| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: flake-pilot-firecracker-guestvm-tools | Distribution: SUSE Linux 16 |
| Version: 3.2.10 | Vendor: SUSE LLC <https://www.suse.com/> |
| Release: 160100.1.1 | Build date: Wed Oct 21 15:30:03 2026 |
| Group: System/Management | Build host: reproducible |
| Size: 3361570 | Source RPM: flake-pilot-3.2.10-160100.1.1.src.rpm |
| Packager: https://www.suse.com/ | |
| Url: https://github.com/OSInside/flake-pilot | |
| Summary: FireCracker guest VM tools | |
Guest VM tools to help with firecracker workloads
MIT
* Wed Oct 21 2026 marcus.schaefer@gmail.com
- Bump version: 3.2.9 → 3.2.10
* Wed Oct 21 2026 marcus.schaefer@gmail.com
- Make sure bubblewrap holds no host mounts
The current version of the bubblewrap-pilot manages the
root of the bwrap in overlay mounts below /var/tmp/bwrap_UID
This leaks the contents of the host root directory to a
location which allows others to read usually root private
data which is a security issue. The proposed fix operates
in two conditions:
1. if the rootfs and layers have no mount points below them,
the pilot sets everything up itself in its own namespace.
2. Mount points below, e.g. /: the pilot hands over to a new
helper command, sandbox-run, via sudo. The helper builds
the mounts as root in a private mount namespace, then drops
to your user for good, sets no_new_privs, and starts bwrap
there. Nothing is mounted on the host on either path.
* Wed Oct 21 2026 marcus.schaefer@gmail.com
- Bump version: 3.2.8 → 3.2.9
* Wed Oct 21 2026 marcus.schaefer@gmail.com
- Differentiate stderr and stdout channels
firecracker-pilot now keeps the command's stdout and stderr on
separate channels whenever its own stdout and stderr aren't both
terminals, for example app > out.txt or app 2>err.log. sci tries
to connect to that ports before it starts the command.
This Fixes #177
* Wed Oct 21 2026 marcus.schaefer@gmail.com
- Fix EOF wait in firecracker-pilot
The pilot reads just the exit status line and no longer waits
for the end of the stream.
* Wed Oct 21 2026 marcus.schaefer@gmail.com
- Fix handling of resume and force_vsock options
The runtime options resume and force_vsock were used at
registration time to create the VM cmdline boot_args
sci_resume and sci_force_vsock. Changing the runtime
options only without the boot_args caused weird side
effects in the behavior of the pilot. This commit
makes sure only the runtime options are taken into
account and the firecracker-pilot constructs the needed
boot_args from the runtime section.
* Wed Oct 21 2026 marcus.schaefer@gmail.com
- Fix race condition
The race came from stream_io on the host ending the whole session
when stdin hit EOF, even though the command in the VM was still running.
Now an early end of input just tells the command its input is over.
The pilot keeps relaying output until the guest closes the stream,
and the exit code arrives right after that. The 1s timeout now only
matters if the connection breaks.
* Wed Oct 21 2026 marcus.schaefer@gmail.com
- Fix firecracker exit code handling
So far the exit code of the calling program inside the VM was
lost in vsock mode. This commit makes sure the exit code is transfered
via a new vsock port to the caller. This Fixes #176
* Mon Oct 19 2026 marcus.schaefer@gmail.com
- Fix bwrap lookup in bubblewrwap-pilot
bubblewrap-pilot checks that bwrap exists by searching PATH,
but it then runs bwrap from the fixed path /usr/bin/bwrap.
As such the search doesn't make any sense. This commit
Fixes #174
* Mon Oct 19 2026 marcus.schaefer@gmail.com
- Use the which crate
Use the which crate to lookup a binary in PATH
* Mon Oct 19 2026 marcus.schaefer@gmail.com
- Bump version: 3.2.7 → 3.2.8
* Mon Oct 19 2026 marcus.schaefer@gmail.com
- No color output by default
flake-pilot no longer prints color by default. This change
affects the messages as well as any progress information.
Applied the change on the documentation side as well.
This Fixes bsc#1285040
* Mon Oct 19 2026 marcus.schaefer@gmail.com
- Add optional egress policy to firecracker network
flake-ctl firecracker network init now supports the new
option --egress-deny. The implementation adds a new chain
FLAKE_PILOT_EGRESS. VM traffic to the outside world now jumps
from FLAKE_PILOT_FORWARD into the new chain. The new chain
holds the egress drop rules first. For two prominent
restrictions the --egress-deny option was simplified:
* --egress-deny link-local
* --egress-deny private
link-local blocks 169.254.0.0/16, which includes the cloud
metadata service at 169.254.169.254. Without it, a VM reaches
that service as the host and can read the instance's credentials.
private blocks the RFC 1918 ranges: 10/8, 172.16/12 and 192.168/16.
The policy is IPv4 only like the rest of the setup
* Sat Oct 17 2026 marcus.schaefer@gmail.com
- Bump version: 3.2.6 → 3.2.7
* Sat Oct 17 2026 marcus.schaefer@gmail.com
- Update user guide
Fix gcloud example
* Sat Oct 17 2026 marcus.schaefer@gmail.com
- Bump version: 3.2.5 → 3.2.6
* Sat Oct 17 2026 marcus.schaefer@gmail.com
- Update user guide
Refactor the section how to build your own app images
* Fri Oct 16 2026 marcus.schaefer@gmail.com
- Update user guide
reference Leap16 variant of claude image in the examples
* Fri Oct 16 2026 marcus.schaefer@gmail.com
- Fix package name in claude image
* Fri Oct 16 2026 marcus.schaefer@gmail.com
- Add support for an addon store to podman-pilot
There is now a new option --use-addon-store to flake-ctl podman pull
and load. With it set, the image goes into /usr/lib/podman/storage
and nothing is written to /var/lib/podman/storage. The flag
is root only because /usr/lib/podman/storage belongs to root
and consequently this option cannot be used for rootless flakes.
It's important to know that pruning/deleting of data in the
additionalstore is not possible with podman because podman treats
this as read-only. The data there can only be deleted by hand.
* Fri Oct 16 2026 marcus.schaefer@gmail.com
- Bump version: 3.2.4 → 3.2.5
* Fri Oct 16 2026 marcus.schaefer@gmail.com
- Update claude image
Add backports repo which provides poetry
* Thu Oct 15 2026 marcus.schaefer@gmail.com
- Allow to configure tmpfs size in bwrap sandbox
The size of the sandbox tmpfs can now be limited. Added new
sandbox_tmpfs_size setting under generic: in /etc/flakes.yml.
Each flake can use %tmpfs_size:SIZE pilot option, given at
call time or registered with the flake. It accepts a number
with a k/m/g/t suffix, or a percentage of the host's RAM.
bubblewrap-pilot passes it to the helper as
sandbox-mount --size SIZE.
* Thu Oct 15 2026 marcus.schaefer@gmail.com
- Detect and report squatted private meta data dirs
squatted private metadata directory is now detected and reported
with the name of the user who created it, both by the pilots
when they refuse to run and by flake-ctl init.
* Thu Oct 15 2026 marcus.schaefer@gmail.com
- Add poetry to firecracker claude image
poetry is handy for many python projects and allows the AI
system to directly use it instead of creating its own venv
* Thu Oct 15 2026 marcus.schaefer@gmail.com
- Bump version: 3.2.3 → 3.2.4
* Wed Oct 14 2026 marcus.schaefer@gmail.com
- Allow install as documented
Several actions were only done in the spec file and
missed if a user does not install the rpm packages.
make build && make install now installs everything
the spec used to install by hand, and the spec's
%build/%install are down to one make call each.
* Wed Oct 14 2026 marcus.schaefer@gmail.com
- Refactor bubblewrap overlay and write area
The sandbox's writable layer now lives in a per-instance
tmpfs instead of on disk. It's kept across runs until you
call the app with %discard or the host reboots. Instance
directories are 0700.
* Wed Oct 14 2026 marcus.schaefer@gmail.com
- Do not unconditionally pull newer or prune
podman-pilot no longer asks the registry for a newer image
or prunes images on every launch. Both are now opt-in pilot
options, %pull_newer and %prune_images. They can be set in
a registration's pilot_options or given at call time,
like the existing options.
* Wed Oct 14 2026 marcus.schaefer@gmail.com
- Bump version: 3.2.2 → 3.2.3
* Wed Oct 14 2026 marcus.schaefer@gmail.com
- Fix indentation
* Wed Oct 14 2026 marcus.schaefer@gmail.com
- Do not call systemfiles script as root
The systemfiles script now runs in a bash process owned by
the calling user instead of through sudo sh. This means
only the actual rsync process to provision host dependencies
needs privileges.
* Wed Oct 14 2026 michele.pagot@suse.com
- Document FLAKE_LOG_STYLE environment variable in user guide
Add documentation for the FLAKE_LOG_STYLE environment variable in the
troubleshooting section of the user guide.
This explains how users can control log output styling across pilots,
documenting the accepted values (always, never, auto) and the default
behavior.
* Wed Oct 14 2026 marcus.schaefer@gmail.com
- Refactor running privileged applications
Every privileged action now goes through one root-owned
program, /usr/libexec/flake-pilot/flake-pilot-helper, which
is the only thing flake-pilot calls through sudo. It has
a fixed set of commands, re-checks every argument, and
checks the caller's authority against root-owned data.
