Skip to content

feat(minvmd): scaffold crate with libkrun FFI wrappers and smoke test - #237

Merged
norrietaylor merged 4 commits into
mainfrom
feature/minvmd-host-daemon
Jun 1, 2026
Merged

feat(minvmd): scaffold crate with libkrun FFI wrappers and smoke test#237
norrietaylor merged 4 commits into
mainfrom
feature/minvmd-host-daemon

Conversation

@norrietaylor

@norrietaylor norrietaylor commented May 27, 2026

Copy link
Copy Markdown
Member

Summary

Lands the macOS-only minvmd crate as a scaffold + FFI surface + gated smoke test. Subsequent PRs add VM boot, the UDS↔vsock bridge, and the lifecycle daemon.

  • New crates/minvmd workspace member; krun module is #[cfg(target_os = "macos")]-gated. Linux ships only a runtime-bailing stub so existing Linux-only CI stays green.
  • build.rs emits link search + rpath on macOS, defaulting to /opt/homebrew/lib with a LIBKRUN_PREFIX env override.
  • libkrun FFI in src/krun/raw.rs covers the smoke-test surface (create_ctx, set_vm_config, set_exec, start_enter, free_ctx) plus the forward boot surface (set_root, set_kernel, add_vsock_port, set_console_output). One block-level // SAFETY: enumerates the pointer / NUL-termination / ownership-transfer invariants the extern \"C\" block inherits from the C ABI; per-function doc comments describe each function's contract.
  • Safe wrappers in src/krun/ctx.rs expose an RAII Context (non-Clone / non-Copy, Drop calls krun_free_ctx) that validates inputs in safe Rust (NUL-termination via CString). Every unsafe call site carries its own // SAFETY: comment naming the invariants the wrapper enforces. start_enter consumes via mem::forget because libkrun documents the configuration as consumed unconditionally.
  • Typed VmError matches the hand-rolled style in sandbox2: Backend { op, code } preserves errno magnitude; NulInPath / NulInString cover boundary validation; StartEnterReturnedUnexpectedly { ret } surfaces the libkrun-docs-violating path explicitly instead of synthesising a misleading "errno 0".
  • minvmd.entitlements grants only com.apple.security.hypervisor. justfile codesign-minvmd recipe builds release and ad-hoc-signs.
  • tests/krun_smoke.rs is #[ignore] and self-skips unless MINVMD_E2E=1. When opted in it spawns the auto-discovered src/bin/krun_smoke_child helper (separate process because krun_start_enter exit()s on success and never returns) which drives the safe wrappers end-to-end.

Out of scope (intentional)

  • VM boot with kernel + Alpine rootfs (follow-up).
  • UDS↔vsock bridge to minimald (follow-up).
  • Lifecycle daemon (run/status/stop, auto-spawn from minimal2) (follow-up).
  • Networking (gvproxy / TSI).
  • All forward FFI surface (set_kernel, set_root, add_vsock_port, set_console_output) is declared and wrapped but not yet exercised.

Test plan

  • cargo build -p minvmd — green on aarch64-apple-darwin
  • cargo clippy -p minvmd --all-targets -- -D warnings — no issues
  • cargo fmt --check — clean
  • cargo test -p minvmd — 9 passed, 1 ignored (the gated smoke test)
  • MINVMD_E2E=1 cargo test -p minvmd --test krun_smoke -- --include-ignored — 1 passed against real libkrun v1.18.1 on macOS
  • Linux CI gate: the krun module is gated out, no libkrun linkage attempted
  • just codesign-minvmd on a Mac — produces a release binary signed with the hypervisor entitlement

🤖 Generated with Claude Code

Summary by CodeRabbit

  • New Features

    • Added a macOS-only minvmd CLI with shell completion and macOS hypervisor entitlement.
  • Libraries / Runtime

    • Introduced a macOS-only FFI-backed VM API with refined error handling.
  • Tests

    • Added macOS-only, opt-in smoke tests and a helper to validate VM bring-up sequences.
  • Chores

    • Registered minvmd in the workspace and added a release build + ad-hoc codesign recipe.

@coderabbitai

coderabbitai Bot commented May 27, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 345331dc-a523-4dfe-a99c-ff9ed7a5a853

📥 Commits

Reviewing files that changed from the base of the PR and between 8767e45 and c0aed34.

