e2e: firecracker parity round 2 — environment, sizing, crash-loop

[Shine-neko]

Firecracker goes from 9 to 13 e2e tests, closing the gaps that mattered most against Cloud Hypervisor's 24.

What was added

t12_environment.sh — environment variables must reach the NoCloud cidata payload. CH covers this (t4); Firecracker did not, despite sharing the cloud-init path. Env vars are how most workloads get configured, so "the VM booted" proves nothing if the config never arrived. Also asserts a value containing spaces survives intact — the case that breaks naive KEY=value emitters — and that the cidata image is reaped on delete.

t13_resource_limits.sh — resources.limits must reach the microVM's machine config. This reads Firecracker's own /machine-config over its API socket, so it checks what the hypervisor actually got rather than what Ring intended to send. Firecracker's sizing rules differ from CH's and are easy to break silently:

• fractional CPU rounds up (1500m → 2 vCPUs), where CH rounds down
• memory below 64 MiB falls back to the 512 MiB default rather than booting a VM too small for systemd

t14_crashloop.sh — a deployment that cannot boot must land in CrashLoopBackOff rather than retrying forever. On a VM runtime that is not cosmetic: every attempt copies a rootfs and allocates a TAP, so an unbounded loop eats disk and network interfaces until the host gives out. Asserts the terminal state, that artifacts stop accumulating after it, and that the failure is explained in the events.

A bug in my own earlier test, now fixed

t11_health_checks.sh shipped in #212 with the on_failure: alert assertion removed, and a comment saying the alert "does not fire reliably within the window".

That was wrong. ring deployment events renders a table and has no --output json flag, so my jq filter was silently parsing tabular text and always yielding nothing. The alert fires within seconds, exactly as designed. The assertion is restored, using the command's own --level filter, and the board task tracking the phantom anomaly is closed.

Worth knowing for anyone writing e2e against this CLI: deployment health-checks supports --output json, deployment events does not.

Verification

firecracker t1, t9, t10, t11, t12, t13, t14 all run and pass locally against real microVMs.