mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-30 07:33:59 +08:00
Drew Newberry
47528ac7d1
Enable Kubernetes-compatible networking in the gateway microVM by building a custom libkrunfw kernel with CONFIG_BRIDGE, CONFIG_NETFILTER, CONFIG_NF_CONNTRACK, CONFIG_IP_NF_IPTABLES, and CONFIG_VETH compiled in. Key changes: - Docker-based kernel build pipeline for macOS (build-custom-libkrunfw.sh) - Kernel config fragment enabling bridge/netfilter/conntrack/NAT/IPVS - Feature-flagged bridge CNI with auto-detection fallback to legacy ptp - Runtime provenance tracking (SHA-256, build metadata, manifest validation) - VM capability checker and host-side verification matrix scripts - Mise tasks: vm:build-custom-runtime, vm:verify, vm:check-capabilities - Architecture and operator documentation
73 lines
2.2 KiB
TOML
73 lines
2.2 KiB
TOML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# openshell-vm development helpers
|
|
|
|
[vm]
|
|
description = "Build and run the standalone gateway microVM"
|
|
run = [
|
|
"mise run vm:build:binary",
|
|
"tasks/scripts/bundle-vm-runtime.sh",
|
|
"tasks/scripts/ensure-vm-rootfs.sh",
|
|
"tasks/scripts/codesign-gateway.sh",
|
|
"tasks/scripts/run-vm.sh",
|
|
]
|
|
hide = false
|
|
|
|
["vm:build"]
|
|
description = "Force a fresh gateway rebuild, including the rootfs"
|
|
run = [
|
|
"mise run vm:build:binary",
|
|
"tasks/scripts/bundle-vm-runtime.sh",
|
|
"OPENSHELL_VM_FORCE_ROOTFS_REBUILD=1 tasks/scripts/ensure-vm-rootfs.sh",
|
|
"tasks/scripts/codesign-gateway.sh",
|
|
]
|
|
hide = false
|
|
|
|
["vm:build:binary"]
|
|
description = "Build the standalone gateway binary"
|
|
run = "cargo build -p openshell-vm"
|
|
hide = true
|
|
|
|
["vm:build:release"]
|
|
description = "Build the standalone gateway binary in release mode"
|
|
run = "cargo build -p openshell-vm --release"
|
|
hide = true
|
|
|
|
["vm:rootfs"]
|
|
description = "Build the default gateway rootfs if needed"
|
|
run = "tasks/scripts/ensure-vm-rootfs.sh"
|
|
hide = true
|
|
|
|
["vm:codesign"]
|
|
description = "Codesign the gateway binary for Hypervisor.framework access on macOS"
|
|
depends = ["vm:build:binary"]
|
|
run = "tasks/scripts/codesign-gateway.sh"
|
|
hide = true
|
|
|
|
["vm:bundle-runtime"]
|
|
description = "Stage the gateway sidecar runtime bundle next to local build outputs"
|
|
run = "tasks/scripts/bundle-vm-runtime.sh"
|
|
hide = false
|
|
|
|
["vm:build-custom-runtime"]
|
|
description = "Build a custom libkrunfw with bridge/netfilter kernel support"
|
|
run = "crates/openshell-vm/runtime/build-custom-libkrunfw.sh"
|
|
hide = false
|
|
|
|
["vm:verify"]
|
|
description = "Run the VM verification matrix against a running gateway"
|
|
run = "crates/openshell-vm/scripts/verify-vm.sh"
|
|
hide = false
|
|
|
|
["vm:check-capabilities"]
|
|
description = "Check VM kernel capabilities (run inside the VM)"
|
|
run = "echo 'This script must be run inside the VM. Copy it to the rootfs or exec into a running VM.'"
|
|
hide = false
|
|
|
|
["vm:package:gateway"]
|
|
description = "Package the gateway binary with its sidecar runtime bundle"
|
|
run = "tasks/scripts/package-gateway-runtime.sh"
|
|
depends = ["vm:build:release", "vm:bundle-runtime"]
|
|
hide = false
|