refactor: remove sandbox, add Blacksmith 32vcpu CI with mold linker

- Remove sandbox.rs, disk quota, and libc dependency
- Replace all shell wrappers with direct tokio::process::Command calls
- Add .cargo/config.toml for mold linker on Linux
- Add CI: Blacksmith 32vcpu runners, nightly Rust, mold, actions/cache@v4
- Add Docker build+push to GHCR on main

Author: echobt

.cargo/config.toml

@@ -0,0 +1,3 @@
+[target.x86_64-unknown-linux-gnu]
+linker = "clang"
+rustflags = ["-C", "link-arg=-fuse-ld=mold"]

.github/workflows/ci.yml

@@ -6,66 +6,131 @@ on:
   pull_request:
     branches: [main]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   CARGO_TERM_COLOR: always
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
+  CARGO_INCREMENTAL: 0
+  CARGO_NET_RETRY: 10
+  RUST_BACKTRACE: short
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    name: Lint & Format
+    runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@nightly
+
+      - name: Install mold linker
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq mold clang
+
+      - name: Install Rust nightly
+        uses: dtolnay/rust-toolchain@nightly
         with:
-          components: rustfmt, clippy
-      - uses: actions/cache@v4
+          components: clippy, rustfmt
+
+      - name: Cache cargo registry + target
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: lint-${{ runner.os }}-nightly-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            lint-${{ runner.os }}-nightly-
+
+      - name: Check formatting
+        run: cargo +nightly fmt --all -- --check
+
+      - name: Clippy
+        run: cargo +nightly clippy --all-targets -- -D warnings
+
+  build:
+    name: Build (nightly, release, 32 threads)
+    runs-on: blacksmith-32vcpu-ubuntu-2404
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install mold linker
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq mold clang
+
+      - name: Install Rust nightly
+        uses: dtolnay/rust-toolchain@nightly
+
+      - name: Cache cargo registry + target
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
             target
-          key: ${{ runner.os }}-lint-${{ hashFiles('**/Cargo.lock') }}
-      - run: cargo +nightly fmt --check
-      - run: cargo +nightly clippy -- -D warnings
+          key: build-${{ runner.os }}-nightly-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            build-${{ runner.os }}-nightly-
+
+      - name: Build release
+        run: cargo +nightly build --release -j $(nproc)
+        env:
+          RUSTFLAGS: "-C debuginfo=0 -C target-cpu=native -C link-arg=-fuse-ld=mold -D warnings"
+
+      - name: Upload binary
+        uses: actions/upload-artifact@v4
+        with:
+          name: term-executor-linux-x86_64
+          path: target/release/term-executor
+          retention-days: 7
 
-  build-and-test:
-    runs-on: ubuntu-latest
+  test:
+    name: Tests (nightly, 32 threads)
+    runs-on: blacksmith-32vcpu-ubuntu-2404
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: actions/cache@v4
+
+      - name: Install mold linker
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq mold clang
+
+      - name: Install Rust nightly
+        uses: dtolnay/rust-toolchain@nightly
+
+      - name: Cache cargo registry + target
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
             target
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-      - name: Build
-        run: cargo build --release
-      - name: Test
-        run: cargo test
+          key: test-${{ runner.os }}-nightly-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            test-${{ runner.os }}-nightly-
+
+      - name: Run tests
+        run: cargo +nightly test --release -j $(nproc) -- --test-threads=$(nproc)
+        env:
+          RUST_LOG: warn
 
   docker:
-    needs: [lint, build-and-test]
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
+    name: Docker build
+    runs-on: blacksmith-32vcpu-ubuntu-2404
+    needs: [lint, build, test]
+    if: github.ref == 'refs/heads/main'
     steps:
       - uses: actions/checkout@v4
-      - name: Log in to GHCR
+
+      - name: Login to GHCR
         uses: docker/login-action@v3
         with:
-          registry: ${{ env.REGISTRY }}
+          registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
-        uses: docker/build-push-action@v5
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
         with:
           context: .
           push: true
           tags: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
+            ghcr.io/${{ github.repository }}:latest
+            ghcr.io/${{ github.repository }}:${{ github.sha }}