⛔ Files ignored due to path filters (1)
  • Cargo.lock is excluded by !**/*.lock
📒 Files selected for processing (13)
  • Cargo.toml
  • crates/minvmd/Cargo.toml
  • crates/minvmd/build.rs
  • crates/minvmd/minvmd.entitlements
  • crates/minvmd/src/bin/krun_smoke_child.rs
  • crates/minvmd/src/error.rs
  • crates/minvmd/src/krun/ctx.rs
  • crates/minvmd/src/krun/mod.rs
  • crates/minvmd/src/krun/raw.rs
  • crates/minvmd/src/lib.rs
  • crates/minvmd/src/main.rs
  • crates/minvmd/tests/krun_smoke.rs
  • justfile
✅ Files skipped from review due to trivial changes (3)
  • crates/minvmd/minvmd.entitlements
  • crates/minvmd/Cargo.toml
  • crates/minvmd/build.rs
🚧 Files skipped from review as they are similar to previous changes (10)
  • Cargo.toml
  • crates/minvmd/src/lib.rs
  • justfile
  • crates/minvmd/src/main.rs
  • crates/minvmd/src/krun/mod.rs
  • crates/minvmd/src/error.rs
  • crates/minvmd/src/krun/raw.rs
  • crates/minvmd/src/krun/ctx.rs
  • crates/minvmd/tests/krun_smoke.rs
  • crates/minvmd/src/bin/krun_smoke_child.rs

📝 Walkthrough

Walkthrough

Adds a new macOS-only minvmd crate: workspace registration, crate manifest and build script for linking libkrun, entitlements and codesign recipe, raw FFI and check_backend, a safe Context wrapper, CLI skeleton, and macOS-only smoke tests.

Changes

minvmd crate—macOS hypervisor integration with libkrun

Layer / File(s) Summary
Project setup and build configuration
Cargo.toml, crates/minvmd/Cargo.toml, crates/minvmd/build.rs, crates/minvmd/minvmd.entitlements, justfile
Workspace member added; new crate manifest with workspace-scoped deps; macOS build script emits rustc link-search and rpath for libkrun; entitlements plist enables com.apple.security.hypervisor; justfile adds codesign recipe.
Error model and diagnostics
crates/minvmd/src/error.rs
VmError enum preserves backend errno via io::Error, models interior-NUL errors and unexpected start_enter return; Display and Error impls updated and unit tests verify messages and errno preservation.
FFI bindings and safe Context wrapper
crates/minvmd/src/krun/raw.rs, crates/minvmd/src/krun/ctx.rs, crates/minvmd/src/krun/mod.rs
Raw extern "C" libkrun declarations and kernel-format constants; check_backend converts negative errno-style returns; Context RAII wrapper with create/config/start APIs, CString helpers, Drop freeing ctx, and unit tests.
Library crate surface and public API
crates/minvmd/src/lib.rs
Crate docs describe macOS-only daemon role; error module exposed; krun module compiled only on macOS; VmError re-exported.
CLI binary entry point and completions
crates/minvmd/src/main.rs
CLI skeleton using clap derive; initializes tracing_subscriber; supports completions subcommand via clap_complete.
Integration test helper and smoke tests
crates/minvmd/src/bin/krun_smoke_child.rs, crates/minvmd/tests/krun_smoke.rs
Test helper binary that exercises bring-up surface and optionally boots; ignored macOS smoke test spawns helper, verifies bring-up markers, and gates full boot checks on env vars and MINVMD_E2E.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

Suggested reviewers

  • evanspearman

Poem

🐰 In a macOS nook I quietly tread,
Linking C and Rust where vms are led,
Entitlements granted, tests take flight,
A tiny daemon sleeps through the night,
Hop on, minvmd — bring guests to bed.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and specifically summarizes the main objective: scaffolding a new minvmd crate with libkrun FFI bindings and a smoke test, which aligns with the primary changes across multiple new files.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Comment @coderabbitai help to get the list of available commands and usage tips.

@norrietaylor
norrietaylor force-pushed the feature/minvmd-host-daemon branch from 4c941fb to d500918 Compare May 27, 2026 06:01

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
crates/minvmd/src/krun/ctx.rs (1)

93-106: ⚡ Quick win

Prefer Option combinators over reconstructive match blocks.

The envp_cstrs, initramfs_cstr, and cmdline_cstr conversions can be expressed more idiomatically with combinators, which keeps the flow tighter and aligns with repo Rust style.

