From 846b316d7247786ed6d21d935bf3bbd529999018 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Fri, 9 Oct 2026 09:09:16 -0400
Subject: [PATCH] fix: keep isolated backend tests hermetic and disk-backed

---
 core/archipelago/src/api/rpc/container.rs       |  6 ++++++
 core/archipelago/src/api/rpc/package/runtime.rs |  6 +++---
 core/archipelago/src/appgate/identity.rs        |  6 +++---
 scripts/test-backend-isolated.sh                | 12 ++++++++----
 4 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/core/archipelago/src/api/rpc/container.rs b/core/archipelago/src/api/rpc/container.rs
index 8fb5c151..b6afcb29 100644
--- a/core/archipelago/src/api/rpc/container.rs
+++ b/core/archipelago/src/api/rpc/container.rs
@@ -257,6 +257,12 @@ impl RpcHandler {
             }
         }
 
+        // Unit tests deliberately construct a handler without an orchestrator.
+        // Never let that mock cross into a real Podman command on the host.
+        if cfg!(test) && self.orchestrator.is_none() {
+            return Ok(serde_json::json!([]));
+        }
+
         let output = tokio::process::Command::new("podman")
             .args(["ps", "-a", "--format", "json"])
             .output()
diff --git a/core/archipelago/src/api/rpc/package/runtime.rs b/core/archipelago/src/api/rpc/package/runtime.rs
index 2fa2176b..0dffdfe8 100644
--- a/core/archipelago/src/api/rpc/package/runtime.rs
+++ b/core/archipelago/src/api/rpc/package/runtime.rs
@@ -1979,9 +1979,9 @@ pub(super) fn manifest_apps_dirs() -> Vec<std::path::PathBuf> {
     if let Some(root) = std::env::var_os("ARCHIPELAGO_APPS_DIR") {
         dirs.push(root.into());
     }
-    if let Ok(manifest_dir) = std::env::var("CARGO_MANIFEST_DIR") {
-        dirs.push(Path::new(&manifest_dir).join("../../apps"));
-    }
+    // Cargo exposes this at compile time, not when an already-built isolated
+    // test executable is launched from a different working directory.
+    dirs.push(Path::new(env!("CARGO_MANIFEST_DIR")).join("../../apps"));
     dirs.extend([
         Path::new("apps").to_path_buf(),
         Path::new("/opt/archipelago/apps").to_path_buf(),
diff --git a/core/archipelago/src/appgate/identity.rs b/core/archipelago/src/appgate/identity.rs
index 5ae37e4a..0abb0521 100644
--- a/core/archipelago/src/appgate/identity.rs
+++ b/core/archipelago/src/appgate/identity.rs
@@ -119,9 +119,9 @@ fn apps_dirs() -> Vec<PathBuf> {
     if let Some(root) = std::env::var_os("ARCHIPELAGO_APPS_DIR") {
         dirs.push(root.into());
     }
-    if let Ok(manifest_dir) = std::env::var("CARGO_MANIFEST_DIR") {
-        dirs.push(PathBuf::from(manifest_dir).join("../../apps"));
-    }
+    // Preserve source discovery after the prebuilt test binary moves into its
+    // networkless execution container.
+    dirs.push(PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../apps"));
     dirs.extend([
         PathBuf::from("apps"),
         PathBuf::from("/opt/archipelago/apps"),
diff --git a/scripts/test-backend-isolated.sh b/scripts/test-backend-isolated.sh
index 0ab8d6b1..6cbc6af8 100755
--- a/scripts/test-backend-isolated.sh
+++ b/scripts/test-backend-isolated.sh
@@ -19,6 +19,8 @@ if [[ ${ARCHY_TEST_ISOLATOR:-systemd} == podman ]]; then
   cargo_home=$(mkdir -p "$cargo_home" && cd "$cargo_home" && pwd)
   artifacts=$(mktemp -d)
   trap 'rm -rf -- "$artifacts"' EXIT
+  install -d "$artifacts/runtime/archipelago" "$artifacts/runtime/containers" \
+    "$artifacts/runtime/tmp"
 
   podman run --rm \
     --cpus="${ARCHY_TEST_CPUS:-4}" --memory="${ARCHY_TEST_MEMORY:-4g}" --pids-limit=2048 \
@@ -54,10 +56,12 @@ PY
 
   podman run --rm \
     --cpus="${ARCHY_TEST_CPUS:-4}" --memory="${ARCHY_TEST_MEMORY:-4g}" --pids-limit=1024 \
-    --cap-drop=all --security-opt=no-new-privileges --read-only \
-    --tmpfs /tmp:rw,size=512m --tmpfs /run:rw,size=64m \
-    --tmpfs /var/lib/archipelago:rw,size=256m --tmpfs /var/lib/containers:rw,size=256m \
-    --tmpfs /root:rw,size=64m --network=none \
+    --cap-drop=all --cap-add=chown --cap-add=fowner --cap-add=setuid --cap-add=setgid \
+    --security-opt=no-new-privileges --read-only \
+    --tmpfs /run:rw,size=64m --tmpfs /root:rw,size=64m --network=none \
+    --volume "$artifacts/runtime/tmp:/tmp:rw,Z" \
+    --volume "$artifacts/runtime/archipelago:/var/lib/archipelago:rw,Z" \
+    --volume "$artifacts/runtime/containers:/var/lib/containers:rw,Z" \
     --volume "$REPO:/workspace:ro,Z" --workdir /workspace/core \
     --env ARCHY_TEST_ISOLATED=1 \
     "$image" "$executable" --test-threads="${ARCHY_TEST_THREADS:-4}" "$@"