Skip to content

docs(spec-minvmd-networking-gvproxy): minvmd networking — gvproxy userspace net for VM sessions - #407

Merged
norrietaylor merged 1 commit into
mainfrom
spec/minvmd-networking-gvproxy-4b2f2347f17424ba
Jun 13, 2026
Merged

docs(spec-minvmd-networking-gvproxy): minvmd networking — gvproxy userspace net for VM sessions#407
norrietaylor merged 1 commit into
mainfrom
spec/minvmd-networking-gvproxy-4b2f2347f17424ba

Conversation

@gominimal-aw-bot

@gominimal-aw-bot gominimal-aw-bot Bot commented Jun 13, 2026

Copy link
Copy Markdown
Contributor

Spec for tracking issue #404.

What this spec covers

Adds gvproxy (containers/gvisor-tap-vsock) as the default outbound network transport for minvmd-managed VMs on both macOS (Hypervisor.framework) and Linux (KVM), with TSI remaining selectable as a fallback via MINVMD_NETMODE=tsi.

The TSI transport in vm.rs caps at ~62 concurrent connections — incompatible with the 200-concurrent cache-fetch target (informed by #204). gvproxy replaces TSI via libkrun's krun_set_passt_fd API (virtio-net backed by an external passt-protocol process), eliminating the cap.

Demoable Units

Unit Summary Files
Unit 1 gvproxy child spawn, lifecycle, reap src/net.rs (new), cmd/run.rs, state.rs
Unit 2 krun_set_passt_fd FFI + VmConfig virtio-net wiring krun/raw.rs, krun/ctx.rs, vm.rs, cmd/vmm_child.rs
Unit 3 Network allowlist enforcement hook (no-op stub + wired call site) src/net.rs, cmd/run.rs

Key design decisions in the spec

  • socketpair handoff: supervisor creates a socketpair(AF_UNIX, SOCK_STREAM), passes one end to gvproxy (--fd <n>) and the other FD number via MINVMD_NET_FD to the VMM child — avoids listen-bind races
  • Orphan prevention: gvproxy is a child of the supervisor; every exit path kills+waits gvproxy before returning
  • TSI coexistence: add_vsock_port2 (the minimald control socket bridge) is orthogonal to the outbound networking mode and unchanged in all modes
  • Platform parity: krun_set_passt_fd is platform-agnostic; VmConfig.apply() is un-gated from macOS

Open questions (flagged for ADRs)

  1. Deny-vs-allow default for network allowlist when enforcement arrives
  2. Warn-vs-silent for declared-but-unenforced capabilities
  3. Per-task vs per-VM enforcement granularity
  4. Linux namespace sandbox path sharing gvproxy code

Next step

Merging this spec PR advances tracking issue #404 from the spec phase into triage — a write-access author comments /triage on #404 to start the architecture phase.

Generated by sdd-spec for issue #404 · sonnet46 7M ·

Closes #406

Summary by CodeRabbit

  • Documentation
    • Added specification for upcoming networking improvements that will establish gvproxy as the default transport for VM outbound connections, with automatic fallback support to ensure compatibility across different deployment scenarios.

…ce networking

Spec for tracking issue #404. Adds gvproxy (containers/gvisor-tap-vsock)
as the default outbound network transport for minvmd-managed VMs, with
TSI remaining selectable via MINVMD_NETMODE=tsi.

Three demoable units:
- Unit 1: gvproxy child spawn/lifecycle/reap (net.rs, run.rs, state.rs)
- Unit 2: krun_set_passt_fd FFI + VmConfig virtio-net wiring
- Unit 3: network allowlist enforcement hook (no-op stub, wired call site)

Resolves the ~62-concurrent-connection TSI cap that blocks cache-fetch
parallelism (informed by #204).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@coderabbitai

coderabbitai Bot commented Jun 13, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 952bb076-814b-42dc-9394-e9dafe4cc75b

📥 Commits

Reviewing files that changed from the base of the PR and between 1f65e57 and 06d0072.

📒 Files selected for processing (1)
  • docs/specs/03-spec-minvmd-networking-gvproxy/03-spec-minvmd-networking-gvproxy.md

📝 Walkthrough

Walkthrough

This PR adds a comprehensive architectural specification for integrating gvproxy as the default outbound networking transport in minvmd-managed VMs. The spec defines three implementation units: supervisor-side gvproxy spawn/reap with state persistence, VMM-side libkrun FFI wiring to passt FD, and a network policy enforcement hook (initially no-op). It also documents design rationale, repository standards, and open questions.

