chore: add PLAT-370 EKS DinD experiment artifacts

deploy/plat-370-experiments/eks-auto-mode-bottlerocket-envbox-experiment/cache-share-probe-a.yaml

@@ -0,0 +1,71 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: envbox-cache-probe-a
+  namespace: envbox-auto
+  labels:
+    app.kubernetes.io/name: envbox-cache-probe
+    experiment.coder.com/probe: a
+spec:
+  restartPolicy: Never
+  nodeSelector:
+    experiment.coder.com/envbox-auto: "true"
+  tolerations:
+    - key: experiment.coder.com/envbox-auto
+      operator: Equal
+      value: "true"
+      effect: NoSchedule
+  containers:
+    - name: probe
+      image: public.ecr.aws/docker/library/alpine:3.21
+      imagePullPolicy: IfNotPresent
+      command:
+        - /bin/sh
+        - -ec
+        - |
+          marker=/cache/share-probe
+
+          echo "SELinux:"
+          cat /proc/self/attr/current
+          echo "Cache mount:"
+          grep " /cache " /proc/self/mountinfo
+          echo "Cache ownership:"
+          ls -ldn /cache
+
+          if [ ! -e "$marker" ]; then
+            temporary="$(mktemp /cache/.probe-a.XXXXXX)"
+            trap 'rm -f "$temporary"' EXIT
+            printf '%s\n' probe-a-v1 > "$temporary"
+            sync
+            mv "$temporary" "$marker"
+            sync
+            trap - EXIT
+            echo "probe-a-created=$(cat "$marker")"
+          else
+            value="$(cat "$marker")"
+            test "$value" = probe-b-v1
+            echo "probe-a-observed=$value"
+          fi
+
+          stat -c 'marker-mode=%a marker-uid=%u marker-gid=%g marker-size=%s' "$marker"
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 0
+        privileged: true
+        allowPrivilegeEscalation: true
+        seccompProfile:
+          type: Unconfined
+      resources:
+        requests:
+          cpu: 10m
+          memory: 16Mi
+        limits:
+          memory: 64Mi
+      volumeMounts:
+        - name: cache
+          mountPath: /cache
+  volumes:
+    - name: cache
+      hostPath:
+        path: /var/lib/envbox-image-cache
+        type: DirectoryOrCreate

deploy/plat-370-experiments/eks-auto-mode-bottlerocket-envbox-experiment/cache-share-probe-b.yaml

@@ -0,0 +1,71 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: envbox-cache-probe-b
+  namespace: envbox-auto
+  labels:
+    app.kubernetes.io/name: envbox-cache-probe
+    experiment.coder.com/probe: b
+spec:
+  restartPolicy: Never
+  nodeSelector:
+    experiment.coder.com/envbox-auto: "true"
+  tolerations:
+    - key: experiment.coder.com/envbox-auto
+      operator: Equal
+      value: "true"
+      effect: NoSchedule
+  containers:
+    - name: probe
+      image: public.ecr.aws/docker/library/alpine:3.21
+      imagePullPolicy: IfNotPresent
+      command:
+        - /bin/sh
+        - -ec
+        - |
+          marker=/cache/share-probe
+
+          echo "SELinux:"
+          cat /proc/self/attr/current
+          echo "Cache mount:"
+          grep " /cache " /proc/self/mountinfo
+          echo "Cache ownership:"
+          ls -ldn /cache
+
+          value="$(cat "$marker")"
+          test "$value" = probe-a-v1
+          echo "probe-b-observed=$value"
+
+          temporary="$(mktemp /cache/.probe-b.XXXXXX)"
+          trap 'rm -f "$temporary"' EXIT
+          printf '%s\n' probe-b-v1 > "$temporary"
+          sync
+          mv "$temporary" "$marker"
+          sync
+          trap - EXIT
+
+          value="$(cat "$marker")"
+          test "$value" = probe-b-v1
+          echo "probe-b-published=$value"
+          stat -c 'marker-mode=%a marker-uid=%u marker-gid=%g marker-size=%s' "$marker"
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 0
+        privileged: true
+        allowPrivilegeEscalation: true
+        seccompProfile:
+          type: Unconfined
+      resources:
+        requests:
+          cpu: 10m
+          memory: 16Mi
+        limits:
+          memory: 64Mi
+      volumeMounts:
+        - name: cache
+          mountPath: /cache
+  volumes:
+    - name: cache
+      hostPath:
+        path: /var/lib/envbox-image-cache
+        type: DirectoryOrCreate

deploy/plat-370-experiments/eks-auto-mode-bottlerocket-envbox-experiment/cluster-delete.log

