mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-29 07:23:25 +08:00
feat(vm): add openshell-vm crate with libkrun microVM gateway (#611)
This commit is contained in:
Drew Newberry
@@ -0,0 +1,125 @@
|
||||
# syntax=docker/dockerfile:1.6
|
||||
|
||||
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
# Cross-compile the openshell-vm binary for macOS aarch64 (Apple Silicon)
|
||||
# using the osxcross toolchain.
|
||||
#
|
||||
# The openshell-vm binary loads libkrun/libkrunfw at runtime via dlopen, so it
|
||||
# does NOT need Hypervisor.framework headers at build time. Pre-compressed
|
||||
# runtime artifacts (libkrun, libkrunfw, gvproxy, rootfs) are injected via
|
||||
# the vm-runtime-compressed build context and embedded into the binary via
|
||||
# include_bytes!().
|
||||
#
|
||||
# Usage:
|
||||
# docker buildx build -f deploy/docker/Dockerfile.vm-macos \
|
||||
# --build-arg OPENSHELL_CARGO_VERSION=0.6.0 \
|
||||
# --build-context vm-runtime-compressed=/path/to/compressed-dir \
|
||||
# --output type=local,dest=out/ .
|
||||
|
||||
ARG OSXCROSS_IMAGE=crazymax/osxcross:latest
|
||||
|
||||
FROM ${OSXCROSS_IMAGE} AS osxcross
|
||||
|
||||
FROM python:3.12-slim AS builder
|
||||
|
||||
ARG CARGO_TARGET_CACHE_SCOPE=default
|
||||
|
||||
ENV PATH="/root/.cargo/bin:/usr/local/bin:/osxcross/bin:${PATH}"
|
||||
ENV LD_LIBRARY_PATH="/osxcross/lib"
|
||||
|
||||
COPY --from=osxcross /osxcross /osxcross
|
||||
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
build-essential \
|
||||
ca-certificates \
|
||||
clang \
|
||||
cmake \
|
||||
curl \
|
||||
pkg-config \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain 1.88.0
|
||||
|
||||
RUN rustup target add aarch64-apple-darwin
|
||||
|
||||
WORKDIR /build
|
||||
|
||||
ENV CC_aarch64_apple_darwin=oa64-clang
|
||||
ENV CXX_aarch64_apple_darwin=oa64-clang++
|
||||
ENV AR_aarch64_apple_darwin=aarch64-apple-darwin25.1-ar
|
||||
ENV CARGO_TARGET_AARCH64_APPLE_DARWIN_LINKER=oa64-clang
|
||||
ENV CARGO_TARGET_AARCH64_APPLE_DARWIN_AR=aarch64-apple-darwin25.1-ar
|
||||
|
||||
# aws-lc-sys workaround (in case it ends up in the dep tree via feature unification)
|
||||
RUN ln -sf /osxcross/bin/arm64-apple-darwin25.1-ld /usr/local/bin/arm64-apple-macosx-ld
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Stage 1: dependency caching — copy only manifests, create dummy sources,
|
||||
# build dependencies. This layer is cached unless Cargo.toml/lock changes.
|
||||
# ---------------------------------------------------------------------------
|
||||
COPY Cargo.toml Cargo.lock ./
|
||||
COPY crates/openshell-vm/Cargo.toml crates/openshell-vm/Cargo.toml
|
||||
COPY crates/openshell-vm/build.rs crates/openshell-vm/build.rs
|
||||
COPY crates/openshell-core/Cargo.toml crates/openshell-core/Cargo.toml
|
||||
COPY crates/openshell-core/build.rs crates/openshell-core/build.rs
|
||||
COPY crates/openshell-bootstrap/Cargo.toml crates/openshell-bootstrap/Cargo.toml
|
||||
COPY crates/openshell-policy/Cargo.toml crates/openshell-policy/Cargo.toml
|
||||
COPY proto/ proto/
|
||||
|
||||
# Scope workspace to VM crates only.
|
||||
RUN sed -i 's|members = \["crates/\*"\]|members = ["crates/openshell-vm", "crates/openshell-core", "crates/openshell-bootstrap", "crates/openshell-policy"]|' Cargo.toml
|
||||
|
||||
RUN mkdir -p crates/openshell-vm/src \
|
||||
crates/openshell-core/src \
|
||||
crates/openshell-bootstrap/src \
|
||||
crates/openshell-policy/src && \
|
||||
echo "fn main() {}" > crates/openshell-vm/src/main.rs && \
|
||||
touch crates/openshell-vm/src/lib.rs && \
|
||||
touch crates/openshell-core/src/lib.rs && \
|
||||
touch crates/openshell-bootstrap/src/lib.rs && \
|
||||
touch crates/openshell-policy/src/lib.rs
|
||||
|
||||
# Build deps only (cached layer).
|
||||
RUN --mount=type=cache,id=cargo-registry-vm-macos,sharing=locked,target=/root/.cargo/registry \
|
||||
--mount=type=cache,id=cargo-git-vm-macos,sharing=locked,target=/root/.cargo/git \
|
||||
--mount=type=cache,id=cargo-target-vm-macos-${CARGO_TARGET_CACHE_SCOPE},sharing=locked,target=/build/target \
|
||||
cargo build --release --target aarch64-apple-darwin -p openshell-vm 2>/dev/null || true
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Stage 2: real build with compressed runtime artifacts
