               DRIVER=overlay2; \
+               DRIVER=; \
              else \
-               DRIVER=vfs; \
+               # Overlay unusable (the krunfw kernel rejects the probe mount
+               # with EINVAL). Only force vfs when fuse is unavailable too —
+               # otherwise fuse-overlayfs auto-detects and works.
+               [ -e /dev/fuse ] || DRIVER=vfs; \
              fi; \
              rmdir /tmp/.preloop-ovprobe 2>/dev/null || true; \
-             printf '{{\"data-root\":\"{DOCKER_DATA_ROOT}\",\"storage-driver\":\"%s\"}}\\n' \"$DRIVER\" > /etc/docker/daemon.json; \
+             if [ -n \"$DRIVER\" ]; then \
+               printf '{{\"data-root\":\"{DOCKER_DATA_ROOT}\",\"storage-driver\":\"%s\"}}\\n' \"$DRIVER\" > /etc/docker/daemon.json; \
+             fi; \
              start_dockerd() {{ \
                rm -f /var/run/docker.pid; \
                dockerd >/var/log/dockerd.log 2>&1 & \