pantsbuild / pants / 37616348623

93%

push

github

go: keep the module download cache owner-writable so sandboxes are not leaked (#23636)

Disclaimer: Like my previous Go PR, I'm still not primarily a golang
developer. However, the fact that Golang doesn't work properly in Pants
has been the bane of my existence for like 2 years now. The moment that
Mythos/Fable dropped I immediately had it dig deeply into whether the
whole road to proper-golang-in-pants could be opened up. So this is all
by Claude Code with Fable 5 (xhigh), with review consults to GPT 5.6
(Sol). I've had it check and recheck, I ran many different roles over
it, and I had it explain and re-explain it to me, and then I checked
myself.

So, as much as I dislike AI slop and am worried about AI PR overload,
I've done my very best to avoid exactly that while still using AI. I
hope we can get this road unblocked.

The rest is Fable talking:

---


Go module download processes extract each module into GOMODCACHE with
read-only permissions, which makes Pants' sandbox cleanup fail to remove
them, so every download silently leaks its whole sandbox. This adds
`-modcacherw` to the download-enabled Go processes so the extracted
cache stays owner-writable and the sandbox can be torn down.

## The leak

A `go mod download` extracts the module archive into GOMODCACHE, which
sits under the sandbox GOPATH. Go strips the write bits from the
extracted module tree, so it is not owner-writable. When Pants cleans up
the sandbox afterwards, `remove_dir_all` cannot delete those directories
and the error is swallowed, so the extracted trees stay on disk after
the sandbox should be gone. The leak repeats on every cold download and
never gets reclaimed.

jgranstrom measured this directly while reviewing a separate change:
about 700 leaked sandboxes and 2.1 GB per cold run, indefinitely. The
observation is his; this PR is the isolated fix for it.

## The fix

`-modcacherw` tells Go to leave newly written module cache directories
writable, so sandbox cleanup can r... (continued)

23 of 23 new or added lines in 2 files covered. (100.0%)

96019 of 103332 relevant lines covered (92.92%)

3.66 hits per line