20561: crunch-run logs files/directories propagated from keep
[arvados.git] / lib / crunchrun / crunchrun_test.go
index 55cc6ee564be66ed2ecfc0e7713ad0c150a03e9e..9c4fe20bc1d29121897237425156f940b8466830 100644 (file)
@@ -5,34 +5,38 @@
 package crunchrun
 
 import (
-       "bufio"
        "bytes"
+       "context"
        "crypto/md5"
        "encoding/json"
        "errors"
        "fmt"
        "io"
        "io/ioutil"
-       "net"
+       "log"
+       "math/rand"
+       "net/http"
+       "net/http/httptest"
        "os"
        "os/exec"
+       "path"
+       "regexp"
        "runtime/pprof"
-       "sort"
+       "strconv"
        "strings"
        "sync"
+       "sync/atomic"
        "syscall"
        "testing"
        "time"
 
+       "git.arvados.org/arvados.git/lib/cloud"
+       "git.arvados.org/arvados.git/lib/cmd"
        "git.arvados.org/arvados.git/sdk/go/arvados"
        "git.arvados.org/arvados.git/sdk/go/arvadosclient"
        "git.arvados.org/arvados.git/sdk/go/arvadostest"
        "git.arvados.org/arvados.git/sdk/go/manifest"
-       "golang.org/x/net/context"
 
-       dockertypes "github.com/docker/docker/api/types"
-       dockercontainer "github.com/docker/docker/api/types/container"
-       dockernetwork "github.com/docker/docker/api/types/network"
        . "gopkg.in/check.v1"
 )
 
@@ -41,18 +45,57 @@ func TestCrunchExec(t *testing.T) {
        TestingT(t)
 }
 
-// Gocheck boilerplate
+const logLineStart = `(?m)(.*\n)*\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d+Z `
+
 var _ = Suite(&TestSuite{})
 
 type TestSuite struct {
-       client *arvados.Client
-       docker *TestDockerClient
-       runner *ContainerRunner
+       client                   *arvados.Client
+       api                      *ArvTestClient
+       runner                   *ContainerRunner
+       executor                 *stubExecutor
+       keepmount                string
+       keepmountTmp             []string
+       testDispatcherKeepClient KeepTestClient
+       testContainerKeepClient  KeepTestClient
 }
 
 func (s *TestSuite) SetUpTest(c *C) {
        s.client = arvados.NewClientFromEnv()
-       s.docker = NewTestDockerClient()
+       s.executor = &stubExecutor{}
+       var err error
+       s.api = &ArvTestClient{}
+       s.runner, err = NewContainerRunner(s.client, s.api, &s.testDispatcherKeepClient, "zzzzz-zzzzz-zzzzzzzzzzzzzzz")
+       c.Assert(err, IsNil)
+       s.runner.executor = s.executor
+       s.runner.MkArvClient = func(token string) (IArvadosClient, IKeepClient, *arvados.Client, error) {
+               return s.api, &s.testContainerKeepClient, s.client, nil
+       }
+       s.runner.RunArvMount = func(cmd []string, tok string) (*exec.Cmd, error) {
+               s.runner.ArvMountPoint = s.keepmount
+               for i, opt := range cmd {
+                       if opt == "--mount-tmp" {
+                               err := os.Mkdir(s.keepmount+"/"+cmd[i+1], 0700)
+                               if err != nil {
+                                       return nil, err
+                               }
+                               s.keepmountTmp = append(s.keepmountTmp, cmd[i+1])
+                       }
+               }
+               return nil, nil
+       }
+       s.keepmount = c.MkDir()
+       err = os.Mkdir(s.keepmount+"/by_id", 0755)
+       s.keepmountTmp = nil
+       c.Assert(err, IsNil)
+       err = os.Mkdir(s.keepmount+"/by_id/"+arvadostest.DockerImage112PDH, 0755)
+       c.Assert(err, IsNil)
+       err = ioutil.WriteFile(s.keepmount+"/by_id/"+arvadostest.DockerImage112PDH+"/"+arvadostest.DockerImage112Filename, []byte("#notarealtarball"), 0644)
+       err = os.Mkdir(s.keepmount+"/by_id/"+fakeInputCollectionPDH, 0755)
+       c.Assert(err, IsNil)
+       err = ioutil.WriteFile(s.keepmount+"/by_id/"+fakeInputCollectionPDH+"/input.json", []byte(`{"input":true}`), 0644)
+       c.Assert(err, IsNil)
+       s.runner.ArvMountPoint = s.keepmount
 }
 
 type ArvTestClient struct {
@@ -68,13 +111,57 @@ type ArvTestClient struct {
 }
 
 type KeepTestClient struct {
-       Called  bool
-       Content []byte
+       Called         bool
+       Content        []byte
+       StorageClasses []string
 }
 
+type stubExecutor struct {
+       imageLoaded bool
+       loaded      string
+       loadErr     error
+       exitCode    int
+       createErr   error
+       created     containerSpec
+       startErr    error
+       waitSleep   time.Duration
+       waitErr     error
+       stopErr     error
+       stopped     bool
+       closed      bool
+       runFunc     func() int
+       exit        chan int
+}
+
+func (e *stubExecutor) LoadImage(imageId string, tarball string, container arvados.Container, keepMount string,
+       containerClient *arvados.Client) error {
+       e.loaded = tarball
+       return e.loadErr
+}
+func (e *stubExecutor) Runtime() string                 { return "stub" }
+func (e *stubExecutor) Version() string                 { return "stub " + cmd.Version.String() }
+func (e *stubExecutor) Create(spec containerSpec) error { e.created = spec; return e.createErr }
+func (e *stubExecutor) Start() error {
+       e.exit = make(chan int, 1)
+       go func() { e.exit <- e.runFunc() }()
+       return e.startErr
+}
+func (e *stubExecutor) CgroupID() string { return "cgroupid" }
+func (e *stubExecutor) Stop() error      { e.stopped = true; go func() { e.exit <- -1 }(); return e.stopErr }
+func (e *stubExecutor) Close()           { e.closed = true }
+func (e *stubExecutor) Wait(context.Context) (int, error) {
+       return <-e.exit, e.waitErr
+}
+func (e *stubExecutor) InjectCommand(ctx context.Context, _, _ string, _ bool, _ []string) (*exec.Cmd, error) {
+       return nil, errors.New("unimplemented")
+}
+func (e *stubExecutor) IPAddress() (string, error) { return "", errors.New("unimplemented") }
+
+const fakeInputCollectionPDH = "ffffffffaaaaaaaa88888888eeeeeeee+1234"
+
 var hwManifest = ". 82ab40c24fc8df01798e57ba66795bb1+841216+Aa124ac75e5168396c73c0a18eda641a4f41791c0@569fa8c3 0:841216:9c31ee32b3d15268a0754e8edc74d4f815ee014b693bc5109058e431dd5caea7.tar\n"
 var hwPDH = "a45557269dcb65a6b78f9ac061c0850b+120"
-var hwImageId = "9c31ee32b3d15268a0754e8edc74d4f815ee014b693bc5109058e431dd5caea7"
+var hwImageID = "9c31ee32b3d15268a0754e8edc74d4f815ee014b693bc5109058e431dd5caea7"
 
 var otherManifest = ". 68a84f561b1d1708c6baff5e019a9ab3+46+Ae5d0af96944a3690becb1decdf60cc1c937f556d@5693216f 0:46:md5sum.txt\n"
 var otherPDH = "a3e8f74c6f101eae01fa08bfb4e49b3a+54"
@@ -92,129 +179,6 @@ var denormalizedWithSubdirsPDH = "b0def87f80dd594d4675809e83bd4f15+367"
 var fakeAuthUUID = "zzzzz-gj3su-55pqoyepgi2glem"
 var fakeAuthToken = "a3ltuwzqcu2u4sc0q7yhpc2w7s00fdcqecg5d6e0u3pfohmbjt"
 
-type TestDockerClient struct {
-       imageLoaded string
-       logReader   io.ReadCloser
-       logWriter   io.WriteCloser
-       fn          func(t *TestDockerClient)
-       exitCode    int
-       stop        chan bool
-       cwd         string
-       env         []string
-       api         *ArvTestClient
-       realTemp    string
-       calledWait  bool
-       ctrExited   bool
-}
-
-func NewTestDockerClient() *TestDockerClient {
-       t := &TestDockerClient{}
-       t.logReader, t.logWriter = io.Pipe()
-       t.stop = make(chan bool, 1)
-       t.cwd = "/"
-       return t
-}
-
-type MockConn struct {
-       net.Conn
-}
-
-func (m *MockConn) Write(b []byte) (int, error) {
-       return len(b), nil
-}
-
-func NewMockConn() *MockConn {
-       c := &MockConn{}
-       return c
-}
-
-func (t *TestDockerClient) ContainerAttach(ctx context.Context, container string, options dockertypes.ContainerAttachOptions) (dockertypes.HijackedResponse, error) {
-       return dockertypes.HijackedResponse{Conn: NewMockConn(), Reader: bufio.NewReader(t.logReader)}, nil
-}
-
-func (t *TestDockerClient) ContainerCreate(ctx context.Context, config *dockercontainer.Config, hostConfig *dockercontainer.HostConfig, networkingConfig *dockernetwork.NetworkingConfig, containerName string) (dockercontainer.ContainerCreateCreatedBody, error) {
-       if config.WorkingDir != "" {
-               t.cwd = config.WorkingDir
-       }
-       t.env = config.Env
-       return dockercontainer.ContainerCreateCreatedBody{ID: "abcde"}, nil
-}
-
-func (t *TestDockerClient) ContainerStart(ctx context.Context, container string, options dockertypes.ContainerStartOptions) error {
-       if t.exitCode == 3 {
-               return errors.New(`Error response from daemon: oci runtime error: container_linux.go:247: starting container process caused "process_linux.go:359: container init caused \"rootfs_linux.go:54: mounting \\\"/tmp/keep453790790/by_id/99999999999999999999999999999999+99999/myGenome\\\" to rootfs \\\"/tmp/docker/overlay2/9999999999999999999999999999999999999999999999999999999999999999/merged\\\" at \\\"/tmp/docker/overlay2/9999999999999999999999999999999999999999999999999999999999999999/merged/keep/99999999999999999999999999999999+99999/myGenome\\\" caused \\\"no such file or directory\\\"\""`)
-       }
-       if t.exitCode == 4 {
-               return errors.New(`panic: standard_init_linux.go:175: exec user process caused "no such file or directory"`)
-       }
-       if t.exitCode == 5 {
-               return errors.New(`Error response from daemon: Cannot start container 41f26cbc43bcc1280f4323efb1830a394ba8660c9d1c2b564ba42bf7f7694845: [8] System error: no such file or directory`)
-       }
-       if t.exitCode == 6 {
-               return errors.New(`Error response from daemon: Cannot start container 58099cd76c834f3dc2a4fb76c8028f049ae6d4fdf0ec373e1f2cfea030670c2d: [8] System error: exec: "foobar": executable file not found in $PATH`)
-       }
-
-       if container == "abcde" {
-               // t.fn gets executed in ContainerWait
-               return nil
-       }
-       return errors.New("Invalid container id")
-}
-
-func (t *TestDockerClient) ContainerRemove(ctx context.Context, container string, options dockertypes.ContainerRemoveOptions) error {
-       t.stop <- true
-       return nil
-}
-
-func (t *TestDockerClient) ContainerWait(ctx context.Context, container string, condition dockercontainer.WaitCondition) (<-chan dockercontainer.ContainerWaitOKBody, <-chan error) {
-       t.calledWait = true
-       body := make(chan dockercontainer.ContainerWaitOKBody, 1)
-       err := make(chan error)
-       go func() {
-               t.fn(t)
-               body <- dockercontainer.ContainerWaitOKBody{StatusCode: int64(t.exitCode)}
-       }()
-       return body, err
-}
-
-func (t *TestDockerClient) ContainerInspect(ctx context.Context, id string) (c dockertypes.ContainerJSON, err error) {
-       c.ContainerJSONBase = &dockertypes.ContainerJSONBase{}
-       c.ID = "abcde"
-       if t.ctrExited {
-               c.State = &dockertypes.ContainerState{Status: "exited", Dead: true}
-       } else {
-               c.State = &dockertypes.ContainerState{Status: "running", Pid: 1234, Running: true}
-       }
-       return
-}
-
-func (t *TestDockerClient) ImageInspectWithRaw(ctx context.Context, image string) (dockertypes.ImageInspect, []byte, error) {
-       if t.exitCode == 2 {
-               return dockertypes.ImageInspect{}, nil, fmt.Errorf("Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?")
-       }
-
-       if t.imageLoaded == image {
-               return dockertypes.ImageInspect{}, nil, nil
-       }
-       return dockertypes.ImageInspect{}, nil, errors.New("")
-}
-
-func (t *TestDockerClient) ImageLoad(ctx context.Context, input io.Reader, quiet bool) (dockertypes.ImageLoadResponse, error) {
-       if t.exitCode == 2 {
-               return dockertypes.ImageLoadResponse{}, fmt.Errorf("Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?")
-       }
-       _, err := io.Copy(ioutil.Discard, input)
-       if err != nil {
-               return dockertypes.ImageLoadResponse{}, err
-       }
-       t.imageLoaded = hwImageId
-       return dockertypes.ImageLoadResponse{Body: ioutil.NopCloser(input)}, nil
-}
-
-func (*TestDockerClient) ImageRemove(ctx context.Context, image string, options dockertypes.ImageRemoveOptions) ([]dockertypes.ImageDeleteResponseItem, error) {
-       return nil, nil
-}
-
 func (client *ArvTestClient) Create(resourceType string,
        parameters arvadosclient.Dict,
        output interface{}) error {
@@ -238,9 +202,10 @@ func (client *ArvTestClient) Create(resourceType string,
 
        if resourceType == "collections" && output != nil {
                mt := parameters["collection"].(arvadosclient.Dict)["manifest_text"].(string)
+               md5sum := md5.Sum([]byte(mt))
                outmap := output.(*arvados.Collection)
-               outmap.PortableDataHash = fmt.Sprintf("%x+%d", md5.Sum([]byte(mt)), len(mt))
-               outmap.UUID = fmt.Sprintf("zzzzz-4zz18-%15.15x", md5.Sum([]byte(mt)))
+               outmap.PortableDataHash = fmt.Sprintf("%x+%d", md5sum, len(mt))
+               outmap.UUID = fmt.Sprintf("zzzzz-4zz18-%015x", md5sum[:7])
        }
 
        return nil
@@ -287,7 +252,7 @@ func (client *ArvTestClient) CallRaw(method, resourceType, uuid, action string,
        } else {
                j = []byte(`{
                        "command": ["sleep", "1"],
-                       "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+                       "container_image": "` + arvadostest.DockerImage112PDH + `",
                        "cwd": ".",
                        "environment": {},
                        "mounts": {"/tmp": {"kind": "tmp"}, "/json": {"kind": "json", "content": {"number": 123456789123456789}}},
@@ -326,7 +291,7 @@ func (client *ArvTestClient) Update(resourceType string, uuid string, parameters
                if parameters["container"].(arvadosclient.Dict)["state"] == "Running" {
                        client.WasSetRunning = true
                }
-       } else if resourceType == "collections" {
+       } else if resourceType == "collections" && output != nil {
                mt := parameters["collection"].(arvadosclient.Dict)["manifest_text"].(string)
                output.(*arvados.Collection).UUID = uuid
                output.(*arvados.Collection).PortableDataHash = fmt.Sprintf("%x", md5.Sum([]byte(mt)))
@@ -375,9 +340,11 @@ func (client *KeepTestClient) LocalLocator(locator string) (string, error) {
        return locator, nil
 }
 
-func (client *KeepTestClient) PutB(buf []byte) (string, int, error) {
-       client.Content = buf
-       return fmt.Sprintf("%x+%d", md5.Sum(buf), len(buf)), len(buf), nil
+func (client *KeepTestClient) BlockWrite(_ context.Context, opts arvados.BlockWriteOptions) (arvados.BlockWriteResponse, error) {
+       client.Content = opts.Data
+       return arvados.BlockWriteResponse{
+               Locator: fmt.Sprintf("%x+%d", md5.Sum(opts.Data), len(opts.Data)),
+       }, nil
 }
 
 func (client *KeepTestClient) ReadAt(string, []byte, int) (int, error) {
@@ -391,6 +358,10 @@ func (client *KeepTestClient) Close() {
        client.Content = nil
 }
 
+func (client *KeepTestClient) SetStorageClasses(sc []string) {
+       client.StorageClasses = sc
+}
+
 type FileWrapper struct {
        io.ReadCloser
        len int64
@@ -424,8 +395,16 @@ func (fw FileWrapper) Sync() error {
        return errors.New("not implemented")
 }
 
