Add sandbox engine integration and per-job executor overrides

.gitlab-ci.yml

@@ -11,7 +11,6 @@ default:
   before_script:
     - rustc --version
     - cargo --version
-    - rustup component add rustfmt clippy
     - export CARGO_TARGET_DIR="$CI_PROJECT_DIR/target/${CI_JOB_NAME_SLUG:-job}"
   cache:
     key: "$CI_COMMIT_REF_SLUG"
@@ -23,9 +22,17 @@ variables:
   CARGO_TERM_COLOR: always
   CARGO_HOME: "$CI_PROJECT_DIR/.cargo"
   CARGO_BUILD_JOBS: "1"
+  RUSTC_WRAPPER: ""
+  SCCACHE_DISABLE: "1"
 
 fetch-sources:
   stage: deps
+  cache:
+    key: "$CI_COMMIT_REF_SLUG"
+    policy: pull-push
+    paths:
+      - .cargo/
+      - target/
   script:
     - cargo fetch --locked
 
@@ -34,8 +41,20 @@ rust-checks:
   needs:
     - job: fetch-sources
       artifacts: false
+  before_script:
+    - rustc --version
+    - cargo --version
+    - rustup component add rustfmt clippy
+    - export CARGO_TARGET_DIR="$CI_PROJECT_DIR/target/${CI_JOB_NAME_SLUG:-job}"
   variables:
     CARGO_INCREMENTAL: "0"
+    CARGO_NET_OFFLINE: "true"
+  cache:
+    key: "$CI_COMMIT_REF_SLUG"
+    policy: pull
+    paths:
+      - .cargo/
+      - target/
   script:
     - cargo check --workspace --all-targets --locked
     - cargo fmt --all -- --check
@@ -63,20 +82,46 @@ unit-tests:
     - job: rust-checks
       artifacts: false
   cache:
-    key: "$CI_COMMIT_REF_SLUG-unit-tests-cargo"
+    key: "$CI_COMMIT_REF_SLUG"
+    policy: pull
     paths:
       - .cargo/
+  variables:
+    CARGO_NET_OFFLINE: "true"
   script:
-    - cargo test --workspace --all-targets --locked
+    - cargo test --workspace --lib --bins --locked
 
-opal-install-smoke:
+build-opal-bin:
   stage: test
   needs:
     - job: fetch-sources
       artifacts: false
+  variables:
+    CARGO_NET_OFFLINE: "true"
+  cache:
+    key: "$CI_COMMIT_REF_SLUG"
+    policy: pull
+    paths:
+      - .cargo/
+      - target/
   script:
-    - export PATH="$CI_PROJECT_DIR/.opal-installed/bin:$PATH"
     - cargo install --path crates/opal --locked --root "$CI_PROJECT_DIR/.opal-installed"
+  artifacts:
+    paths:
+      - .opal-installed/
+
+opal-install-smoke:
+  stage: test
+  needs:
+    - job: build-opal-bin
+      artifacts: true
+  cache:
+    key: "$CI_COMMIT_REF_SLUG"
+    policy: pull
+    paths:
+      - .cargo/
+      - target/
+  script:
     - $CI_PROJECT_DIR/.opal-installed/bin/opal --version
 
