L0 spikes: a real Chromium task through envd-linux, the real OSWorld guest server inside a session, one public task scored 0.0 then 1.0, and the systemd-as-PID-1 incident

In one paragraph

On 2026-10-23 the Linux session prototype went from nothing to three demonstrations in one day, each backed by tests that ran and passed in the sandbox and none backed by a data file. First, envd-linux: a session made of Linux namespaces, an overlayfs on $HOME, a private Xvfb and a Python daemon speaking the envd protocol ran one real Chromium form task end to end and passed the roughly 30-check envd conformance suite over real screenshots and real XTEST input. Second, the OSWorld contract: a full-root overlay with pivot_root, a network namespace per session with a veth, an nftables policy between sessions, and then the real, unmodified OSWorld guest server inside a session with a real accessibility tree and a real /terminal read through AT-SPI. Third, one public task, e0df059f (rename a directory), through the real desktop_env package: the real SetupController ran the setup, evaluate() scored 0.0 before acting and 1.0 after a hand-written os.rename, with only librosa mocked. The same day a probe that made a session's PID 1 exec systemd started the host rootfs's enabled units, including Docker, in the host's network namespace; the residue broke three forwarding tests until the sandbox's kernel state reset. The hand-measured samples (363 MiB PSS for a Chromium session, about 2.5 s reset, 0.8 s empty session) are quoted here as single samples with no data file and are not benchmark results. The twelve full-suite runs that followed over 2026-10-24 (175 to 232 passed) are verified software evidence. "Drums" here means the L0 prototype on the sandbox's own Ubuntu 24.04 root; L0 shares files and page cache only; no shared-runtime (L1) result exists.

Setup

Host. One development sandbox: 4 vCPU, 16 GiB, kernel 6.18, cgroup v1 (hybrid), no KVM, PID 1 is not systemd; hostname and provider not recorded. Nothing launched in a cloud; no credentials.

What L0 is, in this record's own words (envd-linux-spike.md): "shared files and page cache, private state, per-session processes. It is an engineering precursor, not a Drums result. The memory number above is what L1 (shared pre-warmed runtime forks) would have to beat."

Three spikes, in order of commit:

What ran

envd-linux spike (tests that ran and passed, envd-linux/tests). The real daemon process passes the full conformance suite (drums_compare.conformance, about 30 checks: Origin/Host refusal, stale 409, validation, 404/405). One real Chromium task end to end: the form row reached the real verify-server with the attempt's generation and token; the shared template tree was byte-for-byte unchanged afterwards. Reset: a file written in $HOME and /tmp is gone after reset; a second attempt on the same slot is valid with no foreign rows. Two simultaneous sessions: files invisible to each other and to the host; the namespace sees only its own processes; session 0's X socket is on neither the filesystem nor an abstract socket from session 1; kill-all in session 0 leaves session 1 alive; typing into session 0's browser changes session 0's frame and not session 1's. A late action with the previous generation is refused with 409 during a rebuild.

OSWorld contract spike. Each session answers /platform, a 1280x800 screen and a real PNG; two sessions serve port 5000 and a second listener on 9222 at the same time on different addresses; files written under /etc, /opt, /usr/local/bin, /tmp and /home/drums in one session are absent from another and from the host; a browser task runs through the guest contract alone. Network policy (firewall.py): session to session dropped both directions even with forwarding on; a session reaches the host only at its own gateway; private, link-local (cloud metadata) and CGNAT egress dropped under NAT; a control with the firewall off reaches. The outer ownership sweep (sweep.py) was built after a killed test run left sessions, a table and ip_forward=1 and the next run failed 18 tests with "File exists".

Real guest server and one public task. tests/test_osworld_real_server.py: /platform, /screen_size, a real /screenshot; real pyautogui through /execute; launching gnome-terminal via /setup/launch makes /accessibility return a real tree with a terminal node whose text holds the command output, and /terminal returns a test string read through AT-SPI. tests/test_osworld_task_flow.py: task os/e0df059f JSON unmodified through the real DesktopEnv (OSWorld main 04718ea): reset runs the setup (sudo mkdir and a pyautogui click via /setup/execute); the observation has a real accessibility tree, screenshot and terminal key; evaluate() scores 0.0 before acting; step() runs a hand-written os.rename through /execute; evaluate() runs the real getter get_vm_command_line and metric exact_match and scores 1.0. Only librosa is replaced by a mock.

The systemd probe (envd_linux/systemd_probe.py, one run, no network namespace, a 12 s wait). The session's PID 1 exec'd /lib/systemd/systemd --system --unit=multi-user.target over the full-root overlay of the host's own Ubuntu 24.04. Observed from outside: systemd stayed PID 1, systemctl is-system-running = running, 17 active units, 0 failed, systemd-detect-virt --container = container-other.

