kstyagi/nest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add host-backed entropy device support and update kernel configuration

Browse Source
This commit is contained in:
kstyagi
2026-09-23 07:00:22 +05:30
parent eb6119c797
commit dca3cbde2f
9 changed files with 139 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DEVELOPER.md
+16 -2
View File
@@ -490,7 +490,14 @@ The `firecracker/` package has three separate responsibilities.
2. `PUT /boot-source`
3. `PUT /drives/rootfs`
4. `PUT /network-interfaces/eth0`
5. `PUT /actions` with `InstanceStart`
5. `PUT /entropy` with `{}` (a host-backed virtio RNG device)
6. `PUT /actions` with `InstanceStart`
Every generated config includes `entropy`, including retained-disk boots.
An empty object enables the device with default settings; do not skip it with
a truthiness check. A missing/invalid configuration or an entropy API failure
must prevent `InstanceStart`. Without guest entropy, systemd's random-seed
service and OpenSSH can remain in startup while the VM process and IP respond.
The guest receives a static IP via the kernel `ip=` boot argument. The netmask
comes from `Settings.network`, not a hard-coded `/24` value.
@@ -729,7 +736,14 @@ handling, downloads, and integrity-manifest publication.
(`amd64` to `x86_64`, `arm64` to `aarch64`) and rejects unsupported architectures.
The same architecture selects the Firecracker release archive, guest kernel,
native rootfs packages, and architecture-specific boot arguments. The default
kernel URL uses Firecracker's `img/quickstart_guide/<architecture>/kernels/vmlinux.bin`.
kernel URL is pinned to Firecracker's published
`firecracker-ci/v1.15/<architecture>/vmlinux-6.1.155` artifacts. The CI artifact
series is independent of the VMM release. Both architecture configs include
`CONFIG_HW_RANDOM=y` and `CONFIG_HW_RANDOM_VIRTIO=y`; custom kernels need these
built-in drivers for UVM's entropy device. The previous ARM quickstart image
was Linux 4.14.174 without the built-in virtio RNG driver. Updating the device
configuration alone cannot repair that kernel; existing installs need a forced
asset refresh with a matching new trusted kernel checksum, then a fresh VM boot.
An empty `Settings.rootfs_url` selects the built Ubuntu 22.04 (Jammy) template.
Explicit kernel/rootfs URLs and trusted digests must match the host architecture. ARM64
uses an uncompressed Linux `Image` (PE format) and an ARM64 ext4 rootfs.