|
||||
# ---------------------------------------------------------------------------
|
||||
COPY crates/ crates/
|
||||
|
||||
# Copy compressed VM runtime artifacts for embedding.
|
||||
# These are passed in via --build-context vm-runtime-compressed=...
|
||||
COPY --from=vm-runtime-compressed / /build/vm-runtime-compressed/
|
||||
|
||||
# Touch source files to ensure they're rebuilt (not the cached dummy).
|
||||
RUN touch crates/openshell-vm/src/main.rs \
|
||||
crates/openshell-vm/src/lib.rs \
|
||||
crates/openshell-vm/build.rs \
|
||||
crates/openshell-bootstrap/src/lib.rs \
|
||||
crates/openshell-core/src/lib.rs \
|
||||
crates/openshell-core/build.rs \
|
||||
crates/openshell-policy/src/lib.rs \
|
||||
proto/*.proto
|
||||
|
||||
# Declare version ARGs here (not earlier) so the git-hash-bearing values do not
|
||||
# invalidate the expensive dependency-build layers above on every commit.
|
||||
ARG OPENSHELL_CARGO_VERSION
|
||||
ARG OPENSHELL_IMAGE_TAG
|
||||
RUN --mount=type=cache,id=cargo-registry-vm-macos,sharing=locked,target=/root/.cargo/registry \
|
||||
--mount=type=cache,id=cargo-git-vm-macos,sharing=locked,target=/root/.cargo/git \
|
||||
--mount=type=cache,id=cargo-target-vm-macos-${CARGO_TARGET_CACHE_SCOPE},sharing=locked,target=/build/target \
|
||||
if [ -n "${OPENSHELL_CARGO_VERSION:-}" ]; then \
|
||||
sed -i -E '/^\[workspace\.package\]/,/^\[/{s/^version[[:space:]]*=[[:space:]]*".*"/version = "'"${OPENSHELL_CARGO_VERSION}"'"/}' Cargo.toml; \
|
||||
fi && \
|
||||
OPENSHELL_VM_RUNTIME_COMPRESSED_DIR=/build/vm-runtime-compressed \
|
||||
OPENSHELL_IMAGE_TAG="${OPENSHELL_IMAGE_TAG:-dev}" \
|
||||
cargo build --release --target aarch64-apple-darwin -p openshell-vm && \
|
||||
cp target/aarch64-apple-darwin/release/openshell-vm /openshell-vm
|
||||
|
||||
FROM scratch AS binary
|
||||
COPY --from=builder /openshell-vm /openshell-vm
|
||||
@@ -461,9 +461,18 @@ if [ -n "${IMAGE_TAG:-}" ] && [ -f "$HELMCHART" ]; then
|
||||
sed -i -E "s|tag:[[:space:]]*\"?latest\"?|tag: \"${IMAGE_TAG}\"|" "$HELMCHART"
|
||||
fi
|
||||
|
||||
if [ -n "${IMAGE_PULL_POLICY:-}" ] && [ -f "$HELMCHART" ]; then
|
||||
echo "Overriding image pull policy to: ${IMAGE_PULL_POLICY}"
|
||||
sed -i "s|pullPolicy: Always|pullPolicy: ${IMAGE_PULL_POLICY}|" "$HELMCHART"
|
||||
if [ -f "$HELMCHART" ]; then
|
||||
IMAGE_PULL_POLICY_VALUE="${IMAGE_PULL_POLICY:-Always}"
|
||||
if [ -n "${IMAGE_PULL_POLICY:-}" ]; then
|
||||
echo "Overriding image pull policy to: ${IMAGE_PULL_POLICY}"
|
||||
fi
|
||||
sed -i "s|__IMAGE_PULL_POLICY__|${IMAGE_PULL_POLICY_VALUE}|g" "$HELMCHART"
|
||||
|
||||
SANDBOX_IMAGE_PULL_POLICY_VALUE="${SANDBOX_IMAGE_PULL_POLICY:-\"\"}"
|
||||
sed -i "s|__SANDBOX_IMAGE_PULL_POLICY__|${SANDBOX_IMAGE_PULL_POLICY_VALUE}|g" "$HELMCHART"
|
||||
|
||||
DB_URL_VALUE="${DB_URL:-\"sqlite:/var/openshell/openshell.db\"}"
|
||||
sed -i "s|__DB_URL__|${DB_URL_VALUE}|g" "$HELMCHART"
|
||||
fi
|
||||
|
||||
# SSH handshake secret: previously generated here and injected via sed into the
|
||||
|
||||
@@ -27,9 +27,11 @@ spec:
|
||||
image:
|
||||
repository: ghcr.io/nvidia/openshell/gateway
|
||||
tag: latest
|
||||
pullPolicy: Always
|
||||
pullPolicy: __IMAGE_PULL_POLICY__
|
||||
server:
|
||||
sandboxImage: ghcr.io/nvidia/openshell-community/sandboxes/base:latest
|
||||
sandboxImagePullPolicy: __SANDBOX_IMAGE_PULL_POLICY__
|
||||
dbUrl: __DB_URL__
|
||||
sshGatewayHost: __SSH_GATEWAY_HOST__
|
||||
sshGatewayPort: __SSH_GATEWAY_PORT__
|
||||
grpcEndpoint: "https://openshell.openshell.svc.cluster.local:8080"
|
||||
|
||||
Reference in New Issue
Block a user