* Wed Oct 14 2026 marcus.schaefer@gmail.com
- Bump version: 3.2.1 → 3.2.2
* Wed Oct 14 2026 marcus.schaefer@gmail.com
- Volume export/release guest address from state
flake-ctl firecracker volume export now takes the guest address
from the allocation file, /var/lib/firecracker/network-state.yaml,
which belongs to root. It no longer reads the ip= option from
the flake config. That mattered because in user mode the config
belongs to the user, who could have put another user's VM address
there and so had a host path exported to that VM.
volume release --app uses the same lookup.
* Wed Oct 14 2026 marcus.schaefer@gmail.com
- Close DHCP port on the host for VMs
The DHCP port on the host is now closed to VMs by default,
the same way DNS is. It only opens if the host setup was
created with the new flake-ctl firecracker network init --host-dhcp
option.
* Wed Oct 14 2026 marcus.schaefer@gmail.com
- Close DNS port on the host for VMs
The DNS port on the host is now closed to VMs by default.
It only opens if the host setup was created with the new
flake-ctl firecracker network init --host-resolver option.
* Wed Oct 14 2026 marcus.schaefer@gmail.com
- Add locking to the firecracker network state file
Concurrent firecracker network add/remove calls can lose
updates. Calls that change the network state now take an
exclusive flock and hold it for the whole command, so two
concurrent calls can no longer lose each other's changes
or hand out the same address twice.
* Wed Oct 14 2026 marcus.schaefer@gmail.com
- Load kvm module in sci if present
So support nested virtualization if firecracker pass virtualization
through, sci loads the required kvm module and sets up the
permissions for /dev/kvm accordingly
* Wed Oct 14 2026 marcus.schaefer@gmail.com
- sci accepted commands from any vsock peer
sci now only accepts connections from the host (CID 2).
It checks the peer before reading any data
* Wed Oct 14 2026 marcus.schaefer@gmail.com
- Add kiwi to claude firecracker image
Allows to build images via kiwi from AI spec
* Tue Oct 13 2026 marcus.schaefer@gmail.com
- Validate given names and paths in flake-ctl
Due to the security audit names and path given to
flake-ctl must follow a pattern and needs to be validated
such that no unexpected paths are used outside the registry
and maybe passed along to remove or mv calls
* Tue Oct 13 2026 marcus.schaefer@gmail.com
- Update documentation
Clearly state isolation limits
* Tue Oct 13 2026 marcus.schaefer@gmail.com
- Bump version: 3.2.0 → 3.2.1
* Tue Oct 13 2026 marcus.schaefer@gmail.com
- Delete OSS scanner metadata
Anthropic declined the request to include this project
to the OSS scanner
* Tue Oct 13 2026 marcus.schaefer@gmail.com
- Refactor firecracker networking per security scan
Firecracker networking now uses its own firewall chains,
isolates the VMs from each other and from the host, can
be fully undone with a new network cleanup command, and
gives each user their own TAP devices and addresses.
* Tue Oct 13 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.79 → 3.2.0
* Tue Oct 13 2026 marcus.schaefer@gmail.com
- Fix bubblewrap documentation and code comments
The bubblewrap pilot intentionally keeps the written
data from the overlayfs on the system to be able to
re-use this information on the next call of the app.
If there is a need for keeping the sandbox data isolated
and not exposed or kept on the host we will come up
with the respective code on demand
* Tue Oct 13 2026 marcus.schaefer@gmail.com
- Drop sci injection
When pulling a firecracker image, the code checked if the
sci binary was part of the rootfs and injected it if it
wasn't. This code is now dropped because mostly unused
and it also breaks the checksum validation of the pulled
image. It is also considered security critical to modify
the rootfs after pull and it drops the eventually needed
root permissions from the pull command.
* Tue Oct 13 2026 marcus.schaefer@gmail.com
- Drop include feature from flake-pilot
The include feature is gone from flake-pilot: code, CLI options,
templates, completion and docs. Files that still contain an include:
section keep working. The section is simply ignored in this case.
* Tue Oct 13 2026 marcus.schaefer@gmail.com
- Update troubleshooting section
Due to the changes on the NFS export options the information
in the chapter was no longer fully correct. This commit
fixes it
* Mon Oct 12 2026 marcus.schaefer@gmail.com
- Create the metadata directory in init
Don't let the pilots create it and set them free
from root privileges in this context
* Mon Oct 12 2026 marcus.schaefer@gmail.com
- Get rid of some sudo restrictions
In firecracker-pilot create the socket as calling user
* Mon Oct 12 2026 marcus.schaefer@gmail.com
- Add privileges documentation chapter
Added a user guide chapter on the security consequence
and a reference sudoers file.
* Mon Oct 12 2026 marcus.schaefer@gmail.com
- Use absolute paths for every sudo target
Every program flake-pilot runs through sudo now gets
an absolute path, so sudo no longer looks names up
via secure_path or the caller's PATH. It also means
sudoers rules, which only match absolute paths, can
name these programs exactly.
* Mon Oct 12 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.78 → 3.1.79
* Mon Oct 12 2026 marcus.schaefer@gmail.com
- Use sysctl to enable IP forwarding
enable_ip_forward() now runs sudo sysctl -w net.ipv4.ip_forward=1
instead of starting a root shell with echo
* Mon Oct 12 2026 marcus.schaefer@gmail.com
- Export NFS volumes strictly to one app
NFS volume exports are now limited to one guest's IP, squash
every guest user (root included) to the path's owner, drop
insecure, and accept only user-owned paths.
* Mon Oct 12 2026 marcus.schaefer@gmail.com
- Update firecracker appstore images
drop insecure settings with regards to sudo and ssh
* Mon Oct 12 2026 marcus.schaefer@gmail.com
- Drop runas registration option
The runas setting in the registration configuration was no longer
meaningful anywhere, so it gets removed from the pilots, flake-ctl,
the templates, the docs and the bash completion. Whether a flake
runs system-wide or per user now comes only from where its
registration lives.
* Mon Oct 12 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.77 → 3.1.78
* Mon Oct 12 2026 marcus.schaefer@gmail.com
- Sign up for Anthropics OSS scanner
* Fri Oct 09 2026 marcus.schaefer@gmail.com
- Leap16 requires NetworkManager
* Fri Oct 09 2026 marcus.schaefer@gmail.com
- Move claude firecracker image to Leap16
* Thu Oct 08 2026 marcus.schaefer@gmail.com
- Cleanup unused code
Delete unused variables, trace methods or imports from
the code base.
* Wed Oct 07 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.76 → 3.1.77
* Wed Oct 07 2026 marcus.schaefer@gmail.com
- Add support for direct OCI export
With the podman export command, only the export from a
container present in a local podman registry was supported.
This commit adds support for direct unpack of an OCI compliant
tarball into the specified target directory.
* Tue Oct 06 2026 marcus.schaefer@gmail.com
- Fix spec file
The {_sbindir} macro does not resolve to /usr/sbin but /usr/bin
on Fedora. We want sci to be installed to /usr/sbin as such
revert this macro use in the spec file for now
* Tue Oct 06 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.75 → 3.1.76
* Tue Oct 06 2026 marcus.schaefer@gmail.com
- Switch hardcoded paths in spec to macros
* Mon Oct 05 2026 marcus.schaefer@gmail.com
- Add /etc/flakes/APP.d drop-in directory
Users can now put drop-in files in /etc/flakes/APP.d/ to adjust
system-wide flakes. These files are read last, so their settings
win. The read order for system wide flakes therefore changes to:
1. /usr/share/flakes/APP.yaml
2. /usr/share/flakes/APP.d/* in alphabetical order
3. /etc/flakes/APP.d/* in alphabetical order
At registration time an empty drop-in is created in etc/flakes
and removed on registration remove. A force registration removes
first and therefore comes back with an empty etc/flakes.
User registrations under ~/.config/flakes never read /etc/flakes.
This Fixes #141
* Sun Oct 04 2026 marcus.schaefer@gmail.com
- Add license statement for the logo
Use CC-BY-ND for the name and logo of the project
* Sun Oct 04 2026 marcus.schaefer@gmail.com
- Add a logo to the project
Did some design work in inkscape to come up with
a logo for the flake-pilot project. Actually the
pilot is like the captain of ship, steering you
to stormy water :) To keep a reference to flake
a snowflake icon was used on the spokes of the
steering wheel
* Sun Oct 04 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.74 → 3.1.75
* Sun Oct 04 2026 marcus.schaefer@gmail.com
- Add app store URLs to user guide
Add URL references to the prebuilt containers and
images used in the context of the documentation
to the main page of the user guide
* Fri Oct 02 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.73 → 3.1.74
* Fri Oct 02 2026 marcus.schaefer@gmail.com
- Add missing %post for tmpfiles
For suse_version >= 1600 the evaluation of the systemd
tmpfiles configuration in %post was missing
* Fri Oct 02 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.72 → 3.1.73
* Fri Oct 02 2026 marcus.schaefer@gmail.com
- Fix Makefile
tmpfiles source file names changed and a new tmpfile
setup was added for podman
* Fri Oct 02 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.71 → 3.1.72
* Thu Oct 01 2026 marcus.schaefer@gmail.com
- Move system wide flake podman storage to var
To support the immutable flavor the system-wide podman storage is
now /var/lib/podman/storage, and the spec packages that directory.
* Thu Oct 01 2026 marcus.schaefer@gmail.com
- Drop rootless_storage_path from config
Removed the deprecated rootless_storage_path from the system-wide
flake-pilot storage config and, as you chose, kept it in the
per-user config. flake-ctl builds. rootless_storage_path is deprecated
in favor of graphroot, but containers-storage before its config
rework (podman 4.x) ignores graphroot for rootless users when
CONTAINERS_STORAGE_CONF is set. Newer versions only warn about
it as both point to the same path
* Thu Oct 01 2026 rjschwei@suse.com
- Update state file handling
Update the scriptlet that handles the transition to the new structure for
state files. The updated implementation addresses concerns about user
masquerading in the previous implementation.
