test(podman): add real-daemon coverage for resource limits and daemon failure

Neither the Podman driver's resource-limit enforcement nor its behavior
when the Podman daemon is unreachable had any test coverage against a
real daemon; both were only exercised through unit tests against a
mocked Podman client.

podman_resource_limits.rs creates a sandbox with --cpu/--memory flags and
reads /sys/fs/cgroup/memory.max and cpu.max from inside the sandbox
itself, verifying the limit is actually enforced rather than just echoed
back by the template API. Expected values are cross-checked against the
driver's own parse_cpu_to_microseconds/parse_memory_to_bytes and against
a real local `podman run --cpus/--memory` container.

podman_preflight.rs spawns the standalone openshell-driver-podman binary
against a guaranteed-nonexistent Podman socket and asserts it exits
non-zero within its bounded retry window with an actionable error naming
the socket path, rather than hanging or failing silently.

Signed-off-by: politerealism <burdcat17@gmail.com>

Author: politerealism

e2e/rust/Cargo.toml

@@ -88,6 +88,11 @@ name = "podman_gateway_start"
 path = "tests/podman_gateway_start.rs"
 required-features = ["e2e-podman"]
 
+[[test]]
+name = "podman_preflight"
+path = "tests/podman_preflight.rs"
+required-features = ["e2e-podman"]
+
 [[test]]
 name = "podman_corporate_proxy"
 path = "tests/podman_corporate_proxy.rs"
@@ -98,6 +103,11 @@ name = "podman_oci_identity"
 path = "tests/podman_oci_identity.rs"
 required-features = ["e2e-podman"]
 
+[[test]]
+name = "podman_resource_limits"
+path = "tests/podman_resource_limits.rs"
+required-features = ["e2e-podman"]
+
 [[test]]
 name = "podman_userns"
 path = "tests/podman_userns.rs"

e2e/rust/tests/podman_preflight.rs

@@ -0,0 +1,116 @@
+// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+#![cfg(feature = "e2e-podman")]
+
+//! Podman driver daemon-unavailable e2e tests.
+//!
+//! These tests verify that `openshell-driver-podman` fails fast with an
+//! actionable error when it cannot reach a Podman API socket, instead of
+//! hanging or silently serving gRPC against a dead connection.
+//!
+//! The tests do NOT require a running Podman daemon or gateway — they point
+//! `--podman-socket` at a path that is guaranteed not to exist to simulate
+//! the daemon being unavailable.
+
+use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant};
+
+use openshell_e2e::harness::output::strip_ansi;
+
+/// Locate the workspace root by walking up from this crate's manifest directory.
+fn workspace_root() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .ancestors()
+        .nth(2)
+        .expect("failed to resolve workspace root from CARGO_MANIFEST_DIR")
+        .to_path_buf()
+}
+
+/// Return the path to the `openshell-driver-podman` binary.
+///
+/// Uses `OPENSHELL_EXTERNAL_DRIVER_BIN` when set (the same env var the shell
+/// e2e harness uses for prebuilt standalone driver artifacts), otherwise
+/// expects the binary at `<workspace>/target/debug/openshell-driver-podman`.
+fn driver_podman_bin() -> PathBuf {
+    let bin = std::env::var_os("OPENSHELL_EXTERNAL_DRIVER_BIN").map_or_else(
+        || workspace_root().join("target/debug/openshell-driver-podman"),
+        PathBuf::from,
+    );
+    assert!(
+        bin.is_file(),
+        "openshell-driver-podman binary not found at {} — set OPENSHELL_EXTERNAL_DRIVER_BIN \
+         or run `cargo build -p openshell-driver-podman` first",
+        bin.display()
+    );
+    bin
+}
+
+/// Run `openshell-driver-podman` pointed at a Podman socket that does not
+/// exist, and wait for it to exit.
+///
+/// The driver retries a handful of times before giving up (to tolerate the
+/// socket briefly re-activating), so this can take several seconds.
+async fn run_with_unreachable_podman_socket() -> (String, i32, Duration, PathBuf) {
+    let tmpdir = tempfile::tempdir().expect("create isolated socket dir");
+    let missing_socket = tmpdir.path().join("openshell-e2e-nonexistent-podman.sock");
+
+    let start = Instant::now();
+    let mut cmd = tokio::process::Command::new(driver_podman_bin());
+    cmd.arg("--podman-socket")
+        .arg(&missing_socket)
+        .kill_on_drop(true)
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::piped());
+
+    let output = tokio::time::timeout(Duration::from_secs(60), cmd.output())
+        .await
+        .expect("openshell-driver-podman should exit instead of hanging")
+        .expect("spawn openshell-driver-podman");
+    let elapsed = start.elapsed();
+    let stdout = String::from_utf8_lossy(&output.stdout).to_string();
+    let stderr = String::from_utf8_lossy(&output.stderr).to_string();
+    let combined = format!("{stdout}{stderr}");
+    let code = output.status.code().unwrap_or(-1);
+    (combined, code, elapsed, missing_socket)
+}
+
+/// `openshell-driver-podman` should exit non-zero, not hang, when its
+/// configured Podman socket does not exist.
+#[tokio::test]
+async fn driver_exits_when_podman_socket_unreachable() {
+    let (output, code, elapsed, _) = run_with_unreachable_podman_socket().await;
+
+    assert_ne!(
+        code, 0,
+        "driver should exit non-zero when Podman is unreachable, output:\n{output}"
+    );
+
+    assert!(
+        elapsed < Duration::from_secs(30),
+        "driver should give up retrying and exit within its bounded retry \
+         window (took {}s), output:\n{output}",
+        elapsed.as_secs()
+    );
+}
+
+/// The error surfaced when the Podman socket is unreachable should name the
+/// configured socket path and describe a connection failure, not a generic
+/// panic or timeout with no actionable detail.
+#[tokio::test]
+async fn driver_error_names_unreachable_socket() {
+    let (output, code, _, missing_socket) = run_with_unreachable_podman_socket().await;
+
+    assert_ne!(code, 0);
+    let clean = strip_ansi(&output);
+
+    assert!(
+        clean.contains("connection error"),
+        "driver error should describe a connection failure:\n{clean}"
+    );
+    assert!(
+        clean.contains(missing_socket.to_str().expect("socket path is utf-8")),
+        "driver error should name the unreachable socket path {}:\n{clean}",
+        missing_socket.display()
+    );
+}