Changes

minvmd gvproxy Networking Specification

Layer / File(s) Summary
Specification Overview and Goals
docs/specs/03-spec-minvmd-networking-gvproxy/03-spec-minvmd-networking-gvproxy.md (lines 1–101)
Front-matter, problem context (VM lacks outbound connectivity under TSI, connection limits incompatible with parallel cache fetches), operational background, and explicit goals covering concurrency, lifecycle/orphan prevention, and platform parity.
Supervisor-side gvproxy Lifecycle Management
docs/specs/03-spec-minvmd-networking-gvproxy/03-spec-minvmd-networking-gvproxy.md (lines 102–190)
Unit 1: Unix socketpair creation per VM, gvproxy child spawning, FD handoff via MINVMD_NET_FD env var, supervisor-owned cleanup on exit, new NetworkMode type, and gvproxy_pid state serialization. Defines proof artifacts and test expectations for mode selection and fallback behavior.
VMM-side libkrun FFI Integration
docs/specs/03-spec-minvmd-networking-gvproxy/03-spec-minvmd-networking-gvproxy.md (lines 192–271)
Unit 2: libkrun FFI declaration for krun_set_passt_fd with safe wrapper, VmConfig.net_mode field and updated apply() signature, removal of macOS-only gating, and vmm_child FD reading and integration. Includes unit and macOS e2e proof artifacts.
Network Policy Enforcement Hook
docs/specs/03-spec-minvmd-networking-gvproxy/03-spec-minvmd-networking-gvproxy.md (lines 274–345)
Unit 3: NetworkPolicy enum and PolicyError type, check_network_policy as currently no-op (open by default), early boot call site before networking startup. Test expectations for both Open and future Allowlist variants.
Design Rationale, Repository Standards, and Technical Verification
docs/specs/03-spec-minvmd-networking-gvproxy/03-spec-minvmd-networking-gvproxy.md (lines 348–500)
Non-goals (DNS, port-forwarding, packaging, connection limits as separate work), design considerations (socketpair rationale, TSI coexistence, platform parity, orphan prevention), repository standards (FFI safety, validation, test coverage, commit format), open questions on allowlist semantics and enforcement granularity, and technical verification including FD lifetime, race avoidance, leakage prevention, and test matrix.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Possibly related issues

  • #404: Tracking issue for minvmd gvproxy networking feature; this spec directly implements the architectural design and implementation units described in that issue.
  • #406: Mentions the same gvproxy-based minvmd networking spec; directly related to this PR's scope.
  • inbox#225: Original routing source; documents the same gvproxy-by-default design with per-VM lifecycle and libkrun passthrough integration.
  • #397: Linux-host minvmd feature that marks networking as out-of-scope; this spec provides that missing networking subsystem for Linux hosts alongside macOS.

Suggested labels

needs-human

Suggested reviewers

  • norrietaylor

Poem

🐰 A spec for gvproxy springs to life,
Per-VM sockets, free from strife,
FDs passed through libkrun's door,
Network policy—and so much more!
With orphan guards and fallback grace,
minvmd finds its network place. 🌐

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the main change: a new spec documenting gvproxy integration for minvmd networking, which is the primary and only content addition in this PR.
Linked Issues check ✅ Passed The spec document comprehensively addresses all coding-related objectives from issue #404, including gvproxy spawning/lifecycle, krun FFI integration, and network allowlist enforcement hook wiring.
Out of Scope Changes check ✅ Passed The PR contains only a new documentation spec file with no code changes, fully aligned with issue #404 objectives; no out-of-scope alterations are present.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Comment @coderabbitai help to get the list of available commands and usage tips.

@gominimal-aw-bot

Copy link
Copy Markdown
Contributor Author

sdd-validate · Spec boundary

Boundary resolved: Spec — PR adds docs/specs/03-spec-minvmd-networking-gvproxy/03-spec-minvmd-networking-gvproxy.md for tracking issue #404.
Gate set applied: Spec gates (acceptance criteria testable, no implementation leakage, assumptions explicit, proof artifacts present and behavioral).