* Wed Sep 30 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.70 → 3.1.71
* Wed Sep 30 2026 marcus.schaefer@gmail.com
- Improve write performance onoverlay
Remove the sync/dirsync mount options. Writes to the overlay
are now cached and batched instead of each one waiting for the
disk. Crash safety comes from a sync before reboot plus a
1-second journal commit.
* Wed Sep 30 2026 marcus.schaefer@gmail.com
- Update to latest version of pi for deepseek
* Tue Sep 29 2026 marcus.schaefer@gmail.com
- Fix sudoers setup for firecracker images
There is no admin user, the user is named ai
* Tue Sep 29 2026 marcus.schaefer@gmail.com
- Add deepseek(pi) firecracker image
* Sun Sep 27 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.69 → 3.1.70
* Sat Sep 26 2026 marcus.schaefer@gmail.com
- Auto select outgoing interface
Allow to skip providing the --outgoing-interface name.
In this case the code select the default route interface
of the host.
* Sat Sep 26 2026 marcus.schaefer@gmail.com
- Check if storage path really exists
In flake-ctl firecracker show, only show the storage
path when it really exists
* Sat Sep 26 2026 marcus.schaefer@gmail.com
- Drop the garbage collector from firecracker-pilot
firecracker-pilot no longer garbage-collects instance
metadata. This information is used for the firecracker show
command and continues to be useful even if the firecracker
process no longer runs. flake-ctl firecracker remove now
deletes it, and only for the flake being removed.
* Sat Sep 26 2026 marcus.schaefer@gmail.com
- Make sure firecracker-pilot gets HOME from userdb
firecracker-pilot now gets the home directory from the
system user database instead of the HOME variable.
* Sat Sep 26 2026 marcus.schaefer@gmail.com
- Allow firecracker show on config without include
flake-ctl firecracker show no longer crashes on a
flake config without an include section. A missing
section is now treated as empty.
* Sat Sep 26 2026 marcus.schaefer@gmail.com
- Fix size constraints
* Sat Sep 26 2026 marcus.schaefer@gmail.com
- Add storage information to firecracker show
flake-ctl firecracker show now reports each VM's
storage volume, with its path and size.
* Thu Sep 24 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.68 → 3.1.69
* Thu Sep 24 2026 marcus.schaefer@gmail.com
- Fix setup of resolver link
Due to the mount changes to make all mounts visible
in the later root the mapping path for systemd data
from the initrd has been changed to run/systemd.pre-switch-root.
Support both locations for the lookup
* Thu Sep 24 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.67 → 3.1.68
* Thu Sep 24 2026 marcus.schaefer@gmail.com
- firecracker-pilot should not delete storage
The firecracker-pilot should never delete the storage file
created for an instance. If there is no storage file available
firecracker-pilot creates it, but it should never delete it.
For handling the firecracker storage we will eventually come
up with a new flake-ctl firecracker storage command
* Thu Sep 24 2026 marcus.schaefer@gmail.com
- remount / to make it visible in the overlay
* Thu Sep 24 2026 marcus.schaefer@gmail.com
- Leap16 uses NetworkManager
Make sure a network stack exists in the leap image for 16
* Thu Sep 24 2026 marcus.schaefer@gmail.com
- immediately write journal
* Thu Sep 24 2026 marcus.schaefer@gmail.com
- Make sure overlay write mount is visible to /
* Thu Sep 24 2026 marcus.schaefer@gmail.com
- fix overlay storage handling
The ext4 overlay device is now mounted with the sync
and dirsync options, so file and directory changes are written
to the device right away.
* Thu Sep 24 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.66 → 3.1.67
* Thu Sep 24 2026 marcus.schaefer@gmail.com
- Move to leap16 in the examples
* Thu Sep 24 2026 marcus.schaefer@gmail.com
- Update claude firecracker app
Do not select a predefined login method. This makes
it hard to switch between e.g vertex and api key
* Thu Sep 24 2026 marcus.schaefer@gmail.com
- Move firecracker images to ext4
* Thu Sep 24 2026 marcus.schaefer@gmail.com
- Switch firecracker storage to ext4
ext4 with ordering journal is considered best prepared for
unexpected powerloss, which can happen in the use cases for
firecracker processes that can be killed just like that at
any time.
* Wed Sep 23 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.65 → 3.1.66
* Wed Sep 23 2026 marcus.schaefer@gmail.com
- Update main page
Add information on the main page to be more use case focused
* Wed Sep 23 2026 marcus.schaefer@gmail.com
- Add sanity check for NFS server
If a flake is configured to use NFS volumes but the NFS
server is not started, the startup of such a flake would
take a very long time (NFS timeout) and the expected volume
cannot be attached to the flake. As such a sanity check if
the nfsd process/thread is running on the host prevents
users from unknown startup issues.
* Wed Sep 23 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.64 → 3.1.65
* Tue Sep 22 2026 marcus.schaefer@gmail.com
- Deduplicate podman code between pilot and ctl tool
Create a new common/src/podman space which holds all methods
that can be shared between the podman-pilot source and the
flake-ctl source
* Tue Sep 22 2026 marcus.schaefer@gmail.com
- Add new command flake-ctl podman reset
With podman reset one can stop and remove an eventually running
container instance for a podman-pilot app registered with
the resume: true feature. In this mode the container instance
stays open for subsequent exec calls. To reset them the new
command can be used
* Tue Sep 22 2026 marcus.schaefer@gmail.com
- Move leap firecracker image to Leap 16
* Mon Sep 21 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.63 → 3.1.64
* Mon Sep 21 2026 marcus.schaefer@gmail.com
- Update documentation
Add url to the flake store on s3, cloudfront
* Sun Sep 20 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.62 → 3.1.63
* Sun Sep 20 2026 marcus.schaefer@gmail.com
- Use mount call with full path
Run /usr/bin/mount such that matching with sudo
becomes possible
* Sun Sep 20 2026 marcus.schaefer@gmail.com
- Fix overlay dir creation for bubblewrap pilot
There is no need to create the mountpoint directories for
the overlay mount with root permissions. Only the actual
mount process requires root privileges
* Sun Sep 20 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.61 → 3.1.62
* Sun Sep 20 2026 marcus.schaefer@gmail.com
- Fix overlay-src sorting in bubblewrap-pilot
The options provided in the flake registration for
bubblewrap may contain --overlay-src paths. This
information must be handled before all other options
because all --overlay-src paths forms the root
bwrap operates on and all other bwrap options must
be based on that root tree
* Sun Sep 20 2026 marcus.schaefer@gmail.com
- bubblewrap pilot should create user overlay
The overlay mount created by the bubblewrap pilot
must be user specific such that system wide
registrations works for each user
* Sun Sep 20 2026 marcus.schaefer@gmail.com
- Add sanity check for firecracker iptables rules
An application which is configured to use a network does not
start if its TAP device or the netfilter rules of the host are
missing. We have a check for the tap device but we were missing
the rules check. This commits adds it.
* Sun Sep 20 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.60 → 3.1.61
* Sun Sep 20 2026 marcus.schaefer@gmail.com
- Update appstore URL
Now serving from cloudfront (https)
* Sun Sep 20 2026 marcus.schaefer@gmail.com
- Make sure to set a User-Agent
For cloudfront a User-Agent must be provided in
the header of the request
* Sat Sep 19 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.59 → 3.1.60
* Sat Sep 19 2026 marcus.schaefer@gmail.com
- Update appstore URL
Now serving from an S3 bucket and not from git LFS
* Sat Sep 19 2026 marcus.schaefer@gmail.com
- Remove LFS
The LFS store, stores each commit for a change of
the data files managed under git LFS. For the purpose
of an appstore this is not useful as we only want
to provide the latest version of appstore content.
Also LFS offers 10GB of free storage and with the
data provided this quota is reached quickly
* Sat Sep 19 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.58 → 3.1.59
* Sat Sep 19 2026 marcus.schaefer@gmail.com
- Check if the pilot template exists
The templates are shipped with the pilot packages. A missing
template therefore means the pilot required for this type of
registration is not installed. A registration has to fail
in this condition.
* Sat Sep 19 2026 marcus.schaefer@gmail.com
- Refactor registration file reading/writing
Avoid code duplication for reading and writing the yaml
based flake registration files. The pilots as well as
the control utility had a lot of code duplication for
handling the yaml registration files. This commit adds
common registration functions to be used across the
entire project.
* Thu Sep 17 2026 marcus.schaefer@gmail.com
- Add new pilot named bubblewrap-pilot
The bubblewrap-pilot is a sandbox pilot based on the
bubblewrap (bwrap) tool. It calls the registered command
in a given tree, typically a root filesystem tree. In
addition to the pilot the respective flake-ctl bubblewrap
register/show/remove commands were implemented and
documented. Also add new command "flake-ctl podman export"
which allows to export a given container into a directory
tree. This exported tree can then be used for example
in a bubblewrap registration serving as overlay-src
data tree.
* Mon Sep 14 2026 marcus.schaefer@gmail.com
- Refactor podman appstore
Add build category and a simple push script to automate
building and push to an AWS ECR
* Fri Sep 11 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.57 → 3.1.58
* Fri Sep 11 2026 marcus.schaefer@gmail.com
- Add flake-ctl firecracker/podman remove checks
When removing a flake it should not be allowed to do this
when there are still running instances. In addition for
firecracker the removal should also be prohibited when there
are active tap devices associated with an instance.
