Repository navigation
nvx-rs: let run restore a snapshot that has a NIC - #944
Merged
Pedro Henrique Penna (ppenna) merged 3 commits intoOct 28, 2026
Merged
Conversation
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are recorded for the networked snapshot restore changes.
No open issues 🎉
What changed in this PR
Fixes #800’s CLI limitation by allowing nvx-rs run to restore snapshots with a network interface using the captured addressing and network policy. Cold-boot requirements remain unchanged; replacing a non-sandbox snapshot’s policy remains deferred to #942 and #943.
Changes:
- Allow
--network-profilewithout--netduring restore, and reject--net. - Align fake OpenVMM validation and add restore regression tests.
- Document networked restores and their same-policy restrictions.
| File | Description |
|---|---|
nvx-rs/tests/fake_openvmm.rs |
Test networked restore acceptance and --net rejection. |
nvx-rs/tests/cli/validation.rs |
Test restore refusals with --net, with or without a profile. |
nvx-rs/tests/cli/one_shot.rs |
Test networked launch through fake OpenVMM and its outcome report. |
nvx-rs/tests/cli/dry_run.rs |
Cover restore command generation with profiles and policies. |
nvx-rs/src/testing/fake_openvmm.rs |
Match OpenVMM’s network argument restrictions and test them. |
nvx-rs/src/host/cli/run.rs |
Separate restore network validation from cold-boot pairing. |
nvx-rs/src/host/cli/network.rs |
Emit the network profile independently of --net. |
nvx-rs/README.md |
Explain restore behavior and fake OpenVMM validation. |
doc/usage.md |
Update networking and snapshot option requirements. |
doc/run.md |
Add networked restore guidance and policy limitations. |
Review effort: Balanced
OpenVMM takes the addressing of a restored NIC from the snapshot. It refuses a restore with --net, "restore takes microVM network addressing from saved state", and takes --network-profile portable without --net only on a restore: "--network-profile portable requires --net or --restore-snapshot". The fake OpenVMM took --net on a restore, as long as --network-profile portable came with it, and --network-profile alone on a cold boot, so the CLI tests could not tell whether nvx-rs run passes the network options that a restore needs (#800). Refuse both, with OpenVMM's messages and status 2, as the fake refuses the other command lines that OpenVMM does not take, and check the value of a --network-profile that comes without --net. A restore still takes the network profile and policy options alone. The fake cannot tell whether a snapshot has a NIC, so it leaves the refusals that depend on it, and the comparison with the captured policy, to OpenVMM. Unit tests cover a networked restore, its refusal of --net, a profile other than portable, and a cold boot with the profile alone, and the fake's integration test runs a networked restore and refuses one with --net. The module documentation and the README's test hooks describe the checks. Part of #800 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
OpenVMM restores a snapshot that has a NIC with the addressing that the snapshot saved. It refuses --net on a restore, requires --network-profile portable, which it takes without --net only on a restore, and checks the network policy options against the policy that the snapshot was captured with, unless a platform restore replaces the policy of a NIC template, which nvx-rs run does not request. nvx-rs run could not build that command line (#800): check() required --net and --network-profile together, and NetworkOptions::extend_arguments passed --network-profile only with --net. A restore with the profile alone failed in nvx-rs, a restore with both passed --net, which OpenVMM refused, and a restore with neither omitted the profile, which OpenVMM required. nvx.py run, which nvx-rs run replaced, had the same check. On a restore, refuse --net, as --guest is refused, with the reason that OpenVMM gives: the snapshot already fixes the network addressing. Pass --network-profile whenever it is given, so that a restore passes it alone. A cold boot still takes the two together, and its command line does not change. The other network options pass through as before, and OpenVMM still checks them against the snapshot, and refuses them for a snapshot without a NIC, which nvx-rs cannot tell from one with a NIC. The CLI tests restore a networked snapshot in dry runs, with the profile alone, with a policy, and with an egress policy file, launch one through the fake OpenVMM, whose outcome report records the policy, and refuse --net on a restore, with and without the profile, before anything changes. Without the fix, the new dry runs and launch fail in nvx-rs, and a restore with --net and the profile passes --net to OpenVMM. doc/usage.md and the README describe the options of a restore, and the README lists the change among the differences from nvx.py. Part of #800 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
OpenVMM restores a snapshot captured with --net with the addresses and the network policy that the snapshot saved. A restore omits --net, passes --network-profile portable, and passes the network policy options of the capture, whose digest OpenVMM compares with the saved one before the guest runs. Only a platform NIC template takes another policy, with --restore-network-policy, which nvx-rs run does not pass. The guide said neither how to restore such a snapshot nor that its policy cannot change, and it still said that omitting --net or --network-profile is rejected, which the previous commit made true of a cold boot only. A Networked snapshots section in doc/run.md gives the options of such a restore with nvx-rs run, what the restore compares, that it rejects ingress, explicit host loopback, and forwards as a capture does, that the guest keeps the network configuration of its boot, and that a snapshot without a NIC takes no network option. It precedes the Platform NIC templates section, the one exception, which now links back to it. The restore paragraph of Run OpenVMM directly adds --net to the options that a restore omits, and the networking paragraph limits the pairing of --net and --network-profile to a cold boot. The run table of doc/usage.md says what a restore of a networked snapshot needs, and that capture and restore reject forwards, as it already says of ingress and explicit host loopback. The second finding of #800 asked whether a snapshot without a tier, as nvx-rs run restores, should take a new policy at restore as a platform NIC template does. It should, but its guest learns its DNS server and whether to announce its listeners only at boot, so it needs OpenVMM to admit such snapshots (#942) and a guest step after the restore (#943). Until both land, these sections document the same-policy rule. Part of #800 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Pedro Henrique Penna (ppenna)
force-pushed
the
agents/issue-800-logical-commits-fix
branch
from
October 28, 2026 01:16
13d793c to
85b8df9
Compare
Pedro Henrique Penna (ppenna)
deleted the
agents/issue-800-logical-commits-fix
branch
October 28, 2026 19:21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #800.
