microvm-rootfs: add ip and nsenter to the guest - #298
Conversation
|
Warning Review limit reached
More reviews will be available in 57 minutes and 31 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe Changesmicrovm-rootfs runtime tools
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
e11f7fb to
b551bee
Compare
Add iproute2 (ip) and util-linux's nsenter to the microVM guest rootfs runtime closure for network/namespace plumbing. util-linux is pulled as `subsetOf util-linux ["nsenter"]` so only the nsenter binary (which links just glibc) lands in the image, not the whole ~18 MB toolset. A granular `nsenter` output is added to the util-linux package to make that subset possible. iproute2 installs `ip` (and ss/tc/bridge) to /usr/sbin via SBINDIR, so the old wholesale `rm -rf $STAGE/usr/sbin` (which only dropped e2fsprogs's build-only sbin tools) would also delete `ip`. Replace it with a name-based removal of the full e2fsprogs sbin set. Because util-linux is now subset to nsenter-only, its blkid/findfs/fsck/uuidd no longer reach the image, so the e2fsprogs copies of those names must be removed too. Verified with a clean-room build (minimal package): image carries usr/sbin/ip and usr/bin/nsenter; every other util-linux tool and all e2fsprogs files are gone; no toolchain leaks into the closure. Image is 169 MB vs a 163 MB base+git baseline (+6 MB), down from 189 MB before the subset. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
b551bee to
ae778f7
Compare
…build
Adding nsenter to util-linux bumps its spec_hash, which is in 351/375
package closures, so this PR triggers a near-full rebuild that surfaces
opencode's pre-existing frozen-lockfile breakage: our shipped bun resolves
opencode's committed lockfile differently and rejects it under
--frozen-lockfile ("lockfile had changes, but lockfile is frozen"). The
install already network-fetches deps, so --frozen-lockfile was only pinning
versions; dropping it lets bun float the lockfile and unblocks the rebuild.
Bundled here (rather than a separate PR) so it re-kicks this build. Proper
fix = a vendored, bun-version-matched bun.lock (filed as a pkgs issue).
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add
iproute2(ip) and util-linux'snsenterto the microVM guest rootfs runtime closure for network/namespace plumbing.Change
microvm-rootfs/build.ncl: addiproute2(full) andsubsetOf util-linux ["nsenter"]toruntime_deps.util-linux/build.ncl: add a granularnsenteroutput so consumers can pull just that binary.microvm-rootfs/build.sh: replace the wholesalerm -rf $STAGE/usr/sbinwith a name-based removal of the full e2fsprogs sbin set.Why subsetOf util-linux
nsenterlinks only glibc — it needs none of util-linux's shared libs or other 113 tools. Depending on the whole package added ~18 MB of unwanted binaries (mount,fdisk,agetty,dmesg, …).subsetOf util-linux ["nsenter"]pulls only the one binary.Why the build.sh change
iproute2 installs
ip(andss/tc/bridge) to/usr/sbinviaSBINDIR. The old wholesalerm -rf $STAGE/usr/sbinexisted only to drop e2fsprogs's build-only sbin tools — it would now also deleteip. The replacement removes the full e2fsprogs sbin set by name. (Earlier revisions keptblkid/findfs/fsck/uuiddbecause util-linux shipped them; now that util-linux is subset to nsenter-only, those e2fsprogs copies must go too.)Verification
Clean-room build (
minimal package), image inspected withdebugfs:usr/sbin/ip,usr/bin/nsenter— PRESENTmount,dmesg,lsblk,unshare,fdisk,agetty) — gonemke2fs,blkid,fsck,uuidd,findfs,e4crypt, …) — goneip,ss,tc,bridge, …)min check --packages microvm-rootfs util-linux— all checks passSize
gitpackage growth)🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
nsenterbinary package so it can be used on its own.Bug Fixes