 extended-tests:
@@ -88,14 +133,27 @@ extended-tests:
       artifacts: false
     - job: unit-tests
       artifacts: false
+    - job: build-opal-bin
+      artifacts: true
+  variables:
+    CARGO_NET_OFFLINE: "true"
+    OPAL_TMP_TEST_ROOT: "/tmp/opal-extended-tests"
+  before_script:
+    - rustc --version
+    - cargo --version
+    - export CARGO_TARGET_DIR="$CI_PROJECT_DIR/target/${CI_JOB_NAME_SLUG:-job}"
+    - apt-get update
+    - apt-get install -y --no-install-recommends jq podman nftables
+  cache:
+    key: "$CI_COMMIT_REF_SLUG"
+    policy: pull
+    paths:
+      - .cargo/
+      - target/
   script:
-    - if [ -d "/opal/${CI_PIPELINE_ID:-}" ] || [ -d /opal ]; then echo "skipping nested opal fixture run"; exit 0; fi
-    - command -v jq >/dev/null || (apt-get update && apt-get install -y jq)
-    - export PATH="$CI_PROJECT_DIR/.opal-installed/bin:$PATH"
-    - cargo install --path crates/opal --locked --root "$CI_PROJECT_DIR/.opal-installed"
-    - export OPAL_BIN="$CI_PROJECT_DIR/.opal-installed/bin/opal"
     - >
-      ./scripts/test-pipelines.sh
+      ./scripts/run-opal-suite-in-temp-workdir.sh
+      extended-tests
       needs-branch
       needs-optional
       needs-tag
@@ -121,16 +179,27 @@ e2e-tests:
       artifacts: false
     - job: unit-tests
       artifacts: false
+    - job: build-opal-bin
+      artifacts: true
+  variables:
+    CARGO_NET_OFFLINE: "true"
+    OPAL_TMP_TEST_ROOT: "/tmp/opal-e2e-tests"
+  before_script:
+    - rustc --version
+    - cargo --version
+    - export CARGO_TARGET_DIR="$CI_PROJECT_DIR/target/${CI_JOB_NAME_SLUG:-job}"
+    - apt-get update
+    - apt-get install -y --no-install-recommends jq podman nftables
+  cache:
+    key: "$CI_COMMIT_REF_SLUG"
+    policy: pull
+    paths:
+      - .cargo/
+      - target/
   script:
-    - if [ -d "/opal/${CI_PIPELINE_ID:-}" ] || [ -d /opal ]; then echo "skipping nested opal fixture run"; exit 0; fi
-    - command -v jq >/dev/null || (apt-get update && apt-get install -y jq)
-    - export PATH="$CI_PROJECT_DIR/.opal-installed/bin:$PATH"
-    - cargo install --path crates/opal --locked --root "$CI_PROJECT_DIR/.opal-installed"
-    - export OPAL_BIN="$CI_PROJECT_DIR/.opal-installed/bin/opal"
     - >
-      ./scripts/test-pipelines.sh
-      resources-services
-      services-readiness-failure
+      ./scripts/run-opal-suite-in-temp-workdir.sh
+      e2e-tests
       cache-policies
       cache-fallback
       dotenv-reports
@@ -141,6 +210,45 @@ e2e-tests:
     paths:
       - tests-temp/test-pipeline-logs/
 
+e2e-services:
+  stage: test
+  needs:
+    - job: fetch-sources
+      artifacts: false
+    - job: rust-checks
+      artifacts: false
+    - job: unit-tests
+      artifacts: false
+    - job: build-opal-bin
+      artifacts: true
+  variables:
+    CARGO_NET_OFFLINE: "true"
+  before_script:
+    - rustc --version
+    - cargo --version
+    - export CARGO_TARGET_DIR="$CI_PROJECT_DIR/target/${CI_JOB_NAME_SLUG:-job}"
+    - apt-get update
+    - apt-get install -y --no-install-recommends jq podman nftables
+  cache:
+    key: "$CI_COMMIT_REF_SLUG"
+    policy: pull
+    paths:
+      - .cargo/
+      - target/
+  script:
+    - command -v jq >/dev/null || (echo "jq is required for e2e-services"; exit 1)
+    - export OPAL_BIN="$CI_PROJECT_DIR/.opal-installed/bin/opal"
+    - export OPAL_TEST_SUITE="e2e-services"
+    - export OPAL_TEST_ARGS="--no-tui"
+    - >
+      ./scripts/test-pipelines.sh
+      resources-services
+      services-readiness-failure
+  artifacts:
+    when: always
+    paths:
+      - tests-temp/test-pipeline-logs/
+
 ui-docs-build:
   stage: build
   image: docker.io/library/node:22
@@ -191,6 +299,8 @@ release-artifacts:arm64:
       artifacts: false
     - job: e2e-tests
       artifacts: false
+    - job: e2e-services
+      artifacts: false
     - job: ui-docs-check
       artifacts: false
   image:
@@ -223,6 +333,8 @@ release-artifacts:amd64:
       artifacts: false
     - job: e2e-tests
       artifacts: false
+    - job: e2e-services
+      artifacts: false
     - job: ui-docs-check
       artifacts: false
   image:

crates/opal/src/app/context.rs

@@ -73,6 +73,7 @@ pub(crate) fn resolve_engine(choice: EngineChoice) -> EngineKind {
         EngineChoice::Orbstack => EngineKind::Orbstack,
         EngineChoice::Podman => EngineKind::Podman,
         EngineChoice::Nerdctl => EngineKind::Nerdctl,
+        EngineChoice::Sandbox => EngineKind::Sandbox,
     }
 }
 
@@ -83,6 +84,7 @@ pub(crate) fn resolve_engine(choice: EngineChoice) -> EngineKind {
         EngineChoice::Docker => EngineKind::Docker,
         EngineChoice::Nerdctl => EngineKind::Nerdctl,
         EngineChoice::Orbstack => EngineKind::Docker,
+        EngineChoice::Sandbox => EngineKind::Sandbox,
         EngineChoice::Container => {
             eprintln!("'container' engine is unavailable on Linux; falling back to docker");
             EngineKind::Docker
@@ -122,8 +124,7 @@ mod tests {
         let settings = OpalConfig {
             engines: EngineSettings {
                 default: Some(EngineChoice::Docker),
-                container: None,
-                preserve_runtime_objects: false,
+                ..EngineSettings::default()
             },
             ..OpalConfig::default()
         };
@@ -139,8 +140,7 @@ mod tests {
         let settings = OpalConfig {
             engines: EngineSettings {
                 default: Some(EngineChoice::Docker),
-                container: None,
-                preserve_runtime_objects: false,
+                ..EngineSettings::default()
             },
             ..OpalConfig::default()
         };

crates/opal/src/app/run.rs

@@ -7,7 +7,7 @@ use super::view::{find_history_entry_for_workdir, find_job, latest_history_entry
 use crate::config::OpalConfig;
 use crate::executor::{
     ContainerExecutor, DockerExecutor, NerdctlExecutor, OrbstackExecutor, PodmanExecutor,
-    core::ExecutionOutcome,
+    SandboxExecutor, core::ExecutionOutcome,
 };
 use crate::history::HistoryEntry;
 use crate::{EngineKind, ExecutorConfig, RunArgs};
@@ -200,6 +200,20 @@ async fn execute_with_config(config: ExecutorConfig) -> ExecutionOutcome {
                 }
             }
         }
+        EngineKind::Sandbox => {
+            let executor = SandboxExecutor::new(config.clone())
+                .await
+                .with_context(|| "failed create sandbox executor");
+            match executor {
+                Ok(executor) => executor.run().await,
+                Err(err) => {
+                    return ExecutionOutcome {
+                        history_entry: None,
+                        result: Err(err),
+                    };
+                }
+            }
+        }
     };
 
     ExecutionOutcome {
@@ -257,7 +271,7 @@ mod tests {
         let opal_home = dir.path().join("opal-home-rerun-latest");
         fs::create_dir_all(&opal_home).expect("opal home");
         unsafe {
-            env::set_var("OPAL_HOME", &opal_home);
+            env::set_var("XDG_DATA_HOME", &opal_home);
         }
         let app = OpalApp::from_current_dir().expect("app");
         save(
@@ -297,7 +311,7 @@ mod tests {
 
         assert_eq!(prepared.jobs, vec!["rust-checks"]);
         unsafe {
-            env::remove_var("OPAL_HOME");
+            env::remove_var("XDG_DATA_HOME");
         }
     }