Refactor sketch
-        let envp_cstrs: Option<Vec<CString>> = match envp {
-            Some(entries) => Some(cstrings_from_strs(entries, "envp")?),
-            None => None,
-        };
+        let envp_cstrs = envp
+            .map(|entries| cstrings_from_strs(entries, "envp"))
+            .transpose()?;
...
-        let initramfs_cstr = match initramfs {
-            Some(p) => Some(cstring_from_path(p.as_ref(), "initramfs")?),
-            None => None,
-        };
-        let cmdline_cstr = match cmdline {
-            Some(s) => Some(cstring_from_str(s, "cmdline")?),
-            None => None,
-        };
+        let initramfs_cstr = initramfs
+            .map(|p| cstring_from_path(p.as_ref(), "initramfs"))
+            .transpose()?;
+        let cmdline_cstr = cmdline
+            .map(|s| cstring_from_str(s, "cmdline"))
+            .transpose()?;

As per coding guidelines, "Use combinators on Option/Result (map, and_then, ok_or, unwrap_or_else, map_err) instead of match expressions that reconstruct the same enum".

Also applies to: 148-155

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/minvmd/src/krun/ctx.rs` around lines 93 - 106, The envp conversion
reconstructs Option with match; replace it with Option combinators: build
envp_cstrs by using envp.map(|entries| cstrings_from_strs(entries, "envp")?) (or
map_then/and_then to propagate Result), and then create (envp_ptrs, envp_ptr)
with envp_cstrs.as_ref().map(|cstrs| { let mut ptrs = cstrs.iter().map(|c|
c.as_ptr()).collect::<Vec<_>>(); ptrs.push(ptr::null()); (ptrs, ptrs.as_ptr() as
*const *const c_char) }).unwrap_or((Vec::new(), ptr::null())); apply the same
pattern to initramfs_cstr and cmdline_cstr conversions to remove reconstructive
match blocks while preserving the existing symbols envp_cstrs,
cstrings_from_strs, envp_ptrs, and envp_ptr.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@crates/minvmd/src/krun/ctx.rs`:
- Around line 93-106: The envp conversion reconstructs Option with match;
replace it with Option combinators: build envp_cstrs by using envp.map(|entries|
cstrings_from_strs(entries, "envp")?) (or map_then/and_then to propagate
Result), and then create (envp_ptrs, envp_ptr) with
envp_cstrs.as_ref().map(|cstrs| { let mut ptrs = cstrs.iter().map(|c|
c.as_ptr()).collect::<Vec<_>>(); ptrs.push(ptr::null()); (ptrs, ptrs.as_ptr() as
*const *const c_char) }).unwrap_or((Vec::new(), ptr::null())); apply the same
pattern to initramfs_cstr and cmdline_cstr conversions to remove reconstructive
match blocks while preserving the existing symbols envp_cstrs,
cstrings_from_strs, envp_ptrs, and envp_ptr.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 27eca8fd-0dc8-44c6-af37-08383bf7c5f8

📥 Commits

Reviewing files that changed from the base of the PR and between 002fb9e and 4c941fb.

⛔ Files ignored due to path filters (1)
  • Cargo.lock is excluded by !**/*.lock
📒 Files selected for processing (13)
  • Cargo.toml
  • crates/minvmd/Cargo.toml
  • crates/minvmd/build.rs
  • crates/minvmd/minvmd.entitlements
  • crates/minvmd/src/bin/krun_smoke_child.rs
  • crates/minvmd/src/error.rs
  • crates/minvmd/src/krun/ctx.rs
  • crates/minvmd/src/krun/mod.rs
  • crates/minvmd/src/krun/raw.rs
  • crates/minvmd/src/lib.rs
  • crates/minvmd/src/main.rs
  • crates/minvmd/tests/krun_smoke.rs
  • justfile

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
crates/minvmd/src/krun/mod.rs (1)

17-18: ⚡ Quick win

Narrow module visibility to avoid exposing internal layering details.

Line 17 and Line 18 currently publish internals (ctx, raw) as part of the crate API. Prefer keeping modules private (or pub(crate)) and exposing only curated items like Context via re-export.

♻️ Suggested visibility tightening
-pub mod ctx;
-pub mod raw;
+mod ctx;
+pub(crate) mod raw;
 
 pub use ctx::Context;

As per coding guidelines, "Make items private by default; widen to pub(crate) before pub; curate the public API via pub use at the crate root".

