Addresses the two valid items from the independent review (code/security/infra all
Approved; these were Minor/Needs-Change items).
1. provision.sh left the nginx vhost as a manual "see README" step, which broke the
project's own repeatability requirement (FR-9): a rebuild from scratch would have
served the distro default page instead of Atheos. The vhost is now written by the
script itself, the distro default.conf is removed, and the script ASSERTS the socket
contract (nginx fastcgi_pass == php-fpm pool listen) before Atheos is installed - so
a 502 can only ever mean an nginx/php-fpm problem, never be mistaken for an Atheos one.
2. `free` and `uptime` reported the PVE HOST inside the container (a container that had
restarted seconds earlier claimed "up 2 days"), which is misleading in monitoring and
in the test output.
The review suggested `apk add lxcfs` in the guest. That is NOT the fix - lxcfs is a
host-provided FUSE filesystem, not a guest package, and measurement showed it is
already working correctly here:
/proc/meminfo -> MemTotal: 1048576 kB (our 1024 MB limit)
/proc/uptime -> container seconds
/proc/cpuinfo -> 2 processors
The real cause: on Alpine, `free`/`uptime` are BUSYBOX applets that read via the
sysinfo() SYSCALL, which lxcfs cannot intercept. procps-ng ships binaries that read
the lxcfs-virtualised /proc files instead. Measured on the guest:
procps-ng free -> 1024 MB (correct)
busybox free -> 15701 MB (host)
procps-ng uptime -> up 2 min (correct)
busybox uptime -> up 2 days (host)
So provision.sh now installs procps-ng, and build-and-test.sh reports container-
accurate figures (detecting it via apk rather than a binary-existence probe, since
the busybox applets are plain files too).
Verified after the change: build-and-test 40 passed / 0 failed; socket contract MATCH;
resource line now reads "18MB used of 1024MB, up 2 min".
hermes
8f07c377c0