feat(cloud-hypervisor): expose a configurable REST API control socket - #847
Open
Anamika1608 wants to merge 9 commits into
Open
feat(cloud-hypervisor): expose a configurable REST API control socket#847Anamika1608 wants to merge 9 commits into
Anamika1608 wants to merge 9 commits into
Conversation
Signed-off-by: Anamika Aggarwal <anamikaagg18@gmail.com>
Signed-off-by: Anamika Aggarwal <anamikaagg18@gmail.com>
Signed-off-by: Anamika Aggarwal <anamikaagg18@gmail.com>
✅ Deploy Preview for urunc ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Add an opt-in boot_mode field to the monitor configuration. It is inert in this commit; the following commit makes cloud-hypervisor honor boot_mode=api. Signed-off-by: Anamika Aggarwal <anamikaagg18@gmail.com>
Signed-off-by: Anamika Aggarwal <anamikaagg18@gmail.com>
With boot_mode=api, Cloud Hypervisor is spawned after changeRoot as a supervised child with only its API socket enabled, so the monitor and the socket are confined inside the monitor rootfs. urunc sends the whole VM configuration with vm.create and boots the guest with vm.boot only after the start-success handshake, preserving OCI start ordering, then supervises the child for its lifetime. Any other boot_mode value keeps the exec-based boot unchanged. Unikernel-specific raw CLI argument overrides cannot be expressed in the REST configuration and yield a clear error in this mode. Add an HTTP-over-Unix API client and unit tests driving it against a fake REST server, asserting the full vm.create payload and ordering. Signed-off-by: Anamika Aggarwal <anamikaagg18@gmail.com>
createTapDevice relies on a later syscall.Exec into the monitor to
close the tap device fd that netlink.LinkAdd opened (O_CLOEXEC). In any
flow where urunc keeps running instead of exec-ing away, the fd stays
open and, since the tap device is single-queue, blocks the monitor from
attaching to it ("Resource busy").
Close the fd explicitly after the owner and group are set (handling the
close error), and add the author to contributors.
Signed-off-by: Anamika Aggarwal <anamikaagg18@gmail.com>
Signed-off-by: Anamika Aggarwal <anamikaagg18@gmail.com>
Signed-off-by: Anamika Aggarwal <anamikaagg18@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Expose Cloud Hypervisor's REST API over a control socket so the runtime can talk to the monitor after the guest starts (for graceful shutdown, and later snapshots).
cloud_hypervisor.golaunches with--api-socket path=<socket_path>.socket_pathmonitor field; when a custom path is set, urunc creates its parent directory inside the monitor rootfs. Default is a per-container path under/tmp.This PR is self-contained against
main: it carries a small copy of the shared socket infrastructure (socket_pathfield,ResolveSocketPath,DefaultSocketDir,UsesControlSocket, the socket-directory creation). The same infra also appears in the Firecracker (#809) and QEMU (#841) PRs; whichever merges first lands it, and this PR then rebases to drop the duplicate. This PR does not touchfirecracker.goorqemu.go.Related issues
How was this tested?
go build ./...,go test ./pkg/... ./internal/...,gofmt, and cspell pass (Ubuntu 24.04 aarch64 VM, KVM, Cloud Hypervisor v53).ubuntu-cloud-hypervisor-linux-rawandchttp-cloud-hypervisor-*variants return 404), and Cloud Hypervisor v53 has a known raw-disk/console issue on aarch64, both unrelated to this change. The--api-socketwiring itself is covered by the unit tests and the sharedResolveSocketPathtests. Once an aarch64 image is available, the socket can be verified answering/api/v1/vm.info, the same way Firecracker (feat(firecracker): launch with control socket instead of config file #809) and QEMU (feat(qemu): expose a configurable QMP control socket #841) were verified.LLM usage
Checklist
make lint).make test_ctr,make test_nerdctl,make test_docker,make test_crictl).