+func (fw FileWrapper) Snapshot() (*arvados.Subtree, error) {
+       return nil, errors.New("not implemented")
+}
+
+func (fw FileWrapper) Splice(*arvados.Subtree) error {
+       return errors.New("not implemented")
+}
+
 func (client *KeepTestClient) ManifestFileReader(m manifest.Manifest, filename string) (arvados.File, error) {
-       if filename == hwImageId+".tar" {
+       if filename == hwImageID+".tar" {
                rdr := ioutil.NopCloser(&bytes.Buffer{})
                client.Called = true
                return FileWrapper{rdr, 1321984}, nil
@@ -438,49 +417,35 @@ func (client *KeepTestClient) ManifestFileReader(m manifest.Manifest, filename s
 }
 
 func (s *TestSuite) TestLoadImage(c *C) {
-       cr, err := NewContainerRunner(s.client, &ArvTestClient{},
-               &KeepTestClient{}, s.docker, "zzzzz-zzzzz-zzzzzzzzzzzzzzz")
-       c.Assert(err, IsNil)
-
-       kc := &KeepTestClient{}
-       defer kc.Close()
-       cr.ContainerArvClient = &ArvTestClient{}
-       cr.ContainerKeepClient = kc
-
-       _, err = cr.Docker.ImageRemove(nil, hwImageId, dockertypes.ImageRemoveOptions{})
-       c.Check(err, IsNil)
-
-       _, _, err = cr.Docker.ImageInspectWithRaw(nil, hwImageId)
-       c.Check(err, NotNil)
-
-       cr.Container.ContainerImage = hwPDH
-
-       // (1) Test loading image from keep
-       c.Check(kc.Called, Equals, false)
-       c.Check(cr.ContainerConfig.Image, Equals, "")
-
-       err = cr.LoadImage()
-
-       c.Check(err, IsNil)
-       defer func() {
-               cr.Docker.ImageRemove(nil, hwImageId, dockertypes.ImageRemoveOptions{})
-       }()
-
-       c.Check(kc.Called, Equals, true)
-       c.Check(cr.ContainerConfig.Image, Equals, hwImageId)
-
-       _, _, err = cr.Docker.ImageInspectWithRaw(nil, hwImageId)
-       c.Check(err, IsNil)
+       s.runner.Container.ContainerImage = arvadostest.DockerImage112PDH
+       s.runner.Container.Mounts = map[string]arvados.Mount{
+               "/out": {Kind: "tmp", Writable: true},
+       }
+       s.runner.Container.OutputPath = "/out"
 
-       // (2) Test using image that's already loaded
-       kc.Called = false
-       cr.ContainerConfig.Image = ""
+       _, err := s.runner.SetupMounts()
+       c.Assert(err, IsNil)
 
-       err = cr.LoadImage()
+       imageID, err := s.runner.LoadImage()
        c.Check(err, IsNil)
-       c.Check(kc.Called, Equals, false)
-       c.Check(cr.ContainerConfig.Image, Equals, hwImageId)
-
+       c.Check(s.executor.loaded, Matches, ".*"+regexp.QuoteMeta(arvadostest.DockerImage112Filename))
+       c.Check(imageID, Equals, strings.TrimSuffix(arvadostest.DockerImage112Filename, ".tar"))
+
+       s.runner.Container.ContainerImage = arvadostest.DockerImage112PDH
+       s.executor.imageLoaded = false
+       s.executor.loaded = ""
+       s.executor.loadErr = errors.New("bork")
+       imageID, err = s.runner.LoadImage()
+       c.Check(err, ErrorMatches, ".*bork")
+       c.Check(s.executor.loaded, Matches, ".*"+regexp.QuoteMeta(arvadostest.DockerImage112Filename))
+
+       s.runner.Container.ContainerImage = fakeInputCollectionPDH
+       s.executor.imageLoaded = false
+       s.executor.loaded = ""
+       s.executor.loadErr = nil
+       imageID, err = s.runner.LoadImage()
+       c.Check(err, ErrorMatches, "image collection does not include a \\.tar image file")
+       c.Check(s.executor.loaded, Equals, "")
 }
 
 type ArvErrorTestClient struct{}
@@ -523,8 +488,8 @@ func (*KeepErrorTestClient) ManifestFileReader(manifest.Manifest, string) (arvad
        return nil, errors.New("KeepError")
 }
 
-func (*KeepErrorTestClient) PutB(buf []byte) (string, int, error) {
-       return "", 0, errors.New("KeepError")
+func (*KeepErrorTestClient) BlockWrite(context.Context, arvados.BlockWriteOptions) (arvados.BlockWriteResponse, error) {
+       return arvados.BlockWriteResponse{}, errors.New("KeepError")
 }
 
 func (*KeepErrorTestClient) LocalLocator(string) (string, error) {
@@ -555,65 +520,6 @@ func (KeepReadErrorTestClient) ManifestFileReader(m manifest.Manifest, filename
        return ErrorReader{}, nil
 }
 
-func (s *TestSuite) TestLoadImageArvError(c *C) {
-       // (1) Arvados error
-       kc := &KeepTestClient{}
-       defer kc.Close()
-       cr, err := NewContainerRunner(s.client, &ArvErrorTestClient{}, kc, nil, "zzzzz-zzzzz-zzzzzzzzzzzzzzz")
-       c.Assert(err, IsNil)
-
-       cr.ContainerArvClient = &ArvErrorTestClient{}
-       cr.ContainerKeepClient = &KeepTestClient{}
-
-       cr.Container.ContainerImage = hwPDH
-
-       err = cr.LoadImage()
-       c.Check(err.Error(), Equals, "While getting container image collection: ArvError")
-}
-
-func (s *TestSuite) TestLoadImageKeepError(c *C) {
-       // (2) Keep error
-       kc := &KeepErrorTestClient{}
-       cr, err := NewContainerRunner(s.client, &ArvTestClient{}, kc, s.docker, "zzzzz-zzzzz-zzzzzzzzzzzzzzz")
-       c.Assert(err, IsNil)
-
-       cr.ContainerArvClient = &ArvTestClient{}
-       cr.ContainerKeepClient = &KeepErrorTestClient{}
-
-       cr.Container.ContainerImage = hwPDH
-
-       err = cr.LoadImage()
-       c.Assert(err, NotNil)
-       c.Check(err.Error(), Equals, "While creating ManifestFileReader for container image: KeepError")
-}
-
-func (s *TestSuite) TestLoadImageCollectionError(c *C) {
-       // (3) Collection doesn't contain image
-       kc := &KeepReadErrorTestClient{}
-       cr, err := NewContainerRunner(s.client, &ArvTestClient{}, kc, nil, "zzzzz-zzzzz-zzzzzzzzzzzzzzz")
-       c.Assert(err, IsNil)
-       cr.Container.ContainerImage = otherPDH
-
-       cr.ContainerArvClient = &ArvTestClient{}
-       cr.ContainerKeepClient = &KeepReadErrorTestClient{}
-
-       err = cr.LoadImage()
-       c.Check(err.Error(), Equals, "First file in the container image collection does not end in .tar")
-}
-
-func (s *TestSuite) TestLoadImageKeepReadError(c *C) {
-       // (4) Collection doesn't contain image
-       kc := &KeepReadErrorTestClient{}
-       cr, err := NewContainerRunner(s.client, &ArvTestClient{}, kc, s.docker, "zzzzz-zzzzz-zzzzzzzzzzzzzzz")
-       c.Assert(err, IsNil)
-       cr.Container.ContainerImage = hwPDH
-       cr.ContainerArvClient = &ArvTestClient{}
-       cr.ContainerKeepClient = &KeepReadErrorTestClient{}
-
-       err = cr.LoadImage()
-       c.Check(err, NotNil)
-}
-
 type ClosableBuffer struct {
        bytes.Buffer
 }
@@ -647,35 +553,30 @@ func dockerLog(fd byte, msg string) []byte {
 }
 
 func (s *TestSuite) TestRunContainer(c *C) {
-       s.docker.fn = func(t *TestDockerClient) {
-               t.logWriter.Write(dockerLog(1, "Hello world\n"))
-               t.logWriter.Close()
+       s.executor.runFunc = func() int {
+               fmt.Fprintf(s.executor.created.Stdout, "Hello world\n")
+               return 0
        }
-       kc := &KeepTestClient{}
-       defer kc.Close()
-       cr, err := NewContainerRunner(s.client, &ArvTestClient{}, kc, s.docker, "zzzzz-zzzzz-zzzzzzzzzzzzzzz")
-       c.Assert(err, IsNil)
-
-       cr.ContainerArvClient = &ArvTestClient{}
-       cr.ContainerKeepClient = &KeepTestClient{}
 
        var logs TestLogs
-       cr.NewLogWriter = logs.NewTestLoggingWriter
-       cr.Container.ContainerImage = hwPDH
-       cr.Container.Command = []string{"./hw"}
-       err = cr.LoadImage()
-       c.Check(err, IsNil)
+       s.runner.NewLogWriter = logs.NewTestLoggingWriter
+       s.runner.Container.ContainerImage = arvadostest.DockerImage112PDH
+       s.runner.Container.Command = []string{"./hw"}
+       s.runner.Container.OutputStorageClasses = []string{"default"}
 
-       err = cr.CreateContainer()
-       c.Check(err, IsNil)
+       imageID, err := s.runner.LoadImage()
+       c.Assert(err, IsNil)
 
-       err = cr.StartContainer()
-       c.Check(err, IsNil)
+       err = s.runner.CreateContainer(imageID, nil)
+       c.Assert(err, IsNil)
 
-       err = cr.WaitFinish()
-       c.Check(err, IsNil)
+       err = s.runner.StartContainer()
+       c.Assert(err, IsNil)
+
+       err = s.runner.WaitFinish()
+       c.Assert(err, IsNil)
 
-       c.Check(strings.HasSuffix(logs.Stdout.String(), "Hello world\n"), Equals, true)
+       c.Check(logs.Stdout.String(), Matches, ".*Hello world\n")
        c.Check(logs.Stderr.String(), Equals, "")
 }
 
@@ -683,7 +584,7 @@ func (s *TestSuite) TestCommitLogs(c *C) {
        api := &ArvTestClient{}
        kc := &KeepTestClient{}
        defer kc.Close()
-       cr, err := NewContainerRunner(s.client, api, kc, nil, "zzzzz-zzzzz-zzzzzzzzzzzzzzz")
+       cr, err := NewContainerRunner(s.client, api, kc, "zzzzz-zzzzz-zzzzzzzzzzzzzzz")
        c.Assert(err, IsNil)
        cr.CrunchLog.Timestamper = (&TestTimestamper{}).Timestamp
 
@@ -705,10 +606,10 @@ func (s *TestSuite) TestUpdateContainerRunning(c *C) {
        api := &ArvTestClient{}
        kc := &KeepTestClient{}
        defer kc.Close()
-       cr, err := NewContainerRunner(s.client, api, kc, nil, "zzzzz-zzzzz-zzzzzzzzzzzzzzz")
+       cr, err := NewContainerRunner(s.client, api, kc, "zzzzz-zzzzz-zzzzzzzzzzzzzzz")
        c.Assert(err, IsNil)
 
-       err = cr.UpdateContainerRunning()
+       err = cr.UpdateContainerRunning("")
        c.Check(err, IsNil)
 
        c.Check(api.Content[0]["container"].(arvadosclient.Dict)["state"], Equals, "Running")
@@ -718,7 +619,7 @@ func (s *TestSuite) TestUpdateContainerComplete(c *C) {
        api := &ArvTestClient{}
        kc := &KeepTestClient{}
        defer kc.Close()
-       cr, err := NewContainerRunner(s.client, api, kc, nil, "zzzzz-zzzzz-zzzzzzzzzzzzzzz")
+       cr, err := NewContainerRunner(s.client, api, kc, "zzzzz-zzzzz-zzzzzzzzzzzzzzz")
        c.Assert(err, IsNil)
 
        cr.LogsPDH = new(string)
@@ -740,7 +641,7 @@ func (s *TestSuite) TestUpdateContainerCancelled(c *C) {
        api := &ArvTestClient{}
        kc := &KeepTestClient{}
        defer kc.Close()
-       cr, err := NewContainerRunner(s.client, api, kc, nil, "zzzzz-zzzzz-zzzzzzzzzzzzzzz")
+       cr, err := NewContainerRunner(s.client, api, kc, "zzzzz-zzzzz-zzzzzzzzzzzzzzz")
        c.Assert(err, IsNil)
        cr.cCancelled = true
        cr.finalState = "Cancelled"
@@ -755,10 +656,10 @@ func (s *TestSuite) TestUpdateContainerCancelled(c *C) {
 
 // Used by the TestFullRun*() test below to DRY up boilerplate setup to do full
 // dress rehearsal of the Run() function, starting from a JSON container record.
-func (s *TestSuite) fullRunHelper(c *C, record string, extraMounts []string, exitCode int, fn func(t *TestDockerClient)) (api *ArvTestClient, cr *ContainerRunner, realTemp string) {
-       rec := arvados.Container{}
-       err := json.Unmarshal([]byte(record), &rec)
-       c.Check(err, IsNil)
+func (s *TestSuite) fullRunHelper(c *C, record string, extraMounts []string, fn func() int) (*ArvTestClient, *ContainerRunner, string) {
+       err := json.Unmarshal([]byte(record), &s.api.Container)
+       c.Assert(err, IsNil)
+       initialState := s.api.Container.State
 
        var sm struct {
                SecretMounts map[string]arvados.Mount `json:"secret_mounts"`
@@ -766,33 +667,17 @@ func (s *TestSuite) fullRunHelper(c *C, record string, extraMounts []string, exi
        err = json.Unmarshal([]byte(record), &sm)
        c.Check(err, IsNil)
        secretMounts, err := json.Marshal(sm)
-       c.Logf("%s %q", sm, secretMounts)
-       c.Check(err, IsNil)
-
-       s.docker.exitCode = exitCode
-       s.docker.fn = fn
-       s.docker.ImageRemove(nil, hwImageId, dockertypes.ImageRemoveOptions{})
-
-       api = &ArvTestClient{Container: rec}
-       s.docker.api = api
-       kc := &KeepTestClient{}
-       defer kc.Close()
-       cr, err = NewContainerRunner(s.client, api, kc, s.docker, "zzzzz-zzzzz-zzzzzzzzzzzzzzz")
        c.Assert(err, IsNil)
-       s.runner = cr
-       cr.statInterval = 100 * time.Millisecond
-       cr.containerWatchdogInterval = time.Second
-       am := &ArvMountCmdLine{}
-       cr.RunArvMount = am.ArvMountTest
+       c.Logf("SecretMounts decoded %v json %q", sm, secretMounts)
 
-       realTemp, err = ioutil.TempDir("", "crunchrun_test1-")
-       c.Assert(err, IsNil)
-       defer os.RemoveAll(realTemp)
+       s.executor.runFunc = fn
 
-       s.docker.realTemp = realTemp
+       s.runner.statInterval = 100 * time.Millisecond
+       s.runner.containerWatchdogInterval = time.Second
 
+       realTemp := c.MkDir()
        tempcount := 0
-       cr.MkTempDir = func(_ string, prefix string) (string, error) {
+       s.runner.MkTempDir = func(_, prefix string) (string, error) {
                tempcount++
                d := fmt.Sprintf("%s/%s%d", realTemp, prefix, tempcount)
                err := os.Mkdir(d, os.ModePerm)
@@ -802,73 +687,85 @@ func (s *TestSuite) fullRunHelper(c *C, record string, extraMounts []string, exi
                }
                return d, err
        }
-       cr.MkArvClient = func(token string) (IArvadosClient, IKeepClient, *arvados.Client, error) {
-               return &ArvTestClient{secretMounts: secretMounts}, &KeepTestClient{}, nil, nil
+       s.runner.MkArvClient = func(token string) (IArvadosClient, IKeepClient, *arvados.Client, error) {
+               return &ArvTestClient{secretMounts: secretMounts}, &s.testContainerKeepClient, nil, nil
        }
 
        if extraMounts != nil && len(extraMounts) > 0 {
-               err := cr.SetupArvMountPoint("keep")
+               err := s.runner.SetupArvMountPoint("keep")
                c.Check(err, IsNil)
 
                for _, m := range extraMounts {
-                       os.MkdirAll(cr.ArvMountPoint+"/by_id/"+m, os.ModePerm)
+                       os.MkdirAll(s.runner.ArvMountPoint+"/by_id/"+m, os.ModePerm)
                }
        }
 
-       err = cr.Run()
-       if api.CalledWith("container.state", "Complete") != nil {
+       err = s.runner.Run()
+       if s.api.CalledWith("container.state", "Complete") != nil {
                c.Check(err, IsNil)
        }
-       if exitCode != 2 {
-               c.Check(api.WasSetRunning, Equals, true)
+       if s.executor.loadErr == nil && s.executor.createErr == nil && initialState != "Running" {
+               c.Check(s.api.WasSetRunning, Equals, true)
                var lastupdate arvadosclient.Dict
-               for _, content := range api.Content {
+               for _, content := range s.api.Content {
                        if content["container"] != nil {
                                lastupdate = content["container"].(arvadosclient.Dict)
                        }
                }
                if lastupdate["log"] == nil {
-                       c.Errorf("no container update with non-nil log -- updates were: %v", api.Content)
+                       c.Errorf("no container update with non-nil log -- updates were: %v", s.api.Content)
                }
        }
 
        if err != nil {
-               for k, v := range api.Logs {
+               for k, v := range s.api.Logs {
                        c.Log(k)
                        c.Log(v.String())
                }
        }
 
-       return
+       return s.api, s.runner, realTemp
 }
 
 func (s *TestSuite) TestFullRunHello(c *C) {
-       api, _, _ := s.fullRunHelper(c, `{
+       s.runner.enableMemoryLimit = true
+       s.runner.networkMode = "default"
+       s.fullRunHelper(c, `{
     "command": ["echo", "hello world"],
-    "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+    "container_image": "`+arvadostest.DockerImage112PDH+`",
     "cwd": ".",
-    "environment": {},
+    "environment": {"foo":"bar","baz":"waz"},
     "mounts": {"/tmp": {"kind": "tmp"} },
     "output_path": "/tmp",
     "priority": 1,
-    "runtime_constraints": {},
-    "state": "Locked"
-}`, nil, 0, func(t *TestDockerClient) {
-               t.logWriter.Write(dockerLog(1, "hello world\n"))
-               t.logWriter.Close()
+    "runtime_constraints": {"vcpus":1,"ram":1000000},
+    "state": "Locked",
+    "output_storage_classes": ["default"]
+}`, nil, func() int {
+               c.Check(s.executor.created.Command, DeepEquals, []string{"echo", "hello world"})
+               c.Check(s.executor.created.Image, Equals, "sha256:d8309758b8fe2c81034ffc8a10c36460b77db7bc5e7b448c4e5b684f9d95a678")
+               c.Check(s.executor.created.Env, DeepEquals, map[string]string{"foo": "bar", "baz": "waz"})
+               c.Check(s.executor.created.VCPUs, Equals, 1)
+               c.Check(s.executor.created.RAM, Equals, int64(1000000))
+               c.Check(s.executor.created.NetworkMode, Equals, "default")
+               c.Check(s.executor.created.EnableNetwork, Equals, false)
+               c.Check(s.executor.created.CUDADeviceCount, Equals, 0)
+               fmt.Fprintln(s.executor.created.Stdout, "hello world")
+               return 0
        })
 
-       c.Check(api.CalledWith("container.exit_code", 0), NotNil)
-       c.Check(api.CalledWith("container.state", "Complete"), NotNil)
-       c.Check(strings.HasSuffix(api.Logs["stdout"].String(), "hello world\n"), Equals, true)
-
+       c.Check(s.api.CalledWith("container.exit_code", 0), NotNil)
+       c.Check(s.api.CalledWith("container.state", "Complete"), NotNil)
+       c.Check(s.api.Logs["stdout"].String(), Matches, ".*hello world\n")
+       c.Check(s.testDispatcherKeepClient.StorageClasses, DeepEquals, []string{"default"})
+       c.Check(s.testContainerKeepClient.StorageClasses, DeepEquals, []string{"default"})
 }
 
 func (s *TestSuite) TestRunAlreadyRunning(c *C) {
        var ran bool
-       api, _, _ := s.fullRunHelper(c, `{
+       s.fullRunHelper(c, `{
     "command": ["sleep", "3"],
-    "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+    "container_image": "`+arvadostest.DockerImage112PDH+`",
     "cwd": ".",
     "environment": {},
     "mounts": {"/tmp": {"kind": "tmp"} },
@@ -877,19 +774,96 @@ func (s *TestSuite) TestRunAlreadyRunning(c *C) {
     "runtime_constraints": {},
     "scheduling_parameters":{"max_run_time": 1},
     "state": "Running"
-}`, nil, 2, func(t *TestDockerClient) {
+}`, nil, func() int {
                ran = true
+               return 2
        })
-
-       c.Check(api.CalledWith("container.state", "Cancelled"), IsNil)
-       c.Check(api.CalledWith("container.state", "Complete"), IsNil)
+       c.Check(s.api.CalledWith("container.state", "Cancelled"), IsNil)
+       c.Check(s.api.CalledWith("container.state", "Complete"), IsNil)
        c.Check(ran, Equals, false)
 }
 
+func ec2MetadataServerStub(c *C, token *string, failureRate float64, stoptime *atomic.Value) *httptest.Server {
+       failedOnce := false
+       return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+               if !failedOnce || rand.Float64() < failureRate {
+                       w.WriteHeader(http.StatusServiceUnavailable)
+                       failedOnce = true
+                       return
+               }
+               switch r.URL.Path {
+               case "/latest/api/token":
+                       fmt.Fprintln(w, *token)
+               case "/latest/meta-data/spot/instance-action":
+                       if r.Header.Get("X-aws-ec2-metadata-token") != *token {
+                               w.WriteHeader(http.StatusUnauthorized)
+                       } else if t, _ := stoptime.Load().(time.Time); t.IsZero() {
+                               w.WriteHeader(http.StatusNotFound)
+                       } else {
+                               fmt.Fprintf(w, `{"action":"stop","time":"%s"}`, t.Format(time.RFC3339))
+                       }
+               default:
+                       w.WriteHeader(http.StatusNotFound)
+               }
+       }))
+}
+
+func (s *TestSuite) TestSpotInterruptionNotice(c *C) {
+       s.testSpotInterruptionNotice(c, 0.1)
+}
+
+func (s *TestSuite) TestSpotInterruptionNoticeNotAvailable(c *C) {
+       s.testSpotInterruptionNotice(c, 1)
+}
+
+func (s *TestSuite) testSpotInterruptionNotice(c *C, failureRate float64) {
+       var stoptime atomic.Value
+       token := "fake-ec2-metadata-token"
+       stub := ec2MetadataServerStub(c, &token, failureRate, &stoptime)
+       defer stub.Close()
+
+       defer func(i time.Duration, u string) {
+               spotInterruptionCheckInterval = i
+               ec2MetadataBaseURL = u
+       }(spotInterruptionCheckInterval, ec2MetadataBaseURL)
+       spotInterruptionCheckInterval = time.Second / 8
+       ec2MetadataBaseURL = stub.URL
+
+       go s.runner.checkSpotInterruptionNotices()
+       s.fullRunHelper(c, `{
+    "command": ["sleep", "3"],
+    "container_image": "`+arvadostest.DockerImage112PDH+`",
+    "cwd": ".",
+    "environment": {},
+    "mounts": {"/tmp": {"kind": "tmp"} },
+    "output_path": "/tmp",
+    "priority": 1,
+    "runtime_constraints": {},
+    "state": "Locked"
+}`, nil, func() int {
+               time.Sleep(time.Second)
+               stoptime.Store(time.Now().Add(time.Minute).UTC())
+               token = "different-fake-ec2-metadata-token"
+               time.Sleep(time.Second)
+               return 0
+       })
+       c.Check(s.api.Logs["crunch-run"].String(), Matches, `(?ms).*Checking for spot interruptions every 125ms using instance metadata at http://.*`)
+       c.Check(s.api.Logs["crunch-run"].String(), Matches, `(?ms).*Error checking spot interruptions: 503 Service Unavailable.*`)
+       if failureRate == 1 {
+               c.Check(s.api.Logs["crunch-run"].String(), Matches, `(?ms).*Giving up on checking spot interruptions after too many consecutive failures.*`)
+       } else {
+               text := `Cloud provider scheduled instance stop at ` + stoptime.Load().(time.Time).Format(time.RFC3339)
+               c.Check(s.api.Logs["crunch-run"].String(), Matches, `(?ms).*`+text+`.*`)
+               c.Check(s.api.CalledWith("container.runtime_status.warning", "preemption notice"), NotNil)
+               c.Check(s.api.CalledWith("container.runtime_status.warningDetail", text), NotNil)
+               c.Check(s.api.CalledWith("container.runtime_status.preemptionNotice", text), NotNil)
+       }
+}
+
 func (s *TestSuite) TestRunTimeExceeded(c *C) {
-       api, _, _ := s.fullRunHelper(c, `{
+       s.fullRunHelper(c, `{
     "command": ["sleep", "3"],
-    "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+    "container_image": "`+arvadostest.DockerImage112PDH+`",
     "cwd": ".",
     "environment": {},
     "mounts": {"/tmp": {"kind": "tmp"} },
@@ -898,38 +872,37 @@ func (s *TestSuite) TestRunTimeExceeded(c *C) {
     "runtime_constraints": {},
     "scheduling_parameters":{"max_run_time": 1},
     "state": "Locked"
-}`, nil, 0, func(t *TestDockerClient) {
+}`, nil, func() int {
                time.Sleep(3 * time.Second)
-               t.logWriter.Close()
+               return 0
        })
 
-       c.Check(api.CalledWith("container.state", "Cancelled"), NotNil)
-       c.Check(api.Logs["crunch-run"].String(), Matches, "(?ms).*maximum run time exceeded.*")
+       c.Check(s.api.CalledWith("container.state", "Cancelled"), NotNil)
+       c.Check(s.api.Logs["crunch-run"].String(), Matches, "(?ms).*maximum run time exceeded.*")
 }
 
 func (s *TestSuite) TestContainerWaitFails(c *C) {
-       api, _, _ := s.fullRunHelper(c, `{
+       s.fullRunHelper(c, `{
     "command": ["sleep", "3"],
-    "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+    "container_image": "`+arvadostest.DockerImage112PDH+`",
     "cwd": ".",
     "mounts": {"/tmp": {"kind": "tmp"} },
     "output_path": "/tmp",
     "priority": 1,
     "state": "Locked"
-}`, nil, 0, func(t *TestDockerClient) {
-               t.ctrExited = true
-               time.Sleep(10 * time.Second)
-               t.logWriter.Close()
+}`, nil, func() int {
+               s.executor.waitErr = errors.New("Container is not running")
+               return 0
        })
 
-       c.Check(api.CalledWith("container.state", "Cancelled"), NotNil)
-       c.Check(api.Logs["crunch-run"].String(), Matches, "(?ms).*Container is not running.*")
+       c.Check(s.api.CalledWith("container.state", "Cancelled"), NotNil)
+       c.Check(s.api.Logs["crunch-run"].String(), Matches, "(?ms).*Container is not running.*")
 }
 
 func (s *TestSuite) TestCrunchstat(c *C) {
-       api, _, _ := s.fullRunHelper(c, `{
+       s.fullRunHelper(c, `{
                "command": ["sleep", "1"],
-               "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+               "container_image": "`+arvadostest.DockerImage112PDH+`",
                "cwd": ".",
                "environment": {},
                "mounts": {"/tmp": {"kind": "tmp"} },
@@ -937,33 +910,33 @@ func (s *TestSuite) TestCrunchstat(c *C) {
                "priority": 1,
                "runtime_constraints": {},
                "state": "Locked"
-       }`, nil, 0, func(t *TestDockerClient) {
+       }`, nil, func() int {
                time.Sleep(time.Second)
-               t.logWriter.Close()
+               return 0
        })
 
-       c.Check(api.CalledWith("container.exit_code", 0), NotNil)
-       c.Check(api.CalledWith("container.state", "Complete"), NotNil)
+       c.Check(s.api.CalledWith("container.exit_code", 0), NotNil)
+       c.Check(s.api.CalledWith("container.state", "Complete"), NotNil)
 
        // We didn't actually start a container, so crunchstat didn't
        // find accounting files and therefore didn't log any stats.
        // It should have logged a "can't find accounting files"
        // message after one poll interval, though, so we can confirm
        // it's alive:
-       c.Assert(api.Logs["crunchstat"], NotNil)
-       c.Check(api.Logs["crunchstat"].String(), Matches, `(?ms).*cgroup stats files have not appeared after 100ms.*`)
+       c.Assert(s.api.Logs["crunchstat"], NotNil)
+       c.Check(s.api.Logs["crunchstat"].String(), Matches, `(?ms).*cgroup stats files have not appeared after 100ms.*`)
 
        // The "files never appeared" log assures us that we called
        // (*crunchstat.Reporter)Stop(), and that we set it up with
        // the correct container ID "abcde":
-       c.Check(api.Logs["crunchstat"].String(), Matches, `(?ms).*cgroup stats files never appeared for abcde\n`)
+       c.Check(s.api.Logs["crunchstat"].String(), Matches, `(?ms).*cgroup stats files never appeared for cgroupid\n`)
 }
 
 func (s *TestSuite) TestNodeInfoLog(c *C) {
        os.Setenv("SLURMD_NODENAME", "compute2")
-       api, _, _ := s.fullRunHelper(c, `{
+       s.fullRunHelper(c, `{
                "command": ["sleep", "1"],
-               "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+               "container_image": "`+arvadostest.DockerImage112PDH+`",
                "cwd": ".",
                "environment": {},
                "mounts": {"/tmp": {"kind": "tmp"} },
@@ -971,23 +944,22 @@ func (s *TestSuite) TestNodeInfoLog(c *C) {
                "priority": 1,
                "runtime_constraints": {},
                "state": "Locked"
-       }`, nil, 0,
-               func(t *TestDockerClient) {
-                       time.Sleep(time.Second)
-                       t.logWriter.Close()
-               })
+       }`, nil, func() int {
+               time.Sleep(time.Second)
+               return 0
+       })
 
-       c.Check(api.CalledWith("container.exit_code", 0), NotNil)
-       c.Check(api.CalledWith("container.state", "Complete"), NotNil)
+       c.Check(s.api.CalledWith("container.exit_code", 0), NotNil)
+       c.Check(s.api.CalledWith("container.state", "Complete"), NotNil)
 
-       c.Assert(api.Logs["node"], NotNil)
-       json := api.Logs["node"].String()
+       c.Assert(s.api.Logs["node"], NotNil)
+       json := s.api.Logs["node"].String()
        c.Check(json, Matches, `(?ms).*"uuid": *"zzzzz-7ekkf-2z3mc76g2q73aio".*`)
        c.Check(json, Matches, `(?ms).*"total_cpu_cores": *16.*`)
        c.Check(json, Not(Matches), `(?ms).*"info":.*`)
 
-       c.Assert(api.Logs["node-info"], NotNil)
-       json = api.Logs["node-info"].String()
+       c.Assert(s.api.Logs["node-info"], NotNil)
+       json = s.api.Logs["node-info"].String()
        c.Check(json, Matches, `(?ms).*Host Information.*`)
        c.Check(json, Matches, `(?ms).*CPU Information.*`)
        c.Check(json, Matches, `(?ms).*Memory Information.*`)
@@ -995,10 +967,132 @@ func (s *TestSuite) TestNodeInfoLog(c *C) {
        c.Check(json, Matches, `(?ms).*Disk INodes.*`)
 }
 
+func (s *TestSuite) TestLogVersionAndRuntime(c *C) {
+       s.fullRunHelper(c, `{
+               "command": ["sleep", "1"],
+               "container_image": "`+arvadostest.DockerImage112PDH+`",
+               "cwd": ".",
+               "environment": {},
+               "mounts": {"/tmp": {"kind": "tmp"} },
+               "output_path": "/tmp",
+               "priority": 1,
+               "runtime_constraints": {},
+               "state": "Locked"
+       }`, nil, func() int {
+               return 0
+       })
+
+       c.Assert(s.api.Logs["crunch-run"], NotNil)
+       c.Check(s.api.Logs["crunch-run"].String(), Matches, `(?ms).*crunch-run \S+ \(go\S+\) start.*`)
+       c.Check(s.api.Logs["crunch-run"].String(), Matches, `(?ms).*crunch-run process has uid=\d+\(.+\) gid=\d+\(.+\) groups=\d+\(.+\)(,\d+\(.+\))*\n.*`)
+       c.Check(s.api.Logs["crunch-run"].String(), Matches, `(?ms).*Executing container: zzzzz-zzzzz-zzzzzzzzzzzzzzz.*`)
+       c.Check(s.api.Logs["crunch-run"].String(), Matches, `(?ms).*Using container runtime: stub.*`)
+}
+
+func (s *TestSuite) testLogRSSThresholds(c *C, ram int, expected []int, notExpected int) {
+       s.runner.cgroupRoot = "testdata/fakestat"
+       s.fullRunHelper(c, `{
+               "command": ["true"],
+               "container_image": "`+arvadostest.DockerImage112PDH+`",
+               "cwd": ".",
+               "environment": {},
+               "mounts": {"/tmp": {"kind": "tmp"} },
+               "output_path": "/tmp",
+               "priority": 1,
+               "runtime_constraints": {"ram": `+strconv.Itoa(ram)+`},
+               "state": "Locked"
+       }`, nil, func() int { return 0 })
+       logs := s.api.Logs["crunch-run"].String()
+       pattern := logLineStart + `Container using over %d%% of memory \(rss 734003200/%d bytes\)`
+       var threshold int
+       for _, threshold = range expected {
+               c.Check(logs, Matches, fmt.Sprintf(pattern, threshold, ram))
+       }
+       if notExpected > threshold {
+               c.Check(logs, Not(Matches), fmt.Sprintf(pattern, notExpected, ram))
+       }
+}
+
+func (s *TestSuite) TestLogNoRSSThresholds(c *C) {
+       s.testLogRSSThresholds(c, 7340032000, []int{}, 90)
+}
+
+func (s *TestSuite) TestLogSomeRSSThresholds(c *C) {
+       onePercentRSS := 7340032
+       s.testLogRSSThresholds(c, 102*onePercentRSS, []int{90, 95}, 99)
+}
+
+func (s *TestSuite) TestLogAllRSSThresholds(c *C) {
+       s.testLogRSSThresholds(c, 734003299, []int{90, 95, 99}, 0)
+}
+
+func (s *TestSuite) TestLogMaximaAfterRun(c *C) {
+       s.runner.cgroupRoot = "testdata/fakestat"
+       s.runner.parentTemp = c.MkDir()
+       s.fullRunHelper(c, `{
+        "command": ["true"],
+        "container_image": "`+arvadostest.DockerImage112PDH+`",
+        "cwd": ".",
+        "environment": {},
+        "mounts": {"/tmp": {"kind": "tmp"} },
+        "output_path": "/tmp",
+        "priority": 1,
+        "runtime_constraints": {"ram": 7340032000},
+        "state": "Locked"
+    }`, nil, func() int { return 0 })
+       logs := s.api.Logs["crunch-run"].String()
+       for _, expected := range []string{
+               `Maximum disk usage was \d+%, \d+/\d+ bytes`,
+               `Maximum container memory cache usage was 73400320 bytes`,
+               `Maximum container memory swap usage was 320 bytes`,
+               `Maximum container memory pgmajfault usage was 20 faults`,
+               `Maximum container memory rss usage was 10%, 734003200/7340032000 bytes`,
+               `Maximum crunch-run memory rss usage was \d+ bytes`,
+       } {
+               c.Check(logs, Matches, logLineStart+expected)
+       }
+}
+
+func (s *TestSuite) TestCommitNodeInfoBeforeStart(c *C) {
+       var collection_create, container_update arvadosclient.Dict
+       s.fullRunHelper(c, `{
+               "command": ["true"],
+               "container_image": "`+arvadostest.DockerImage112PDH+`",
+               "cwd": ".",
+               "environment": {},
+               "mounts": {"/tmp": {"kind": "tmp"} },
+               "output_path": "/tmp",
+               "priority": 1,
+               "runtime_constraints": {},
+               "state": "Locked",
+               "uuid": "zzzzz-dz642-202301121543210"
+       }`, nil, func() int {
+               collection_create = s.api.CalledWith("ensure_unique_name", true)
+               container_update = s.api.CalledWith("container.state", "Running")
+               return 0
+       })
+
+       c.Assert(collection_create, NotNil)
+       log_collection := collection_create["collection"].(arvadosclient.Dict)
+       c.Check(log_collection["name"], Equals, "logs for zzzzz-dz642-202301121543210")
+       manifest_text := log_collection["manifest_text"].(string)
+       // We check that the file size is at least two digits as an easy way to
+       // check the file isn't empty.
+       c.Check(manifest_text, Matches, `\. .+ \d+:\d{2,}:node-info\.txt( .+)?\n`)
+       c.Check(manifest_text, Matches, `\. .+ \d+:\d{2,}:node\.json( .+)?\n`)
+
+       c.Assert(container_update, NotNil)
+       // As of Arvados 2.5.0, the container update must specify its log in PDH
+       // format for the API server to propagate it to container requests, which
+       // is what we care about for this test.
+       expect_pdh := fmt.Sprintf("%x+%d", md5.Sum([]byte(manifest_text)), len(manifest_text))
+       c.Check(container_update["container"].(arvadosclient.Dict)["log"], Equals, expect_pdh)
+}
+
 func (s *TestSuite) TestContainerRecordLog(c *C) {
-       api, _, _ := s.fullRunHelper(c, `{
+       s.fullRunHelper(c, `{
                "command": ["sleep", "1"],
-               "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+               "container_image": "`+arvadostest.DockerImage112PDH+`",
                "cwd": ".",
                "environment": {},
                "mounts": {"/tmp": {"kind": "tmp"} },
@@ -1006,23 +1100,23 @@ func (s *TestSuite) TestContainerRecordLog(c *C) {
                "priority": 1,
                "runtime_constraints": {},
                "state": "Locked"
-       }`, nil, 0,
-               func(t *TestDockerClient) {
+       }`, nil,
+               func() int {
                        time.Sleep(time.Second)
-                       t.logWriter.Close()
+                       return 0
                })
 
-       c.Check(api.CalledWith("container.exit_code", 0), NotNil)
-       c.Check(api.CalledWith("container.state", "Complete"), NotNil)
+       c.Check(s.api.CalledWith("container.exit_code", 0), NotNil)
+       c.Check(s.api.CalledWith("container.state", "Complete"), NotNil)
 
-       c.Assert(api.Logs["container"], NotNil)
-       c.Check(api.Logs["container"].String(), Matches, `(?ms).*container_image.*`)
+       c.Assert(s.api.Logs["container"], NotNil)
+       c.Check(s.api.Logs["container"].String(), Matches, `(?ms).*container_image.*`)
 }
 
 func (s *TestSuite) TestFullRunStderr(c *C) {
-       api, _, _ := s.fullRunHelper(c, `{
+       s.fullRunHelper(c, `{
     "command": ["/bin/sh", "-c", "echo hello ; echo world 1>&2 ; exit 1"],
-    "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+    "container_image": "`+arvadostest.DockerImage112PDH+`",
     "cwd": ".",
     "environment": {},
     "mounts": {"/tmp": {"kind": "tmp"} },
@@ -1030,25 +1124,25 @@ func (s *TestSuite) TestFullRunStderr(c *C) {
     "priority": 1,
     "runtime_constraints": {},
     "state": "Locked"
-}`, nil, 1, func(t *TestDockerClient) {
-               t.logWriter.Write(dockerLog(1, "hello\n"))
-               t.logWriter.Write(dockerLog(2, "world\n"))
-               t.logWriter.Close()
+}`, nil, func() int {
+               fmt.Fprintln(s.executor.created.Stdout, "hello")
+               fmt.Fprintln(s.executor.created.Stderr, "world")
+               return 1
        })
 
-       final := api.CalledWith("container.state", "Complete")
+       final := s.api.CalledWith("container.state", "Complete")
        c.Assert(final, NotNil)
        c.Check(final["container"].(arvadosclient.Dict)["exit_code"], Equals, 1)
        c.Check(final["container"].(arvadosclient.Dict)["log"], NotNil)
 
-       c.Check(strings.HasSuffix(api.Logs["stdout"].String(), "hello\n"), Equals, true)
-       c.Check(strings.HasSuffix(api.Logs["stderr"].String(), "world\n"), Equals, true)
+       c.Check(s.api.Logs["stdout"].String(), Matches, ".*hello\n")
+       c.Check(s.api.Logs["stderr"].String(), Matches, ".*world\n")
 }
 
 func (s *TestSuite) TestFullRunDefaultCwd(c *C) {
-       api, _, _ := s.fullRunHelper(c, `{
+       s.fullRunHelper(c, `{
     "command": ["pwd"],
-    "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+    "container_image": "`+arvadostest.DockerImage112PDH+`",
     "cwd": ".",
     "environment": {},
     "mounts": {"/tmp": {"kind": "tmp"} },
@@ -1056,21 +1150,21 @@ func (s *TestSuite) TestFullRunDefaultCwd(c *C) {
     "priority": 1,
     "runtime_constraints": {},
     "state": "Locked"
-}`, nil, 0, func(t *TestDockerClient) {
-               t.logWriter.Write(dockerLog(1, t.cwd+"\n"))
-               t.logWriter.Close()
+}`, nil, func() int {
+               fmt.Fprintf(s.executor.created.Stdout, "workdir=%q", s.executor.created.WorkingDir)
+               return 0
        })
 
-       c.Check(api.CalledWith("container.exit_code", 0), NotNil)
-       c.Check(api.CalledWith("container.state", "Complete"), NotNil)
-       c.Log(api.Logs["stdout"])
-       c.Check(strings.HasSuffix(api.Logs["stdout"].String(), "/\n"), Equals, true)
+       c.Check(s.api.CalledWith("container.exit_code", 0), NotNil)
+       c.Check(s.api.CalledWith("container.state", "Complete"), NotNil)
+       c.Log(s.api.Logs["stdout"])
+       c.Check(s.api.Logs["stdout"].String(), Matches, `.*workdir=""\n`)
 }
 
 func (s *TestSuite) TestFullRunSetCwd(c *C) {
-       api, _, _ := s.fullRunHelper(c, `{
+       s.fullRunHelper(c, `{
     "command": ["pwd"],
-    "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+    "container_image": "`+arvadostest.DockerImage112PDH+`",
     "cwd": "/bin",
     "environment": {},
     "mounts": {"/tmp": {"kind": "tmp"} },
@@ -1078,41 +1172,104 @@ func (s *TestSuite) TestFullRunSetCwd(c *C) {
     "priority": 1,
     "runtime_constraints": {},
     "state": "Locked"
-}`, nil, 0, func(t *TestDockerClient) {
-               t.logWriter.Write(dockerLog(1, t.cwd+"\n"))
-               t.logWriter.Close()
+}`, nil, func() int {
+               fmt.Fprintln(s.executor.created.Stdout, s.executor.created.WorkingDir)
+               return 0
        })
 
-       c.Check(api.CalledWith("container.exit_code", 0), NotNil)
-       c.Check(api.CalledWith("container.state", "Complete"), NotNil)
-       c.Check(strings.HasSuffix(api.Logs["stdout"].String(), "/bin\n"), Equals, true)
+       c.Check(s.api.CalledWith("container.exit_code", 0), NotNil)
+       c.Check(s.api.CalledWith("container.state", "Complete"), NotNil)
+       c.Check(s.api.Logs["stdout"].String(), Matches, ".*/bin\n")
 }
 
-func (s *TestSuite) TestStopOnSignal(c *C) {
-       s.testStopContainer(c, func(cr *ContainerRunner) {
-               go func() {
-                       for !s.docker.calledWait {
-                               time.Sleep(time.Millisecond)
-                       }
-                       cr.SigChan <- syscall.SIGINT
-               }()
+func (s *TestSuite) TestFullRunSetOutputStorageClasses(c *C) {
+       s.fullRunHelper(c, `{
+    "command": ["pwd"],
+    "container_image": "`+arvadostest.DockerImage112PDH+`",
+    "cwd": "/bin",
+    "environment": {},
+    "mounts": {"/tmp": {"kind": "tmp"} },
+    "output_path": "/tmp",
+    "priority": 1,
+    "runtime_constraints": {},
+    "state": "Locked",
+    "output_storage_classes": ["foo", "bar"]
+}`, nil, func() int {
+               fmt.Fprintln(s.executor.created.Stdout, s.executor.created.WorkingDir)
+               return 0
        })
+
+       c.Check(s.api.CalledWith("container.exit_code", 0), NotNil)
+       c.Check(s.api.CalledWith("container.state", "Complete"), NotNil)
+       c.Check(s.api.Logs["stdout"].String(), Matches, ".*/bin\n")
+       c.Check(s.testDispatcherKeepClient.StorageClasses, DeepEquals, []string{"foo", "bar"})
+       c.Check(s.testContainerKeepClient.StorageClasses, DeepEquals, []string{"foo", "bar"})
 }
 
-func (s *TestSuite) TestStopOnArvMountDeath(c *C) {
-       s.testStopContainer(c, func(cr *ContainerRunner) {
-               cr.ArvMountExit = make(chan error)
-               go func() {
-                       cr.ArvMountExit <- exec.Command("true").Run()
-                       close(cr.ArvMountExit)
-               }()
+func (s *TestSuite) TestEnableCUDADeviceCount(c *C) {
+       s.fullRunHelper(c, `{
+    "command": ["pwd"],
+    "container_image": "`+arvadostest.DockerImage112PDH+`",
+    "cwd": "/bin",
+    "environment": {},
+    "mounts": {"/tmp": {"kind": "tmp"} },
+    "output_path": "/tmp",
+    "priority": 1,
+    "runtime_constraints": {"cuda": {"device_count": 2}},
+    "state": "Locked",
+    "output_storage_classes": ["foo", "bar"]
+}`, nil, func() int {
+               fmt.Fprintln(s.executor.created.Stdout, "ok")
+               return 0
+       })
+       c.Check(s.executor.created.CUDADeviceCount, Equals, 2)
+}
+
+func (s *TestSuite) TestEnableCUDAHardwareCapability(c *C) {
+       s.fullRunHelper(c, `{
+    "command": ["pwd"],
+    "container_image": "`+arvadostest.DockerImage112PDH+`",
+    "cwd": "/bin",
+    "environment": {},
+    "mounts": {"/tmp": {"kind": "tmp"} },
+    "output_path": "/tmp",
+    "priority": 1,
+    "runtime_constraints": {"cuda": {"hardware_capability": "foo"}},
+    "state": "Locked",
+    "output_storage_classes": ["foo", "bar"]
+}`, nil, func() int {
+               fmt.Fprintln(s.executor.created.Stdout, "ok")
+               return 0
        })
+       c.Check(s.executor.created.CUDADeviceCount, Equals, 0)
 }
 
-func (s *TestSuite) testStopContainer(c *C, setup func(cr *ContainerRunner)) {
+func (s *TestSuite) TestStopOnSignal(c *C) {
+       s.executor.runFunc = func() int {
+               s.executor.created.Stdout.Write([]byte("foo\n"))
+               s.runner.SigChan <- syscall.SIGINT
+               time.Sleep(10 * time.Second)
+               return 0
+       }
+       s.testStopContainer(c)
+}
+
+func (s *TestSuite) TestStopOnArvMountDeath(c *C) {
+       s.executor.runFunc = func() int {
+               s.executor.created.Stdout.Write([]byte("foo\n"))
+               s.runner.ArvMountExit <- nil
+               close(s.runner.ArvMountExit)
+               time.Sleep(10 * time.Second)
+               return 0
+       }
+       s.runner.ArvMountExit = make(chan error)
+       s.testStopContainer(c)
+}
+
+func (s *TestSuite) testStopContainer(c *C) {
        record := `{
     "command": ["/bin/sh", "-c", "echo foo && sleep 30 && echo bar"],
-    "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+    "container_image": "` + arvadostest.DockerImage112PDH + `",
     "cwd": ".",
     "environment": {},
     "mounts": {"/tmp": {"kind": "tmp"} },
@@ -1122,31 +1279,17 @@ func (s *TestSuite) testStopContainer(c *C, setup func(cr *ContainerRunner)) {
     "state": "Locked"
 }`
 
-       rec := arvados.Container{}
-       err := json.Unmarshal([]byte(record), &rec)
-       c.Check(err, IsNil)
-
-       s.docker.fn = func(t *TestDockerClient) {
-               <-t.stop
-               t.logWriter.Write(dockerLog(1, "foo\n"))
-               t.logWriter.Close()
-       }
-       s.docker.ImageRemove(nil, hwImageId, dockertypes.ImageRemoveOptions{})
-
-       api := &ArvTestClient{Container: rec}
-       kc := &KeepTestClient{}
-       defer kc.Close()
-       cr, err := NewContainerRunner(s.client, api, kc, s.docker, "zzzzz-zzzzz-zzzzzzzzzzzzzzz")
+       err := json.Unmarshal([]byte(record), &s.api.Container)
        c.Assert(err, IsNil)
-       cr.RunArvMount = func([]string, string) (*exec.Cmd, error) { return nil, nil }
-       cr.MkArvClient = func(token string) (IArvadosClient, IKeepClient, *arvados.Client, error) {
+
+       s.runner.RunArvMount = func([]string, string) (*exec.Cmd, error) { return nil, nil }
+       s.runner.MkArvClient = func(token string) (IArvadosClient, IKeepClient, *arvados.Client, error) {
                return &ArvTestClient{}, &KeepTestClient{}, nil, nil
        }
-       setup(cr)
 
        done := make(chan error)
        go func() {
-               done <- cr.Run()
+               done <- s.runner.Run()
        }()
        select {
        case <-time.After(20 * time.Second):
@@ -1155,20 +1298,20 @@ func (s *TestSuite) testStopContainer(c *C, setup func(cr *ContainerRunner)) {
        case err = <-done:
                c.Check(err, IsNil)
        }
-       for k, v := range api.Logs {
+       for k, v := range s.api.Logs {
                c.Log(k)
-               c.Log(v.String())
+               c.Log(v.String(), "\n")
        }
 
-       c.Check(api.CalledWith("container.log", nil), NotNil)
-       c.Check(api.CalledWith("container.state", "Cancelled"), NotNil)
-       c.Check(api.Logs["stdout"].String(), Matches, "(?ms).*foo\n$")
+       c.Check(s.api.CalledWith("container.log", nil), NotNil)
+       c.Check(s.api.CalledWith("container.state", "Cancelled"), NotNil)
+       c.Check(s.api.Logs["stdout"].String(), Matches, "(?ms).*foo\n$")
 }
 
 func (s *TestSuite) TestFullRunSetEnv(c *C) {
-       api, _, _ := s.fullRunHelper(c, `{
+       s.fullRunHelper(c, `{
     "command": ["/bin/sh", "-c", "echo $FROBIZ"],
-    "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+    "container_image": "`+arvadostest.DockerImage112PDH+`",
     "cwd": "/bin",
     "environment": {"FROBIZ": "bilbo"},
     "mounts": {"/tmp": {"kind": "tmp"} },
@@ -1176,14 +1319,14 @@ func (s *TestSuite) TestFullRunSetEnv(c *C) {
     "priority": 1,
     "runtime_constraints": {},
     "state": "Locked"
-}`, nil, 0, func(t *TestDockerClient) {
-               t.logWriter.Write(dockerLog(1, t.env[0][7:]+"\n"))
-               t.logWriter.Close()
+}`, nil, func() int {
+               fmt.Fprintf(s.executor.created.Stdout, "%v", s.executor.created.Env)
+               return 0
        })
 
-       c.Check(api.CalledWith("container.exit_code", 0), NotNil)
-       c.Check(api.CalledWith("container.state", "Complete"), NotNil)
-       c.Check(strings.HasSuffix(api.Logs["stdout"].String(), "bilbo\n"), Equals, true)
+       c.Check(s.api.CalledWith("container.exit_code", 0), NotNil)
+       c.Check(s.api.CalledWith("container.state", "Complete"), NotNil)
+       c.Check(s.api.Logs["stdout"].String(), Matches, `.*map\[FROBIZ:bilbo\]\n`)
 }
 
 type ArvMountCmdLine struct {
@@ -1206,27 +1349,18 @@ func stubCert(temp string) string {
 }
 
 func (s *TestSuite) TestSetupMounts(c *C) {
-       api := &ArvTestClient{}
-       kc := &KeepTestClient{}
-       defer kc.Close()
-       cr, err := NewContainerRunner(s.client, api, kc, nil, "zzzzz-zzzzz-zzzzzzzzzzzzzzz")
-       c.Assert(err, IsNil)
+       cr := s.runner
        am := &ArvMountCmdLine{}
        cr.RunArvMount = am.ArvMountTest
        cr.ContainerArvClient = &ArvTestClient{}
        cr.ContainerKeepClient = &KeepTestClient{}
+       cr.Container.OutputStorageClasses = []string{"default"}
 
-       realTemp, err := ioutil.TempDir("", "crunchrun_test1-")
-       c.Assert(err, IsNil)
-       certTemp, err := ioutil.TempDir("", "crunchrun_test2-")
-       c.Assert(err, IsNil)
+       realTemp := c.MkDir()
+       certTemp := c.MkDir()
        stubCertPath := stubCert(certTemp)
-
        cr.parentTemp = realTemp
 
-       defer os.RemoveAll(realTemp)
-       defer os.RemoveAll(certTemp)
-
        i := 0
        cr.MkTempDir = func(_ string, prefix string) (string, error) {
                i++
@@ -1255,12 +1389,12 @@ func (s *TestSuite) TestSetupMounts(c *C) {
                cr.Container.Mounts["/tmp"] = arvados.Mount{Kind: "tmp"}
                cr.Container.OutputPath = "/tmp"
                cr.statInterval = 5 * time.Second
-               err := cr.SetupMounts()
+               bindmounts, err := cr.SetupMounts()
                c.Check(err, IsNil)
-               c.Check(am.Cmd, DeepEquals, []string{"--foreground", "--allow-other",
-                       "--read-write", "--crunchstat-interval=5",
-                       "--mount-by-pdh", "by_id", realTemp + "/keep1"})
-               c.Check(cr.Binds, DeepEquals, []string{realTemp + "/tmp2:/tmp"})
+               c.Check(am.Cmd, DeepEquals, []string{"arv-mount", "--foreground",
+                       "--read-write", "--storage-classes", "default", "--crunchstat-interval=5",
+                       "--mount-by-pdh", "by_id", "--disable-event-listening", "--mount-by-id", "by_uuid", realTemp + "/keep1"})
+               c.Check(bindmounts, DeepEquals, map[string]bindmount{"/tmp": {realTemp + "/tmp2", false}})
                os.RemoveAll(cr.ArvMountPoint)
                cr.CleanupDirs()
                checkEmpty()
@@ -1273,13 +1407,14 @@ func (s *TestSuite) TestSetupMounts(c *C) {
                cr.Container.Mounts["/out"] = arvados.Mount{Kind: "tmp"}
                cr.Container.Mounts["/tmp"] = arvados.Mount{Kind: "tmp"}
                cr.Container.OutputPath = "/out"
+               cr.Container.OutputStorageClasses = []string{"foo", "bar"}
 
-               err := cr.SetupMounts()
+               bindmounts, err := cr.SetupMounts()
                c.Check(err, IsNil)
-               c.Check(am.Cmd, DeepEquals, []string{"--foreground", "--allow-other",
-                       "--read-write", "--crunchstat-interval=5",
-                       "--mount-by-pdh", "by_id", realTemp + "/keep1"})
-               c.Check(cr.Binds, DeepEquals, []string{realTemp + "/tmp2:/out", realTemp + "/tmp3:/tmp"})
+               c.Check(am.Cmd, DeepEquals, []string{"arv-mount", "--foreground",
+                       "--read-write", "--storage-classes", "foo,bar", "--crunchstat-interval=5",
+                       "--mount-by-pdh", "by_id", "--disable-event-listening", "--mount-by-id", "by_uuid", realTemp + "/keep1"})
+               c.Check(bindmounts, DeepEquals, map[string]bindmount{"/out": {realTemp + "/tmp2", false}, "/tmp": {realTemp + "/tmp3", false}})
                os.RemoveAll(cr.ArvMountPoint)
                cr.CleanupDirs()
                checkEmpty()
@@ -1291,21 +1426,20 @@ func (s *TestSuite) TestSetupMounts(c *C) {
                cr.Container.Mounts = make(map[string]arvados.Mount)
                cr.Container.Mounts["/tmp"] = arvados.Mount{Kind: "tmp"}
                cr.Container.OutputPath = "/tmp"
+               cr.Container.RuntimeConstraints.API = true
+               cr.Container.OutputStorageClasses = []string{"default"}
 
-               apiflag := true
-               cr.Container.RuntimeConstraints.API = &apiflag
-
-               err := cr.SetupMounts()
+               bindmounts, err := cr.SetupMounts()
                c.Check(err, IsNil)
-               c.Check(am.Cmd, DeepEquals, []string{"--foreground", "--allow-other",
-                       "--read-write", "--crunchstat-interval=5",
-                       "--mount-by-pdh", "by_id", realTemp + "/keep1"})
-               c.Check(cr.Binds, DeepEquals, []string{realTemp + "/tmp2:/tmp", stubCertPath + ":/etc/arvados/ca-certificates.crt:ro"})
+               c.Check(am.Cmd, DeepEquals, []string{"arv-mount", "--foreground",
+                       "--read-write", "--storage-classes", "default", "--crunchstat-interval=5",
+                       "--mount-by-pdh", "by_id", "--disable-event-listening", "--mount-by-id", "by_uuid", realTemp + "/keep1"})
+               c.Check(bindmounts, DeepEquals, map[string]bindmount{"/tmp": {realTemp + "/tmp2", false}, "/etc/arvados/ca-certificates.crt": {stubCertPath, true}})
                os.RemoveAll(cr.ArvMountPoint)
                cr.CleanupDirs()
                checkEmpty()
 
-               apiflag = false
+               cr.Container.RuntimeConstraints.API = false
        }
 
        {
@@ -1318,12 +1452,12 @@ func (s *TestSuite) TestSetupMounts(c *C) {
 
                os.MkdirAll(realTemp+"/keep1/tmp0", os.ModePerm)
 
-               err := cr.SetupMounts()
+               bindmounts, err := cr.SetupMounts()
                c.Check(err, IsNil)
-               c.Check(am.Cmd, DeepEquals, []string{"--foreground", "--allow-other",
-                       "--read-write", "--crunchstat-interval=5",
-                       "--mount-tmp", "tmp0", "--mount-by-pdh", "by_id", realTemp + "/keep1"})
-               c.Check(cr.Binds, DeepEquals, []string{realTemp + "/keep1/tmp0:/keeptmp"})
+               c.Check(am.Cmd, DeepEquals, []string{"arv-mount", "--foreground",
+                       "--read-write", "--storage-classes", "default", "--crunchstat-interval=5",
+                       "--mount-tmp", "tmp0", "--mount-by-pdh", "by_id", "--disable-event-listening", "--mount-by-id", "by_uuid", realTemp + "/keep1"})
+               c.Check(bindmounts, DeepEquals, map[string]bindmount{"/keeptmp": {realTemp + "/keep1/tmp0", false}})
                os.RemoveAll(cr.ArvMountPoint)
                cr.CleanupDirs()
                checkEmpty()
@@ -1341,14 +1475,15 @@ func (s *TestSuite) TestSetupMounts(c *C) {
                os.MkdirAll(realTemp+"/keep1/by_id/59389a8f9ee9d399be35462a0f92541c+53", os.ModePerm)
                os.MkdirAll(realTemp+"/keep1/tmp0", os.ModePerm)
 
-               err := cr.SetupMounts()
+               bindmounts, err := cr.SetupMounts()
                c.Check(err, IsNil)
-               c.Check(am.Cmd, DeepEquals, []string{"--foreground", "--allow-other",
-                       "--read-write", "--crunchstat-interval=5",
-                       "--mount-tmp", "tmp0", "--mount-by-pdh", "by_id", realTemp + "/keep1"})
-               sort.StringSlice(cr.Binds).Sort()
-               c.Check(cr.Binds, DeepEquals, []string{realTemp + "/keep1/by_id/59389a8f9ee9d399be35462a0f92541c+53:/keepinp:ro",
-                       realTemp + "/keep1/tmp0:/keepout"})
+               c.Check(am.Cmd, DeepEquals, []string{"arv-mount", "--foreground",
+                       "--read-write", "--storage-classes", "default", "--crunchstat-interval=5",
+                       "--mount-tmp", "tmp0", "--mount-by-pdh", "by_id", "--disable-event-listening", "--mount-by-id", "by_uuid", realTemp + "/keep1"})
+               c.Check(bindmounts, DeepEquals, map[string]bindmount{
+                       "/keepinp": {realTemp + "/keep1/by_id/59389a8f9ee9d399be35462a0f92541c+53", true},
+                       "/keepout": {realTemp + "/keep1/tmp0", false},
+               })
                os.RemoveAll(cr.ArvMountPoint)
                cr.CleanupDirs()
                checkEmpty()
@@ -1367,14 +1502,15 @@ func (s *TestSuite) TestSetupMounts(c *C) {
                os.MkdirAll(realTemp+"/keep1/by_id/59389a8f9ee9d399be35462a0f92541c+53", os.ModePerm)
                os.MkdirAll(realTemp+"/keep1/tmp0", os.ModePerm)
 
-               err := cr.SetupMounts()
+               bindmounts, err := cr.SetupMounts()
                c.Check(err, IsNil)
-               c.Check(am.Cmd, DeepEquals, []string{"--foreground", "--allow-other",
-                       "--read-write", "--crunchstat-interval=5",
-                       "--file-cache", "512", "--mount-tmp", "tmp0", "--mount-by-pdh", "by_id", realTemp + "/keep1"})
-               sort.StringSlice(cr.Binds).Sort()
-               c.Check(cr.Binds, DeepEquals, []string{realTemp + "/keep1/by_id/59389a8f9ee9d399be35462a0f92541c+53:/keepinp:ro",
-                       realTemp + "/keep1/tmp0:/keepout"})
+               c.Check(am.Cmd, DeepEquals, []string{"arv-mount", "--foreground",
+                       "--read-write", "--storage-classes", "default", "--crunchstat-interval=5", "--ram-cache",
+                       "--file-cache", "512", "--mount-tmp", "tmp0", "--mount-by-pdh", "by_id", "--disable-event-listening", "--mount-by-id", "by_uuid", realTemp + "/keep1"})
+               c.Check(bindmounts, DeepEquals, map[string]bindmount{
+                       "/keepinp": {realTemp + "/keep1/by_id/59389a8f9ee9d399be35462a0f92541c+53", true},
+                       "/keepout": {realTemp + "/keep1/tmp0", false},
+               })
                os.RemoveAll(cr.ArvMountPoint)
                cr.CleanupDirs()
                checkEmpty()
@@ -1393,10 +1529,11 @@ func (s *TestSuite) TestSetupMounts(c *C) {
                cr.Container.Mounts = map[string]arvados.Mount{
                        "/mnt/test.json": {Kind: "json", Content: test.in},
                }
-               err := cr.SetupMounts()
+               bindmounts, err := cr.SetupMounts()
                c.Check(err, IsNil)
-               sort.StringSlice(cr.Binds).Sort()
-               c.Check(cr.Binds, DeepEquals, []string{realTemp + "/json2/mountdata.json:/mnt/test.json:ro"})
+               c.Check(bindmounts, DeepEquals, map[string]bindmount{
+                       "/mnt/test.json": {realTemp + "/json2/mountdata.json", true},
+               })
                content, err := ioutil.ReadFile(realTemp + "/json2/mountdata.json")
                c.Check(err, IsNil)
                c.Check(content, DeepEquals, []byte(test.out))
@@ -1418,13 +1555,14 @@ func (s *TestSuite) TestSetupMounts(c *C) {
                cr.Container.Mounts = map[string]arvados.Mount{
                        "/mnt/test.txt": {Kind: "text", Content: test.in},
                }
-               err := cr.SetupMounts()
+               bindmounts, err := cr.SetupMounts()
                if test.out == "error" {
                        c.Check(err.Error(), Equals, "content for mount \"/mnt/test.txt\" must be a string")
                } else {
                        c.Check(err, IsNil)
-                       sort.StringSlice(cr.Binds).Sort()
-                       c.Check(cr.Binds, DeepEquals, []string{realTemp + "/text2/mountdata.text:/mnt/test.txt:ro"})
+                       c.Check(bindmounts, DeepEquals, map[string]bindmount{
+                               "/mnt/test.txt": {realTemp + "/text2/mountdata.text", true},
+                       })
                        content, err := ioutil.ReadFile(realTemp + "/text2/mountdata.text")
                        c.Check(err, IsNil)
                        c.Check(content, DeepEquals, []byte(test.out))
@@ -1447,12 +1585,15 @@ func (s *TestSuite) TestSetupMounts(c *C) {
 
                os.MkdirAll(realTemp+"/keep1/tmp0", os.ModePerm)
 
-               err := cr.SetupMounts()
+               bindmounts, err := cr.SetupMounts()
                c.Check(err, IsNil)
-               c.Check(am.Cmd, DeepEquals, []string{"--foreground", "--allow-other",
-                       "--read-write", "--crunchstat-interval=5",
-                       "--file-cache", "512", "--mount-tmp", "tmp0", "--mount-by-pdh", "by_id", realTemp + "/keep1"})
-               c.Check(cr.Binds, DeepEquals, []string{realTemp + "/tmp2:/tmp", realTemp + "/keep1/tmp0:/tmp/foo:ro"})
+               c.Check(am.Cmd, DeepEquals, []string{"arv-mount", "--foreground",
+                       "--read-write", "--storage-classes", "default", "--crunchstat-interval=5", "--ram-cache",
+                       "--file-cache", "512", "--mount-tmp", "tmp0", "--mount-by-pdh", "by_id", "--disable-event-listening", "--mount-by-id", "by_uuid", realTemp + "/keep1"})
+               c.Check(bindmounts, DeepEquals, map[string]bindmount{
+                       "/tmp":     {realTemp + "/tmp2", false},
+                       "/tmp/foo": {realTemp + "/keep1/tmp0", true},
+               })
                os.RemoveAll(cr.ArvMountPoint)
                cr.CleanupDirs()
                checkEmpty()
@@ -1482,7 +1623,7 @@ func (s *TestSuite) TestSetupMounts(c *C) {
                rf.Write([]byte("bar"))
                rf.Close()
 
-               err := cr.SetupMounts()
+               _, err := cr.SetupMounts()
                c.Check(err, IsNil)
                _, err = os.Stat(cr.HostOutputDir + "/foo")
                c.Check(err, IsNil)
@@ -1504,9 +1645,9 @@ func (s *TestSuite) TestSetupMounts(c *C) {
                }
                cr.Container.OutputPath = "/tmp"
 
-               err := cr.SetupMounts()
+               _, err := cr.SetupMounts()
                c.Check(err, NotNil)
-               c.Check(err, ErrorMatches, `Only mount points of kind 'collection', 'text' or 'json' are supported underneath the output_path.*`)
+               c.Check(err, ErrorMatches, `only mount points of kind 'collection', 'text' or 'json' are supported underneath the output_path.*`)
                os.RemoveAll(cr.ArvMountPoint)
                cr.CleanupDirs()
                checkEmpty()
@@ -1521,9 +1662,9 @@ func (s *TestSuite) TestSetupMounts(c *C) {
                        "stdin": {Kind: "tmp"},
                }
 
