nvx-rs: factor minimal guest rootfs and descriptor-rooted host mapping #539

Activity

1. ppenna commented on Oct 16, 2026

   

   Pedro Henrique Penna (ppenna)

   on Oct 16, 2026

   Contributor

   More actions

   Five suggestions from the #531 review belong here. #531 keeps a faithful port of the C agent, so they wait until the #358 series is done:

   • Give launch neutral inputs (review). SpawnRequest carries AgentConfig, the agent's argv strings, and GuestExecPayload, the decoded NVXC frame. Convert them once at dispatch into a neutral exec spec (argv, environment, inherit flag, cwd, timeout) and an explicit identity, so that the root-entry and spawn hooks take input that another adapter can build. UID and GID validation can stay at launch time to keep today's failure stage.
   • Give reaping a single owner (review). cgroup::reap and cgroup::verify_empty call waitpid(-1, WNOHANG) from the execution path, as the C agent does, so they collect any child of the process. One agent-owned reaper that keeps PID 1's orphan reaping and records exit statuses by PID, which the execution core asks for its own child's status, lets the core run in a process with other children (nvx-rs: prove shared host and guest mechanics through two independent adapters #545).
   • Pass the execution cgroup in as a value (review). cgroup::prepare, has_tasks, kill, and launch.rs each rebuild the nvx-exec path, so only the direct root's fixed cgroup gets cgroup-level settlement, and in sandbox mode cgroup::terminate kills only the process group. An ExecCgroup { dir } with prepare, has_tasks, kill, settle, and procs serves whole-workload settlement in a layered root and one cgroup per execution for a concurrent adapter (nvx-rs: prove shared host and guest mechanics through two independent adapters #545). NVXC v1 still creates nvx-exec on every EXEC.
   • Make the mapping roots explicit, and keep NVXC batching separate (review). For example, apply_maps(system, export_root, target_root, first, maps). The NVXC loop keeps HostMappings and its sequence rules and passes /, so paths stay byte-identical until the descriptor-rooted walk replaces the inside.
   • Test symlinks in intermediate path components (review). Mapping application resolves the source and target by name: make_directories and both mount calls follow symlinks, and only the file target refuses one, with O_NOFOLLOW on its last component. The C agent does the same. For example, with work read-only, work/out read-write, and work/out/deps/cache read-only, a writer that replaces work/out/deps with a symlink to /var after the host's ExportPlan::verify makes the bind and its remount land on the guest's /var/cache. The descriptor-rooted walk (openat2 with RESOLVE_BENEATH | RESOLVE_NO_SYMLINKS, then open_tree, mount_setattr, and move_mount) must refuse it, and a regression test should cover this case.

   The first four keep NVXC v1's wire bytes, limits, exit statuses, and diagnostics. #358 checks in the C agent's parity fixtures before it removes the C agent, and those fixtures can prove it.
2. esaurez commented on Oct 16, 2026

   

   Enrique Saurez (esaurez)

   on Oct 16, 2026

   ContributorAuthor

   More actions

   From the #550 review (the Rust time tools), deferred because #550 keeps a faithful port. For this core:

   • Expose the time steps as library calls. In Port the time tools to Rust #550, nvx::guest::time and nvx::guest::reseed export only main(), and the validated restore packet leaves repair_restore only as a text line and an entropy file. A Rust PID 1 must therefore start nvx-time capture, nvx-reseed and nvx-time restore-finish and parse their output (#358 asked PR 4 for these calls). Keep the CLI as a thin wrapper, with today's bytes and statuses, over calls such as:

     • time::boot();
     • time::capture(request, previous_id), which returns the validated RestorePacket after the clock step, or that nothing was restored;
     • time::restore_finish(acknowledge, new_cpus);
     • reseed::reseed(seed, previous_id).

     Failures stay fatal through a helper that the CLI also uses. The time daemon stays a separate process, because C10 requires its name to be nvx-time and its PID to be greater than 1.

   • Scope port access to each transaction. RealOps requests PortAccess for the whole command, and the thread's I/O bitmap passes to fork children and survives execve, whatever their capabilities. An in-process caller must take and drop it for each port transaction, never while it starts a workload. Add a test that a workload can neither read the byte channel nor write the snapshot or shutdown port.

   With both, neither adapter needs nvx-snapshot or helper processes on a readiness path (#542, #545).
3. esaurez commented on Oct 20, 2026

   

   Enrique Saurez (esaurez)

   on Oct 20, 2026

   ContributorAuthor

   More actions

   Replaced by the rewritten #535. Neutral launch, a single reaper, an exec cgroup, explicit roots, time as library calls and per-transaction ports move to #619 (A1-guest). The minimal layered root, with the Rust PID 1, descriptor-rooted mappings and ordered maps, moves to #621 (A3). Closing in favor of those issues.
4. Enrique Saurez (esaurez)

   closed this as not plannedon Oct 20, 2026
5. Pedro Henrique Penna (ppenna)

   added the

   Feature

   issue type on Oct 20, 2026