Cargo.lock

@@ -55,8 +55,7 @@ tempfile = "3"
 parking_lot = "0.12"
 dashmap = "6"
 
-# Process / system
-libc = "0.2"
+
 
 [dev-dependencies]
 tokio-test = "0.4"

Cargo.toml

@@ -13,10 +13,11 @@ pub async fn remove_work_dir(path: &Path) {
 
 /// Kill all processes in a process group (best-effort).
 #[allow(dead_code)]
-pub fn kill_process_group(pgid: u32) {
-    unsafe {
-        libc::kill(-(pgid as i32), libc::SIGKILL);
-    }
+pub async fn kill_process_group(pgid: u32) {
+    let _ = tokio::process::Command::new("kill")
+        .args(["-9", &format!("-{}", pgid)])
+        .output()
+        .await;
 }
 
 /// Scan workspace base for stale session directories older than max_age_secs.

src/cleanup.rs

@@ -3,7 +3,6 @@ use std::path::PathBuf;
 const DEFAULT_PORT: u16 = 8080;
 const DEFAULT_SESSION_TTL: u64 = 1800;
 const DEFAULT_MAX_CONCURRENT: usize = 4;
-const DEFAULT_DISK_QUOTA_MB: u64 = 2048;
 const DEFAULT_CLONE_TIMEOUT: u64 = 120;
 const DEFAULT_AGENT_TIMEOUT: u64 = 600;
 const DEFAULT_TEST_TIMEOUT: u64 = 300;
@@ -17,7 +16,6 @@ pub struct Config {
     pub auth_token: Option<String>,
     pub session_ttl_secs: u64,
     pub max_concurrent_evals: usize,
-    pub disk_quota_mb: u64,
     pub clone_timeout_secs: u64,
     pub agent_timeout_secs: u64,
     pub test_timeout_secs: u64,
@@ -34,7 +32,6 @@ impl Config {
             auth_token: std::env::var("AUTH_TOKEN").ok(),
             session_ttl_secs: env_parse("SESSION_TTL_SECS", DEFAULT_SESSION_TTL),
             max_concurrent_evals: env_parse("MAX_CONCURRENT_EVALS", DEFAULT_MAX_CONCURRENT),
-            disk_quota_mb: env_parse("DISK_QUOTA_MB", DEFAULT_DISK_QUOTA_MB),
             clone_timeout_secs: env_parse("CLONE_TIMEOUT_SECS", DEFAULT_CLONE_TIMEOUT),
             agent_timeout_secs: env_parse("AGENT_TIMEOUT_SECS", DEFAULT_AGENT_TIMEOUT),
             test_timeout_secs: env_parse("TEST_TIMEOUT_SECS", DEFAULT_TEST_TIMEOUT),
@@ -54,7 +51,6 @@ impl Config {
         tracing::info!("║  Auth:              {:<28}║", if self.auth_token.is_some() { "enabled" } else { "disabled" });
         tracing::info!("║  Max concurrent:    {:<28}║", self.max_concurrent_evals);
         tracing::info!("║  Session TTL:       {:<25}s ║", self.session_ttl_secs);
-        tracing::info!("║  Disk quota:        {:<24}MB ║", self.disk_quota_mb);
         tracing::info!("║  Clone timeout:     {:<25}s ║", self.clone_timeout_secs);
         tracing::info!("║  Agent timeout:     {:<25}s ║", self.agent_timeout_secs);
         tracing::info!("║  Test timeout:      {:<25}s ║", self.test_timeout_secs);
@@ -79,7 +75,6 @@ mod tests {
         let cfg = Config::from_env();
         assert_eq!(cfg.port, DEFAULT_PORT);
         assert_eq!(cfg.max_concurrent_evals, DEFAULT_MAX_CONCURRENT);
-        assert_eq!(cfg.disk_quota_mb, DEFAULT_DISK_QUOTA_MB);
     }
 
     #[test]