build(embed): pin the platform builds that refuse a pause the disk cannot hold

GitOrigin-RevId: 12d33afd170f6bb7a9bcd2c8ea30a97e114261bb

Author: svalleru

embed/compose/.env

@@ -2,17 +2,17 @@
 # is tagged, and each Embed release moves these lines to it: the trailing
 # marker is what the release tooling rewrites. Everything without a marker is
 # pinned by hand.
-E2B_API_IMAGE=us-docker.pkg.dev/e2b-artifacts/api/api:v0.14.202609170000-908833e4c12 # x-release-please-version
-E2B_DB_MIGRATOR_IMAGE=us-docker.pkg.dev/e2b-artifacts/api/db-migrator:v0.14.202609170000-908833e4c12 # x-release-please-version
-E2B_CLIENT_PROXY_IMAGE=us-docker.pkg.dev/e2b-artifacts/client-proxy/client-proxy:v0.3.202609130627-59497eb9134 # x-release-please-version
-E2B_CLICKHOUSE_MIGRATOR_IMAGE=us-docker.pkg.dev/e2b-artifacts/clickhouse-migrator/clickhouse-migrator:v0.4.202609130627-59497eb9134 # x-release-please-version
+E2B_API_IMAGE=us-docker.pkg.dev/e2b-artifacts/api/api:v0.14.202610051633-d1cd3db3890 # x-release-please-version
+E2B_DB_MIGRATOR_IMAGE=us-docker.pkg.dev/e2b-artifacts/api/db-migrator:v0.14.202610051633-d1cd3db3890 # x-release-please-version
+E2B_CLIENT_PROXY_IMAGE=us-docker.pkg.dev/e2b-artifacts/client-proxy/client-proxy:v0.3.202610051633-d1cd3db3890 # x-release-please-version
+E2B_CLICKHOUSE_MIGRATOR_IMAGE=us-docker.pkg.dev/e2b-artifacts/clickhouse-migrator/clickhouse-migrator:v0.4.202610051633-d1cd3db3890 # x-release-please-version
 # dashboard-api is a platform image and moves with the release like the api it
 # serves; it must come from the same source commit as the api and db-migrator.
-E2B_DASHBOARD_API_IMAGE=us-docker.pkg.dev/e2b-artifacts/dashboard-api/dashboard-api:v0.7.202609170000-908833e4c12 # x-release-please-version
+E2B_DASHBOARD_API_IMAGE=us-docker.pkg.dev/e2b-artifacts/dashboard-api/dashboard-api:v0.7.202610051633-d1cd3db3890 # x-release-please-version
 # The dashboard has its own release line (github.com/e2b-dev/dashboard) and is
 # pinned by hand.
 E2B_DASHBOARD_IMAGE=us-docker.pkg.dev/e2b-artifacts/dashboard/dashboard:v0.2.1
-E2B_ORCHESTRATOR_VERSION=v0.16.202609212023-35cc85a6c61 # x-release-please-version
+E2B_ORCHESTRATOR_VERSION=v0.16.202610051633-d1cd3db3890 # x-release-please-version
 # envd has its own release line; the kernel, Firecracker and BusyBox are not
 # released here at all. Bumping one adds its checksum row to
 # scripts/fetch-artifacts.sh first.

embed/compose/README.md

@@ -51,10 +51,11 @@ the hub is [`../README.md`](../README.md).
   show what you have; an
   older Compose rejects the compose file with an error on `required:` before
   anything starts.
-- 12 GiB RAM recommended and 20 GiB free disk. With an orchestrator release that
-  reads `PAUSE_ADMISSION_DISK_HEADROOM_MIB` (the pin here predates it), a pause
-  the disk cannot hold is refused before it starts, keeping 1 GiB free, instead
-  of failing midway. `HUGEPAGES=2048` reserves
+- 12 GiB RAM recommended and 20 GiB free disk. A pause the disk cannot hold is
+  refused before it starts, keeping 1 GiB free
+  (`PAUSE_ADMISSION_DISK_HEADROOM_MIB`), instead of failing midway; the
+  estimate counts the sandbox's whole memory, so a large sandbox needs that
+  much free disk to pause. `HUGEPAGES=2048` reserves
   4 GiB of that RAM for sandboxes, and `preflight` does not check RAM, so on
   a smaller host the first signal is `host-setup` failing with `FIX: give the
   host more memory (12 GiB recommended) or lower HUGEPAGES`. Lower
@@ -391,12 +392,9 @@ restarts; a single machine has nowhere to drain them to.
 - The team API key rotates only through the seed (set `TEAM_API_KEY`, or
   remove the key file, then `up`), not through an API call, and the old key
   keeps working for up to five minutes afterwards.
-- With an api release that reads `PAUSE_REFUSAL_RESTORE` (the pin here
-  predates it), a pause the node refuses — it is still persisting the
-  sandbox's parent — leaves the sandbox running and answers 503; retry it.
-  Until then a refused pause ends the old way, with the sandbox killed and a
-  500. A full disk is not a refusal in the pinned orchestrator: that pause
-  fails after it has started and ends the same old way.
+- A pause the node refuses — it is still persisting the sandbox's parent, or
+  the disk cannot hold the capture — leaves the sandbox running and answers
+  503 (`PAUSE_REFUSAL_RESTORE`); retry it.
 - Container logs are capped: every service keeps at most five 50 MiB log
   files (`x-logging` in `compose.yaml`), so `docker compose logs` shows about
   the last 250 MiB per service and older lines are gone. Without the cap a

