Hyper.Node.FireVMM.ChrootJail (Hyper v0.1.0)

Places a VM's boot artifacts inside its jailer chroot and points the boot spec at them.

firecracker runs chrooted, so the kernel (a regular file) is hardlinked/copied in and the writable rootfs (a block device) gets a matching device node mknod-ed in - both chowned to the jail uid/gid via the setuid helper. The resolved BootSpec.Cold carries HOST paths; stage/4 stages them into the chroot and returns a copy whose kernel + rootfs paths are the in-jail (chroot-relative) equivalents the chrooted firecracker can open.

Summary

Functions

stage(vm_id, uid, gid, cold)

Stage cold's host kernel + rootfs device into vm_id's chroot (owned uid:gid), and return cold with its kernel + rootfs paths rewritten to their in-jail equivalents. Fails the boot if either artifact cannot be staged.

Functions

stage(vm_id, uid, gid, cold)

@spec stage(
  Hyper.Vm.Id.t(),
  non_neg_integer(),
  non_neg_integer(),
  Hyper.Node.FireVMM.BootSpec.Cold.t()
) ::
  {:ok, Hyper.Node.FireVMM.BootSpec.Cold.t()} | {:error, term()}