Results

Single samples, no data file (hand-measured, quoted from the spike documents; not benchmark results):

The spike doc says of these: "One sample on this sandbox (not a benchmark)". They are not comparable with the host-delta slopes of EXP-004 and later (different workload, accounting and readiness definition).

Suite runs as software evidence (measured, docs/data/suite_runs/, pytest -q on the whole repository with every optional environment set):

Counts from commit messages alone ("141 passed", "145 passed", "148 passed, 0 failed" in dce0211) have no log on the branch and are not listed as evidence.

Failures and surprises

• The systemd-as-PID-1 incident (incident-docker-leftovers.md, d11fefa). Because the session root was a copy-on-write view of the host's /, systemd started the host rootfs's enabled units. docker.service among them ran in the sandbox's host network namespace (the probe had no private one) and created docker0, Docker's ip nat, ip filter, ip6 nat and ip6 filter tables with a FORWARD policy of DROP, and set ip_forward=1; without a cgroup namespace systemd also wrote into the host's cgroup hierarchy. Three tests that need forwarded packets then failed (142 passed, 3 failed; they had passed at 141 passed, 0 failed before the probe). A drop policy in another table's FORWARD chain overrides an accept in the run's own inet drums_* table. The author's attempt to delete the residue was refused by the sandbox's permission layer and no workaround was tried. When cleanup was later authorised, the sandbox's kernel state had been reset (uptime about 23 s) and nothing was left to clean; the record of the residue rests on the command outputs captured at the time. The suite then passed 145 with everything set. Lessons kept: exec_systemd now refuses without a private network namespace and an explicit environment variable; a systemd session needs a cgroup namespace and a trimmed unit set; on any Docker host, nat=True needs an explicit allow for the session subnet.
• Readiness flake, fixed. The end-to-end test failed in about 2 of a dozen early runs because the "display settled" check accepted the blank window Chromium paints before the page loads; the adapter now requires at least one display change after launch. 12 consecutive runs then passed. The author: "That is evidence, not proof; the settle rule is a heuristic."
• Environment traps found and recorded: terminals need a private devpts; python-xlib needs an ~/.Xauthority file; gnome-terminal needs a UTF-8 locale; the kit's python must be a wrapper script, not a symlink, or pyvenv.cfg is not found; python -m http.server hangs in a session without DNS; the current OSWorld main's recording-update probe demands the guest server be a systemd unit when the guest build is older than the host package.
• Test counts differ by invocation (108 vs 100 at the same commit) because pytest from the repo root also collects verify-server/tests and the uv environment lacks agentrl-worker. "Quote the exact command with any count."

Limitations

• No data file holds any of the performance samples; they are single hand measurements on one sandbox with no window manager (envd-linux spike) or with openbox (contract spike), a shared host network namespace in the first spike, no cgroups, and --no-sandbox --disable-gpu Chromium.
• The OSWorld image, GNOME and systemd were not used; the root filesystem is the sandbox's. Actual OSWorld application compatibility is not shown. Only 8 of the 361 test_nogdrive tasks have setups and getters that could run app-free in this sandbox (see EXP-025).
• One task, one hand-written action, not a model's; librosa mocked; the broader evaluator stack is not shown to work.
• Suite passes are software evidence of the tree at each commit, never a benchmark result. Two single failures are flakes or edit races by the author's account.
• No KVM here, so the incumbent QEMU-in-Docker backend cannot run in this sandbox at all.
• No L1 result exists.

Reproduce

pytest envd-linux compare -q                                            # fake-backed and (if root, overlayfs, Xvfb, nft, python-xlib) integration tests
DRUMS_OSW_PYTHON=<venv python> DRUMS_OSW_SRC=<OSWorld checkout> pytest envd-linux/tests/test_osworld_task_flow.py -q
DRUMS_ALLOW_SYSTEMD_PROBE=1 python -m envd_linux.systemd_probe          # only with a private network namespace and a cgroup subtree you own

Integration tests need root and must not run concurrently (veth names and the nftables table are host-global).

Sources

• docs/envd-linux-spike.md (67847dc, 2026-10-23 08:07:49 UTC)
• docs/osworld-contract-spike.md sections 1 to 9 (bc0cadb 09:09:26, 098613c 11:04:32, bd01ec8 12:34:26, 4cf869b 14:13:44, e980c46 14:37:31 UTC)
• docs/gnome-namespace-investigation.md, section "Experiment: systemd as PID 1"; docs/incident-docker-leftovers.md (d11fefa, 15:21:45 UTC)
• docs/data/suite_runs/README.md, full_suite.log to full_suite12.log
• envd-linux/envd_linux/daemon.py, session.py, session_init.py, netsetup.py, firewall.py, sweep.py, realkit.py, systemd_probe.py; envd-linux/tests/test_osworld_real_server.py, test_osworld_task_flow.py, test_osworld_real_package.py, test_session_network_policy.py, test_sweep.py
• compare/drums_compare/conformance.py
• Branch claude/linux-comparison-prep; no result file (no measured data file exists for this record)