embed/kubernetes/kustomization.yaml

@@ -12,19 +12,19 @@ resources:
 images:
   - name: E2B_API_IMAGE
     newName: us-docker.pkg.dev/e2b-artifacts/api/api
-    newTag: v0.14.202609170000-908833e4c12 # x-release-please-version
+    newTag: v0.14.202610051633-d1cd3db3890 # x-release-please-version
   - name: E2B_DB_MIGRATOR_IMAGE
     newName: us-docker.pkg.dev/e2b-artifacts/api/db-migrator
-    newTag: v0.14.202609170000-908833e4c12 # x-release-please-version
+    newTag: v0.14.202610051633-d1cd3db3890 # x-release-please-version
   - name: E2B_CLIENT_PROXY_IMAGE
     newName: us-docker.pkg.dev/e2b-artifacts/client-proxy/client-proxy
-    newTag: v0.3.202609130627-59497eb9134 # x-release-please-version
+    newTag: v0.3.202610051633-d1cd3db3890 # x-release-please-version
   - name: E2B_CLICKHOUSE_MIGRATOR_IMAGE
     newName: us-docker.pkg.dev/e2b-artifacts/clickhouse-migrator/clickhouse-migrator
-    newTag: v0.4.202609130627-59497eb9134 # x-release-please-version
+    newTag: v0.4.202610051633-d1cd3db3890 # x-release-please-version
   - name: E2B_DASHBOARD_API_IMAGE
     newName: us-docker.pkg.dev/e2b-artifacts/dashboard-api/dashboard-api
-    newTag: v0.7.202609170000-908833e4c12 # x-release-please-version
+    newTag: v0.7.202610051633-d1cd3db3890 # x-release-please-version
   - name: E2B_DASHBOARD_IMAGE
     newName: us-docker.pkg.dev/e2b-artifacts/dashboard/dashboard
     newTag: v0.2.1
@@ -44,7 +44,7 @@ images:
 configMapGenerator:
   - name: e2b-versions
     literals:
-      - E2B_ORCHESTRATOR_VERSION=v0.16.202609212023-35cc85a6c61 # x-release-please-version
+      - E2B_ORCHESTRATOR_VERSION=v0.16.202610051633-d1cd3db3890 # x-release-please-version
       - E2B_ENVD_VERSION=v0.9.202609130627-59497eb9134
       - E2B_KERNEL_VERSION=vmlinux-6.1.177_5008931
       - E2B_FIRECRACKER_VERSION=v1.14-0.2.0

embed/tests/pins.bats

@@ -22,6 +22,36 @@ setup() {
   fi
 }
 
+# A refused pause keeps the sandbox running only once the api reads
+# PAUSE_REFUSAL_RESTORE, and a pause the disk cannot hold is refused up front
+# only once the orchestrator reads PAUSE_ADMISSION_DISK_HEADROOM_MIB; both
+# shipped in the builds of 2026-10-05, which compose.yaml sets both variables
+# for. Older pins ignore the variables and a refusal kills the sandbox, so
+# the pins must not slide back below those builds.
+@test "api pin is at least the build that reads PAUSE_REFUSAL_RESTORE" {
+  grep -q 'PAUSE_REFUSAL_RESTORE: "true"' compose/compose.yaml
+  api_tag="$(sed -n 's/^E2B_API_IMAGE=.*:\(v[^ #]*\).*/\1/p' compose/.env)"
+  [ -n "$api_tag" ]
+  min=v0.14.202610051633
+  lowest="$(printf '%s\n%s\n' "$min" "$api_tag" | sort -V | head -1)"
+  if [ "$lowest" != "$min" ]; then
+    echo "E2B_API_IMAGE is $api_tag; PAUSE_REFUSAL_RESTORE is read from api build $min on" >&2
+    return 1
+  fi
+}
+
+@test "orchestrator pin is at least the build that reads PAUSE_ADMISSION_DISK_HEADROOM_MIB" {
+  grep -q 'PAUSE_ADMISSION_DISK_HEADROOM_MIB: "1024"' compose/compose.yaml
+  orch_tag="$(sed -n 's/^E2B_ORCHESTRATOR_VERSION=\(v[^ #]*\).*/\1/p' compose/.env)"
+  [ -n "$orch_tag" ]
+  min=v0.16.202610051633
+  lowest="$(printf '%s\n%s\n' "$min" "$orch_tag" | sort -V | head -1)"
+  if [ "$lowest" != "$min" ]; then
+    echo "E2B_ORCHESTRATOR_VERSION is $orch_tag; PAUSE_ADMISSION_DISK_HEADROOM_MIB is read from orchestrator build $min on" >&2
+    return 1
+  fi
+}
+
 # The whole tag, not the SemVer prefix: an auto-deploy tag carries the commit
 # after a hyphen, and two images from different commits must not compare equal.
 @test "api and db-migrator pins move together" {