feat(container-runner): jitter idle timeout to avoid teardown waves

[abcxff]

No description provided.

[abcxff]

Stack for rivet-dev/actors

• #5620 fix(container-runner): drain actors before announcing envoy …
• #5594 feat(container-runner): drain engine sleeps unless the idle …
• #5595 feat(container-runner): jitter idle timeout to avoid teardow … 👈
• #5585 feat(container-runner): self-destroy on repeated actor start
• #5586 feat(container-runner): sleep on startup idle timeout
• #5589 chore(container-runner): tighten comments
• #5587 feat(container-runner): exit process when the last child sto …
• #5588 feat(container-runner): drain child before SIGTERM on engine …
• #5584 feat(container-runner): drain children and engine concurrent …
• #5565 fix(envoy-client): ack terminating stop commands so pegboard …
• main

Get stack: forklift get 5595
Push local edits: forklift submit
Merge when ready: forklift merge 5595

_{change wxwlxowm}

[claude]

Review

Small, focused change: adds jitter to the container-runner's idle-timeout so co-started instances don't all sleep/teardown at the same instant. The core logic (base + random_duration_up_to(max_jitter), jitter capped at min(20%, 60s), always additive) is correct and the doc comments are clear.

Suggestions

1. Blocking file I/O inside async context, when rand is already a workspace dependency (container-runner/src/main.rs:146 / repo root Cargo.toml)

random_duration_up_to opens /dev/urandom with std::fs::File::open + read_exact on every call. arm_idle_timeout calls this synchronously from inside on_start (an async fn) before the tokio::spawn, so this blocking syscall runs directly on a Tokio worker thread rather than via spawn_blocking. It's a one-shot call per actor start so the practical impact is negligible, but rand = "0.8" is already declared in the workspace Cargo.toml (just not pulled into container-runner's dependencies). Using rand::random::<u64>() (or thread_rng().gen_range(..)) would avoid the blocking fd open/read, the hardcoded /dev/urandom path, and the manual modulo-biased sampling, for less code than the hand-rolled version.

2. No test coverage for the new functions

container-runner/src/main.rs already has an established pattern for testing small pure helpers in this exact file — base64url_nopad and boot_id are covered via #[path = "../tests/inline/boot_id.rs"] mod tests;. idle_timeout_with_jitter and random_duration_up_to are equally easy to unit test (e.g. assert base <= idle_timeout_with_jitter(base) <= base + max_jitter, and check the 60s cap kicks in for a large base) but ship with no tests. Worth adding given the precedent in the same file.

Minor

• random_duration_up_to silently falls back to Duration::ZERO if /dev/urandom can't be opened/read, with no log line. Given this is inherently best-effort (anti-thundering-herd), silent fallback is reasonable, but a tracing::debug! on the error path would help diagnose if it ever happens.

Nothing blocking here — the change is small and correct as written; the above are polish suggestions.