Drums full-root sessions on the OSWorld image root with GNOME Shell 42.9: seven host attempts, two simultaneous GNOME sessions reported working, a CRIU 4.3 dump that failed on configfs, a black pre-dump capture

In one paragraph

Every Drums number on this site so far was measured on the sandbox's own Ubuntu 24.04 userland with openbox. A fair comparison needs the incumbent's userland, so the team tried to run Drums sessions on top of a read-only mount of the official OSWorld qcow2 root (Ubuntu 22.04.3, GNOME Shell 42.9, Chrome 130, LibreOffice 7.3.7.2, user uid 1000) on a real Ubuntu 24.04 host, between 2026-10-24 19:52 and 2026-10-25 01:27 UTC by commit time. The branch records seven owner-reported attempts and no raw artifact from any of them. Attempts one and two failed before any desktop (no ensurepip in the image's Python; no Xvfb in the image after the pivot). The first GNOME attempt reached GNOME Shell 42.9, which exited with "Oh no! Something has gone wrong" because there was no system D-Bus; a private, non-activating system bus was added. After that the owner reported two simultaneous full-root image-backed sessions each showing a working GNOME Shell as uid 1000 with separate bus IDs and mount namespaces. The sixth run reached a CRIU 4.3 dump, which failed: Error (criu/mount.c:724): mnt: FS mnt ./sys/kernel/config dev 0x15 root / unsupported id 462, because the recursively bound /sys had imported configfs and other host submounts; and the screenshot taken before the dump was entirely black with a cursor, although GNOME (PID 68) and Writer (PID 731) were alive. The readiness check written after that falsely passed the very same black capture (70 colours from the cursor's soft edges), which is recorded as a failure of the team's own check and fixed. The seventh run failed in 1.7 s before any desktop on a cgroup path the fresh sysfs lacks. Status failed, author-reported: no CRIU dump of a GNOME session on the image root has succeeded, and GNOME dump/restore compatibility is unknown. "Drums" here is still the L0 mechanism (namespaces, overlayfs, pivot_root) with the image as the lower layer; no shared-runtime (L1) result exists.

Setup

Host. A real Ubuntu 24.04 host operated by the owner, with cgroup v2 and KVM available; the instance type and hardware are not stated in the branch for these runs (the surrounding plan context is a small cloud instance). Each run ended with "all cloud resources were gone".

The session. Supervisor base_root = the read-only NBD mount of the pinned qcow2 (mount_image_rootfs.sh; qcow2 sha256 pinned in run_image_criu_probe.sh); overlay lower template:<image root>; pivot_root; drums_home=/home/user, drums_desktop=gnome (gnome-session --builtin --session=ubuntu), drums_uid=1000, drums_system_bus=true (a private dbus-daemon from a flattened copy of the image's system.conf with all activation removed), the guest server under the image's Python 3.10.12, a jammy xvfb deb (pinned from the Ubuntu snapshot archive of 2024-03-01, 863344 bytes) unpacked into the writable layer because the image has no X server for this purpose. CRIU 4.3 from the maintainer PPA's .deb installed privately by hash, because Ubuntu 24.04's archive has no criu candidate at all (a correction made on the host at 19:26).

Pre-dump requirements written before the sixth run (section 22): the token must be 16 hex characters from return code 0; the Writer must be live with the same PIDs before and after; the screen must be measurable, differ by at most 5% from the pre-dump reference, and show at least 50 distinct colours before and after.

What ran

Seven owner-reported host attempts, by source commit and commit time (UTC):

Results

The sixth run (owner-reported, section 24)

Image capture from inside the session: Ubuntu 22.04.3, GNOME Shell 42.9, Chrome 130.0.6723.58, LibreOffice 7.3.7.2, Python 3.10.12, user 1000. The file marker and the token were set; the Writer (PID 731) and GNOME (PID 68) were alive.

screenshot_before.png was entirely black with a cursor. Process liveness and version readback are not a working desktop; initial usable-pixel readiness is a separate blocker. The sixth run's /tmp logs were lost on cleanup, so the cause of the black screen is unknown; the 0.5 s start-up sleep versus window-manager readiness is a hypothesis.

The CRIU 4.3 dump was reached and FAILED:

(00.025555) Error (criu/mount.c:724): mnt: FS mnt ./sys/kernel/config dev 0x15 root / unsupported id 462

/sys was recursively bound into the session, importing configfs and the host's security, debug, bpf, pstore, efivarfs, fuse and cgroup submounts, which CRIU cannot dump. No restore, no siblings, no task evaluation happened. The author: "This is not evidence about GNOME dump/restore compatibility, and no raw FAIL is rewritten."

The black capture, kept as a fixture (the one artifact on the branch)

compare/tests/fixtures/sixth_black_capture.png: 1280x800 RGB, 3480 bytes, sha256 173bd22793e560190da6c3b45f4e4b396f61ea9c0abcfa6dbe97a495017324a4. Measured on that file by the branch's own tests: 70 distinct colours (the antialiased cursor), 133 of 1,024,000 pixels brighter than intensity 16.