nvx-rs run --restore-snapshotcould not restore a snapshot that has a NIC (finding 1). OpenVMM takes the addressing of a restored NIC from the snapshot: it refuses--neton a restore, requires--network-profile portable, which it takes without--netonly on a restore, and checks the network policy options against the captured policy.nvx-rs runtook--netand--network-profileonly together, and passed the profile only with--net, so every such restore failed before the VM started, in nvx-rs or in OpenVMM. A restore now passes the profile alone and refuses--netwith OpenVMM's reason, and a cold boot keeps the pairing and its command line. The fake OpenVMM refuses what OpenVMM refuses, so the CLI tests can tell, and the guide documents these restores.Finding 2 asked whether a snapshot without a tier, as
nvx-rs runrestores, should take a new network policy at restore, as a platform NIC template does since #536 and #931. It should, but its guest learns its DNS server and whether to announce its listeners only at boot, so it needs OpenVMM to admit such snapshots, #942, and a guest step after the restore, #943. Until both land, the guide documents the same-policy rule for them.Based on
devatb855c4d55. There is no OpenVMM change: OpenVMM at the pinnedd2338ea22restores these snapshots once it gets this command line.Change
f54fa09afnvx-rsnvx-rs/src/testing/fake_openvmm.rs,nvx-rs/tests/fake_openvmm.rs,nvx-rs/README.md--neton a restore and--network-profilealone on a cold boot, with OpenVMM's messages and status 2b5a62115dnvx-rsnvx-rs/src/host/cli/run.rs,nvx-rs/src/host/cli/network.rs,nvx-rs/tests/cli/dry_run.rs,nvx-rs/tests/cli/one_shot.rs,nvx-rs/tests/cli/validation.rs,doc/usage.md,nvx-rs/README.mdrunrefuses--neton a restore and passes--network-profilealone; a cold boot still takes the two together85b8df93ddocdoc/run.md,doc/usage.mdBefore and after
nvx-rs --root ROOT run --restore-snapshot SNAPSHOT OPTIONS --dry-runon Windows, withNVX_OPENVMMnaming an empty placeholder, which a dry run never runs:OPTIONSdev)--network-profile portable --network-egress deny--net and --network-profile must be specified together>> …\openvmm.exe … --restore-snapshot SNAPSHOT --network-profile portable --network-egress deny--net 10.0.0.2/24 --network-profile portable --network-egress deny--net, which OpenVMM refuses:restore takes microVM network addressing from saved state--net is not accepted for restore; the snapshot already fixes the network addressing--net 10.0.0.2/24--net and --network-profile must be specified together--net is not accepted for restore; the snapshot already fixes the network addressing--network-egress denyTests
--neton a restore, with and without the profile, before any side effect. Without the fix inrun.rsandnetwork.rs, the dry run and the launch fail in nvx-rs, and the restore with--netand the profile passes--netto OpenVMM.--net, a profile other thanportable, and a cold boot with the profile alone. Its integration test restores a networked snapshot and refuses one with--net.Validation
On Windows, on
d77908efc: the steps ofcheck-nvx-rs(formatting, the three Clippy runs,test --all-featureswith 1,087 passed,testwith 873 passed,--no-default-featureswith 258 passed, the documentation, the 1.89 MSRV check, and the runtime adapter's protocol and host configurations and guest Clippy),scripts/check_markdown_links.py, andtest_nvx_tools.pywithtest_markdown_links.py, 594 tests. The first commit alone passes the fake's tests and the CLI tests. After the rebase ontob855c4d55, whose #887 reworked the fake OpenVMM for template captures: formatting, Clippy,test --all-featureswith 1,117 passed, and the Markdown links. A capture is a cold boot, and nvx-rs lowers--network-profileonly with--net, so the fake's stricter checks leave captures unchanged. No hypervisor ran and no snapshot was restored; Linux and the hypervisor matrix are left to CI.