Confine the Firecracker VMM with the jailer - #960

Draft

epompeii wants to merge 145 commits into

develfrom

Commits on Jul 27, 2026

Bundle the Firecracker jailer alongside the VMM
epompeii
committed
a95d2bf
Add a runner state directory, jail sweep, and empty network namespace
epompeii
committed
a8b80ce
Confine the Firecracker VMM with the jailer
epompeii
committed
b375853
Test jail confinement, placement policy, and teardown
epompeii
committed
8caa692
Identify the jailed VMM by inode, not by root path
epompeii
committed
14dda3b

Commits on Jul 28, 2026

Propagate the state directory to daemon jobs
epompeii
committed
c238701
Unwind every stacked mount at the network namespace handle
epompeii
committed
a62f31a
Serialize the jail lifecycle with an advisory lock
epompeii
committed
15116c1
Assert the jailer argument vector
epompeii
committed
fdcc034
Make the jail uid and gid configurable, defaulting to 61016
epompeii
committed
4322071
Run the KVM scenarios as root in CI
epompeii
committed
4e98275
Address jail sockets through a descriptor, not a long path
epompeii
committed
bd393c0
Make the jail scenarios fail when the product is broken
epompeii
committed
0a53f1c
Prepare the host on demand rather than at daemon startup
epompeii
committed
f0862d1
Reject a root jail user, and harden the namespace and state directory
epompeii
committed
9b1bbbf
Use a marker the runner cannot print
epompeii
committed
dc01537
Reap the VMM and cgroup a killed runner leaves behind
epompeii
committed
e44e79d
Unlink jail sockets through the host view
epompeii
committed
a1808ae
Elevate the smoke test's sandboxed runner
epompeii
committed
3b65040
Document that sandboxed Jobs now require a root Runner
epompeii
committed
ae7d8c3
Degrade when the cpuset controller is absent, fail when it refuses
epompeii
committed
82b3f6f
Stop a failed sweep from wedging a runner permanently
epompeii
committed
cc2af91
Own the host preparation latch, and name the VM identity
epompeii
committed
7f27678
Wrap the original error instead of formatting it into a string
epompeii
committed
6c8d5c4
Give Scenario a Default, and split the changelog entry
epompeii
committed
2de2ccc
Let the sweep reap the orphan the scenario creates
epompeii
committed
abf6e58
Keep the chroot when the reap leaves a VMM running, and finish the sweep
epompeii
committed
98ddcdd
Read back the cpuset so Applied means the kernel agreed
epompeii
committed
d936d35
Correct the reason a stale jail matters, and read back cpuset.mems
epompeii
committed
ba9a3f6
Fail the job when a stale jail still has a VMM running
epompeii
committed
c1318a9

Commits on Jul 29, 2026

Commits on Jul 30, 2026

Name the jail lock file once
epompeii
committed
fd942ed
Remove a stale jail's cgroup before the chroot that names it
epompeii
committed
26f991f
Hold a job's chroot when its cgroup could not be removed
epompeii
committed
f27b689
Refuse to build a jail without root, and say so
epompeii
committed
0f9d2ef
Delete the resource limits nothing applies
epompeii
committed
9d01ecd
Refuse a state directory whose contents cannot be read
epompeii
committed
e8af769
Refuse a jail whose scan and kill disagree
epompeii
committed
a629391
Require an absolute state directory
epompeii
committed
770b83a
Punctuate the build script overrides consistently
epompeii
committed
6ae0d51
Spend the reclaim signal only on a sweep that finished
epompeii
committed
6846fa2
Let the runner own a dedicated filesystem
epompeii
committed
913cd4d
Name both ways to give up the sandbox
epompeii
committed
cbc396c
Track which archive entries are still wanted
epompeii
committed
1d96162
Say what the scenarios' state directory actually is
epompeii
committed
a5e7669
Report a jail directory the sweep could not read
epompeii
committed
d1a92c1
Keep the checked socket path end to end
epompeii
committed
307d933
Hold the jailer's exit status, not a rendering of it
epompeii
committed
a95dd7a
Unwind the network namespace handle through clear
epompeii
committed
bd10461
Drop the empty error channel on cgroup cleanup
epompeii
committed
c24a432
Report a probe timeout when it happens, not minutes later
epompeii
committed
c47927c
Return the scenarios' state directory to its invoker
epompeii
committed
e8e9a2a
Owe another sweep when a chroot will not go away
epompeii
committed
eb97a64
Refuse to call a jail clear without having looked in it
epompeii
committed
df48dc3
Write down what a failing teardown step does
epompeii
committed
ec74798
Say that the jail uid is shared across concurrent runners
epompeii
committed
fa1dfc1
Stop the scenarios' assertions passing without looking
epompeii
committed
d4d793f
Never report a measurement read that did not happen
epompeii
committed
67ad1de
Keep a chroot for its own cgroup, not for any stale jail
epompeii
committed
402628e
Extend the table to what a run measures
epompeii
committed
b3df643
Announce the network namespace lock's wait
epompeii
committed
1b46586
Keep the API harness out of the real state directory
epompeii
committed
a02a1c2
Put the absolute state directory rule on the type
epompeii
committed
f599006
Prove the state directory is ours by its tree, not by a name
epompeii
committed
4f0501b
Stop a failed stat from authorizing destruction
epompeii
committed
201df93
Catch a jailed process that exits during the last sleep
epompeii
committed
7eeccb2
Report a malformed HTTP response as malformed
epompeii
committed
f2aec94
Warn about the jail user once per runner, not once per job
epompeii
committed
47eef34
Say in the table that a read may gate an action
epompeii
committed
dfc253c
Search for one binary in one place
epompeii
committed
c6807fb
Widen the syscall arguments explicitly
epompeii
committed
042ef29
Say what the state directory actually holds
epompeii
committed
644b252
Write down why the metrics stat may stay
epompeii
committed
a378095
Record the jail user warning when it is given
epompeii
committed
ea75511
Fix a typo in the stale cgroup reasoning
epompeii
committed
b3e1d7d
Look once more before calling a VMM still running
epompeii
committed
f379837
Say why the grace period's fall-through is not the same bug
epompeii
committed
1dbe0f5
Match the reap's outcomes exhaustively
epompeii
committed
9ba83d5
Document the invocation the scenarios actually accept
epompeii
committed
82e2273