* Fri Sep 11 2026 marcus.schaefer@gmail.com
- Add tap device sanity check
If a flake is configured to use a network but its
tap device does not exist, an error pointing out
that the flake-ctl firecracker network add command
must be called first
* Thu Sep 10 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.56 → 3.1.57
* Thu Sep 10 2026 marcus.schaefer@gmail.com
- Update appstore
Add openssl-devel to claude system
* Thu Sep 10 2026 marcus.schaefer@gmail.com
- Add network and volume info to firecracker show
flake-ctl firecracker show now also reports information about
the network and the NFS volumes attached to each VM instance
* Thu Sep 10 2026 marcus.schaefer@gmail.com
- Adapt boxbuild options to kiwi v11
* Wed Sep 09 2026 marcus.schaefer@gmail.com
- pull newer kiwi container
When rebuilding the appstore, pull the latest kiwi container
to run the boxbuild inside
* Tue Sep 08 2026 marcus.schaefer@gmail.com
- Update appstore
Added some useful software to the claude image
* Tue Sep 08 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.55 → 3.1.56
* Tue Sep 08 2026 marcus.schaefer@gmail.com
- Update architecture diagram
* Sat Sep 05 2026 marcus.schaefer@gmail.com
- Update appstore
Install latest version of claude
* Sat Sep 05 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.54 → 3.1.55
* Sat Sep 05 2026 marcus.schaefer@gmail.com
- Add troubleshooting section regarding users
When exporting over NFS user IDs might matter
* Sat Sep 05 2026 marcus.schaefer@gmail.com
- Add troubleshooting section for firewalld
Add information how to make NFS work when firewalld
blocks it
* Sat Sep 05 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.53 → 3.1.54
* Fri Sep 04 2026 marcus.schaefer@gmail.com
- Dynamically select private network
The network is no longer hardcoded, it is selected at setup
with a preference for 172.16.0.0/24. The selected network is
recorded in network.yaml such that other commands like
network add or volume add knows about the initialized network.
This Fixes #115
* Fri Sep 04 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.52 → 3.1.53
* Fri Sep 04 2026 marcus.schaefer@gmail.com
- Fix overlay root (/) permission settings
sci creates the directories with fs::create_dir_all() which uses
0777 and let the umask reduce it. At call time of sci no umask
is set which caused the root (/) to have the wrong permission
settings. This commit fixes the permissions right after the
overlay mount and before the switch root.
* Fri Sep 04 2026 marcus.schaefer@gmail.com
- Drop use of pivot_root
sci used the pivot_root (chroot) procedure to switch into the
new root (/) in case of an overlay root such that sci as a
process can stay active. This root layout however, can confuse
applications running on top it. Therefore this commit changes
the procedure into a standard switch_root followed by a re-exec
of sci to serve as a real init process.
* Fri Sep 04 2026 marcus.schaefer@gmail.com
- Fix default firecracker setup at registration time
By default the "flake-ctl firecracker register" call uses a
firecracker setup template including a network configuraton.
If a user does not also configure the network via
"flake-ctl firecracker network add", the call will fail
because the required tap device is not present. We had
the --no-net option to avoid this but that's a bad user
experience. Therefore the default setup now comes without
a network, meaning the behavior of --no-net is now the
default procedure and all required steps to add a network
are part of the firecracker network implementation.
* Fri Sep 04 2026 marcus.schaefer@gmail.com
- Update appstore
Add an ai user to the claude image
* Thu Sep 03 2026 marcus.schaefer@gmail.com
- Add handler for terminal resize over vsock
In a firecracker guest/host connection via vsock, the
initial terminal size of the caller is transfered as
boot arguments. If the terminal size changes during
runtime this information was not passed to the pty in
the guest and all applications still assumed the original
terminal size leading to rendering issues. This commit
adds a vsock connection on port 53 to transfer terminal
size information as they appear and sci applies them
to the pty in the guest. This Fixes #116
* Thu Sep 03 2026 marcus.schaefer@gmail.com
- Update completion
* Thu Sep 03 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.51 → 3.1.52
* Thu Sep 03 2026 marcus.schaefer@gmail.com
- Fix flake-pilot-firecracker-guestvm-tools spec
Require nfs-client
* Thu Sep 03 2026 marcus.schaefer@gmail.com
- Add doc chapter about firecracker volumes
* Thu Sep 03 2026 marcus.schaefer@gmail.com
- Implement firecracker NFS volume add/remove
Add firecracker volume add/remove commands to assign
a formerly exported NFS volume to a flake and its instances
* Wed Sep 02 2026 198982749+Copilot@users.noreply.github.com
- Implement firecracker NFS volume handling
Add firecracker volume export/release commands for
NFS-backed host paths
Assisted-by: GPT-5.4
* Wed Sep 02 2026 marcus.schaefer@gmail.com
- Add support for NFS mounts in sci
Add support for optional NFS volume(s) to mount in the
VM before the app is called, given as a comma separated
list of NAME_OR_IP:/export_path:/mount_path elements.
A mount point which does not exist is created. This
requires a network setup for the VM and the NFS client
tools in the VM image. See sci(8) for details
Example: "nfs=some.host:/host/path:/local/path".
The nfs variable exists in the VM if provided as part
of the firecracker guest config boot_args. There
will be follow up implementations in flake-ctl which
allows to export NFS shares and add this volume setup
to an instance in a similar fashion as it was done
for the network support.
* Wed Sep 02 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.50 → 3.1.51
* Wed Sep 02 2026 marcus.schaefer@gmail.com
- Fix UDS socket setup
Check if there is an old UDS socket file still present prior
creating a new firecracker process. It must be deleted to allow
the new firecracker process to create and connect to it
* Wed Sep 02 2026 marcus.schaefer@gmail.com
- Fix firecracker network setup
Make sure a host route is added when assigning an IP address
to a firecracker instance (tap device)
* Wed Sep 02 2026 marcus.schaefer@gmail.com
- Update appstore
Make sure nfs-client exists in the firecracker images
* Wed Sep 02 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.49 → 3.1.50
* Wed Sep 02 2026 marcus.schaefer@gmail.com
- Fix evaluation of %ignore_missing_volume_path
The argument parser splits option name and argument name
into single words which requires a different matching
logic in the loop iterating through the argument values
* Tue Sep 01 2026 marcus.schaefer@gmail.com
- Add new pilot_options section to the flake config
Allow to specify pilot options (that are options beginning with a %)
like %ignore_missing_volume_path in the flake yaml registration file.
A new registration argument named --pilot-option can be used to
permanently add a pilot option as part of the registration such
that it does not have to be passed at the commandline.
This is related to bsc#1274855
Assisted-by: Claude:claude-opus-4-6
* Tue Sep 01 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.48 → 3.1.49
* Tue Sep 01 2026 marcus.schaefer@gmail.com
- Fixed Makefile
ghpages target missing the setup
* Tue Sep 01 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.47 → 3.1.48
* Tue Sep 01 2026 marcus.schaefer@gmail.com
- Fix bumpversion config
Invalid path setup
* Tue Sep 01 2026 marcus.schaefer@gmail.com
- Refactor documentation
Create a user guide rather than a README. The information in
the README has grown a lot and the document became less clear.
This commit turns the information into a user guide style
documentation and pushes it to gh-pages. The former README
just lists a link to the documentation page
* Mon Aug 31 2026 marcus.schaefer@gmail.com
- Fix CWE-59 / Privilege Escalation issues
Several methods like chmod, cp, mkdir shell out to perform
the job. If this is done with root privileges a local unprivileged
attacker can create a symbolic link pointing to a restricted path.
As such none of this operations should allow to follow symlinks
in the given path if the calling user is not the same as the
one requested for the operation. In addition the combination of
tools to shell out like mkdir followed by chmod is not race free.
As such this commit also introduces race free implementations
which are preferred if the calling user is the same as the
one requested for the operation. This fixes bsc#1277029
Assisted-by: Claude:claude-opus-4-6
* Mon Aug 31 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.46 → 3.1.47
* Mon Aug 31 2026 marcus.schaefer@gmail.com
- Fix --no-net firecracker registrations
Make sure that no network-interfaces section is passed
to firecracker in this case
* Mon Aug 31 2026 marcus.schaefer@gmail.com
- Don't store network.yaml meta file in flakes dir
Do not store the network.yaml metadata file in the flakes
directory as it is then also read like a flakes registration
with invalid layout
* Mon Aug 31 2026 marcus.schaefer@gmail.com
- Update README
Rewrite networking chapter for firecracker
Assisted-by: Claude:claude-opus-4-6
* Mon Aug 31 2026 marcus.schaefer@gmail.com
- Delete unused documentation diagrams
* Mon Aug 31 2026 marcus.schaefer@gmail.com
- Add flake-ctl firecracker network remove
Disconnect a VM application from the host network
* Mon Aug 31 2026 marcus.schaefer@gmail.com
- Add flake-ctl firecracker network add
Add a network setup for a given app registration
based on the host network init (NAT) and static
IP assignment done by the add command.
* Sun Aug 30 2026 marcus.schaefer@gmail.com
- Add flake-ctl firecracker network init
Prepare the host to allow for NAT networking and
IP forwarding on a given outgoing interface.
* Sun Aug 30 2026 marcus.schaefer@gmail.com
- Update README
Fix information about user vs. system wide flakes
* Sun Aug 30 2026 marcus.schaefer@gmail.com
- Add support for Per-instance boot_args
An optional instance map inside the firecracker
engine section can be added, keyed by the @NAME selector.
This allows for e.g. different network settings per
firecracker instance and tap device.