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/minvmd/src/krun/mod.rs` around lines 17 - 18, The crate currently
exposes internal modules `ctx` and `raw` publicly; change their visibility to
private (or `pub(crate)`) so internals aren't part of the public API, then
re-export only the curated public types (e.g., `Context`) from the crate root
using `pub use` (reference the `ctx` module's `Context` type and any other
public-facing symbols you intend to expose) so consumers see only the intended
API surface while implementation details in `ctx` and `raw` remain hidden.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@crates/minvmd/src/krun/mod.rs`:
- Around line 17-18: The crate currently exposes internal modules `ctx` and
`raw` publicly; change their visibility to private (or `pub(crate)`) so
internals aren't part of the public API, then re-export only the curated public
types (e.g., `Context`) from the crate root using `pub use` (reference the `ctx`
module's `Context` type and any other public-facing symbols you intend to
expose) so consumers see only the intended API surface while implementation
details in `ctx` and `raw` remain hidden.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 91e08578-ca0e-47f6-b41a-31e7371f5d24

📥 Commits

Reviewing files that changed from the base of the PR and between 4c941fb and d500918.

⛔ Files ignored due to path filters (1)
  • Cargo.lock is excluded by !**/*.lock
📒 Files selected for processing (13)
  • Cargo.toml
  • crates/minvmd/Cargo.toml
  • crates/minvmd/build.rs
  • crates/minvmd/minvmd.entitlements
  • crates/minvmd/src/bin/krun_smoke_child.rs
  • crates/minvmd/src/error.rs
  • crates/minvmd/src/krun/ctx.rs
  • crates/minvmd/src/krun/mod.rs
  • crates/minvmd/src/krun/raw.rs
  • crates/minvmd/src/lib.rs
  • crates/minvmd/src/main.rs
  • crates/minvmd/tests/krun_smoke.rs
  • justfile
✅ Files skipped from review due to trivial changes (2)
  • crates/minvmd/minvmd.entitlements
  • Cargo.toml
🚧 Files skipped from review as they are similar to previous changes (10)
  • crates/minvmd/Cargo.toml
  • justfile
  • crates/minvmd/build.rs
  • crates/minvmd/src/main.rs
  • crates/minvmd/src/lib.rs
  • crates/minvmd/src/error.rs
  • crates/minvmd/src/bin/krun_smoke_child.rs
  • crates/minvmd/src/krun/ctx.rs
  • crates/minvmd/src/krun/raw.rs
  • crates/minvmd/tests/krun_smoke.rs

@twitchyliquid64 twitchyliquid64 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did we try using the libkrun crate? would prefer that rather than rolling our own FFI if that works

https://crates.io/crates/libkrun corresponding to https://github.com/containers/libkrun/blob/main/src/libkrun/src/lib.rs

@norrietaylor

Copy link
Copy Markdown
Member Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented May 27, 2026

Copy link
Copy Markdown
✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Comment thread crates/minvmd/src/bin/krun_smoke_child.rs Outdated
Comment thread crates/minvmd/src/bin/krun_smoke_child.rs Outdated
Comment thread crates/minvmd/src/error.rs
@norrietaylor

Copy link
Copy Markdown
Member Author

@evanspearman thanks for the feedback. For now I am going to close this PR in favour of a krunkit exploration spike. I will incorporate your feedback for future PRs.

Adds the macOS-only `minvmd` crate that will, in follow-up changes, bring up a
Linux microVM via libkrun, supervise its lifecycle, and bridge a host UDS to
a guest vsock port. This change lands the bones only: crate scaffold, FFI
surface, safe wrappers, and a gated smoke test. Boot, lifecycle, and bridge
work follows.

