kstyagi/nest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactor documentation structure and improve validation checks; update VM state handling and error management.

Browse Source
This commit is contained in:
kstyagi
2026-09-09 17:47:50 +05:30
parent d8a25209b9
commit ee26962902
9 changed files with 86 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
USAGE.md
+17 -12
View File
@@ -97,6 +97,8 @@ SSH to a known guest IP does not require root.
The following is syntax notation, not a shell script. `VM` means an exact VM
ID, local name, or guest IPv4 address. Flags are command-specific; in
particular, create has no `--dry-run`, and start has no `--timeout`.
Examples elsewhere are separate scenarios; substitute your VM identifiers
and do not run every destructive example as a single script.
```text
uvm install [--force]
@@ -235,7 +237,7 @@ literal secret in the command line or history. Do not enable shell tracing:
```bash
sudo -v
read -r -s -p 'Guest password: ' guest_password
IFS= read -r -s -p 'Guest password: ' guest_password
printf '\n'
printf '%s\n' "$guest_password" | sudo ./uvm.py create --name app \
--cpu 1 --ram 1G --guest-ip 10.42.0.10 \
@@ -346,8 +348,9 @@ adopt a legacy process, or reconcile a VM. Policy status is a separate snapshot:
| `unknown` | Inspection failed or metadata could not establish policy status. |
`enforced` is not a service-connectivity test or a lasting guarantee against
external rule changes. Mutation JSON may report policy `unknown` without a
fresh observation; use inspect or ports list for a current readback.
external rule changes. Dry-run target snapshots may show policy `unknown`
because a preview does not verify enforcement. Use inspect or ports list for
a current readback.
### Logs and Doctor
@@ -441,11 +444,12 @@ support, and compatible network settings are still required. Removing the
original rootfs template does not prevent retained-disk start, although doctor
checks templates and can report it missing.
Start on an already running, identified VM synchronizes its managed port
policy without rebooting. Restart is stop followed by start under the same
operation lock. Unknown process identity, an incomplete/unsafe disk, or pending
deletion blocks a new boot; inspect the error rather than editing registry
flags. An interrupted boot with a live VMM must be stopped before start.
Start on a VM recorded as running with a verified process identity synchronizes
its managed port policy without rebooting. Restart is stop followed by start
under the same operation lock. Unknown process identity, an incomplete/unsafe
disk, or pending deletion blocks a new boot; inspect the error rather than
editing registry flags. An interrupted boot with a live VMM must be stopped
before start.
### Scenario: Permanently Remove a VM
@@ -508,10 +512,11 @@ or NAT can change reachability; a private IP is not by itself an exposure
guarantee, and UVM does not integrate with external firewall managers yet.
UDP and IPv6 service policies are not yet supported. Unsolicited inbound UDP
is blocked, as is IPv6 in both directions on managed TAPs. Guest-initiated IPv4 TCP/UDP (including
DNS queries), replies to that egress, ARP, ICMP echo, and required related ICMP
errors remain allowed. An empty TCP allowlist is not a complete network
disconnect. Other VMs' policies still apply to guest-to-guest egress.
is blocked, as is IPv6 in both directions on managed TAPs. Guest-initiated IPv4
TCP/UDP (including DNS queries), replies to that egress, ARP, ICMP echo, and
required related ICMP errors remain allowed. An empty TCP allowlist is not a
complete network disconnect. Other VMs' policies still apply to guest-to-guest
egress.
### List, Open, Close, and Set