* Sun Aug 30 2026 marcus.schaefer@gmail.com
- Fix tap device setup
The tap name is a free-form string (program basename plus
the @NAME instance selector), which could produce names
the kernel rejects. With this commit:
* every character outside [A-Za-z0-9_] becomes _ —
covers /, :, whitespace
(rejected by the kernel's dev_valid_name)
and @ (kernel-legal but iproute2 uses it for
the name@parent notation);
* names longer than IFNAMSIZ - 1 (15) are truncated to the
leading characters and re-uniquified with a 6-hex-digit
hash suffix, e.g.
some-very-long-application-name → tap-some_bbb9de;
* an empty name degrades to the hash rather than producing
the bare prefix.
* The tap name is logged under PILOT_DEBUG=1, so users can
see which device to pre-create. Later versions might
offer a network setup in flake-ctl
* Wed Aug 26 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.45 → 3.1.46
* Wed Aug 26 2026 marcus.schaefer@gmail.com
- Drop --user flag
Drop --user flag in favor of auto-detecting user mode.
* Tue Aug 25 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.44 → 3.1.45
* Sun Aug 23 2026 marcus.schaefer@gmail.com
- Drop extra rootfs image checksum test
The image is verified against the checksum record
fetched from its origin. This Fixes #103
* Sun Aug 23 2026 marcus.schaefer@gmail.com
- Refactor firecracker checksum validation
So far the --kis-image pull method downloaded a tar file
and only verified the checksum of the root filesystem
image inside the tarball. However the tarball also contains
initrd and kernel files and the kiwi kis build also provides
an overall checksum file for the entire archive. This
commit refactors the code such that the entire tar file
is matched against its checksum. The appstore has been
already updated to provide these checksum files along
with the actual kis tar files. This Fixes #103
* Thu Aug 20 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.43 → 3.1.44
* Thu Aug 20 2026 marcus.schaefer@gmail.com
- Update rsync options
Do not set extended attributes and acls as they failed to
transfer into the storage backend used by podman
* Thu Aug 20 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.42 → 3.1.43
* Thu Aug 20 2026 marcus.schaefer@gmail.com
- Add --force option to remove command
Add --force option to flake-ctl firecracker remove
and fix the tab completion
* Wed Aug 19 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.41 → 3.1.42
* Wed Aug 19 2026 marcus.schaefer@gmail.com
- Fixed firecracker pilot garbage collector
Only remove firecracker pilot related metadata files ending with .vmid
* Wed Aug 19 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.40 → 3.1.41
* Wed Aug 19 2026 marcus.schaefer@gmail.com
- Fix commandline quoting for sci
call_str is now parsed with shell_words::split(), the same
shell-style parser sci already uses for the run= kernel
cmdline variable. The trailing token is popped as the exec
port, the remainder is kept as exec_cmd. This Fixes #37
* Wed Aug 19 2026 marcus.schaefer@gmail.com
- Increas scope of rsync transfer
Make sure extended attributes and ACLs gets transfered
* Wed Aug 19 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.39 → 3.1.40
* Wed Aug 19 2026 marcus.schaefer@gmail.com
- Add support for init command
So far the user mode setup requires a user to read the
information from the flake-pilot man page and to create
the respective directories and files in the home directory
himself. This commit adds a new command to allow to
perform this task. This Fixes #96
* Wed Aug 19 2026 marcus.schaefer@gmail.com
- Fix spec file
man page files listed twice
* Wed Aug 19 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.38 → 3.1.39
* Wed Aug 19 2026 marcus.schaefer@gmail.com
- Add show command for podman and firecracker pilots
Allow to show details about running containers or
firecracker process. This Fixes #97
* Wed Aug 19 2026 marcus.schaefer@gmail.com
- Add user mode support for firecracker
Similar to the podman-pilot now also the firecracker-pilot
now supports a user mode. In this mode images gets downloaded
into the calling user's home directory and flake registrations
are stored there too.
* Wed Aug 19 2026 marcus.schaefer@gmail.com
- Update flake-pilot man page
Update the instructions to setup for rootless podman/firecracker
* Tue Aug 18 2026 marcus.schaefer@gmail.com
- Update documentation
Fix typos
* Tue Aug 18 2026 marcus.schaefer@gmail.com
- Update documentation
More details how to use the firecracker claude
example and some consistency changes
* Tue Aug 18 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.37 → 3.1.38
* Tue Aug 18 2026 marcus.schaefer@gmail.com
- Fixed podman pilot garbage collector
Only remove podman pilot related metadata files ending with .cid
* Tue Aug 18 2026 marcus.schaefer@gmail.com
- Fixed firecracker garbage collector
Make sure to cleanup the sock_NR call ID sockets as well
* Tue Aug 18 2026 marcus.schaefer@gmail.com
- Change garbage collector threshold
Set the threshold for all pilots to 1. This will run
the cleanup with every invocation
* Tue Aug 18 2026 marcus.schaefer@gmail.com
- Drop user name from cid file
The cid files are organized in /tmp/flakes/UID/flakename.cid
The additional user name in the .cid file, as it was before,
is now superfluous information and can be dropped.
* Tue Aug 18 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.36 → 3.1.37
* Tue Aug 18 2026 marcus.schaefer@gmail.com
- Add sci child reaper for firecracker
In a resume type firecracker VM the sci command servers as
the init process (PID 1). All childs of this process ended
up to be defunct. To avoid this a reaper function was added
to reap re-parented processes so nothing lingers as defunct
* Tue Aug 18 2026 marcus.schaefer@gmail.com
- Add shadow and procps to claude VM
* Tue Aug 18 2026 marcus.schaefer@gmail.com
- Use var/tmp for managing downloads
Image data is downloaded to a temporary location before it is
moved to its final destination in the registry. The system
default temporary directory /tmp is in most cases backed by a
memory filesystem which is too small to hold an image. Thus
the temporary data is placed in defaults::TEMP_DIR which is
expected to be persistent storage
* Tue Aug 18 2026 marcus.schaefer@gmail.com
- Update README
Fixed ip calls, must be done with root permissions
* Mon Aug 17 2026 marcus.schaefer@gmail.com
- Add support for terminfo to firecracker pilot
Add terminfo support to sci such that cursor keys
and other VTE(8003) features work
* Mon Aug 17 2026 rjschwei@suse.com
- Permission fix up during package update
As a follow up to #84 and #95 we need to fix up the permissions and file
locations when the RPM package is updated. We handle the permission and
location change in the pre scriptlet to ensure changes are applied before the
new binaries are installed. On update this also ensures that the setup is in
place in case flake-ctl is called during update of another package. This
should avoid any error conditions.
Co-authored-by: Gemini
* Mon Aug 17 2026 marcus.schaefer@gmail.com
- Update appstore
Add leap basesystem for firecracker. Update to latest sci
for all firecracker images
* Mon Aug 17 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.35 → 3.1.36
* Mon Aug 17 2026 marcus.schaefer@gmail.com
- Followup fix for garbage collect on metadata
Check if filetype is a normal file, avoid working on
socket files or other special file types
* Mon Aug 17 2026 marcus.schaefer@gmail.com
- Set custom PROMPT in sci
Use a standard prompt in the sci caller
* Mon Aug 17 2026 marcus.schaefer@gmail.com
- Fixed metadata garbage collector
Only check for deleting garbage if the file in question
actually exists
* Mon Aug 17 2026 marcus.schaefer@gmail.com
- Appstore update
Update claude for firecracker. Add google SDK and several
other useful tools
* Mon Aug 17 2026 marcus.schaefer@gmail.com
- Set default log level for firecracker to debug
Instead of trace set debug as default log level
* Mon Aug 17 2026 marcus.schaefer@gmail.com
- Fix terminal emulation in firecracker sessions
Make sure to place the caller terminal in raw mode such
that tab completion can work. Additionally make sure
to setup window size and terminal type correctly
* Sun Aug 16 2026 marcus.schaefer@gmail.com
- Allow to ignore volume setup
Add new podman pilot option %ignore_missing_volume_path.
When provisioning a container with a shared volume setup
like --volume /host/path:/container/path
or -v /host/path:/container/path, the default action is
to stop with an error when the host path does not exist.
This option allows to continue even if the host path is
missing. This Fixes bsc#1274855
* Sat Aug 15 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.34 → 3.1.35
* Sat Aug 15 2026 marcus.schaefer@gmail.com
- Update documentation
Add section about known issues
* Sat Aug 15 2026 marcus.schaefer@gmail.com
- Update documentation
Fix typo
* Sat Aug 15 2026 marcus.schaefer@gmail.com
- Fixed target column in list output for firecracker
* Sat Aug 15 2026 marcus.schaefer@gmail.com
- Add --format option to list command
flake-ctl list gained --format <FORMAT> with format
available as table(default), json and csv.
* Sat Aug 15 2026 marcus.schaefer@gmail.com
- Update spec file
Make sure to modify eventually existing /tmp/flakes
tmp directory permissions to the new sticky permissions
to prevent running into the hard error for 0777.
* Fri Aug 14 2026 marcus.schaefer@gmail.com
- Drop robot test framework
Integration testing is done sandboxed. One cannot call
the test framework on a work system because the tests
changes it. The tests also removes paths from the system
and are pretty intrusive. The tests itself are pretty
outdated und unmaintained. We run integration tests on
sandboxed systems providing the required podman and
firecracker engines and want these tests to run on the
desired target distribution.
