feat(runtime): package and enable Firecracker - #38
Open
tianyuzhou95 wants to merge 2 commits into
Open
Conversation
Update the sandboxd submodule to the tested runtime series and use its shared manifest as the single source of truth for gVisor artifacts. This keeps sandboxd E2E and AKernel packaging on the same compatibility release. Install the checksum-verified runsc binary from the promoted AKernel gVisor release instead of selecting an independent upstream release in the node image. Do not expose per-field artifact overrides; testing another runtime release requires checking out the sandboxd revision that pins it. Signed-off-by: Tianyu Zhou <albert.zty@antgroup.com>
Package the promoted Firecracker runtime bundle selected by sandboxd's shared runtime manifest. Verify the archive, provenance manifest, inner checksums, VMM version, and component hashes before installing the official VMM, tested guest kernel, resolved configuration, and licenses. Build only sandboxd's matching static guest-agent initrd in AKernel. Removing the duplicate kernel configuration and source build ensures sandboxd E2E and AKernel standalone consume the same artifacts that passed candidate testing. Register the runtime in standalone and cloud deployment configurations so eligible KVM nodes advertise the microVM backend. Require local or image-provider-backed raw EROFS files for roots and filesystem mounts while each sandbox owns only its private ext4 writable layer and runtime state. Document the supported command, file, PTY, networking, storage, recovery, and tunnel workflows together with the VMM limitations. Reject OCI, Nydus, host directories, GPU, and nested KVM instead of weakening their semantics. Signed-off-by: Tianyu Zhou <albert.zty@antgroup.com>
tianyuzhou95
force-pushed
the
albert/firecracker
branch
from
August 23, 2026 04:25
0958208 to
5f30a1e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consume sandboxd's shared runtime manifest as the source of truth for the
compatible gVisor and Firecracker releases.
Package the checksum-verified Firecracker runtime bundle, build its matching
guest-agent initrd, and enable the runtime in standalone, Helm, and Terraform
deployments. Firecracker accepts read-only EROFS roots and mounts, with a
private ext4 writable layer for each sandbox.
Update the runtime documentation and examples to describe KVM requirements,
capability discovery, storage behavior, and unsupported inputs.
Testing
make sdk-checkmake deploy-script-checkmake versionsrecovery, and reverse-tunnel coverage
range server