@@ -0,0 +1,12 @@
+2026-08-08 23:09:45 [ℹ]  deleting EKS cluster "envbox-auto-bottlerocket-136"
+2026-08-08 23:09:45 [ℹ]  deleted 0 Fargate profile(s)
+2026-08-08 23:09:46 [✔]  kubeconfig has been updated
+2026-08-08 23:09:47 [ℹ]  cleaning up AWS load balancers created by Kubernetes objects of Kind Service, Ingress, or Gateway
+2026-08-08 23:09:48 [ℹ]  1 task: { delete cluster control plane "envbox-auto-bottlerocket-136" }
+2026-08-08 23:09:48 [ℹ]  will delete stack "eksctl-envbox-auto-bottlerocket-136-cluster"
+2026-08-08 23:09:48 [ℹ]  waiting for stack "eksctl-envbox-auto-bottlerocket-136-cluster" to get deleted
+2026-08-08 23:09:48 [ℹ]  waiting for CloudFormation stack "eksctl-envbox-auto-bottlerocket-136-cluster"
+2026-08-08 23:10:19 [ℹ]  waiting for CloudFormation stack "eksctl-envbox-auto-bottlerocket-136-cluster"
+2026-08-08 23:11:08 [ℹ]  waiting for CloudFormation stack "eksctl-envbox-auto-bottlerocket-136-cluster"
+2026-08-08 23:12:10 [ℹ]  waiting for CloudFormation stack "eksctl-envbox-auto-bottlerocket-136-cluster"
+2026-08-08 23:12:10 [✔]  all cluster resources were deleted

deploy/plat-370-experiments/eks-auto-mode-bottlerocket-envbox-experiment/cluster.yaml

@@ -0,0 +1,10 @@
+apiVersion: eksctl.io/v1alpha5
+kind: ClusterConfig
+
+metadata:
+  name: envbox-auto-bottlerocket-136
+  region: us-east-2
+  version: "1.36"
+
+autoModeConfig:
+  enabled: true

deploy/plat-370-experiments/eks-auto-mode-bottlerocket-envbox-experiment/envbox-cgroup-probe.yaml

@@ -0,0 +1,88 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: envbox-cgroup-probe
+  namespace: envbox-auto
+  labels:
+    app.kubernetes.io/name: envbox-cgroup-probe
+spec:
+  restartPolicy: Never
+  nodeSelector:
+    experiment.coder.com/envbox-auto: "true"
+  tolerations:
+    - key: experiment.coder.com/envbox-auto
+      operator: Equal
+      value: "true"
+      effect: NoSchedule
+  containers:
+    - name: probe
+      image: 849808308023.dkr.ecr.us-east-2.amazonaws.com/envbox-eks-cache-experiment@sha256:92f53d2cc637979dfac855ad7d413f44a9f799c1dfd1a3d4242ae5e046d4f861
+      imagePullPolicy: IfNotPresent
+      command:
+        - /bin/sh
+        - -ec
+        - |
+          inspect() {
+            echo "cgroup namespace: $(readlink /proc/self/ns/cgroup)"
+            echo "cgroup membership:"
+            cat /proc/self/cgroup
+            echo "mountinfo entries at /sys/fs/cgroup:"
+            awk '$5 == "/sys/fs/cgroup" { print }' /proc/self/mountinfo
+            echo "current wrapper selection:"
+            awk '
+              $5 == "/sys/fs/cgroup" { root[$1] = $4; isparent[$2] = 1 }
+              END { for (id in root) if (!(id in isparent)) print "id=" id, "root=" root[id] }
+            ' /proc/self/mountinfo
+            echo "findmnt:"
+            findmnt -R /sys/fs/cgroup || true
+          }
+
+          echo "=== before unshare ==="
+          inspect
+          echo "=== after unshare --cgroup ==="
+          set +e
+          unshare --cgroup /bin/sh -c '
+            echo "cgroup namespace: $(readlink /proc/self/ns/cgroup)"
+            echo "cgroup membership:"
+            cat /proc/self/cgroup
+            echo "mountinfo entries at /sys/fs/cgroup:"
+            grep " /sys/fs/cgroup " /proc/self/mountinfo || true
+            echo "findmnt:"
+            findmnt -R /sys/fs/cgroup || true
+            echo "mounting namespace-rooted cgroup2 over existing mount:"
+            mount -t cgroup2 cgroup /sys/fs/cgroup
+            mount_status=$?
+            echo "mount status: $mount_status"
+            echo "mountinfo entries after mount:"
+            grep " /sys/fs/cgroup " /proc/self/mountinfo || true
+            echo "findmnt after mount:"
+            findmnt -R /sys/fs/cgroup || true
+            echo "lazy-detaching existing mount:"
+            umount -l /sys/fs/cgroup
+            lazy_status=$?
+            echo "lazy umount status: $lazy_status"
+            if [ "$lazy_status" -eq 0 ]; then
+              echo "mounting namespace-rooted cgroup2 after lazy detach:"
+              mount -t cgroup2 cgroup /sys/fs/cgroup
+              replacement_status=$?
+              echo "replacement mount status: $replacement_status"
+              echo "mountinfo after replacement:"
+              grep " /sys/fs/cgroup " /proc/self/mountinfo || true
+              echo "findmnt after replacement:"
+              findmnt -R /sys/fs/cgroup || true
+            fi
+          '
+          unshare_status=$?
+          set -e
+          echo "unshare status: $unshare_status"
+      securityContext:
+        privileged: true
+        allowPrivilegeEscalation: true
+        seccompProfile:
+          type: Unconfined
+      resources:
+        requests:
+          cpu: 10m
+          memory: 16Mi
+        limits:
+          memory: 64Mi