The false pass (section 25, kept as found)

After the sixth run a readiness check was added: at least 50 colours and no change between frames. Replaying the real black capture through it returned ready=True after two polls (colors=70, changed fraction 0). The synthetic black test images had no cursor, so they never caught it. Recorded as a failure of the team's own check. The corrected rule: at least 50 colours, at least 5% of the document region lit, no single colour over 90%, two consecutive frames agree, at least 25% of a 16x10 grid of cells textured, AND the guest reports a window manager on the root window and at least one mapped window of at least 200x100; before the dump and on every restored sibling the Writer must additionally be an identified on-screen window (class LibreOffice/soffice, _NET_WM_PID among the live soffice.bin PIDs). The facts parser was validated against real xprop/xwininfo output from Xvfb plus Openbox plus xterm (facts_real_openbox_xterm.txt); it has not been run against GNOME.

What is established and what is not

Failures and surprises

• Seven attempts, seven different first failures, each fixed in code before the next: missing ensurepip; missing Xvfb in the image; a RUNPATH-blind library closure; a wrong session file name; no system bus; cgroup v2 controllers not enabled top-down (fixed to enable root, drums, drums/<run> one at a time with verification); the image-only kit Python passed as the host-side init interpreter; /sys recursively bound; and finally the CRIU-friendly init re-executing after the pivot with the same argv and re-joining a cgroup through a host path the fresh read-only sysfs does not have. The seventh fix is a handshake: the init joins its cgroup in stage 1, verifies membership through the pivoted root's own /proc/self/cgroup in stage 2 and waits; the host verifies membership, cgroup.procs listing and limit readback from the real kernel, then writes go; only then does Xvfb start. Review 26a states plainly that the seventh run remains a FAIL and that nothing has executed on the image or on the host's cgroup v2 since.
• The dump failure was found only because a live dump was attempted; the offline mount_problems denylist (configfs, securityfs, debugfs, tracefs, bpf, pstore, efivarfs, fusectl, cgroup, cgroup2, selinuxfs) was written after it, and "still only means 'no KNOWN CRIU blocker', never 'CRIU can dump this'".
• The two-session bus check failed on an inode-only identity that was never an identity; the raw FAIL is preserved and the check now compares device and inode.
• The owner's earlier text expected a stock CRIU 3.19 on Ubuntu 24.04; the archive has none. Private PPA 4.3 by exact hash was the replacement.
• Parity gaps the team itself lists (PARITY_GAPS): Xvfb instead of Xorg, no display manager, a non-activating private bus with LSM hooks dropped, the host's kernel instead of the image's 6.5.0-15, screen lock and clock differences. No matched-desktop claim is made.

Limitations

• No raw data from any host run is on the branch; every number and error line is author-reported. The dossier that fed this record could verify commit shas and the fixture hash, nothing else.
• "Everything after the session start (GNOME readiness, Writer, dump, restore) remains unmeasured. The full fair comparison, save/restore economics and training are still open." (section 26)
• The runner sha 65ec348 quoted for the seventh run is not a commit on this branch.
• The sandbox where the code is tested is cgroup v1 hybrid, so the v2 limit path is tested on an emulated kernel plus real v2 membership only; the host's v2 path text matching the check is a stated runtime gap.
• The CRIU POSIX-lock-after-restore failure recorded elsewhere on this site stays unresolved and was never reached here.
• The OSWorld image's licence field is blank on its dataset card; the team treats that as unresolved.
• No L1 result exists; this arm is the L0 mechanism with a different lower layer.

Reproduce

Owner-operated host steps, all gated: bash deploy/aws_host/mount_image_rootfs.sh (read-only NBD mount of the pinned qcow2); bash deploy/aws_host/install_criu_private.sh DEST --debs DEB_DIR SHA256SUMS; PYTHONPATH=envd-linux python3 -m envd_linux.limits preflight (must exit 0 on a real v2 hierarchy); python -m drums_compare.criu_probe preflight --config CFG --out DIR --scope host; only after ALL OK, python -m drums_compare.criu_probe run --config CFG --out DIR (600 s timeout in run_image_criu_probe.sh). The pre-dump mount audit now refuses to dump if the session's /proc/self/mountinfo holds any filesystem in criu.UNSUPPORTED_FS.

Sources

• docs/matched-software-plan.md sections 10 to 26b (commits 44754c0, be11875, 1d0dca7, c5ca1a3, 82af27a, 061d593, 407bc6d, b9e2a33, 128dfe3, 8e113c1, eca8571, 0155373, 3b5cb19, 19adee8, 9442746, 9f76d7e, a1c2f26, e23286d; 2026-10-24 19:52 to 2026-10-25 04:40 UTC)
• compare/tests/fixtures/sixth_black_capture.png (sha256 173bd227...324a4), facts_real_openbox_xterm.txt
• compare/drums_compare/criu_probe.py, fullroot_gates.py, boot_validate.py, bus_validate.py, pngstats.py, stages.py
• envd-linux/envd_linux/session_init.py, criu.py, limits.py, rootcheck.py, baseid.py
• deploy/aws_host/mount_image_rootfs.sh, prepare_kit_for_image.sh, add_debs_to_overlay.sh, fetch_xvfb_deb.sh, install_criu_private.sh, run_image_criu_probe.sh
• docs/gnome-namespace-investigation.md (the open systemd question)
• Branch claude/linux-comparison-prep; no result file (no measured data file exists for this record)