[jwx0925]

Summary

OCI restores currently create a snapfiles ublk device and mount for every Sandbox. Share one read-only device and mount per resolved snapfiles image and credential scope within the same state directory and mount namespace, while keeping writable rootfs devices and uppers private. Fastlet uses its Pod-scoped state directory; standalone fsb-vm uses the same shared preparation path by default.

Persist Sandbox leases, serialize first preparation across fsb-vm processes, retain a bounded idle cache, and extend OCI Janitor cleanup for caches left by deleted Fastlet Pods. Share snapfiles by default in both standalone fsb-vm and Fastlet; add cleanup-snapfiles for explicit idle-cache cleanup. Include focused tests and usage documentation.

This branch is based directly on master and contains only snapfiles sharing, lifecycle cleanup, tests, and documentation. The earlier bridge MAC, native ublkd patch, image-cache, and Firecracker launch optimizations are excluded.

Validation

• Repository-wide Linux lint and formatter checks: passed.
• Focused Linux amd64 package tests: cmd/fsb-vm, internal/runtime/firecracker, internal/janitor.
• K8s FastPath gRPC: 20 running Sandboxes used 5 shared read-only snapfiles devices and 20 private writable rootfs devices; template creation, pause/resume file preservation, 10 snapshot clones, and old-Pod OCIBackend cleanup passed.
• K8s performance used the same immutable template, 1 vCPU / 2 GiB VM configuration, 5 Fastlets, and 100 warm samples per group. FastPath READY P50: serial 107.5 → 92.8 ms; concurrency 10: 195.8 → 149.7 ms; concurrency 20: 378.0 → 238.7 ms. All 600 measured creates succeeded.
• The K8s comparison exercised shared preparation before its CLI opt-in flag was removed; this PR now enables that same path by default.
• The K8s benchmark applied the existing MAC/ublkd fixes equally to baseline and candidate; those fixes are not part of this PR. The OCIBackend was exercised directly after Pod removal; the background Janitor DaemonSet was not globally replaced.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T12:31:03.859417Z	7cec16e	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b935b742b2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7cec16e3b7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Pangjiping]

LGTM