-               err := cr.SetupMounts()
+               _, err := cr.SetupMounts()
                c.Check(err, NotNil)
-               c.Check(err, ErrorMatches, `Unsupported mount kind 'tmp' for stdin.*`)
+               c.Check(err, ErrorMatches, `unsupported mount kind 'tmp' for stdin.*`)
                os.RemoveAll(cr.ArvMountPoint)
                cr.CleanupDirs()
                checkEmpty()
@@ -1552,34 +1693,24 @@ func (s *TestSuite) TestSetupMounts(c *C) {
                }
                cr.Container.OutputPath = "/tmp"
 
-               err := cr.SetupMounts()
+               bindmounts, err := cr.SetupMounts()
                c.Check(err, IsNil)
 
-               // dirMap[mountpoint] == tmpdir
-               dirMap := make(map[string]string)
-               for _, bind := range cr.Binds {
-                       tokens := strings.Split(bind, ":")
-                       dirMap[tokens[1]] = tokens[0]
-
-                       if cr.Container.Mounts[tokens[1]].Writable {
-                               c.Check(len(tokens), Equals, 2)
-                       } else {
-                               c.Check(len(tokens), Equals, 3)
-                               c.Check(tokens[2], Equals, "ro")
-                       }
+               for path, mount := range bindmounts {
+                       c.Check(mount.ReadOnly, Equals, !cr.Container.Mounts[path].Writable, Commentf("%s %#v", path, mount))
                }
 
-               data, err := ioutil.ReadFile(dirMap["/tip"] + "/dir1/dir2/file with mode 0644")
+               data, err := ioutil.ReadFile(bindmounts["/tip"].HostPath + "/dir1/dir2/file with mode 0644")
                c.Check(err, IsNil)
                c.Check(string(data), Equals, "\000\001\002\003")
-               _, err = ioutil.ReadFile(dirMap["/tip"] + "/file only on testbranch")
+               _, err = ioutil.ReadFile(bindmounts["/tip"].HostPath + "/file only on testbranch")
                c.Check(err, FitsTypeOf, &os.PathError{})
                c.Check(os.IsNotExist(err), Equals, true)
 
-               data, err = ioutil.ReadFile(dirMap["/non-tip"] + "/dir1/dir2/file with mode 0644")
+               data, err = ioutil.ReadFile(bindmounts["/non-tip"].HostPath + "/dir1/dir2/file with mode 0644")
                c.Check(err, IsNil)
                c.Check(string(data), Equals, "\000\001\002\003")
-               data, err = ioutil.ReadFile(dirMap["/non-tip"] + "/file only on testbranch")
+               data, err = ioutil.ReadFile(bindmounts["/non-tip"].HostPath + "/file only on testbranch")
                c.Check(err, IsNil)
                c.Check(string(data), Equals, "testfile\n")
 
@@ -1591,7 +1722,7 @@ func (s *TestSuite) TestSetupMounts(c *C) {
 func (s *TestSuite) TestStdout(c *C) {
        helperRecord := `{
                "command": ["/bin/sh", "-c", "echo $FROBIZ"],
-               "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+               "container_image": "` + arvadostest.DockerImage112PDH + `",
                "cwd": "/bin",
                "environment": {"FROBIZ": "bilbo"},
                "mounts": {"/tmp": {"kind": "tmp"}, "stdout": {"kind": "file", "path": "/tmp/a/b/c.out"} },
@@ -1601,38 +1732,26 @@ func (s *TestSuite) TestStdout(c *C) {
                "state": "Locked"
        }`
 
-       api, cr, _ := s.fullRunHelper(c, helperRecord, nil, 0, func(t *TestDockerClient) {
-               t.logWriter.Write(dockerLog(1, t.env[0][7:]+"\n"))
-               t.logWriter.Close()
+       s.fullRunHelper(c, helperRecord, nil, func() int {
+               fmt.Fprintln(s.executor.created.Stdout, s.executor.created.Env["FROBIZ"])
+               return 0
        })
 
-       c.Check(api.CalledWith("container.exit_code", 0), NotNil)
-       c.Check(api.CalledWith("container.state", "Complete"), NotNil)
-       c.Check(cr.ContainerArvClient.(*ArvTestClient).CalledWith("collection.manifest_text", "./a/b 307372fa8fd5c146b22ae7a45b49bc31+6 0:6:c.out\n"), NotNil)
+       c.Check(s.api.CalledWith("container.exit_code", 0), NotNil)
+       c.Check(s.api.CalledWith("container.state", "Complete"), NotNil)
+       c.Check(s.runner.ContainerArvClient.(*ArvTestClient).CalledWith("collection.manifest_text", "./a/b 307372fa8fd5c146b22ae7a45b49bc31+6 0:6:c.out\n"), NotNil)
 }
 
 // Used by the TestStdoutWithWrongPath*()
-func (s *TestSuite) stdoutErrorRunHelper(c *C, record string, fn func(t *TestDockerClient)) (api *ArvTestClient, cr *ContainerRunner, err error) {
-       rec := arvados.Container{}
-       err = json.Unmarshal([]byte(record), &rec)
-       c.Check(err, IsNil)
-
-       s.docker.fn = fn
-       s.docker.ImageRemove(nil, hwImageId, dockertypes.ImageRemoveOptions{})
-
-       api = &ArvTestClient{Container: rec}
-       kc := &KeepTestClient{}
-       defer kc.Close()
-       cr, err = NewContainerRunner(s.client, api, kc, s.docker, "zzzzz-zzzzz-zzzzzzzzzzzzzzz")
+func (s *TestSuite) stdoutErrorRunHelper(c *C, record string, fn func() int) (*ArvTestClient, *ContainerRunner, error) {
+       err := json.Unmarshal([]byte(record), &s.api.Container)
        c.Assert(err, IsNil)
-       am := &ArvMountCmdLine{}
-       cr.RunArvMount = am.ArvMountTest
-       cr.MkArvClient = func(token string) (IArvadosClient, IKeepClient, *arvados.Client, error) {
-               return &ArvTestClient{}, &KeepTestClient{}, nil, nil
+       s.executor.runFunc = fn
+       s.runner.RunArvMount = (&ArvMountCmdLine{}).ArvMountTest
+       s.runner.MkArvClient = func(token string) (IArvadosClient, IKeepClient, *arvados.Client, error) {
+               return s.api, &KeepTestClient{}, nil, nil
        }
-
-       err = cr.Run()
-       return
+       return s.api, s.runner, s.runner.Run()
 }
 
 func (s *TestSuite) TestStdoutWithWrongPath(c *C) {
@@ -1640,10 +1759,8 @@ func (s *TestSuite) TestStdoutWithWrongPath(c *C) {
     "mounts": {"/tmp": {"kind": "tmp"}, "stdout": {"kind": "file", "path":"/tmpa.out"} },
     "output_path": "/tmp",
     "state": "Locked"
-}`, func(t *TestDockerClient) {})
-
-       c.Check(err, NotNil)
-       c.Check(strings.Contains(err.Error(), "Stdout path does not start with OutputPath"), Equals, true)
+}`, func() int { return 0 })
+       c.Check(err, ErrorMatches, ".*Stdout path does not start with OutputPath.*")
 }
 
 func (s *TestSuite) TestStdoutWithWrongKindTmp(c *C) {
@@ -1651,10 +1768,8 @@ func (s *TestSuite) TestStdoutWithWrongKindTmp(c *C) {
     "mounts": {"/tmp": {"kind": "tmp"}, "stdout": {"kind": "tmp", "path":"/tmp/a.out"} },
     "output_path": "/tmp",
     "state": "Locked"
-}`, func(t *TestDockerClient) {})
-
-       c.Check(err, NotNil)
-       c.Check(strings.Contains(err.Error(), "Unsupported mount kind 'tmp' for stdout"), Equals, true)
+}`, func() int { return 0 })
+       c.Check(err, ErrorMatches, ".*unsupported mount kind 'tmp' for stdout.*")
 }
 
 func (s *TestSuite) TestStdoutWithWrongKindCollection(c *C) {
@@ -1662,18 +1777,14 @@ func (s *TestSuite) TestStdoutWithWrongKindCollection(c *C) {
     "mounts": {"/tmp": {"kind": "tmp"}, "stdout": {"kind": "collection", "path":"/tmp/a.out"} },
     "output_path": "/tmp",
     "state": "Locked"
-}`, func(t *TestDockerClient) {})
-
-       c.Check(err, NotNil)
-       c.Check(strings.Contains(err.Error(), "Unsupported mount kind 'collection' for stdout"), Equals, true)
+}`, func() int { return 0 })
+       c.Check(err, ErrorMatches, ".*unsupported mount kind 'collection' for stdout.*")
 }
 
 func (s *TestSuite) TestFullRunWithAPI(c *C) {
-       defer os.Setenv("ARVADOS_API_HOST", os.Getenv("ARVADOS_API_HOST"))
-       os.Setenv("ARVADOS_API_HOST", "test.arvados.org")
-       api, _, _ := s.fullRunHelper(c, `{
-    "command": ["/bin/sh", "-c", "echo $ARVADOS_API_HOST"],
-    "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+       s.fullRunHelper(c, `{
+    "command": ["/bin/sh", "-c", "true $ARVADOS_API_HOST"],
+    "container_image": "`+arvadostest.DockerImage112PDH+`",
     "cwd": "/bin",
     "environment": {},
     "mounts": {"/tmp": {"kind": "tmp"} },
@@ -1681,23 +1792,21 @@ func (s *TestSuite) TestFullRunWithAPI(c *C) {
     "priority": 1,
     "runtime_constraints": {"API": true},
     "state": "Locked"
-}`, nil, 0, func(t *TestDockerClient) {
-               t.logWriter.Write(dockerLog(1, t.env[1][17:]+"\n"))
-               t.logWriter.Close()
+}`, nil, func() int {
+               c.Check(s.executor.created.Env["ARVADOS_API_HOST"], Equals, os.Getenv("ARVADOS_API_HOST"))
+               return 3
        })
-
-       c.Check(api.CalledWith("container.exit_code", 0), NotNil)
-       c.Check(api.CalledWith("container.state", "Complete"), NotNil)
-       c.Check(strings.HasSuffix(api.Logs["stdout"].String(), "test.arvados.org\n"), Equals, true)
-       c.Check(api.CalledWith("container.output", "d41d8cd98f00b204e9800998ecf8427e+0"), NotNil)
+       c.Check(s.api.CalledWith("container.exit_code", 3), NotNil)
+       c.Check(s.api.CalledWith("container.state", "Complete"), NotNil)
+       c.Check(s.api.Logs["crunch-run"].String(), Matches, `(?ms).*status code 3\n.*`)
 }
 
 func (s *TestSuite) TestFullRunSetOutput(c *C) {
        defer os.Setenv("ARVADOS_API_HOST", os.Getenv("ARVADOS_API_HOST"))
        os.Setenv("ARVADOS_API_HOST", "test.arvados.org")
-       api, _, _ := s.fullRunHelper(c, `{
+       s.fullRunHelper(c, `{
     "command": ["/bin/sh", "-c", "echo $ARVADOS_API_HOST"],
-    "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+    "container_image": "`+arvadostest.DockerImage112PDH+`",
     "cwd": "/bin",
     "environment": {},
     "mounts": {"/tmp": {"kind": "tmp"} },
@@ -1705,20 +1814,52 @@ func (s *TestSuite) TestFullRunSetOutput(c *C) {
     "priority": 1,
     "runtime_constraints": {"API": true},
     "state": "Locked"
-}`, nil, 0, func(t *TestDockerClient) {
-               t.api.Container.Output = "d4ab34d3d4f8a72f5c4973051ae69fab+122"
-               t.logWriter.Close()
+}`, nil, func() int {
+               s.api.Container.Output = arvadostest.DockerImage112PDH
+               return 0
        })
 
-       c.Check(api.CalledWith("container.exit_code", 0), NotNil)
-       c.Check(api.CalledWith("container.state", "Complete"), NotNil)
-       c.Check(api.CalledWith("container.output", "d4ab34d3d4f8a72f5c4973051ae69fab+122"), NotNil)
+       c.Check(s.api.CalledWith("container.exit_code", 0), NotNil)
+       c.Check(s.api.CalledWith("container.state", "Complete"), NotNil)
+       c.Check(s.api.CalledWith("container.output", arvadostest.DockerImage112PDH), NotNil)
+}
+
+func (s *TestSuite) TestArvMountRuntimeStatusWarning(c *C) {
+       s.runner.RunArvMount = func([]string, string) (*exec.Cmd, error) {
+               os.Mkdir(s.runner.ArvMountPoint+"/by_id", 0666)
+               ioutil.WriteFile(s.runner.ArvMountPoint+"/by_id/README", nil, 0666)
+               return s.runner.ArvMountCmd([]string{"bash", "-c", "echo >&2 Test: Keep write error: I am a teapot; sleep 3"}, "")
+       }
+       s.executor.runFunc = func() int {
+               time.Sleep(time.Second)
+               return 137
+       }
+       record := `{
+    "command": ["sleep", "1"],
+    "container_image": "` + arvadostest.DockerImage112PDH + `",
+    "cwd": "/bin",
+    "environment": {},
+    "mounts": {"/tmp": {"kind": "tmp"} },
+    "output_path": "/tmp",
+    "priority": 1,
+    "runtime_constraints": {"API": true},
+    "state": "Locked"
+}`
+       err := json.Unmarshal([]byte(record), &s.api.Container)
+       c.Assert(err, IsNil)
+       err = s.runner.Run()
+       c.Assert(err, IsNil)
+       c.Check(s.api.CalledWith("container.exit_code", 137), NotNil)
+       c.Check(s.api.CalledWith("container.runtime_status.warning", "arv-mount: Keep write error"), NotNil)
+       c.Check(s.api.CalledWith("container.runtime_status.warningDetail", "Test: Keep write error: I am a teapot"), NotNil)
+       c.Check(s.api.CalledWith("container.state", "Complete"), NotNil)
+       c.Check(s.api.Logs["crunch-run"].String(), Matches, `(?ms).*Container exited with status code 137 \(signal 9, SIGKILL\).*`)
 }
 
 func (s *TestSuite) TestStdoutWithExcludeFromOutputMountPointUnderOutputDir(c *C) {
        helperRecord := `{
                "command": ["/bin/sh", "-c", "echo $FROBIZ"],
-               "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+               "container_image": "` + arvadostest.DockerImage112PDH + `",
                "cwd": "/bin",
                "environment": {"FROBIZ": "bilbo"},
                "mounts": {
@@ -1737,20 +1878,20 @@ func (s *TestSuite) TestStdoutWithExcludeFromOutputMountPointUnderOutputDir(c *C
 
        extraMounts := []string{"a3e8f74c6f101eae01fa08bfb4e49b3a+54"}
 
-       api, cr, _ := s.fullRunHelper(c, helperRecord, extraMounts, 0, func(t *TestDockerClient) {
-               t.logWriter.Write(dockerLog(1, t.env[0][7:]+"\n"))
-               t.logWriter.Close()
+       s.fullRunHelper(c, helperRecord, extraMounts, func() int {
+               fmt.Fprintln(s.executor.created.Stdout, s.executor.created.Env["FROBIZ"])
+               return 0
        })
 
-       c.Check(api.CalledWith("container.exit_code", 0), NotNil)
-       c.Check(api.CalledWith("container.state", "Complete"), NotNil)
-       c.Check(cr.ContainerArvClient.(*ArvTestClient).CalledWith("collection.manifest_text", "./a/b 307372fa8fd5c146b22ae7a45b49bc31+6 0:6:c.out\n"), NotNil)
+       c.Check(s.api.CalledWith("container.exit_code", 0), NotNil)
+       c.Check(s.api.CalledWith("container.state", "Complete"), NotNil)
+       c.Check(s.runner.ContainerArvClient.(*ArvTestClient).CalledWith("collection.manifest_text", "./a/b 307372fa8fd5c146b22ae7a45b49bc31+6 0:6:c.out\n"), NotNil)
 }
 
 func (s *TestSuite) TestStdoutWithMultipleMountPointsUnderOutputDir(c *C) {
        helperRecord := `{
                "command": ["/bin/sh", "-c", "echo $FROBIZ"],
-               "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+               "container_image": "` + arvadostest.DockerImage112PDH + `",
                "cwd": "/bin",
                "environment": {"FROBIZ": "bilbo"},
                "mounts": {
@@ -1764,7 +1905,8 @@ func (s *TestSuite) TestStdoutWithMultipleMountPointsUnderOutputDir(c *C) {
                "output_path": "/tmp",
                "priority": 1,
                "runtime_constraints": {},
-               "state": "Locked"
+               "state": "Locked",
+               "uuid": "zzzzz-dz642-202301130848001"
        }`
 
        extraMounts := []string{
@@ -1773,42 +1915,46 @@ func (s *TestSuite) TestStdoutWithMultipleMountPointsUnderOutputDir(c *C) {
                "a0def87f80dd594d4675809e83bd4f15+367/subdir1/subdir2/file2_in_subdir2.txt",
        }
 
-       api, runner, realtemp := s.fullRunHelper(c, helperRecord, extraMounts, 0, func(t *TestDockerClient) {
-               t.logWriter.Write(dockerLog(1, t.env[0][7:]+"\n"))
-               t.logWriter.Close()
+       api, _, realtemp := s.fullRunHelper(c, helperRecord, extraMounts, func() int {
+               fmt.Fprintln(s.executor.created.Stdout, s.executor.created.Env["FROBIZ"])
+               return 0
        })
 