- New `crates/minvmd` workspace member; `krun` module is
  `#[cfg(target_os = "macos")]`-gated and Linux ships only a runtime-bailing
  stub so the existing Linux-only CI stays green.
- `build.rs` emits `cargo:rustc-link-search` and `cargo:rustc-link-arg=-Wl,-rpath`
  on macOS, defaulting the libkrun prefix to `/opt/homebrew/lib` with a
  `LIBKRUN_PREFIX` env override.
- libkrun FFI declarations in `src/krun/raw.rs` cover the smoke-test surface
  (create_ctx, set_vm_config, set_exec, start_enter, free_ctx) and the
  forward-looking boot surface (set_root, set_kernel, add_vsock_port,
  set_console_output). A single block-level `// SAFETY:` enumerates the
  pointer / NUL-termination / ownership-transfer invariants the `extern "C"`
  block inherits from the C ABI; per-function doc comments describe each
  function's contract.
- Safe wrappers in `src/krun/ctx.rs` expose an RAII `Context` (non-Clone /
  non-Copy, Drop calls `krun_free_ctx`) that validates inputs in safe Rust
  (NUL-termination via `CString`) before any FFI call. Every unsafe call
  site carries its own `// SAFETY:` comment naming the invariants the
  wrapper enforces. `start_enter` consumes via `mem::forget` because libkrun
  documents the configuration as consumed unconditionally.
- Typed `VmError` matches the hand-rolled error style used by sandbox2:
  `Backend { op, code }` preserves errno magnitude; `NulInPath` / `NulInString`
  cover boundary validation; `StartEnterReturnedUnexpectedly { ret }`
  surfaces the libkrun-docs-violating path explicitly rather than synthesising
  a misleading "errno 0".
- `minvmd.entitlements` grants only `com.apple.security.hypervisor`;
  `justfile` `codesign-minvmd` recipe builds release and ad-hoc-signs.
- `tests/krun_smoke.rs` is `#[ignore]` and self-skips unless `MINVMD_E2E=1`.
  When opted in it spawns the auto-discovered `src/bin/krun_smoke_child`
  helper bin (separate process because `krun_start_enter` `exit()`s on
  success and never returns) which drives the safe wrappers end-to-end.
  Verified end-to-end against libkrun v1.18.1 on `aarch64-apple-darwin`.

Verification:
  cargo fmt && cargo clippy -p minvmd --all-targets -- -D warnings  → clean
  cargo test -p minvmd                                                → 9 passed
  MINVMD_E2E=1 cargo test -p minvmd --test krun_smoke -- --include-ignored
    on macOS with libkrun v1.18.1 installed                           → passed

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@norrietaylor norrietaylor reopened this Jun 1, 2026
@norrietaylor
norrietaylor force-pushed the feature/minvmd-host-daemon branch from 8767e45 to f868ce4 Compare June 1, 2026 20:42
@norrietaylor

Copy link
Copy Markdown
Member Author

@twitchyliquid64 on the libkrun crate: I looked at it, but the crates.io libkrun is the VMM itself — it compiles libkrun from source (pulls krun-hvf, kvm-bindings, etc.) and exposes the C ABI. It's not a thin bindings crate, so depending on it would mean building the whole hypervisor backend into our tree rather than linking the prebuilt libkrun.dylib that ships via Homebrew.

The canonical containers/krunkit tool links the prebuilt dylib via #[link(name = "krun")] extern "C" (src/context.rs) with build.rs emitting rustc-link-search={PREFIX}/lib — no crate dep, no dlopen. minvmd now mirrors that exactly. The committed bring-up spec (docs/specs/02-spec-minvmd-bringup/) records this as the chosen FFI strategy.

Evan's review points are all addressed in the latest push; threads replied inline.

@norrietaylor
norrietaylor requested a review from evanspearman June 1, 2026 20:43
@norrietaylor
norrietaylor force-pushed the feature/minvmd-host-daemon branch from f868ce4 to b585a67 Compare June 1, 2026 21:00

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
crates/minvmd/src/krun/raw.rs (1)

46-47: ⚡ Quick win

Stale reference: check_backend is no longer on VmError.

This SAFETY note still points at crate::error::VmError::check_backend, but the helper was moved into this module as a free function. Update the reference to avoid misleading future contributors.

📝 Proposed doc fix
-// - Return values are i32: zero or positive on success, negative errno on
-//   failure. [`crate::error::VmError::check_backend`] translates these.
+// - Return values are i32: zero or positive on success, negative errno on
+//   failure. [`check_backend`] translates these.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/minvmd/src/krun/raw.rs` around lines 46 - 47, The SAFETY doc comment
refers to the moved helper as crate::error::VmError::check_backend, which is
stale; update the reference to the new free function name in this module
(check_backend) or fully qualify it (crate::krun::raw::check_backend) in the
comment so readers can find the helper; adjust the SAFETY note text to mention
check_backend as a free function rather than a VmError method.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@crates/minvmd/src/krun/raw.rs`:
- Around line 46-47: The SAFETY doc comment refers to the moved helper as
crate::error::VmError::check_backend, which is stale; update the reference to
the new free function name in this module (check_backend) or fully qualify it
(crate::krun::raw::check_backend) in the comment so readers can find the helper;
adjust the SAFETY note text to mention check_backend as a free function rather
than a VmError method.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 464259da-a161-4455-b1f5-6d03b8e4e515

📥 Commits

Reviewing files that changed from the base of the PR and between 8767e45 and b585a67.

