feat(firecracker): enable OCI and Nydus roots with virtio-fs - #57
Merged
Conversation
Update sandboxd to b8f4656 and use its pinned Firecracker v1.16.1-akernel.3 artifacts. Build virtiofsd 1.14.0 from a pinned source revision with its release lockfile, and package the binary, runtime libraries, and licenses with the Firecracker payload. Enable read-only virtio-fs in standalone and Helm so Firecracker consumes OCI and Nydus roots directly from the image manager. Keep private ext4 writes and configure AsyncDirect with Writeback, documenting the host capabilities and checkpoint compatibility required by the updated stack. Allow the custom-image example and integration suite to select image roots, verify private writes across sandboxes, and install CA certificates for HTTPS checks. Document RAFS v5 preparation and the supported image and mount contracts. Signed-off-by: Tianyu Zhou <albert.zty@antgroup.com>
Restore the custom image example to its original fixed configuration so it remains a short illustration of the Sandbox API. Remove documentation for the extra command-line arguments while retaining Firecracker image support documentation and integration coverage. Signed-off-by: Tianyu Zhou <albert.zty@antgroup.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Firecracker currently rejects OCI/Nydus directory roots in AKernel's bundled configuration. This change enables
Sandbox(runtime="firecracker", image="ubuntu:24.04")by packaging pinned virtiofsd 1.14.0 and enabling read-only virtio-fs in standalone and Helm. Roots come directly from the existing image manager; sandbox writes remain on a private ext4 disk, and the default runtime root remains EROFS.Update sandboxd to
b8f4656c57432bce1b50111e766bcd21510ee482, which selects Firecrackerv1.16.1-akernel.3through its runtime manifest. The build packages the matching VMM, kernel, guest-agent initrd, virtiofsd libraries, and licenses. Set the writable disk policy toAsyncDirectwithWriteback, and document the required host capabilities and checkpoint compatibility. Hosts must provide usable io_uring and STATX_DIOALIGN; drain sandboxes before replacing the runtime stack.Integration tests accept
AKERNEL_TEST_IMAGE, verify independent writes for sandboxes sharing an image, and install CA certificates for HTTPS probes. Documentation covers OCI/Nydus roots, RAFS v5 preparation, and supported mounts.Validation:
make buildcompleted both the RRT rootfs and all-in-one image on a Linux 6.8 KVM node, with control plane, RRT, and test client fixed to0.10.2rc2.git diff --checkpassed.