fix(tests): deflake TestSandboxMemoryIntegrity with explicit resume timeout (#2988)

`TestSandboxMemoryIntegrity/tmpfs_hash` flakes ~52% on main. Service
logs from failed runs show it is never an integrity failure (no hash
mismatch ever): the resume call passes an empty body, so the sandbox
gets the 15s `SandboxTimeoutDefault`. Hashing the ~480MB tmpfs after
resume faults the whole file back through UFFD, which takes >15s on the
compressed/dedup shards (zstd1 fails 12/15 recent main runs, lz4 4/15,
uncompressed 0/15), so the sandbox is evicted with `kill_reason:
timeout` mid-check and every retry gets 502 until the 3min
`EventuallyWithT` window expires.

Pass an explicit 300s timeout on resume, matching the sandbox creation
timeout.

Author: ValentaTomas

tests/integration/internal/tests/api/sandboxes/sandbox_list_test.go

@@ -321,7 +321,9 @@ func TestSandboxListPaginationRunningLargerLimit(t *testing.T) { //nolint:tparal
 	sbxsCount := 12
 	sandboxes := make([]string, sbxsCount)
 	for i := range sbxsCount {
-		sbx := utils.SetupSandboxWithCleanup(t, c, utils.WithMetadata(api.SandboxMetadata{metadataKey: metadataValue}))
+		// Default 30s timeout is shorter than creating 12 sandboxes plus the
+		// list assertions under load, so the sandboxes would expire mid-test.
+		sbx := utils.SetupSandboxWithCleanup(t, c, utils.WithTimeout(300), utils.WithMetadata(api.SandboxMetadata{metadataKey: metadataValue}))
 		sandboxes[sbxsCount-i-1] = sbx.SandboxID
 
 		t.Logf("Created sandbox %d/%d: %s", i+1, sbxsCount, sbx.SandboxID)

tests/integration/internal/tests/envd/process_test.go

@@ -10,6 +10,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/e2b-dev/infra/packages/shared/pkg/grpc/envd/process"
+	"github.com/e2b-dev/infra/tests/integration/internal/api"
 	"github.com/e2b-dev/infra/tests/integration/internal/setup"
 	"github.com/e2b-dev/infra/tests/integration/internal/utils"
 )
@@ -20,15 +21,28 @@ func TestCommandKillNextApp(t *testing.T) {
 	defer cancel()
 
 	client := setup.GetAPIClient()
-	sbx := utils.SetupSandboxWithCleanup(t, client, utils.WithTimeout(300))
-
-	envdClient := setup.GetEnvdClient(t, ctx)
 
-	// Run `npx create-next-app`
+	// Pre-bake create-next-app into a template build (fresh-boot VM) instead of
+	// running the page-fault-heavy npm install in the restored sandbox, where
+	// host load has caused guest soft lockups and envd stream EOFs.
 	// Pinned to the latest known-good stable release; `@latest` currently resolves
 	// to a 16.3.0 pre-release that ships a broken SWC binary and 404s on preview.
-	err := utils.ExecCommand(t, ctx, sbx, envdClient, "npx", "create-next-app@16.2.8", "nextapp", "--yes")
-	require.NoError(t, err)
+	tmpl := utils.BuildTemplate(t, utils.TemplateBuildOptions{
+		Name:    "kill-next-app",
+		Timeout: 10 * time.Minute,
+		BuildData: api.TemplateBuildStartV2{
+			FromTemplate: &setup.SandboxTemplateID,
+			Steps: &[]api.TemplateStep{{
+				Type: "RUN",
+				Args: &[]string{"cd /home/user && npx create-next-app@16.2.8 nextapp --yes", "user"},
+			}},
+		},
+		ReqEditors: []api.RequestEditorFn{setup.WithAPIKey()},
+	})
+
+	sbx := utils.SetupSandboxWithCleanup(t, client, utils.WithTimeout(300), utils.WithTemplateID(tmpl.TemplateID))
+
+	envdClient := setup.GetEnvdClient(t, ctx)
 
 	// Run `npm run dev` in background
 	cwd := "~/nextapp"

tests/integration/internal/tests/orchestrator/sandbox_memory_integrity_test.go

@@ -21,6 +21,11 @@ func TestSandboxMemoryIntegrity(t *testing.T) {
 
 	c := setup.GetAPIClient()
 
+	// Resuming without an explicit timeout gives the sandbox only the 15s
+	// default; hashing the tmpfs after resume can take longer than that under
+	// load, so the sandbox would be evicted mid-check.
+	resumeTimeout := int32(300)
+
 	// Build a template with stress-ng and time pre-installed so subtests
 	// skip the page-fault-heavy apt-get phase that saturates decompression
 	// under parallel load.
@@ -100,7 +105,7 @@ echo "Used memory after tmpfs mount and file fill: ${USED_MEM_MB_AFTER} MB"
 			require.NotNil(t, res.JSON200)
 			assert.Equal(t, api.Paused, res.JSON200.State)
 