⛔ Files ignored due to path filters (1)
  • Cargo.lock is excluded by !**/*.lock
📒 Files selected for processing (13)
  • Cargo.toml
  • crates/minvmd/Cargo.toml
  • crates/minvmd/build.rs
  • crates/minvmd/minvmd.entitlements
  • crates/minvmd/src/bin/krun_smoke_child.rs
  • crates/minvmd/src/error.rs
  • crates/minvmd/src/krun/ctx.rs
  • crates/minvmd/src/krun/mod.rs
  • crates/minvmd/src/krun/raw.rs
  • crates/minvmd/src/lib.rs
  • crates/minvmd/src/main.rs
  • crates/minvmd/tests/krun_smoke.rs
  • justfile
✅ Files skipped from review due to trivial changes (2)
  • crates/minvmd/Cargo.toml
  • Cargo.toml
🚧 Files skipped from review as they are similar to previous changes (8)
  • justfile
  • crates/minvmd/src/main.rs
  • crates/minvmd/src/lib.rs
  • crates/minvmd/minvmd.entitlements
  • crates/minvmd/src/krun/mod.rs
  • crates/minvmd/src/krun/ctx.rs
  • crates/minvmd/build.rs
  • crates/minvmd/src/bin/krun_smoke_child.rs

@norrietaylor

Copy link
Copy Markdown
Member Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Jun 1, 2026

Copy link
Copy Markdown
✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

norrietaylor and others added 3 commits June 1, 2026 14:17
CodeRabbit nitpick: prefer "private by default; widen to pub(crate) before pub;
curate the public API via pub use at the crate root" per the workspace coding
guideline.

- src/krun/mod.rs: ctx and raw are now `mod`, not `pub mod`. Within the same
  module they remain accessible to siblings, so ctx.rs's `use crate::krun::raw`
  still resolves.
- Re-export the two libkrun kernel-format constants the test helper actually
  needs (KRUN_KERNEL_FORMAT_IMAGE_BZ2, KRUN_KERNEL_FORMAT_IMAGE_GZ) at the
  krun root.
- Update krun_smoke_child.rs to import via the curated path
  `minvmd::krun::{Context, KRUN_KERNEL_FORMAT_*}`.
- Drop the three unused constants (RAW, ELF, PE_GZ) that were only public
  surface; add a comment naming them as added-on-demand.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
`VmError::check_backend` translates libkrun return codes and has callers only
inside the `krun` module, which is itself `#[cfg(target_os = "macos")]`-gated.
On Linux the krun module compiles out, leaving check_backend with no callers
in the lib target — clippy's `-D dead-code` then fails the Linux CI job.

Gate `impl VmError { check_backend }` on `target_os = "macos"`, and gate the
two unit tests that exercise it. The Display + variant tests stay portable.

Verified:
  cargo clippy -p minvmd --all-targets -- -D warnings                  → clean
  cargo clippy --target aarch64-unknown-linux-musl -p minvmd \
    --all-targets -- -D warnings                                       → clean
  cargo test -p minvmd                                                 → 9 passed

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- VmError::Backend now carries io::Error (built via
  io::Error::from_raw_os_error(checked_neg)) instead of a bare i32 code,
  preserving the errno and wiring up Error::source().
- Move check_backend off VmError into the krun FFI module as a free
  function; drop the no-op #[inline] and the scattered #[cfg(macos)]
  (the helper now lives entirely in the macOS-only krun module).
- krun_smoke_child propagates errors with ? via Result-returning main
  and run_macos instead of expect().
- Express the envp/initramfs/cmdline Option conversions with
  map().transpose() per the repo's combinator standard.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@norrietaylor
norrietaylor force-pushed the feature/minvmd-host-daemon branch from b585a67 to c0aed34 Compare June 1, 2026 21:17
@norrietaylor
norrietaylor merged commit 48eda35 into main Jun 1, 2026
9 checks passed
@norrietaylor
norrietaylor deleted the feature/minvmd-host-daemon branch June 1, 2026 23:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants