Replace bits-and-blooms/bitset with roaring bitmaps

[ValentaTomas]

Replace all direct usage of bits-and-blooms/bitset with roaring/v2 (v2.17.0). Uses the new Ranges() iterator (#522) for range iteration in CreateMapping and BitmapRanges.

[cursor]

PR Summary

Medium Risk
Touches snapshot diff metadata and dirty/empty block tracking used for exporting rootfs/memory diffs; a subtle bitmap semantics or concurrency mismatch could lead to incorrect diff contents or missing blocks. Risk is mitigated by updated tests but the change affects core data paths.

Overview
Replaces bits-and-blooms/bitset usage in snapshot dirty/empty tracking with roaring/v2 bitmaps, introducing shared/pkg/syncroaring for concurrency-safe mutation and read-only views used across orchestrator cache export, memory diff handling, and header diff mapping generation. Range iteration for dirty blocks/mappings is rewritten to use roaring’s Ranges() iterator, diff metadata/builders now emit syncroaring.ReadOnly bitmaps, and dependencies are updated accordingly (including removing the old atomicbitset wrapper).

^{Reviewed by Cursor Bugbot for commit 4b07195. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fa35957fa3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[levb]

a few nits, otherwise LGTM

[jakubno]

Nice! 🚀 1 suggestion left in comments

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4b07195. Configure here.}

[cursor]

ReadOnly view shares live bitmap without copying

Medium Severity

Bitset.ReadOnly() returns a view sharing the same underlying *roaring.Bitmap without copying. The old atomicbitset.BitSet() called b.bm.ToBitSet(), which produced a snapshot copy. In ExportToDiff, the returned DiffMetadata.Dirty now aliases c.dirty.bm; after the lock is released, any concurrent WriteAtWithoutLock → setIsCached → c.dirty.SetRange mutates the bitmap that downstream consumers (e.g. ToDiffHeader, ExportMemory) are reading, creating a data race.

Additional Locations (1)

• packages/orchestrator/pkg/sandbox/block/cache.go#L138-L139

 

^{Reviewed by Cursor Bugbot for commit 4b07195. Configure here.}