-       c.Check(runner.Binds, DeepEquals, []string{realtemp + "/tmp2:/tmp",
-               realtemp + "/keep1/by_id/a0def87f80dd594d4675809e83bd4f15+367/file2_in_main.txt:/tmp/foo/bar:ro",
-               realtemp + "/keep1/by_id/a0def87f80dd594d4675809e83bd4f15+367/subdir1/subdir2/file2_in_subdir2.txt:/tmp/foo/baz/sub2file2:ro",
-               realtemp + "/keep1/by_id/a0def87f80dd594d4675809e83bd4f15+367/subdir1:/tmp/foo/sub1:ro",
-               realtemp + "/keep1/by_id/a0def87f80dd594d4675809e83bd4f15+367/subdir1/file2_in_subdir1.txt:/tmp/foo/sub1file2:ro",
+       c.Check(s.executor.created.BindMounts, DeepEquals, map[string]bindmount{
+               "/tmp":                   {realtemp + "/tmp1", false},
+               "/tmp/foo/bar":           {s.keepmount + "/by_id/a0def87f80dd594d4675809e83bd4f15+367/file2_in_main.txt", true},
+               "/tmp/foo/baz/sub2file2": {s.keepmount + "/by_id/a0def87f80dd594d4675809e83bd4f15+367/subdir1/subdir2/file2_in_subdir2.txt", true},
+               "/tmp/foo/sub1":          {s.keepmount + "/by_id/a0def87f80dd594d4675809e83bd4f15+367/subdir1", true},
+               "/tmp/foo/sub1file2":     {s.keepmount + "/by_id/a0def87f80dd594d4675809e83bd4f15+367/subdir1/file2_in_subdir1.txt", true},
        })
 
        c.Check(api.CalledWith("container.exit_code", 0), NotNil)
        c.Check(api.CalledWith("container.state", "Complete"), NotNil)
-       for _, v := range api.Content {
-               if v["collection"] != nil {
-                       c.Check(v["ensure_unique_name"], Equals, true)
-                       collection := v["collection"].(arvadosclient.Dict)
-                       if strings.Index(collection["name"].(string), "output") == 0 {
-                               manifest := collection["manifest_text"].(string)
-
-                               c.Check(manifest, Equals, `./a/b 307372fa8fd5c146b22ae7a45b49bc31+6 0:6:c.out
+       output_count := uint(0)
+       for _, v := range s.runner.ContainerArvClient.(*ArvTestClient).Content {
+               if v["collection"] == nil {
+                       continue
+               }
+               collection := v["collection"].(arvadosclient.Dict)
+               if collection["name"].(string) != "output for zzzzz-dz642-202301130848001" {
+                       continue
+               }
+               c.Check(v["ensure_unique_name"], Equals, true)
+               c.Check(collection["manifest_text"].(string), Equals, `./a/b 307372fa8fd5c146b22ae7a45b49bc31+6 0:6:c.out
 ./foo 3e426d509afffb85e06c4c96a7c15e91+27+Aa124ac75e5168396c73c0abcdefgh11234567890@569fa8c3 3e426d509afffb85e06c4c96a7c15e91+27+Aa124ac75e5168396cabcdefghij6419876543234@569fa8c4 9:18:bar 36:18:sub1file2
 ./foo/baz 3e426d509afffb85e06c4c96a7c15e91+27+Aa124ac75e5168396c73c0bcdefghijk544332211@569fa8c5 9:18:sub2file2
 ./foo/sub1 3e426d509afffb85e06c4c96a7c15e91+27+Aa124ac75e5168396cabcdefghij6419876543234@569fa8c4 0:9:file1_in_subdir1.txt 9:18:file2_in_subdir1.txt
 ./foo/sub1/subdir2 3e426d509afffb85e06c4c96a7c15e91+27+Aa124ac75e5168396c73c0bcdefghijk544332211@569fa8c5 0:9:file1_in_subdir2.txt 9:18:file2_in_subdir2.txt
 `)
-                       }
-               }
+               output_count++
        }
+       c.Check(output_count, Not(Equals), uint(0))
 }
 
 func (s *TestSuite) TestStdoutWithMountPointsUnderOutputDirDenormalizedManifest(c *C) {
        helperRecord := `{
                "command": ["/bin/sh", "-c", "echo $FROBIZ"],
-               "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+               "container_image": "` + arvadostest.DockerImage112PDH + `",
                "cwd": "/bin",
                "environment": {"FROBIZ": "bilbo"},
                "mounts": {
@@ -1819,38 +1965,42 @@ func (s *TestSuite) TestStdoutWithMountPointsUnderOutputDirDenormalizedManifest(
                "output_path": "/tmp",
                "priority": 1,
                "runtime_constraints": {},
-               "state": "Locked"
+               "state": "Locked",
+               "uuid": "zzzzz-dz642-202301130848002"
        }`
 
        extraMounts := []string{
                "b0def87f80dd594d4675809e83bd4f15+367/subdir1/file2_in_subdir1.txt",
        }
 
-       api, _, _ := s.fullRunHelper(c, helperRecord, extraMounts, 0, func(t *TestDockerClient) {
-               t.logWriter.Write(dockerLog(1, t.env[0][7:]+"\n"))
-               t.logWriter.Close()
+       s.fullRunHelper(c, helperRecord, extraMounts, func() int {
+               fmt.Fprintln(s.executor.created.Stdout, s.executor.created.Env["FROBIZ"])
+               return 0
        })
 
-       c.Check(api.CalledWith("container.exit_code", 0), NotNil)
-       c.Check(api.CalledWith("container.state", "Complete"), NotNil)
-       for _, v := range api.Content {
-               if v["collection"] != nil {
-                       collection := v["collection"].(arvadosclient.Dict)
-                       if strings.Index(collection["name"].(string), "output") == 0 {
-                               manifest := collection["manifest_text"].(string)
-
-                               c.Check(manifest, Equals, `./a/b 307372fa8fd5c146b22ae7a45b49bc31+6 0:6:c.out
+       c.Check(s.api.CalledWith("container.exit_code", 0), NotNil)
+       c.Check(s.api.CalledWith("container.state", "Complete"), NotNil)
+       output_count := uint(0)
+       for _, v := range s.runner.ContainerArvClient.(*ArvTestClient).Content {
+               if v["collection"] == nil {
+                       continue
+               }
+               collection := v["collection"].(arvadosclient.Dict)
+               if collection["name"].(string) != "output for zzzzz-dz642-202301130848002" {
+                       continue
+               }
+               c.Check(collection["manifest_text"].(string), Equals, `./a/b 307372fa8fd5c146b22ae7a45b49bc31+6 0:6:c.out
 ./foo 3e426d509afffb85e06c4c96a7c15e91+27+Aa124ac75e5168396c73c0abcdefgh11234567890@569fa8c3 10:17:bar
 `)
-                       }
-               }
+               output_count++
        }
+       c.Check(output_count, Not(Equals), uint(0))
 }
 
 func (s *TestSuite) TestOutputError(c *C) {
        helperRecord := `{
                "command": ["/bin/sh", "-c", "echo $FROBIZ"],
-               "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+               "container_image": "` + arvadostest.DockerImage112PDH + `",
                "cwd": "/bin",
                "environment": {"FROBIZ": "bilbo"},
                "mounts": {
@@ -1861,21 +2011,18 @@ func (s *TestSuite) TestOutputError(c *C) {
                "runtime_constraints": {},
                "state": "Locked"
        }`
-
-       extraMounts := []string{}
-
-       api, _, _ := s.fullRunHelper(c, helperRecord, extraMounts, 0, func(t *TestDockerClient) {
-               os.Symlink("/etc/hosts", t.realTemp+"/tmp2/baz")
-               t.logWriter.Close()
+       s.fullRunHelper(c, helperRecord, nil, func() int {
+               os.Symlink("/etc/hosts", s.runner.HostOutputDir+"/baz")
+               return 0
        })
 
-       c.Check(api.CalledWith("container.state", "Cancelled"), NotNil)
+       c.Check(s.api.CalledWith("container.state", "Cancelled"), NotNil)
 }
 
 func (s *TestSuite) TestStdinCollectionMountPoint(c *C) {
        helperRecord := `{
                "command": ["/bin/sh", "-c", "echo $FROBIZ"],
-               "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+               "container_image": "` + arvadostest.DockerImage112PDH + `",
                "cwd": "/bin",
                "environment": {"FROBIZ": "bilbo"},
                "mounts": {
@@ -1893,9 +2040,9 @@ func (s *TestSuite) TestStdinCollectionMountPoint(c *C) {
                "b0def87f80dd594d4675809e83bd4f15+367/file1_in_main.txt",
        }
 
-       api, _, _ := s.fullRunHelper(c, helperRecord, extraMounts, 0, func(t *TestDockerClient) {
-               t.logWriter.Write(dockerLog(1, t.env[0][7:]+"\n"))
-               t.logWriter.Close()
+       api, _, _ := s.fullRunHelper(c, helperRecord, extraMounts, func() int {
+               fmt.Fprintln(s.executor.created.Stdout, s.executor.created.Env["FROBIZ"])
+               return 0
        })
 
        c.Check(api.CalledWith("container.exit_code", 0), NotNil)
@@ -1915,7 +2062,7 @@ func (s *TestSuite) TestStdinCollectionMountPoint(c *C) {
 func (s *TestSuite) TestStdinJsonMountPoint(c *C) {
        helperRecord := `{
                "command": ["/bin/sh", "-c", "echo $FROBIZ"],
-               "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+               "container_image": "` + arvadostest.DockerImage112PDH + `",
                "cwd": "/bin",
                "environment": {"FROBIZ": "bilbo"},
                "mounts": {
@@ -1929,9 +2076,9 @@ func (s *TestSuite) TestStdinJsonMountPoint(c *C) {
                "state": "Locked"
        }`
 
-       api, _, _ := s.fullRunHelper(c, helperRecord, nil, 0, func(t *TestDockerClient) {
-               t.logWriter.Write(dockerLog(1, t.env[0][7:]+"\n"))
-               t.logWriter.Close()
+       api, _, _ := s.fullRunHelper(c, helperRecord, nil, func() int {
+               fmt.Fprintln(s.executor.created.Stdout, s.executor.created.Env["FROBIZ"])
+               return 0
        })
 
        c.Check(api.CalledWith("container.exit_code", 0), NotNil)
@@ -1951,7 +2098,7 @@ func (s *TestSuite) TestStdinJsonMountPoint(c *C) {
 func (s *TestSuite) TestStderrMount(c *C) {
        api, cr, _ := s.fullRunHelper(c, `{
     "command": ["/bin/sh", "-c", "echo hello;exit 1"],
-    "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+    "container_image": "`+arvadostest.DockerImage112PDH+`",
     "cwd": ".",
     "environment": {},
     "mounts": {"/tmp": {"kind": "tmp"},
@@ -1961,10 +2108,10 @@ func (s *TestSuite) TestStderrMount(c *C) {
     "priority": 1,
     "runtime_constraints": {},
     "state": "Locked"
-}`, nil, 1, func(t *TestDockerClient) {
-               t.logWriter.Write(dockerLog(1, "hello\n"))
-               t.logWriter.Write(dockerLog(2, "oops\n"))
-               t.logWriter.Close()
+}`, nil, func() int {
+               fmt.Fprintln(s.executor.created.Stdout, "hello")
+               fmt.Fprintln(s.executor.created.Stderr, "oops")
+               return 1
        })
 
        final := api.CalledWith("container.state", "Complete")
@@ -1976,131 +2123,37 @@ func (s *TestSuite) TestStderrMount(c *C) {
 }
 
 func (s *TestSuite) TestNumberRoundTrip(c *C) {
-       kc := &KeepTestClient{}
-       defer kc.Close()
-       cr, err := NewContainerRunner(s.client, &ArvTestClient{callraw: true}, kc, nil, "zzzzz-zzzzz-zzzzzzzzzzzzzzz")
+       s.api.callraw = true
+       err := s.runner.fetchContainerRecord()
        c.Assert(err, IsNil)
-       cr.fetchContainerRecord()
-
-       jsondata, err := json.Marshal(cr.Container.Mounts["/json"].Content)
-
+       jsondata, err := json.Marshal(s.runner.Container.Mounts["/json"].Content)
+       c.Logf("%#v", s.runner.Container)
        c.Check(err, IsNil)
        c.Check(string(jsondata), Equals, `{"number":123456789123456789}`)
 }
 
-func (s *TestSuite) TestFullBrokenDocker1(c *C) {
-       tf, err := ioutil.TempFile("", "brokenNodeHook-")
-       c.Assert(err, IsNil)
-       defer os.Remove(tf.Name())
-
-       tf.Write([]byte(`#!/bin/sh
-exec echo killme
-`))
-       tf.Close()
-       os.Chmod(tf.Name(), 0700)
-
-       ech := tf.Name()
-       brokenNodeHook = &ech
-
-       api, _, _ := s.fullRunHelper(c, `{
-    "command": ["echo", "hello world"],
-    "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
-    "cwd": ".",
-    "environment": {},
-    "mounts": {"/tmp": {"kind": "tmp"} },
-    "output_path": "/tmp",
-    "priority": 1,
-    "runtime_constraints": {},
-    "state": "Locked"
-}`, nil, 2, func(t *TestDockerClient) {
-               t.logWriter.Write(dockerLog(1, "hello world\n"))
-               t.logWriter.Close()
-       })
-
-       c.Check(api.CalledWith("container.state", "Queued"), NotNil)
-       c.Check(api.Logs["crunch-run"].String(), Matches, "(?ms).*unable to run containers.*")
-       c.Check(api.Logs["crunch-run"].String(), Matches, "(?ms).*Running broken node hook.*")
-       c.Check(api.Logs["crunch-run"].String(), Matches, "(?ms).*killme.*")
-
-}
-
-func (s *TestSuite) TestFullBrokenDocker2(c *C) {
-       ech := ""
-       brokenNodeHook = &ech
-
-       api, _, _ := s.fullRunHelper(c, `{
-    "command": ["echo", "hello world"],
-    "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
-    "cwd": ".",
-    "environment": {},
-    "mounts": {"/tmp": {"kind": "tmp"} },
-    "output_path": "/tmp",
-    "priority": 1,
-    "runtime_constraints": {},
-    "state": "Locked"
-}`, nil, 2, func(t *TestDockerClient) {
-               t.logWriter.Write(dockerLog(1, "hello world\n"))
-               t.logWriter.Close()
-       })
-
-       c.Check(api.CalledWith("container.state", "Queued"), NotNil)
-       c.Check(api.Logs["crunch-run"].String(), Matches, "(?ms).*unable to run containers.*")
-       c.Check(api.Logs["crunch-run"].String(), Matches, "(?ms).*Writing /var/lock/crunch-run-broken to mark node as broken.*")
-}
-
-func (s *TestSuite) TestFullBrokenDocker3(c *C) {
-       ech := ""
-       brokenNodeHook = &ech
-
-       api, _, _ := s.fullRunHelper(c, `{
-    "command": ["echo", "hello world"],
-    "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
-    "cwd": ".",
-    "environment": {},
-    "mounts": {"/tmp": {"kind": "tmp"} },
-    "output_path": "/tmp",
-    "priority": 1,
-    "runtime_constraints": {},
-    "state": "Locked"
-}`, nil, 3, func(t *TestDockerClient) {
-               t.logWriter.Write(dockerLog(1, "hello world\n"))
-               t.logWriter.Close()
-       })
-
-       c.Check(api.CalledWith("container.state", "Cancelled"), NotNil)
-       c.Check(api.Logs["crunch-run"].String(), Matches, "(?ms).*unable to run containers.*")
-}
-
-func (s *TestSuite) TestBadCommand1(c *C) {
-       ech := ""
-       brokenNodeHook = &ech
-
-       api, _, _ := s.fullRunHelper(c, `{
-    "command": ["echo", "hello world"],
-    "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
-    "cwd": ".",
-    "environment": {},
-    "mounts": {"/tmp": {"kind": "tmp"} },
-    "output_path": "/tmp",
-    "priority": 1,
-    "runtime_constraints": {},
-    "state": "Locked"
-}`, nil, 4, func(t *TestDockerClient) {
-               t.logWriter.Write(dockerLog(1, "hello world\n"))
-               t.logWriter.Close()
-       })
-
-       c.Check(api.CalledWith("container.state", "Cancelled"), NotNil)
-       c.Check(api.Logs["crunch-run"].String(), Matches, "(?ms).*Possible causes:.*is missing.*")
-}
-
-func (s *TestSuite) TestBadCommand2(c *C) {
-       ech := ""
-       brokenNodeHook = &ech
-
-       api, _, _ := s.fullRunHelper(c, `{
+func (s *TestSuite) TestFullBrokenDocker(c *C) {
+       nextState := ""
+       for _, setup := range []func(){
+               func() {
+                       c.Log("// waitErr = ocl runtime error")
+                       s.executor.waitErr = errors.New(`Error response from daemon: oci runtime error: container_linux.go:247: starting container process caused "process_linux.go:359: container init caused \"rootfs_linux.go:54: mounting \\\"/tmp/keep453790790/by_id/99999999999999999999999999999999+99999/myGenome\\\" to rootfs \\\"/tmp/docker/overlay2/9999999999999999999999999999999999999999999999999999999999999999/merged\\\" at \\\"/tmp/docker/overlay2/9999999999999999999999999999999999999999999999999999999999999999/merged/keep/99999999999999999999999999999999+99999/myGenome\\\" caused \\\"no such file or directory\\\"\""`)
+                       nextState = "Cancelled"
+               },
+               func() {
+                       c.Log("// loadErr = cannot connect")
+                       s.executor.loadErr = errors.New("Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?")
+                       s.runner.brokenNodeHook = c.MkDir() + "/broken-node-hook"
+                       err := ioutil.WriteFile(s.runner.brokenNodeHook, []byte("#!/bin/sh\nexec echo killme\n"), 0700)
+                       c.Assert(err, IsNil)
+                       nextState = "Queued"
+               },
+       } {
+               s.SetUpTest(c)
+               setup()
+               s.fullRunHelper(c, `{
     "command": ["echo", "hello world"],
-    "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+    "container_image": "`+arvadostest.DockerImage112PDH+`",
     "cwd": ".",
     "environment": {},
     "mounts": {"/tmp": {"kind": "tmp"} },
@@ -2108,22 +2161,30 @@ func (s *TestSuite) TestBadCommand2(c *C) {
     "priority": 1,
     "runtime_constraints": {},
     "state": "Locked"
-}`, nil, 5, func(t *TestDockerClient) {
-               t.logWriter.Write(dockerLog(1, "hello world\n"))
-               t.logWriter.Close()
-       })
-
-       c.Check(api.CalledWith("container.state", "Cancelled"), NotNil)
-       c.Check(api.Logs["crunch-run"].String(), Matches, "(?ms).*Possible causes:.*is missing.*")
+}`, nil, func() int { return 0 })
+               c.Check(s.api.CalledWith("container.state", nextState), NotNil)
+               c.Check(s.api.Logs["crunch-run"].String(), Matches, "(?ms).*unable to run containers.*")
+               if s.runner.brokenNodeHook != "" {
+                       c.Check(s.api.Logs["crunch-run"].String(), Matches, "(?ms).*Running broken node hook.*")
+                       c.Check(s.api.Logs["crunch-run"].String(), Matches, "(?ms).*killme.*")
+                       c.Check(s.api.Logs["crunch-run"].String(), Not(Matches), "(?ms).*Writing /var/lock/crunch-run-broken to mark node as broken.*")
+               } else {
+                       c.Check(s.api.Logs["crunch-run"].String(), Matches, "(?ms).*Writing /var/lock/crunch-run-broken to mark node as broken.*")
+               }
+       }
 }
 
