[lifecycle] Abandoned `PullSession` boots an unreachable microVM instead of cancelling

[ya-luotao]

Severity: low · Area: lifecycle

Where: ext/microsandbox/src/sandbox.rs:1830-1865 (native PullSession, no Drop).

If a caller does Sandbox.create_with_progress(...) and then abandons it (never iterates to
completion, never calls #sandbox/#result), GC drops the JoinHandle, which detaches
(does not abort) the spawned create task. On the gem's multi-threaded tokio runtime
(runtime.rs:44-50) that task runs to completion on worker threads — performing a full image
pull and microVM boot — and the resulting Sandbox is then immediately dropped, firing the
watchdog teardown. (The dropped progress receiver doesn't cancel the pull either: the sender
try_sends and silently discards — crates/image/lib/progress.rs:130,152-156.)

Impact: Wasted image pull + transient VM boot + teardown on any abandoned
create_with_progress; a buggy loop that abandons sessions repeatedly thrashes the host.

Fix: Add Drop for the native PullSession that calls join.abort() when the handle was
never taken (and ideally drains the progress channel), so an abandoned session cancels the
in-flight create. Document that a PullSession must be driven to #sandbox or explicitly
discarded; consider a block/ensure form.

---

---

Filed from a cross-repo audit of microsandbox-rb 0.8.1 against upstream microsandbox v0.5.10; each finding was adversarially verified against source in both repos.