feat(firecracker): launch with control socket instead of config file#809
Open
Anamika1608 wants to merge 5 commits into
Open
feat(firecracker): launch with control socket instead of config file#809Anamika1608 wants to merge 5 commits into
Anamika1608 wants to merge 5 commits into
Conversation
✅ Deploy Preview for urunc ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Firecracker currently boots via --no-api --config-file, which disables its control socket entirely. Switch to --api-sock so the socket stays open and reachable after the guest starts, instead of driving everything through a static config file. Signed-off-by: Anamika AggarwaL <anamikaagg18@gmail.com>
Anamika1608
force-pushed
the
firecracker-api-sock
branch
from
691f601 to
811a606
Compare
Add an optional socket_path field under a monitor's configuration section so users can override where the control socket is created. Falls back to today's default path when unset. The field is added to the shared MonitorConfig type, so it is available to any monitor, but only Firecracker's BuildExecCmd reads it in this change, since it is the only monitor with a control socket right now. Signed-off-by: Anamika AggarwaL <anamikaagg18@gmail.com>
Add the new socket_path field to the Monitor Options table and the Firecracker example, matching the existing style for path/data_path. Signed-off-by: Anamika AggarwaL <anamikaagg18@gmail.com>
…ased boot Add an optional boot_mode field under a monitor's configuration. "api" (default) keeps today's behavior: drive the monitor's boot over its control socket. "config-file" lets Firecracker boot itself from the JSON config file, using the socket only for communication after the guest is running. Currently only used by Firecracker. Signed-off-by: Anamika AggarwaL <anamikaagg18@gmail.com>
Stop syscall.Exec-ing into Firecracker for boot_mode=api. Instead, spawn
it as a child, configure it over its control socket using the existing
config-building logic (now shared with the config-file path), start the
guest, then supervise the child: forward SIGTERM/SIGINT and exit with
its status once it exits. The child inherits whatever confinement
changeRoot already set up on this process (pivot_root or chroot), so no
separate confinement step is needed here.
Add HasNetwork() as a cheap, early check for whether a container has a
network interface, separate from the full (expensive) NetworkSetup.
Rootfs prep only needs this cheap fact (see prepareMonRootfs's needsTAP
argument), not the finished network, so for boot_mode=api, rootfs prep
now runs concurrently with the real network setup, joining just before
unikernel.Init (every supported unikernel type needs the resolved
network result to build the guest's boot command line).
Also fixes a real bug this surfaced: createTapDevice's file descriptor
was opened O_CLOEXEC and relied on syscall.Exec to close it as a side
effect of replacing the process. Since urunc no longer execs away for
boot_mode=api, that fd was staying open indefinitely, blocking
Firecracker's own attempt to attach to the same single-queue tap
device ("Resource busy"). The device is created with TUNSETPERSIST, so
it's safe to close the fd explicitly once setup is done.
Signed-off-by: Anamika AggarwaL <anamikaagg18@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related to #112.
Today Firecracker boots via
--no-api --config-file, which explicitly disables its control socket. This switches to--api-sock, so the socket stays open and reachable after the guest starts, instead of everything being driven through a static config file.This is a minimal first step: the JSON config file is still generated the same way, only the launch flag changes.