-func (s *TestSuite) TestBadCommand3(c *C) {
-       ech := ""
-       brokenNodeHook = &ech
-
-       api, _, _ := s.fullRunHelper(c, `{
+func (s *TestSuite) TestBadCommand(c *C) {
+       for _, startError := range []string{
+               `panic: standard_init_linux.go:175: exec user process caused "no such file or directory"`,
+               `Error response from daemon: Cannot start container 41f26cbc43bcc1280f4323efb1830a394ba8660c9d1c2b564ba42bf7f7694845: [8] System error: no such file or directory`,
+               `Error response from daemon: Cannot start container 58099cd76c834f3dc2a4fb76c8028f049ae6d4fdf0ec373e1f2cfea030670c2d: [8] System error: exec: "foobar": executable file not found in $PATH`,
+       } {
+               s.SetUpTest(c)
+               s.executor.startErr = errors.New(startError)
+               s.fullRunHelper(c, `{
     "command": ["echo", "hello world"],
-    "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+    "container_image": "`+arvadostest.DockerImage112PDH+`",
     "cwd": ".",
     "environment": {},
     "mounts": {"/tmp": {"kind": "tmp"} },
@@ -2131,20 +2192,16 @@ func (s *TestSuite) TestBadCommand3(c *C) {
     "priority": 1,
     "runtime_constraints": {},
     "state": "Locked"
-}`, nil, 6, func(t *TestDockerClient) {
-               t.logWriter.Write(dockerLog(1, "hello world\n"))
-               t.logWriter.Close()
-       })
-
-       c.Check(api.CalledWith("container.state", "Cancelled"), NotNil)
-       c.Check(api.Logs["crunch-run"].String(), Matches, "(?ms).*Possible causes:.*is missing.*")
+}`, nil, func() int { return 0 })
+               c.Check(s.api.CalledWith("container.state", "Cancelled"), NotNil)
+               c.Check(s.api.Logs["crunch-run"].String(), Matches, "(?ms).*Possible causes:.*is missing.*")
+       }
 }
 
 func (s *TestSuite) TestSecretTextMountPoint(c *C) {
-       // under normal mounts, gets captured in output, oops
        helperRecord := `{
                "command": ["true"],
-               "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+               "container_image": "` + arvadostest.DockerImage112PDH + `",
                "cwd": "/bin",
                "mounts": {
                     "/tmp": {"kind": "tmp"},
@@ -2158,22 +2215,22 @@ func (s *TestSuite) TestSecretTextMountPoint(c *C) {
                "state": "Locked"
        }`
 
-       api, cr, _ := s.fullRunHelper(c, helperRecord, nil, 0, func(t *TestDockerClient) {
-               content, err := ioutil.ReadFile(t.realTemp + "/tmp2/secret.conf")
+       s.fullRunHelper(c, helperRecord, nil, func() int {
+               content, err := ioutil.ReadFile(s.runner.HostOutputDir + "/secret.conf")
                c.Check(err, IsNil)
-               c.Check(content, DeepEquals, []byte("mypassword"))
-               t.logWriter.Close()
+               c.Check(string(content), Equals, "mypassword")
+               return 0
        })
 
-       c.Check(api.CalledWith("container.exit_code", 0), NotNil)
-       c.Check(api.CalledWith("container.state", "Complete"), NotNil)
-       c.Check(cr.ContainerArvClient.(*ArvTestClient).CalledWith("collection.manifest_text", ". 34819d7beeabb9260a5c854bc85b3e44+10 0:10:secret.conf\n"), NotNil)
-       c.Check(cr.ContainerArvClient.(*ArvTestClient).CalledWith("collection.manifest_text", ""), IsNil)
+       c.Check(s.api.CalledWith("container.exit_code", 0), NotNil)
+       c.Check(s.api.CalledWith("container.state", "Complete"), NotNil)
+       c.Check(s.runner.ContainerArvClient.(*ArvTestClient).CalledWith("collection.manifest_text", ". 34819d7beeabb9260a5c854bc85b3e44+10 0:10:secret.conf\n"), NotNil)
+       c.Check(s.runner.ContainerArvClient.(*ArvTestClient).CalledWith("collection.manifest_text", ""), IsNil)
 
        // under secret mounts, not captured in output
        helperRecord = `{
                "command": ["true"],
-               "container_image": "d4ab34d3d4f8a72f5c4973051ae69fab+122",
+               "container_image": "` + arvadostest.DockerImage112PDH + `",
                "cwd": "/bin",
                "mounts": {
                     "/tmp": {"kind": "tmp"}
@@ -2187,17 +2244,185 @@ func (s *TestSuite) TestSecretTextMountPoint(c *C) {
                "state": "Locked"
        }`
 
-       api, cr, _ = s.fullRunHelper(c, helperRecord, nil, 0, func(t *TestDockerClient) {
-               content, err := ioutil.ReadFile(t.realTemp + "/tmp2/secret.conf")
+       s.SetUpTest(c)
+       s.fullRunHelper(c, helperRecord, nil, func() int {
+               content, err := ioutil.ReadFile(s.runner.HostOutputDir + "/secret.conf")
                c.Check(err, IsNil)
-               c.Check(content, DeepEquals, []byte("mypassword"))
-               t.logWriter.Close()
+               c.Check(string(content), Equals, "mypassword")
+               return 0
        })
 
-       c.Check(api.CalledWith("container.exit_code", 0), NotNil)
-       c.Check(api.CalledWith("container.state", "Complete"), NotNil)
-       c.Check(cr.ContainerArvClient.(*ArvTestClient).CalledWith("collection.manifest_text", ". 34819d7beeabb9260a5c854bc85b3e44+10 0:10:secret.conf\n"), IsNil)
-       c.Check(cr.ContainerArvClient.(*ArvTestClient).CalledWith("collection.manifest_text", ""), NotNil)
+       c.Check(s.api.CalledWith("container.exit_code", 0), NotNil)
+       c.Check(s.api.CalledWith("container.state", "Complete"), NotNil)
+       c.Check(s.runner.ContainerArvClient.(*ArvTestClient).CalledWith("collection.manifest_text", ". 34819d7beeabb9260a5c854bc85b3e44+10 0:10:secret.conf\n"), IsNil)
+       c.Check(s.runner.ContainerArvClient.(*ArvTestClient).CalledWith("collection.manifest_text", ""), NotNil)
+
+       // under secret mounts, output dir is a collection, not captured in output
+       helperRecord = `{
+               "command": ["true"],
+               "container_image": "` + arvadostest.DockerImage112PDH + `",
+               "cwd": "/bin",
+               "mounts": {
+                    "/tmp": {"kind": "collection", "writable": true}
+                },
+                "secret_mounts": {
+                    "/tmp/secret.conf": {"kind": "text", "content": "mypassword"}
+                },
+               "output_path": "/tmp",
+               "priority": 1,
+               "runtime_constraints": {},
+               "state": "Locked"
+       }`
+
+       s.SetUpTest(c)
+       _, _, realtemp := s.fullRunHelper(c, helperRecord, nil, func() int {
+               // secret.conf should be provisioned as a separate
+               // bind mount, i.e., it should not appear in the
+               // (fake) fuse filesystem as viewed from the host.
+               content, err := ioutil.ReadFile(s.runner.HostOutputDir + "/secret.conf")
+               if !c.Check(errors.Is(err, os.ErrNotExist), Equals, true) {
+                       c.Logf("secret.conf: content %q, err %#v", content, err)
+               }
+               err = ioutil.WriteFile(s.runner.HostOutputDir+"/.arvados#collection", []byte(`{"manifest_text":". acbd18db4cc2f85cedef654fccc4a4d8+3 0:3:foo.txt\n"}`), 0700)
+               c.Check(err, IsNil)
+               return 0
+       })
+
+       content, err := ioutil.ReadFile(realtemp + "/text1/mountdata.text")
+       c.Check(err, IsNil)
+       c.Check(string(content), Equals, "mypassword")
+       c.Check(s.executor.created.BindMounts["/tmp/secret.conf"], DeepEquals, bindmount{realtemp + "/text1/mountdata.text", true})
+       c.Check(s.api.CalledWith("container.exit_code", 0), NotNil)
+       c.Check(s.api.CalledWith("container.state", "Complete"), NotNil)
+       c.Check(s.runner.ContainerArvClient.(*ArvTestClient).CalledWith("collection.manifest_text", ". acbd18db4cc2f85cedef654fccc4a4d8+3 0:3:foo.txt\n"), NotNil)
+}
+
+func (s *TestSuite) TestCalculateCost(c *C) {
+       defer func(s string) { lockdir = s }(lockdir)
+       lockdir = c.MkDir()
+       now := time.Now()
+       cr := s.runner
+       cr.costStartTime = now.Add(-time.Hour)
+       var logbuf bytes.Buffer
+       cr.CrunchLog.Immediate = log.New(&logbuf, "", 0)
+
+       // if there's no InstanceType env var, cost is calculated as 0
+       os.Unsetenv("InstanceType")
+       cost := cr.calculateCost(now)
+       c.Check(cost, Equals, 0.0)
+
+       // with InstanceType env var and loadPrices() hasn't run (or
+       // hasn't found any data), cost is calculated based on
+       // InstanceType env var
+       os.Setenv("InstanceType", `{"Price":1.2}`)
+       defer os.Unsetenv("InstanceType")
+       cost = cr.calculateCost(now)
+       c.Check(cost, Equals, 1.2)
+
+       // first update tells us the spot price was $1/h until 30
+       // minutes ago when it increased to $2/h
+       j, err := json.Marshal([]cloud.InstancePrice{
+               {StartTime: now.Add(-4 * time.Hour), Price: 1.0},
+               {StartTime: now.Add(-time.Hour / 2), Price: 2.0},
+       })
+       c.Assert(err, IsNil)
+       os.WriteFile(lockdir+"/"+pricesfile, j, 0777)
+       cr.loadPrices()
+       cost = cr.calculateCost(now)
+       c.Check(cost, Equals, 1.5)
+
+       // next update (via --list + SIGUSR2) tells us the spot price
+       // increased to $3/h 15 minutes ago
+       j, err = json.Marshal([]cloud.InstancePrice{
+               {StartTime: now.Add(-time.Hour / 3), Price: 2.0}, // dup of -time.Hour/2 price
+               {StartTime: now.Add(-time.Hour / 4), Price: 3.0},
+       })
+       c.Assert(err, IsNil)
+       os.WriteFile(lockdir+"/"+pricesfile, j, 0777)
+       cr.loadPrices()
+       cost = cr.calculateCost(now)
+       c.Check(cost, Equals, 1.0/2+2.0/4+3.0/4)
+
+       cost = cr.calculateCost(now.Add(-time.Hour / 2))
+       c.Check(cost, Equals, 0.5)
+
+       c.Logf("%s", logbuf.String())
+       c.Check(logbuf.String(), Matches, `(?ms).*Instance price changed to 1\.00 at 20.* changed to 2\.00 .* changed to 3\.00 .*`)
+       c.Check(logbuf.String(), Not(Matches), `(?ms).*changed to 2\.00 .* changed to 2\.00 .*`)
+}
+
+func (s *TestSuite) TestSIGUSR2CostUpdate(c *C) {
+       pid := os.Getpid()
+       now := time.Now()
+       pricesJSON, err := json.Marshal([]cloud.InstancePrice{
+               {StartTime: now.Add(-4 * time.Hour), Price: 2.4},
+               {StartTime: now.Add(-2 * time.Hour), Price: 2.6},
+       })
+       c.Assert(err, IsNil)
+
+       os.Setenv("InstanceType", `{"Price":2.2}`)
+       defer os.Unsetenv("InstanceType")
+       defer func(s string) { lockdir = s }(lockdir)
+       lockdir = c.MkDir()
+
+       // We can't use s.api.CalledWith because timing differences will yield
+       // different cost values across runs. getCostUpdate iterates over API
+       // calls until it finds one that sets the cost, then writes that value
+       // to the next index of costUpdates.
+       deadline := now.Add(time.Second)
+       costUpdates := make([]float64, 2)
+       costIndex := 0
+       apiIndex := 0
+       getCostUpdate := func() {
+               for ; time.Now().Before(deadline); time.Sleep(time.Second / 10) {
+                       for apiIndex < len(s.api.Content) {
+                               update := s.api.Content[apiIndex]
+                               apiIndex++
+                               var ok bool
+                               var cost float64
+                               if update, ok = update["container"].(arvadosclient.Dict); !ok {
+                                       continue
+                               }
+                               if cost, ok = update["cost"].(float64); !ok {
+                                       continue
+                               }
+                               c.Logf("API call #%d updates cost to %v", apiIndex-1, cost)
+                               costUpdates[costIndex] = cost
+                               costIndex++
+                               return
+                       }
+               }
+       }
+
+       s.fullRunHelper(c, `{
+               "command": ["true"],
+               "container_image": "`+arvadostest.DockerImage112PDH+`",
+               "cwd": ".",
+               "environment": {},
+               "mounts": {"/tmp": {"kind": "tmp"} },
+               "output_path": "/tmp",
+               "priority": 1,
+               "runtime_constraints": {},
+               "state": "Locked",
+               "uuid": "zzzzz-dz642-20230320101530a"
+       }`, nil, func() int {
+               s.runner.costStartTime = now.Add(-3 * time.Hour)
+               err := syscall.Kill(pid, syscall.SIGUSR2)
+               c.Check(err, IsNil, Commentf("error sending first SIGUSR2 to runner"))
+               getCostUpdate()
+
+               err = os.WriteFile(path.Join(lockdir, pricesfile), pricesJSON, 0o700)
+               c.Check(err, IsNil, Commentf("error writing JSON prices file"))
+               err = syscall.Kill(pid, syscall.SIGUSR2)
+               c.Check(err, IsNil, Commentf("error sending second SIGUSR2 to runner"))
+               getCostUpdate()
+
+               return 0
+       })
+       // Comparing with format strings makes it easy to ignore minor variations
+       // in cost across runs while keeping diagnostics pretty.
+       c.Check(fmt.Sprintf("%.3f", costUpdates[0]), Equals, "6.600")
+       c.Check(fmt.Sprintf("%.3f", costUpdates[1]), Equals, "7.600")
 }
 
 type FakeProcess struct {