LinuxContainer: Give 1 vcpu of overhead for guest

Sources/Containerization/LinuxContainer.swift

@@ -530,6 +530,9 @@ extension LinuxContainer {
             let mib: UInt64 = 1.mib()
             let vmMemory = (self.memoryInBytes + guestAgentOverhead + mib - 1) & ~(mib - 1)
 
+            // Give the guest agent a core to play with outside of the container.
+            let vmCpus = self.cpus + 1
+
             // Prepare file mounts. This transforms single-file mounts into directory shares.
             let fileMountContext = try FileMountContext.prepare(mounts: self.config.mounts)
             // This is dumb, but alas.
@@ -542,7 +545,7 @@ extension LinuxContainer {
             }
 
             let vmConfig = VMConfiguration(
-                cpus: self.cpus,
+                cpus: vmCpus,
                 memoryInBytes: vmMemory,
                 interfaces: self.interfaces,
                 mountsByID: [self.id: containerMounts],

Sources/Containerization/VZVirtualMachineManager.swift

@@ -55,11 +55,14 @@ public struct VZVirtualMachineManager: VirtualMachineManager {
         // Clamp to system RAM as Virtualization.framework bounds us to this.
         let memoryInBytes = min(vmConfig.memoryInBytes, ProcessInfo.processInfo.physicalMemory)
 
+        // Clamp to system CPU count as Virtualization.framework bounds us to this.
+        let cpus = min(vmConfig.cpus, ProcessInfo.processInfo.activeProcessorCount)
+
         return try VZVirtualMachineInstance(
             group: self.group,
             logger: self.logger,
             with: { instanceConfig in
-                instanceConfig.cpus = vmConfig.cpus
+                instanceConfig.cpus = cpus
                 instanceConfig.memoryInBytes = memoryInBytes
 
                 instanceConfig.kernel = self.kernel