[cdalar]

Summary

• onctl up -n <name> for the fc provider was spending most of its wall time (~4.6s sys time observed) on a plain io.Copy of the entire base rootfs image on every Deploy.
• The cache disk preparer already avoided this via a copy-on-write reflink (cp --reflink=always); the rootfs preparer now does the same, falling back to a full byte-for-byte copy on filesystems that don't support reflinks.

Test plan

• go build ./...
• go vet ./...
• go test ./internal/providerfc/...
• gofmt -l clean

🤖 Generated with Claude Code

https://claude.ai/code/session_01PVpF4aLeq6xpokgHiBCy4v

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7e7000483c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cdalar]

The claude-review check is failing on an infra step unrelated to this PR's diff: the action fails while adding the anthropics/claude-code marketplace with HTTPS authentication failed... fatal: could not read Username for 'https://github.com': terminal prompts disabled. This has happened identically on both commits so far (7e70004 and e39aed4), before any review logic runs — it's a credential-helper/auth problem in the workflow's marketplace-setup step, not something this PR's code touches or can fix. Re-running the job once to rule out a one-off; if it fails the same way again, the workflow config needs attention.

---

Generated by Claude Code

[cdalar]

Build (stable) failed on TestActionCmd_DownloadFile_404 (cmd/coverage_test.go), which hits the external service https://httpstat.us/404 and got a 502 Bad Gateway instead of the expected 404. That's an external-service hiccup in a pre-existing test unrelated to this PR's change (internal/providerfc/common.go). Re-running the failed job once to confirm.

---

Generated by Claude Code

[cdalar]

Build (stable) failed again on the same test: TestActionCmd_DownloadFile_404 (cmd/coverage_test.go:153) got a 502 Bad Gateway from https://httpstat.us/404 instead of the expected 404, on both this run and the previous one. That confirms it's not a one-off flake — httpstat.us is consistently unreliable from this runner — but it's still unrelated to this PR's change (internal/providerfc/common.go), which the CI graph confirms: Lint, Vuln, security, CodeQL, Analyze(go), and Test deployment are all green on this same commit.

Root cause and fix are outside this PR's scope (pre-existing test, unrelated file), so per the drive-to-green policy I'm not widening this PR to patch it. For whoever picks this up: swap the external call for an httptest.NewServer returning a fixed 404, e.g.:

srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
    w.WriteHeader(http.StatusNotFound)
}))
defer srv.Close()
err := downloadFile(srv.URL, tempFile)

That removes the external dependency entirely rather than just re-pointing it. I won't re-run this again (already used one re-run to rule out a transient flake); merging is blocked on this until it's fixed or the branch protection rule for Build (stable) is relaxed to tolerate this known-unrelated failure.

---

Generated by Claude Code

[cdalar]

Verified in production

Deployed and tested on both live fc-hosts (aimax, fc-host):

• Timing: onctl up for the fc provider dropped from real 8.371s / sys 4.670s to real ~1.8s / sys ~0.02-0.09s — a ~4.6x wall-clock improvement, entirely from the rootfs reflink fix.
• Reflink confirmed real (not just faster disk): df showed zero additional physical disk usage after creating a 20GB rootfs image — proof it's true copy-on-write, not a full copy.
• Permissions confirmed correct: reflinked rootfs images come out 0600 as intended (verified via stat).
• Rolled out to both hosts without disrupting live traffic (in-flight GitHub Actions runners and a terminal-rental VM were left untouched during the binary swap).

Investigated further to shave the remaining ~1.8s (guest boot + SSH readiness) via SSH poll tuning, ARP pre-seeding, console-log-based readiness detection, and systemd unit reordering on a disposable clone of the golden image — all tested empirically, all had no measurable benefit beyond what's in this PR (the guest's own boot time and sshd's daemon-init cost are the real floor). Only the harmless poll-interval tightening (500ms→100ms) made it into this PR; everything else was reverted after testing showed no gain.

Ready to merge.

[cdalar]

claude-review failed again on the new commit (f3a871d) with the same pre-existing infra issue: the action fails adding the anthropics/claude-code marketplace (HTTPS authentication failed), before any review logic runs — unrelated to this PR's code (now including the new WaitForSSH poll-interval change). Re-running once.

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​golang.org/​x/​crypto@​v0.55.0 ⏵ v0.56.0	+1

View full report

[cdalar]

Pushed db50fd7: swapped TestActionCmd_DownloadFile_404's dependency on https://httpstat.us/404 for a local httptest.Server, since that external service has now returned 502 on 4 consecutive Build (stable) runs on this PR and was blocking merge on an otherwise unrelated flake. Verified locally — the test passes reliably now, and go vet/go build are clean. This was the last remaining blocker; everything else on this PR (Lint, Vuln, security, CodeQL, Analyze, Test deployment, claude-review) is green.

---

Generated by Claude Code