Gate 1 — Acceptance criteria testable ✅ Pass

All proof artifacts are stated as observable pass/fail conditions:

  • Unit 1: cargo test -p minvmd net:: (mode-selection logic) and the TSI-fallback E2E test.
  • Unit 2: cargo test -p minvmd vm:: / krun:: (VmConfig/FFI surface) and the gvproxy E2E test.
  • Unit 3: cargo test -p minvmd net::check_network_policy (no-op hook behavior).

No aspirational or untestable criteria found.


Gate 2 — No implementation leakage ⚠️ Warning

Several requirements prescribe specific Rust type names, function signatures, struct fields, and literal code blocks where behavioral statements would be sufficient. plan:provided is not set on #404, so the translation-mode relaxation does not apply.

Evidence:

Location Leakage
03-spec-minvmd-networking-gvproxy.md:132–141 (R1.1) Prescribes enum NetworkMode { GvProxy, Tsi }, fn resolve_net_mode() -> NetworkMode, and fn gvproxy_bin() -> std::path::PathBuf by name and signature.
03-spec-minvmd-networking-gvproxy.md:142–149 (R1.2) Prescribes fn spawn_gvproxy(net_fd: RawFd) -> Result<Child> verbatim.
03-spec-minvmd-networking-gvproxy.md:219–227 (R2.1) Includes the literal Rust FFI declaration pub fn krun_set_passt_fd(ctx_id: u32, fd: i32) -> i32; and prescribes the // SAFETY: comment structure.
03-spec-minvmd-networking-gvproxy.md:228–235 (R2.2) Includes the verbatim safe-wrapper signature pub fn set_passt_fd(&mut self, fd: std::os::unix::io::RawFd) -> Result<(), VmError>.
03-spec-minvmd-networking-gvproxy.md:236–246 (R2.3) Prescribes VmConfig.net_mode: NetworkMode field name, the VmConfig::new parameter addition, and the changed apply signature fn apply(&self, ctx: &mut Context, net_fd: Option<RawFd>).
03-spec-minvmd-networking-gvproxy.md:294–321 (R3.1) Provides the exact Rust source for NetworkPolicy (including variant names and Vec<String> inner type) and the full body of check_network_policy.

The behavioral intent behind each requirement is sound; the prescription of implementation names is what crosses the line. An implementer could satisfy every stated behavior with a different module layout, different type names, or a different safe-wrapper signature. This is a Warning, not a Blocker — the spec is implementable as written and the leakage is consistent with an intent-driven design rather than accidental over-specification.


Gate 3 — Assumptions explicit ✅ Pass

Key assumptions are surfaced:

  • libkrun v1.18+ required for krun_set_passt_fd — flagged explicitly in Open Question 5 (03-spec-minvmd-networking-gvproxy.md:450–453).
  • gvproxy exits on EOF from its socketpair FD — stated in Design Considerations (03-spec-minvmd-networking-gvproxy.md:406–409).
  • FD_CLOEXEC inheritance semantics across fork+exec — stated at 03-spec-minvmd-networking-gvproxy.md:381–385.
  • gvproxy's --fd <n> interface and immediate readiness — stated at 03-spec-minvmd-networking-gvproxy.md:468–471.

Minor: the Unit 1 proof artifact references serial_test for env-var isolation (03-spec-minvmd-networking-gvproxy.md:183) without noting whether the crate is already a dev-dependency. Not a finding — a standard Rust test-isolation crate is a reasonable assumption.


Gate 4 — Proof artifacts present and behavioral ✅ Pass

Each demoable unit carries at least one proof artifact. None would pass against an empty PR:

  • Unit 1 (2 artifacts): targets net.rs (new file) and an e2e integration that would fail without the fallback wiring.
  • Unit 2 (2 artifacts): targets new VmConfig.net_mode field and set_passt_fd — both absent today.
  • Unit 3 (1 artifact): targets net::check_network_policy, which does not yet exist.

Summary

Gate Result
1 · Acceptance criteria testable ✅ Pass
2 · No implementation leakage ⚠️ Warning
3 · Assumptions explicit ✅ Pass
4 · Proof artifacts present and behavioral ✅ Pass

No Blockers. The spec boundary passes clean. The single Warning (Gate 2) is advisory — the spec is detailed enough that the implementation leakage may be intentional to give the executing agent precise direction, but it narrows the implementer's latitude beyond what the behavioral goals require.

Generated by sdd-validate for issue #407 · sonnet46 1.6M ·

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

spec: minvmd networking — gvproxy userspace net for VM sessions

1 participant