* Thu Aug 13 2026 marcus.schaefer@gmail.com
- Refactor code to fix certain security issues
New shared primitives
IO::private_dir(base, user) — creates the shared base dir as
1777 (sticky) and a per-uid 0700 subdir, verifying it is a real
directory owned by the caller. Refuses to run if the base is
world-writable without the sticky bit. IO::no_symlink(path) /
IO::create_meta_file(path) — O_NOFOLLOW, mode 0600.
podman-pilot
@NAME validated before use; graphroot 777→755, per-user
runroot 777→700; CID files moved into the private per-uid dir
with a symlink check on read and on create; gc()/gc_cid_file()
follow; sudo --preserve-env moved to --preserve-env=
CONTAINERS_STORAGE_CONF,XDG_RUNTIME_DIR;
the %VAR expansion loop is bounded (defaults::VAR_EXPANSION_LIMIT).
firecracker-pilot
@NAME validated; .vmid files in the private per-uid dir, written
via IO::create_meta_file; the sci command socket moved from
/tmp/sci_cmd_<app>.sock to <ids-dir>/<uid>/sci_cmd_<app>.sock
and chmod 777→600 (the per-port listener socket inherits the
private dir and gets a symlink check); overlay dir created by
the calling user at 0700 — when HOME is unset it now falls
back to the user's private dir instead of shared /tmp;
delete_file uses fs::remove_file instead of a PATH-resolved rm.
flake-ctl
/usr/share/flakes 777→755;
/var/lib/firecracker/{images,storage} 0o777→0o755;
- -preserve-env scoped as in the pilot; downloads are refused over
non-https unless FLAKE_ALLOW_INSECURE_TRANSPORT is set (https_only
also blocks https→http redirects); the KIS .sha256 record is now
verified against the rootfs instead of being deleted unread,
documented in doc/flake-ctl-firecracker-pull.rst.
Behaviour changes:
1. Env inheritance is gone. Flakes that relied on arbitrary
variables reaching podman or the sudo-wrapped helpers will
no longer see them; only CONTAINERS_STORAGE_CONF and
XDG_RUNTIME_DIR are forwarded.
2. An existing /tmp/flakes at 0777 is now a hard error with a message
telling the user to chmod 1777 /tmp/flakes. Meta data also moves
down one level into /tmp/flakes/<uid>/, so running instances from
a pre-upgrade pilot won't be found by the new one.
3. flake-ctl firecracker pull over plain http now fails unless
FLAKE_ALLOW_INSECURE_TRANSPORT is set — note the second example
in the pull man page uses an https S3 URL, so it still works.
4. The KIS sha256 check fails the pull on a genuine mismatch;
a missing/unparsable record or absent sha256sum only warns,
so systems without coreutils keep working.
* Thu Aug 13 2026 marcus.schaefer@gmail.com
- Add more details to the list output
Provide more information about the location of the flake
setup files and which engine is used for the flake
* Wed Aug 12 2026 marcus.schaefer@gmail.com
- Update README
gemini seems dead, switch AI example to claude and also
mention limitations of krun
* Wed Aug 12 2026 marcus.schaefer@gmail.com
- Apply clippy fixes
Mostly removing redundant borrows
* Wed Aug 12 2026 marcus.schaefer@gmail.com
- Update claude container
Provide system wide setup file, and make sure the
google sdk exists for vertex authentication
* Mon Jul 06 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.33 → 3.1.34
* Fri Jul 03 2026 marcus.schaefer@gmail.com
- Reverse showing progress logic
So far the user had to pass %silent to the call to make
the pilot stop showing progress information. The default
behavior to show progress information caused a lot of
confusion and breakage to script code calling an application
as a flake. It is rather unexpected that such progress
information is provided by default. This commit reverse the
logic such that a user has to provide %progress to see
the progress spinner while the pilot is working.
This Fixes #80
* Tue May 19 2026 marcus.schaefer@gmail.com
- Update documentation
* Mon May 18 2026 marcus.schaefer@gmail.com
- Update documentation
* Sat May 16 2026 marcus.schaefer@gmail.com
- Fix typo in documentation
* Sat May 16 2026 marcus.schaefer@gmail.com
- Update documentation
* Fri May 15 2026 marcus.schaefer@gmail.com
- Add ECR container sources to appstore
* Wed May 13 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.32 → 3.1.33
* Wed May 13 2026 marcus.schaefer@gmail.com
- Call tools from /usr/sbin with abspath
Calling tools from /usr/sbin like mkfs.ext2 might not
be found by the calling shell if the PATH does not contain
/usr/sbin. Make sure to call these tools with an absolute
path. Also make sure to cleanup a broken filesystem artifact
when mkfs could not be called
* Wed May 13 2026 marcus.schaefer@gmail.com
- Update documentation
Update examples and architecture diagram
* Tue May 12 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.31 → 3.1.32
* Tue May 12 2026 marcus.schaefer@gmail.com
- Create tap device ourselves
* Tue May 12 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.30 → 3.1.31
* Tue May 12 2026 marcus.schaefer@gmail.com
- Require root permissions only for provisioning
When using the firecracker pilot require root permissions
only when provisioning data into the instance. This requires
mounting the overlay for which root permissions would be
needed. All the rest can be done rootless and provisioning
data is an optional setting
* Tue May 12 2026 marcus.schaefer@gmail.com
- Add appstore for prebuilt images
* Mon May 11 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.29 → 3.1.30
* Mon May 11 2026 marcus.schaefer@gmail.com
- Start sshd in sci
Run sshd if present as part of the sci guest tool
* Mon May 11 2026 marcus.schaefer@gmail.com
- Fixed typo
* Sun May 10 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.28 → 3.1.29
* Sun May 10 2026 marcus.schaefer@gmail.com
- Fix stdio/stderr and stdin channel setup
When calling firecracker pilot using vsock as transport, it
is required that all standard channels gets detached from
the firecracker process such that the following pty/vsock
channel operates correctly.
* Wed Apr 15 2026 marcus.schaefer@gmail.com
- Update spec file due to new package restrictions
On SUSE new package restrictions where added to support the
concept of the so called immutable mode. The new guideline
says "Any files in the RPM spec %files section that are not
in /usr or /etc is likely to break in Immutable Mode". For
the flake-pilot packaging this applies to the flake-pilot-firecracker
sub package. This commit implements the suggested solution based
on systemd-tmpfiles and only applies for SUSE.
This Fixes jira#PCT-1054
* Thu Mar 12 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.27 → 3.1.28
* Thu Mar 12 2026 marcus.schaefer@gmail.com
- Fix spec file
Require firecracker only for SUSE TW, it does
not exists anywhere else
* Wed Feb 04 2026 marcus.schaefer@gmail.com
- Add ai sandbox example workflow
* Wed Feb 04 2026 marcus.schaefer@gmail.com
- Clippy fixes
* Wed Feb 04 2026 marcus.schaefer@gmail.com
- Update documentation
Fix language mistakes and wording
* Mon Jan 26 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.26 → 3.1.27
* Mon Jan 26 2026 marcus.schaefer@gmail.com
- Add support for --force option for remove
Add support for podman remove --force mode. In this
mode the referenced application will be force removed
and no sanity checks if this is pointing to a flake
registration will be done. Eventually missing files
do not cause an error.
* Mon Jan 26 2026 marcus.schaefer@gmail.com
- Fix spec file
Allow to build for Fedora, fix packager e-mail
* Mon Jan 26 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.25 → 3.1.26
* Mon Jan 26 2026 marcus.schaefer@gmail.com
- Allow force registration with arbitrary data
When using --force also register even if the eventually
conflicting file does not belong to a flake registration
* Sat Jan 24 2026 marcus.schaefer@gmail.com
- Add --force option for register command
Allow to force writing the registration even if a
registration of the same name already exists. Also
update the man pages.
* Sat Jan 24 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.24 → 3.1.25
* Sat Jan 24 2026 marcus.schaefer@gmail.com
- Improve command debug log
Make sure the command called is part of the log message
and not only the arguments
* Sat Jan 24 2026 marcus.schaefer@gmail.com
- drop obsolete permission settings
With the proper user vs. system wide setup there is no
need for the hacky permission adaptions. This also
improves the runtime performance
* Sat Jan 24 2026 marcus.schaefer@gmail.com
- Fixup flake lookup
system wide first, then user specific
* Fri Jan 23 2026 marcus.schaefer@gmail.com
- Fix podman remove for both workloads
Make sure podman remove functions properly when called
in system and/or user mode. Sanity checks must be performed
before any file/directory removal starts.
* Thu Jan 22 2026 marcus.schaefer@gmail.com
- Add flake-ctl podman --user ... option
Flake registrations can be done systemwide and are
then called from a normal user via sudo or they can
be done user specific which requires to setup fakes.yml
and the respective storage.conf to point to a writable
space for the calling user. As a user you can decide
via the new --user option which direction to go for
the registration.
* Thu Jan 22 2026 marcus.schaefer@gmail.com
- Update documentation
Add information how to setup for rootless mode
* Thu Jan 22 2026 marcus.schaefer@gmail.com
- Allow user specific podman storage location
In addition to the user specific config, a new config
option named podman_storage_conf has been added. By
default it points to /etc/flakes/storage.conf which is
provided with the pilot package. The file can now point
to a user specific version and can include podman
options to let it create the storage in a user writable
space on the system
* Thu Jan 22 2026 marcus.schaefer@gmail.com
- Allow user specific flake config file
By default and if the calling user is root the setup
of the flakes directory and other settings are read from
/etc/flakes.yml. This commit allows to read a user
specific $HOME/.config/flakes.yml when present.
* Thu Jan 22 2026 marcus.schaefer@gmail.com
- Fix typo in storage conf
* Wed Jan 21 2026 marcus.schaefer@gmail.com
- Update README
Fix repo names and update use case list
* Mon Jan 19 2026 marcus.schaefer@gmail.com
- Fix image prune for local containers
On pull of a newer container the old one stays in the local
registry without any reference. So far pruning this old data
was done directly after explicitly pulling a container by
the pilot e.g. for a layer reference. However podman on its
own is also expected to pull the referenced container according
to the flake setup. As such the prune command is only called
under certain condition where it should be called as part of
the garbage collection with any flake invocation.