Commits on Jul 31, 2026

Test that host tuning applies and unwinds
epompeii
committed
c6e92e2
Document the tuning scenario
epompeii
committed
6d545bd
Remove the cgroup the tuning partition leaves behind
epompeii
committed
8350d9b
Have the tuning scenario diagnose its own partition failure
epompeii
committed
5303562
Reap what the state directory wipe would strand
epompeii
committed
cc94a36

Commits on Aug 4, 2026

Refuse a state directory tree that is really a link
epompeii
committed
fcd4c04
Take back a state directory tree that is only half built
epompeii
committed
b19dcd3
Say what a failed sweep reclaimed before it failed
epompeii
committed
8521cac
Say what makes a populated state directory ours
epompeii
committed
dbc6f5b
Say what a pidfd actually pins
epompeii
committed
b738cf3
Wait on the VMM the reap pinned, not on its number
epompeii
committed
7fbc05d
Wait out only the cgroup removal that waiting can fix
epompeii
committed
090709f
Keep why enabling cpuset failed, so an absence is one
epompeii
committed
fe94488
Find the jailer that was orphaned before it chrooted
epompeii
committed
d33c748
Name the flag the chroot teardown actually reads
epompeii
committed
4210ccb
Cover the rest of a chroot's creation with its own teardown
epompeii
committed
9705bdc
Mint a local run's id instead of recovering a chroot it has none of
epompeii
committed
1e35821
Reserve the port suffix on every socket path that can take one
epompeii
committed
b5d7987
Refuse an identity the runner could not have minted
epompeii
committed
3d5388a
Give the chroot's own creation a row in the table
epompeii
committed
14d21a0
Hand the jailer none of the runner's environment
epompeii
committed
8911a31
Name the step that ran before the exec that failed
epompeii
committed
3aa6f72
Decide what an unpollable child means instead of falling through it
epompeii
committed
c85d284
Stop unlinking through the one view that can go stale
epompeii
committed
82bfb5c
Degrade on the absence the host declared, not on the read that failed
epompeii
committed
5366361
Name the socket an API call could not reach after readiness
epompeii
committed
60e48c2
Point the public docs at nothing they cannot reach
epompeii
committed
c13f3ff
Key the cached binaries to the release they came out of
epompeii
committed
1fff3cd
Say that the staged binary's mode is set, not preserved
epompeii
committed
c8f2289
Keep saying why the runner is waiting for the jail lock
epompeii
committed
9db22a6
Answer a jail user of 0 with why root is no jail
epompeii
committed
756a7b7
Look for the binaries where cargo put them, not where the harness stands
epompeii
committed
8e2c407
Hand back every tree the elevated run left root-owned
epompeii
committed
ed08e2a
Ask for a jail uid by name, and hold the VMM to that one
epompeii
committed
34f6f0f
Watch the namespace the VMM joined, not just the network it lacks
epompeii
committed
77b9c0e
Take the stacked mounts back off the handle the setup wedged
epompeii
committed
3fd69cd
Pin that a jail the runner cannot build fails the job
epompeii
committed
a4f6e3f
Reap the cgroups a killed daemon leaves nobody able to find
epompeii
committed
2a6e31b
Stop the elevated runner on every way out of the test
epompeii
committed
7e56f58
Say plainly why the handle is removed and not left mounted
epompeii
committed
e47e109
Wait out a cgroup the kill has not been reaped for
epompeii
committed
af3a189
Claim only what a snapshot of the host can show
epompeii
committed
536dc00
Match the failure-policy table to the pidfd reap that replaced the status read
epompeii
committed
56d902a
Read the state lock name from the module that writes it
epompeii
committed
ee635cb
Point the remaining public docs at nothing private
epompeii
committed
ecb18cb
Say why the chroot tightens by path where the state guard will not
epompeii
committed
1b1bda9
Follow a state directory link only root could have aimed
epompeii
committed
ed84b37

Commits on Aug 5, 2026

Hold the state tree as root, and read its listing before removing from it
epompeii
committed
da193f5
Retry the poll a signal interrupted
epompeii
committed
8163ecd
Carry the error the vsock collection failed with
epompeii
committed
d36c0a2
Refuse a cpuset the runner could not parse
epompeii
committed
637ba40
Document what one state directory holds and what it may be
epompeii
committed
b8da28f
Take the jailer into the guard the moment it exists
epompeii
committed
b690cb6
Wake the announcer on the way out of a panic too
epompeii
committed
405ae3f
Judge the state directory link by an injected showing
epompeii
committed
80c6bc6
Name the entries the archive actually lacked
epompeii
committed
1a54b24
Pin the config round trip to every field it skips
epompeii
committed
8655ccf
Name the binary whose mode could not be set
epompeii
committed
a265c1e
Say that a slow sweep is reclaiming rather than wedged
epompeii
committed
8453cc0