refactor(example): move V8 suspend support to a dependent change

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

examples/isolation-backend-v8/Cargo.lock

@@ -21,7 +21,6 @@ rustix = { version = "1", features = ["process"] }
 tokio-rustls = "0.26"
 rustls = "0.23"
 rustls-pemfile = "2"
-hmac = "0.12"
 clap = { version = "4.5", features = ["derive", "env"] }
 prost = "0.14"
 prost-types = "0.14"
@@ -36,10 +35,6 @@ uuid = { version = "1", features = ["v4"] }
 
 v8 = "152.2.0"
 
-[dev-dependencies]
-tempfile = "3"
-rcgen = { version = "0.13", default-features = false, features = ["crypto", "pem", "aws_lc_rs"] }
-
 [build-dependencies]
 protoc-bin-vendored = "3"
 tonic-prost-build = "0.14"

examples/isolation-backend-v8/Cargo.toml

@@ -61,11 +61,10 @@ openshell sandbox create --name js-demo \
   --keep --no-tty --no-auto-providers -- /work/guest.js
 ```
 
-The bundled script prints a greeting, attempts a request, catches the
-network-disabled error, and counts once per second for about 12 seconds.
-Egress is disabled by the runtime's lack of network bindings; this example
-does not relay requests to the supervisor for policy evaluation. No policy
-file is needed.
+The bundled script prints a greeting, attempts a request, and catches the
+network-disabled error. Egress is disabled by the runtime's lack of network
+bindings; this example does not relay requests to the supervisor for policy
+evaluation. No policy file is needed.
 
 The create command prints the script's output and returns its exit code. The
 sandbox becomes `Completed` on exit code 0 or `Error` on a nonzero exit code.
@@ -76,54 +75,6 @@ print an error and return exit code 1.
 Add `--detach` to run without attaching; detached creation does not stream guest
 output. Use `openshell sandbox connect js-demo` to attach afterward.
 
-## Suspend and resume
-
-Suspension freezes the V8 isolate in place and the `js-sbx serve` process keeps
-it in memory; resume continues the same isolate in a new runtime generation.
-The default `guest.js` counts for about 12 seconds after its network check:
-
-```shell
-./start.sh
-```
-
-In another terminal, create the sandbox, then suspend and resume it while it
-counts:
-
-```shell
-openshell sandbox create --name js-demo \
-  --keep --no-tty --no-auto-providers --detach -- /work/guest.js
-openshell sandbox suspend js-demo
-openshell sandbox resume js-demo
-```
-
-To discard the retained state and start the script from the beginning:
-
-```shell
-openshell sandbox stop js-demo
-openshell sandbox start js-demo
-```
-
-`backend.log` shows the count continue from its value at suspension, and the
-elapsed time includes the gap. The 15-second deadline counts only running time.
-
-The driver sends `SIGUSR1` to the supervisor, which calls `SuspendBoundary`.
-The backend retains the frozen isolate and privately persists its handle in
-`restore-reference` before acknowledging suspension. The supervisor exits;
-it does not write or read a reference file. On resume the driver provisions
-the backend using `launch.json`, while the supervisor attaches through its
-ordinary boundary-opening path. The shared `boundary.json` contains no
-retention fields. The reference authenticates the sandbox with a key in
-`retention.key`, so a restarted `js-sbx serve` can tell lost state from a forged
-or superseded reference. If you restart `js-sbx serve` while the sandbox is suspended, resume
-fails and the sandbox stays `Suspended`; `openshell sandbox start js-demo`
-then runs the script from the beginning.
-`openshell sandbox start`, `stop`, and `delete` discard the retained state.
-
-Restoration borrows the retained guest until the driver observes supervisor
-readiness and consumes `restore-reference`. If startup fails or times out,
-the driver stops the supervisor and waits for the backend to refreeze the guest
-before reporting failure. The same reference remains available for a retry.
-
 ## Inspect and stop
 
 ```shell
@@ -143,5 +94,5 @@ limits do not bound all native V8 resources. The V8 isolate confines JavaScript;
 the host process does not run in a Linux namespace or container.
 
 The example has no HTTP relay or guest network implementation. `fetch` is only
-a synchronous denial stub. Exec, PTY, providers, and supervisor recovery are
-unsupported. Retained state lives only in the `js-sbx serve` process memory.
+a synchronous denial stub. Exec, PTY, providers, suspend/resume, and supervisor
+recovery are unsupported.

examples/isolation-backend-v8/README.md

@@ -9,18 +9,3 @@ try {
   if (error.message !== "Network access is disabled") throw error;
   console.log(error.message);
 }
-
-// Counts once per second of running time. The guest has no timers, so it
-// busy-waits. Suspend partway through; after resume the count continues from
-// the value held in the isolate's memory.
-const started = Date.now();
-let count = 0;
-let next = Date.now() + 1000;
-while (count < 12) {
-  if (Date.now() >= next) {
-    count += 1;
-    next = Date.now() + 1000;
-    console.log(`count ${count} (${Math.round((Date.now() - started) / 1000)}s since start)`);
-  }
-}
-console.log("done");