* Wed Jan 07 2026 marcus.schaefer@gmail.com
- Bump version: 3.1.23 → 3.1.24
* Fri Dec 19 2025 marcus.schaefer@gmail.com
- Clippy fixes
Avoid unneeded unwrap
* Fri Dec 19 2025 marcus.schaefer@gmail.com
- Use pull policy set to: newer
if the image on the registry is newer than the one in the
local flake registry, make sure to fetch the latest version
automatically. Pull errors are suppressed if a local image
was found and we can't pull from the source location e.g an
image that was provided by a package and the blob was loaded
from the local storage.
* Mon Nov 24 2025 marcus.schaefer@gmail.com
- Bump version: 3.1.22 → 3.1.23
* Mon Nov 24 2025 marcus.schaefer@gmail.com
- Improve error handling
Check for the presence of the main flake registration.
Even though this should never happen because the file
is the result of a successful flake-ctl registration we
cannot prevent users from working with it outside
flake-ctl. In addition explicitly match on potential
parse errors from aml_rust::YamlLoader instead of looking
at the error message as result from an Err unwrap.
* Thu Nov 20 2025 marcus.schaefer@gmail.com
- Better error handling for config_from_str()
If the provided source data is empty this is not an error
for YamlLoader and the empty data is just passed along as
a None value. The unconditional unwrap of a None value
however, let the application to panic into a stacktrace.
This commit catches the condition and provides a better
error message.
* Thu Nov 20 2025 marcus.schaefer@gmail.com
- Use derive statement for Writeback
replaced the manual implementation with a derive attribute
and marked the default variant instead of adding a default()
implementation
* Mon Sep 29 2025 marcus.schaefer@gmail.com
- Add information about potential firewall conflicts
Add a note about the NAT setup for firecracker guests to
connect with the host.
* Thu Sep 04 2025 marcus.schaefer@gmail.com
- Bump version: 3.1.21 → 3.1.22
* Thu Sep 04 2025 marcus.schaefer@gmail.com
- Fixes to use flakes as normal user
Running a flake is a container based instance provisioning
and startup. Some part of this process requires root permissions
for example mounting the container instance store for the
provisioning step. This commit fixes the required calls to
be properly managed by sudo.
* Thu Aug 21 2025 marcus.schaefer@gmail.com
- Bump version: 3.1.20 → 3.1.21
* Thu Aug 21 2025 marcus.schaefer@gmail.com
- seed from entropy
* Thu Aug 21 2025 marcus.schaefer@gmail.com
- Fix assignment of random sequence number
We should use a seed for the sequence as described in
https://rust-random.github.io/book/guide-seeding.html#a-simple-number
In addition the logic when a random sequence number should
be used was wrong and needed a fix regarding resume and
attach type flakes which must not use a random sequence
* Tue Aug 19 2025 marcus.schaefer@gmail.com
- Pass --init option for resume type flakes
In resume mode a sleep command is used to keep the container
open. However, without the --init option there is no signal
handling available. This commit fixes it
* Tue Aug 19 2025 marcus.schaefer@gmail.com
- Revert "kill prior remove when using %remove flag"
This reverts commit 7128fb44027b238bbc863f9580fbe068a74998c0.
no hard killing needed with the event loop entrypoint
* Tue Aug 19 2025 marcus.schaefer@gmail.com
- Fixed CVE-2025-55159 slab: incorrect bounds check
Update to slab 0.4.11 to fix the mentioned CVE.
This Fixes bsc#1248004
* Tue Aug 19 2025 marcus.schaefer@gmail.com
- Apply clippy fixes
* Tue Aug 19 2025 marcus.schaefer@gmail.com
- Create sequence number for the same invocation
If a flake which is not a resume or attach flake is called twice
with the same invocation arguments an error message is displayed
to give this invocation a new name via the @NAME runtime option.
This commit makes this more comfortable and automatically assigns
a random sequence number for the call if no @NAME is given.
* Wed Jul 09 2025 marcus.schaefer@gmail.com
- kill prior remove when using %remove flag
In case the container instance should be removed via the %remove
flag, send a kill first, followed by a force remove. The reason
for this is because we use a never ending sleep command as entry
point for resume type containers. If they should be removed the
standard signal send on podman rm will not stop the sleep and
after a period of 10 seconds podman sends a kill signal itself.
We can speedup this process as we know the entry point command
and send the kill signal first followed by the remove which
saves us some wait time spent in podman otherwise.
* Tue Jul 08 2025 marcus.schaefer@gmail.com
- Bump version: 3.1.19 → 3.1.20
* Tue Jul 08 2025 marcus.schaefer@gmail.com
- Fix clippy hints
variables can be used directly in the format! string
* Tue Jul 08 2025 marcus.schaefer@gmail.com
- Prune old images after load
Make sure no <none> image references stay in the registry
* Wed Jun 25 2025 marcus.schaefer@gmail.com
- Bump version: 3.1.18 → 3.1.19
* Wed Jun 25 2025 marcus.schaefer@gmail.com
- Fix CVE-2025-3416
rebuild of the tool also inherits openssl in a version that
fixes the above mentioned CVE. This fixes bsc#1242680
* Wed Jun 25 2025 marcus.schaefer@gmail.com
- Fix CVE-2025-5791
Switch to uzers crate as actively maintained fork of the
unmaintained users crate. This Fixes bsc#1244207
* Wed Feb 26 2025 marcus.schaefer@gmail.com
- Fix firecracker requirement
Require firefracker only for TW as it exists in no
other version of SUSE. In case the firecracker-pilot
is installed on a system that has no firecracker it
must be installed to this system in an alternative
way which is easily possible because firefracker
is also a rust application only depending on libc
* Tue Feb 11 2025 marcus.schaefer@gmail.com
- Bump version: 3.1.17 → 3.1.18
* Tue Feb 11 2025 marcus.schaefer@gmail.com
- Style fixes
* Tue Feb 11 2025 marcus.schaefer@gmail.com
- Fix error handling for container check methods
The condition to setup permissions and redo the call
was done when the exec of the call was not possible.
But this is not the right place to check for a permission
denied error. This commit fixes the evaluation of the
error data
* Tue Feb 11 2025 marcus.schaefer@gmail.com
- Bump version: 3.1.16 → 3.1.17
* Tue Feb 11 2025 marcus.schaefer@gmail.com
- Don't use perform for bool status methods
The perform() call checks the status code and raises an
ExecutionError. This does not allow us to return a
false boolean. Use output() call instead
* Tue Feb 11 2025 marcus.schaefer@gmail.com
- Bump version: 3.1.15 → 3.1.16
* Tue Feb 11 2025 marcus.schaefer@gmail.com
- No error return for bool method
* Tue Feb 11 2025 marcus.schaefer@gmail.com
- Bump version: 3.1.14 → 3.1.15
* Tue Feb 11 2025 marcus.schaefer@gmail.com
- Fix call for podman_setup_permissions
Make sure podman_setup_permissions is only called if there
is a permission problem detected.
* Sat Feb 01 2025 marcus.schaefer@gmail.com
- Bump version: 3.1.13 → 3.1.14
* Sat Feb 01 2025 marcus.schaefer@gmail.com
- Use actions/upload-artifact: v4
* Sat Feb 01 2025 marcus.schaefer@gmail.com
- Make clippy happy
* Sat Feb 01 2025 marcus.schaefer@gmail.com
- Fix building runtime arguments
Use get_run_cmdline method everywhere
* Sat Feb 01 2025 marcus.schaefer@gmail.com
- Fix container cleanup
A flake configured to be attached can also be re-started
using the same container storage. However, the container
was always removed when the command exited. This commit
fixes it to avoid removing the container of attach type
flakes. In addition a flake option %remove was added to
allow removing the container created for resume and attach
type flakes
* Tue Dec 17 2024 marcus.schaefer@gmail.com
- Bump version: 3.1.12 → 3.1.13
* Tue Dec 17 2024 marcus.schaefer@gmail.com
- Allow env placeholders for the podman pilot
The podman runtime arguments allows to set environment
variable placeholders starting with '%' and followed by
the name of the environment variable. For example %HOME
will be replaced to the value of $HOME of the calling user.
If the given placeholder cannot be translated into an
existing environment variable it will be turned into the
variable name, $HOME in the above example.
* Mon Dec 16 2024 marcus.schaefer@gmail.com
- Bump version: 3.1.11 → 3.1.12
* Mon Dec 16 2024 marcus.schaefer@gmail.com
- Automatically detect terminal mode
* Mon Dec 16 2024 marcus.schaefer@gmail.com
- Drop superfluous comment
* Mon Dec 16 2024 marcus.schaefer@gmail.com
- Bump version: 3.1.10 → 3.1.11
* Mon Dec 16 2024 marcus.schaefer@gmail.com
- Update system files provisioning
Expect systemfiles to be a callable that produces the
list of host files to sync
* Fri Dec 13 2024 marcus.schaefer@gmail.com
- Bump version: 3.1.9 → 3.1.10
* Fri Dec 13 2024 marcus.schaefer@gmail.com
- Include systemfiles.libs for host provisioning
Only use copy-links for the files mentioned in
systemfiles.libs. The other systemfiles are synced in the
usual way.