e2e/rust/tests/podman_resource_limits.rs

@@ -0,0 +1,69 @@
+// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+#![cfg(feature = "e2e-podman")]
+
+//! Podman-specific E2E coverage verifying that declared sandbox CPU/memory
+//! resource limits are actually enforced by cgroups inside the workload, not
+//! just echoed back by the API/template layer.
+//!
+//! `e2e/rust/tests/sandbox_templates.rs` already verifies that
+//! `sandbox template create --cpu ... --memory ...` is stored and returned
+//! correctly, but it never inspects the resulting container's real resource
+//! state. This test creates a sandbox with those flags directly and reads the
+//! cgroup v2 interface files from inside the sandbox itself, so it exercises
+//! the actual enforcement boundary the workload experiences.
+
+use openshell_e2e::harness::sandbox::SandboxGuard;
+
+const CPU_REQUEST: &str = "500m";
+const MEMORY_REQUEST: &str = "512Mi";
+
+// "500m" (500 millicores) becomes a 50000us quota over Podman's 100000us
+// (100ms) CFS period — see
+// crates/openshell-driver-podman/src/container.rs's parse_cpu_to_microseconds.
+// Verified directly against a real `podman run --cpus=0.5` container, whose
+// cpu.max reads "50000 100000".
+const EXPECTED_CPU_MAX: &str = "50000 100000";
+
+// "512Mi" (mebibytes) becomes exactly 512 * 1024 * 1024 bytes — see
+// crates/openshell-driver-podman/src/container.rs's parse_memory_to_bytes.
+// Verified directly against a real `podman run --memory=512m` container,
+// whose memory.max reads "536870912".
+const EXPECTED_MEMORY_MAX: &str = "536870912";
+
+#[tokio::test]
+async fn sandbox_resource_limits_are_enforced_via_cgroups() {
+    if std::env::var("OPENSHELL_E2E_DRIVER").as_deref() != Ok("podman") {
+        eprintln!("Skipping Podman resource-limit test: e2e driver is not podman");
+        return;
+    }
+
+    let mut sandbox = SandboxGuard::create(&["--cpu", CPU_REQUEST, "--memory", MEMORY_REQUEST])
+        .await
+        .expect("sandbox create with resource limits should succeed");
+
+    let memory_max = sandbox
+        .exec(&["cat", "/sys/fs/cgroup/memory.max"])
+        .await
+        .expect("read memory.max from sandbox cgroup")
+        .trim()
+        .to_string();
+    assert_eq!(
+        memory_max, EXPECTED_MEMORY_MAX,
+        "sandbox cgroup should enforce the declared {MEMORY_REQUEST} memory limit, got {memory_max}"
+    );
+
+    let cpu_max = sandbox
+        .exec(&["cat", "/sys/fs/cgroup/cpu.max"])
+        .await
+        .expect("read cpu.max from sandbox cgroup")
+        .trim()
+        .to_string();
+    assert_eq!(
+        cpu_max, EXPECTED_CPU_MAX,
+        "sandbox cgroup should enforce the declared {CPU_REQUEST} CPU limit, got {cpu_max}"
+    );
+
+    sandbox.cleanup().await;
+}