deploy/plat-370-experiments/eks-auto-mode-bottlerocket-envbox-experiment/envbox-smoke-cache-mount.yaml

@@ -0,0 +1,126 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: envbox-smoke
+  namespace: envbox-auto
+  labels:
+    app.kubernetes.io/name: envbox-smoke
+    experiment.coder.com/role: workspace
+    experiment.coder.com/cache-mount: outer-only
+spec:
+  restartPolicy: Never
+  terminationGracePeriodSeconds: 300
+  nodeSelector:
+    experiment.coder.com/envbox-auto: "true"
+  tolerations:
+    - key: experiment.coder.com/envbox-auto
+      operator: Equal
+      value: "true"
+      effect: NoSchedule
+  initContainers:
+    - name: initialize-workspace-volume
+      image: public.ecr.aws/docker/library/alpine:3.21
+      imagePullPolicy: IfNotPresent
+      command:
+        - /bin/sh
+        - -ec
+        - |
+          mkdir -p \
+            /workspace-volume/home \
+            /workspace-volume/cache/docker \
+            /workspace-volume/cache/containers \
+            /workspace-volume/envbox/containers \
+            /workspace-volume/envbox/docker
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 0
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop: ["ALL"]
+        seccompProfile:
+          type: RuntimeDefault
+      resources:
+        requests:
+          cpu: 10m
+          memory: 16Mi
+        limits:
+          memory: 64Mi
+      volumeMounts:
+        - name: workspace
+          mountPath: /workspace-volume
+  containers:
+    - name: envbox
+      image: ghcr.io/coder/envbox:0.6.7
+      imagePullPolicy: Always
+      command: ["/envbox", "docker"]
+      env:
+        - name: CODER_INNER_IMAGE
+          value: us-docker.pkg.dev/coder-v2-images-public/public/envbox/enterprise-base:ubuntu
+        - name: CODER_INNER_USERNAME
+          value: coder
+        - name: CODER_INNER_HOSTNAME
+          value: envbox-smoke
+        - name: CODER_MOUNTS
+          value: /home/coder:/home/coder
+        - name: CODER_CPUS
+          value: "1"
+        - name: CODER_MEMORY
+          value: "4294967296"
+        - name: CODER_DEBUG
+          value: "true"
+      securityContext:
+        privileged: true
+        allowPrivilegeEscalation: true
+        seccompProfile:
+          type: Unconfined
+      resources:
+        requests:
+          cpu: "1"
+          memory: 3Gi
+        limits:
+          cpu: "2"
+          memory: 7Gi
+      volumeMounts:
+        - name: workspace
+          mountPath: /home/coder
+          subPath: home
+        - name: workspace
+          mountPath: /var/lib/coder/docker
+          subPath: cache/docker
+        - name: workspace
+          mountPath: /var/lib/coder/containers
+          subPath: cache/containers
+        - name: sysbox
+          mountPath: /var/lib/sysbox
+        - name: workspace
+          mountPath: /var/lib/containers
+          subPath: envbox/containers
+        - name: workspace
+          mountPath: /var/lib/docker
+          subPath: envbox/docker
+        - name: usr-src
+          mountPath: /usr/src
+          readOnly: true
+        - name: lib-modules
+          mountPath: /lib/modules
+          readOnly: true
+        - name: cache
+          mountPath: /cache
+  volumes:
+    - name: workspace
+      persistentVolumeClaim:
+        claimName: envbox-workspace
+    - name: sysbox
+      emptyDir: {}
+    - name: usr-src
+      hostPath:
+        path: /usr/src
+        type: ""
+    - name: lib-modules
+      hostPath:
+        path: /lib/modules
+        type: ""
+    - name: cache
+      hostPath:
+        path: /var/lib/envbox-image-cache
+        type: DirectoryOrCreate