kstyagi/nest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: enhance guest agent setup and terminal support for microVMs

Browse Source
This commit is contained in:
kstyagi
2026-09-25 21:15:53 +05:30
parent 6573f483e6
commit a4e9cefbc3
3 changed files with 54 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DEVELOPER.md
+16 -5
View File
@@ -998,17 +998,28 @@ too. An unconfirmed cleanup is an unknown outcome. Stopping the agent service
also kills its job scopes; dropping an HTTP connection does not cancel a job.
The v5 Ubuntu builder installs Python, the terminal-capable service, and an
ownership manifest. Creation provisions the VM ID/username in root-only
`/etc/uvm-agent.json` before marking the disk ready. Cached v4 templates are also
configured; their original manifest-less agent is recognized by its exact
published source digest. Earlier templates require an explicit stopped-disk
`agent/install` request.
ownership manifest. Agent setup is mandatory on every compatible image:
`create()` provisions the VM ID/username in root-only `/etc/uvm-agent.json` before
marking the disk ready, and `_start_locked()` ensures the agent after confirmed
runtime cleanup and pending resize, before booting. This covers stopped starts,
restarts, and resizing. There is no image-marker allowlist for agent setup.
An observed live or ambiguous VMM never permits offline agent writes.
`_guest_agent_current()` checks the expected payloads, identity, file metadata,
ownership manifest, and enabled service without mutating the disk. Current
installations return immediately. The explicit `agent/install` operation forces
a staged recheck for manual repair. The original manifest-less v4 agent is
recognized by its exact published source digest.
Provisioning and upgrades stage a sparse copy, replay/check ext4, validate guest
path ownership and recorded agent-file hashes, enable the service, verify writes,
and publish atomically. A root-only guest manifest records managed file hashes
so later upgrades preserve guest edits. An older guest missing Python installs
it through apt inside the guest on its next boot; no guest binaries execute on
the host. This bootstrap requires working guest egress until the runtime is ready.
Incompatible custom images or agent setup failures prevent boot with an actionable
error; they are not silently skipped. New-VM failures roll back creation, while
retained-VM failures preserve the private disk for retry.
The guest needs systemd, Python 3.10+, built-in virtio-vsock, and cgroup v2 with
`cgroup.kill` (Linux 5.14+). Host socket paths are derived from Settings, so the