feat(container-runner): jitter idle timeout to avoid teardown waves

[abcxff]

No description provided.

[abcxff]

Stack for rivet-dev/actors

• #5594 feat(container-runner): drain engine sleeps unless the idle …
• #5595 feat(container-runner): jitter idle timeout to avoid teardow … 👈
• #5585 feat(container-runner): self-sleep on repeated actor start
• #5586 feat(container-runner): sleep on startup idle timeout
• #5589 chore(container-runner): tighten comments
• #5587 feat(container-runner): exit process when the last child sto …
• #5588 feat(container-runner): drain child before SIGTERM on engine …
• #5584 feat(container-runner): drain children and engine concurrent …
• #5565 fix(envoy-client): ack terminating stop commands so pegboard …
• main

Get stack: forklift get 5595
Push local edits: forklift submit
Merge when ready: forklift merge 5595

_{change wxwlxowm}

[claude]

Review

Small, well-scoped change: jitters the container-runner idle-sleep timeout by up to 20% (capped at 60s) so co-started instances don't all sleep in lockstep. Logic and edit are correct and match the file's existing conventions.

Correctness

• Jitter is only ever added (base + random_duration_up_to(...)), so the invariant "never sleeps earlier than the configured window" holds. ✅
• random_duration_up_to caps max_ms well below u64::MAX (≤60000), so max_ms + 1 can't overflow, and the CSPRNG-unavailable fallback (Duration::ZERO) degrades to no jitter rather than failing the actor start. ✅
• Reusing the /dev/urandom read pattern already established by boot_id() (main.rs:270) instead of pulling in the rand crate is consistent with this file's stated policy of avoiding dependencies for small needs.

Minor notes (non-blocking)

• Test coverage: idle_timeout_with_jitter / random_duration_up_to are pure functions with no test added, while the sibling boot_id() helper in the same file has a companion test at container-runner/tests/inline/boot_id.rs. A cheap test asserting base <= result <= base + min(base*0.2, 60s) (plus a base = 0/tiny-base edge case) would guard the jitter math without needing real infra.
• Blocking I/O frequency: arm_idle_timeout now does a synchronous /dev/urandom open+read on every actor start (previously only boot_id() did this, once per process). This is consistent with the existing pattern in the file and is a tiny, infrequent (once per actor lifecycle) blocking call, so it's not a real concern here, but worth being aware of if idle_timeout_with_jitter ever gets called from a hotter path in the future.
• u64::from_le_bytes(buf) % (max_ms + 1) has a theoretical modulo bias, but with max_ms capped at 60000 against a 64-bit draw the bias is negligible and not worth the extra code to remove.

No security or performance concerns beyond the above; the change is additive and doesn't touch any trust boundary.