-			sbxResume, err := c.PostSandboxesSandboxIDResumeWithResponse(t.Context(), sbxId, api.PostSandboxesSandboxIDResumeJSONRequestBody{}, setup.WithAPIKey())
+			sbxResume, err := c.PostSandboxesSandboxIDResumeWithResponse(t.Context(), sbxId, api.PostSandboxesSandboxIDResumeJSONRequestBody{Timeout: &resumeTimeout}, setup.WithAPIKey())
 			require.NoError(t, err)
 			require.Equal(t, http.StatusCreated, sbxResume.StatusCode())
 			require.NotNil(t, sbxResume.JSON201)
@@ -135,7 +140,7 @@ echo "Used memory after tmpfs mount and file fill: ${USED_MEM_MB_AFTER} MB"
 		}
 		resume := func() {
 			t.Helper()
-			r, err := c.PostSandboxesSandboxIDResumeWithResponse(t.Context(), sbxId, api.PostSandboxesSandboxIDResumeJSONRequestBody{}, setup.WithAPIKey())
+			r, err := c.PostSandboxesSandboxIDResumeWithResponse(t.Context(), sbxId, api.PostSandboxesSandboxIDResumeJSONRequestBody{Timeout: &resumeTimeout}, setup.WithAPIKey())
 			require.NoError(t, err)
 			require.Equal(t, http.StatusCreated, r.StatusCode())
 		}

tests/integration/internal/tests/orchestrator/sandbox_object_not_found_test.go

@@ -22,7 +22,10 @@ func TestSandboxObjectNotFound(t *testing.T) {
 
 	client := setup.GetOrchestratorClient(t, ctx)
 
-	for range 10 {
+	// Under full host load (parallel 100-sandbox tests) the orchestrator can
+	// report ResourceExhausted for minutes before template validation is
+	// reached, so keep the retry window generous.
+	for range 36 {
 		_, err := client.Create(ctx, &orchestrator.SandboxCreateRequest{
 			Sandbox: &orchestrator.SandboxConfig{
 				TemplateId:          "nonexistent-template-id",
@@ -67,6 +70,6 @@ func TestSandboxObjectNotFound(t *testing.T) {
 		return
 	}
 
-	t.Log("failed to create sandbox after 10 retries")
+	t.Log("failed to create sandbox after 36 retries")
 	t.FailNow()
 }

tests/integration/internal/tests/proxies/auto_resume_test.go

@@ -109,8 +109,9 @@ func TestSandboxAutoResumeViaProxy(t *testing.T) {
 	require.NotNil(t, res.JSON200, "expected 200 response, got status %d", res.StatusCode())
 	require.Equal(t, api.Paused, res.JSON200.State)
 
-	// Make a proxy request to trigger auto-resume.
-	resumeClient := &http.Client{Timeout: 10 * time.Second}
+	// Make a proxy request to trigger auto-resume. The single request must
+	// cover the whole snapshot resume, which can take a while under load.
+	resumeClient := &http.Client{Timeout: 60 * time.Second}
 	req := utils.NewRequest(sbx, proxyURL, port, nil)
 	resp, err = resumeClient.Do(req)
 	require.NoError(t, err)

tests/integration/internal/tests/proxies/mask_request_host_test.go

@@ -30,25 +30,21 @@ func TestMaskRequestHostAPIParameter(t *testing.T) {
 	// Create sandbox with maskRequestHost set
 	sbx := utils.SetupSandboxWithCleanup(t, c, utils.WithNetwork(sbxNet), utils.WithTimeout(120))
 
-	// run sudo apt-get update; sudo apt-get install -y netcat
-	// run nc -l -p 8080
 	envdClient := setup.GetEnvdClient(t, ctx)
 
-	// Install netcat for the test
-	err := utils.ExecCommandAsRoot(t, ctx, sbx, envdClient, "apt-get", "update")
-	require.NoError(t, err)
-	err = utils.ExecCommandAsRoot(t, ctx, sbx, envdClient, "apt-get", "install", "-y", "netcat-traditional")
-	require.NoError(t, err)
-
 	port := 8080
-	// Start a netcat listener on port that outputs request headers to a file
+	// Single-shot listener that dumps the raw request to a file. Uses the
+	// preinstalled python instead of installing netcat via apt-get, which is
+	// page-fault-heavy enough to wedge the sandbox under parallel test load.
 	outputFile := "/tmp/nc_output.txt"
+	listener := fmt.Sprintf(
+		`import socket; s=socket.socket(); s.bind(("0.0.0.0",%d)); s.listen(1); c,_=s.accept(); open(%q,"wb").write(c.recv(65536))`,
+		port, outputFile)
 	go func() {
-		_ = utils.ExecCommandAsRoot(t, ctx, sbx, envdClient,
-			"/bin/bash", "-c", fmt.Sprintf("nc -l -p %d > %s", port, outputFile))
+		_ = utils.ExecCommandAsRoot(t, ctx, sbx, envdClient, "python3", "-c", listener)
 	}()
 
-	// Wait for nc to be up
+	// Wait for the listener to be up
 	time.Sleep(2 * time.Second)
 
 	// Prepare the sandbox URL using helpers

tests/integration/internal/tests/proxies/traffic_access_token_test.go

@@ -317,7 +317,9 @@ func TestEnvdAccessTokenAutoResumeViaProxy(t *testing.T) {
 	envdHealthURL := *proxyURL
 	envdHealthURL.Path = "/health"
 
-	client := &http.Client{Timeout: 10 * time.Second}
+	// The auto-resume request below must cover the whole snapshot resume,
+	// which can take longer than 10s under load.
+	client := &http.Client{Timeout: 60 * time.Second}
 	envdPort := int(consts.DefaultEnvdServerPort)
 
 	// Verify envd is reachable with valid access token while running.