* chore(code): simple code cleanup
* chore(code): additional code cleanup
* feature(krata): rework api and make ip assignment persistent to database
* rework and cleanup
* fix daemon config references
* wip hvm
* feat: move platform stuff all into it's own thing
* hvm work
* more hvm work
* more hvm work
* feat: rework to support multiple platforms
* hvm nonredist
* more hvm work
* more hvm work
* pvh work
* work on loading cmdline
* implement initrd loading for pvh
* partially working pvh support
* fix merge issues
* pvh works!
* swap over to pv support
* remove old kernel stuff
* fix support for pv
* pvh is gone for now
* fix(runtime): debug should be respected
* fix(xen): arm64 is currently unsupported, treat it as such at runtime
* fix(examples): use architecture cfg for boot example
* fix(x86): use IOMMU only when needed for passthrough
* chore(build): print kernel architecture during fetch
There is currently a bug in the Xen support for Alpine where /boot/config-lts
is expected to exist but in Alpine /boot/config-VERSION-lts is the only file
available. This change copies the config to /boot/config-lts to fix the build.
The resolv.conf that the stage1 os script generates is fine for actual use,
but our GitHub workflows now uses the Step Security hardened runner action.
This action replaces the nameserver so that all lookups go through that,
but because the chroot calls apk add, it needs to contact the internet.
On the GitHub workflows, the OS build currently fails since the hardened
runner cannot access other nameservers.
Now that we have the kernel build infrastructure at https://github.com/edera-dev/kernels
it makes sense to drop building the kernel and download the kernel images directly.
This change introduces a ./hack/kernel/fetch.sh script which is backed by crates/build
We utilize the OCI infrastructure itself to download the kernel image. The DEV guide
has been updated to include calling the fetch script, and the OS builder now uses this
method instead. Due to the lack of need for the kernel build infra to exist here now,
it has also been removed. This should significantly speed up full builds.
This change will also enable us to turn on os build workflows for all PRs. We should
likely make the OS status checks required once this is merged.
We have a need to ensure great security while also ensuring that dependabot
does not constantly provide multiple PRs. After all, when something becomes
too time consuming it risks not being handled with care. With grouped updates,
version bumps will get grouped together, but security updates will still be
indvidualized. This makes it safer for us to enable grouped dependency updates.
Previously, krata runtime allowed a single permit when performing operations.
This was necessary because the only IP allocation storage was xenstore, and
the commit of xenstore data happens after allocation. This commit introduces
IpVendor, a service which vends IPv4 and IPv6 addresses to guests using a
linear address strategy within an IP network space. The IpVendor table is
initialized from xenstore, and from there on out, the in-memory table
is the source of truth. This implementation is not perfect, but it will allow
us to lift the single permit limit, allowing guests to start concurrently.
* feat: pci passthrough
* feat: guest device management
* feat: addons mounting and kernel modules support
* feat: more pci work
* fix: kernel build squashfs fixes
* fix: e820entry should be available on all platforms
* chore: rework oci crate to be more composable
* feat: image pull is now internally explicit
* feat: utilize vfs for assembling oci images
* feat: rework oci to preserve permissions via a vfs
* feat: oci packer can now use mksquashfs if available
* fix: use nproc in kernel build script for default jobs, and fix DEV.md guide
* feat: working erofs backend
Implement IDM snooping, a new feature that lets you snoop on messages between guests and the host. The feature exposes the IDM packets send and receives
to the API, allowing kratactl to now listen for messages and feed them to a user for debugging purposes.
* feat: initial support for idm send in daemon
* feat: implement IdmClient backend support
* feat: daemon idm now uses IdmClient
* fix: implement channel destruction propagation
* feat: implement request response idm system
* feat: implement metrics support
* proto: move metrics into GuestMetrics for reusability
* fix: log level of guest agent was trace
* feat: metrics tree with process information
alex