* Thu Dec 12 2024 marcus.schaefer@gmail.com
- Make sure interactive processes can run
* Thu Dec 12 2024 marcus.schaefer@gmail.com
- Fixed podman call dead lock
When calling the flake and stdout/stderr gets redirected into
a pipe like `flake | grep ... | cut ...` the pilot binary runs
in a dead lock because there is no reader/writer to feed the
pipe from the child process (podman) executed via the pilot.
This commit fixes it by making sure all data from the child
gets read first and then passed along to stdout/stderr of the
caller.
* Thu Dec 12 2024 marcus.schaefer@gmail.com
- Bump version: 3.1.8 → 3.1.9
* Tue Dec 10 2024 marcus.schaefer@gmail.com
- Copy symlinks for host dependencies
For provisioning of host dependencies copy symlinks such
that they appear under their name as a file and not as a
symlink. We use this logic for the host dependency sync
only to be less strict on versioned library syncing
* Wed Dec 04 2024 marcus.schaefer@gmail.com
- Clippy fix
elide the lifetimes for User instances
* Wed Dec 04 2024 marcus.schaefer@gmail.com
- Bump version: 3.1.7 → 3.1.8
* Wed Dec 04 2024 marcus.schaefer@gmail.com
- Fixed the runroot permission fixup
podman differentiates the runroot between root and rootless
calls. If you initially call a flake as a user the initial
podman database gets setup as rootless variant which also
allows root based workloads without permission issues.
However, if you do it the other way round the runroot is
setup for root only which prevents the flake to be called
as normal user. To handle this permission issues we have
fix methods in the flake common code to change the
permissions according to the calling user via sudo. The
code to handle permissions for the runroot target has to
apply for all users as we can't predict if the storage
will be setup initially as rootless or for root only
* Fri Nov 29 2024 marcus.schaefer@gmail.com
- Bump version: 3.1.6 → 3.1.7
* Fri Nov 29 2024 marcus.schaefer@gmail.com
- Follow symlinks for mkdir
* Thu Nov 28 2024 marcus.schaefer@gmail.com
- Bump version: 3.1.5 → 3.1.6
* Thu Nov 28 2024 marcus.schaefer@gmail.com
- Add support for systemfiles provisioning
If the base container comes with a systemfiles metadata file
it will be used to transfer all the data mentioned in the file
from the host to the instance. In contrast to the removed files
the systemfiles sync will not continue when failed and this
can only be overwritten via the %ignore_sync_error flake option
* Wed Nov 27 2024 marcus.schaefer@gmail.com
- Bump version: 3.1.4 → 3.1.5
* Wed Nov 27 2024 marcus.schaefer@gmail.com
- Add provision of systemfiles
* Wed Nov 27 2024 marcus.schaefer@gmail.com
- Fix initialization of CID dir
chmod to the wrong path
* Tue Nov 26 2024 rjschwei@suse.com
- Doc clarification
Using the term "container name" can be confusing and interpreted as simply
the name of the container itself. What we really need to make registration
work is the path of the container in the local registry. Clarify the
documentation by adding a not ethat points out this potential pitfall.
* Tue Nov 26 2024 marcus.schaefer@gmail.com
- Bump version: 3.1.3 → 3.1.4
* Tue Nov 26 2024 rjschwei@suse.com
- Handle incomplete container path
If the given oci path does not match a file, the value is treated
as a glob pattern. From the possible match of the pattern the
last match will be used as the file to load. This Fixes #51
* Sun Nov 24 2024 marcus.schaefer@gmail.com
- Bump version: 3.1.2 → 3.1.3
* Sun Nov 24 2024 marcus.schaefer@gmail.com
- Handle the removal of containers in the pilot
* Sun Nov 24 2024 marcus.schaefer@gmail.com
- Fix cleanup
Only modify permissions of the run state for the calling user.
Make sure to remove non resume/attach type app containers after
the call
* Sun Nov 24 2024 marcus.schaefer@gmail.com
- suppress podman exists output
* Sat Nov 23 2024 marcus.schaefer@gmail.com
- Bump version: 3.1.1 → 3.1.2
* Sat Nov 23 2024 marcus.schaefer@gmail.com
- Fix spec file
Do not create /usr/share/flakes as part of the
package. Let the tooling create the directory
if not present
* Sat Nov 23 2024 marcus.schaefer@gmail.com
- Bump version: 3.1.0 → 3.1.1
* Sat Nov 23 2024 marcus.schaefer@gmail.com
- Provide error message for unknown command
If the target_app_path is set to / this means the
container configured entry point is called. Such a
setup cannot be used as resume flake because we
don't know the entry point command to exec
* Sat Nov 23 2024 marcus.schaefer@gmail.com
- Update flake-ctl-podman-register man page
* Sat Nov 23 2024 marcus.schaefer@gmail.com
- Bump version: 3.0.15 → 3.1.0
* Fri Nov 22 2024 marcus.schaefer@gmail.com
- Use custom registry for the podman pilot
Use podman in a way that it references a custom registry
only for the flakes and independent of any other registry
setup on the system. This Fixes #48
* Tue Nov 05 2024 marcus.schaefer@gmail.com
- Bump version: 3.0.14 → 3.0.15
* Tue Nov 05 2024 marcus.schaefer@gmail.com
- Fix vendoring
Use cargo-vendor-filterer crate
* Tue Nov 05 2024 marcus.schaefer@gmail.com
- Bump version: 3.0.13 → 3.0.14
* Tue Nov 05 2024 marcus.schaefer@gmail.com
- Fixed code still not using flakes config file
* Tue Nov 05 2024 marcus.schaefer@gmail.com
- Allow to mount podman storage in rootless mode
Temporary gain root permissions via sudo for mounting
and modifying instance storage. This allows for provisioning
transparent containers also for non root users but still
requires sudo to be configured properly.
* Mon Nov 04 2024 marcus.schaefer@gmail.com
- Make sure flake-ctl also reads /etc/flakes.yml
The system wide configuration file was not read by flake-ctl
only by the pilots. This commit fixes it
* Thu Jun 06 2024 marcus.schaefer@gmail.com
- Make clippy happy
assigning the result of `ToOwned::to_owned()` may be inefficient
* Thu Jun 06 2024 marcus.schaefer@gmail.com
- Bump version: 3.0.12 → 3.0.13
* Thu Jun 06 2024 marcus.schaefer@gmail.com
- Rebuild with rustls fix
The crate index was updated and the vendor source seems to have
fixed the rustls security issue. This fixes bsc#1223217
* Wed Apr 10 2024 marcus.schaefer@gmail.com
- Turn terminal flag setup into function
* Wed Apr 10 2024 marcus.schaefer@gmail.com
- Bump version: 3.0.11 → 3.0.12
* Tue Apr 09 2024 marcus.schaefer@gmail.com
- Fix race condition on connection check
* Tue Apr 09 2024 marcus.schaefer@gmail.com
- set PS1 prompt via sci env
* Tue Apr 09 2024 marcus.schaefer@gmail.com
- Add terminal settings for pty stdout in sci
disable ECHO
* Tue Apr 09 2024 marcus.schaefer@gmail.com
- Fix invalid early exit condition
* Mon Apr 08 2024 marcus.schaefer@gmail.com
- Bump version: 3.0.10 → 3.0.11
* Mon Apr 08 2024 marcus.schaefer@gmail.com
- Fix build for Leap
Issues on the gcc side for static targets, disable
sci static build for older targets, e.g Leap
* Wed Apr 03 2024 marcus.schaefer@gmail.com
- Prevent use of socat in firecracker-pilot
Do not shell out socat and use proper UnixListener/UnixStream
to do this job. This version of the commit works but I stumbled
across a few issues:
1. Permission denied when the UnixListener runs as user and the
firecracker process was called as root (run_as: root in the flake).
The former implementation ran socat via sudo in the same way as
the firecracker process. Thus if you register the flake to
run as root it can now also only be called as root, which is
acceptable.
2. The behavior in interactive sessions differs compared to socat.
When sci in the guest is called it creates a pty and all data
is copied to the vsock stream. The host connects via an UDS
socket to this data and we multiplex stdin->stream and
stream->stdout. When doing this with socat the behavior
is different in a way that e.g tabs are effectively interpreted
and the pty prompt allows for input on the same line when
my code now always needs a newline to renew the prompt.
I did not debug further what is needed to make this look
nicer.
This Fixes #8
* Wed Mar 27 2024 marcus.schaefer@gmail.com
- Bump version: 3.0.9 → 3.0.10
* Wed Mar 27 2024 marcus.schaefer@gmail.com
- Clippy fixes
* Wed Mar 27 2024 marcus.schaefer@gmail.com
- sudo is required
* Wed Mar 27 2024 marcus.schaefer@gmail.com
- Fix error handling
Make sure the real command that is called through sudo is
displayed. Also fix that the runas information is really used
* Wed Mar 27 2024 marcus.schaefer@gmail.com
- Exit on remove if there is an error
The remove sequence when used with --container or --vm deregisters
all apps associated with the container or VM first. If there is
an error on this deregistration, exit early and do not try to
delete the container/vm
* Mon Mar 25 2024 marcus.schaefer@gmail.com
- Update URL in spec file
Point to OSInside Organisation
* Mon Mar 25 2024 marcus.schaefer@gmail.com
- Bump version: 3.0.8 → 3.0.9
* Mon Mar 25 2024 marcus.schaefer@gmail.com
- Fix spec file
Several changes according to the SUSE regulations
* Mon Mar 25 2024 marcus.schaefer@gmail.com
- Fix robot tests
* Mon Mar 25 2024 marcus.schaefer@gmail.com
- Add missing %changelog line in spec
* Mon Mar 25 2024 marcus.schaefer@gmail.com
- Allow non static sci
Build sci non static for ppc64le which doesn't support
the rust static target yet
* Mon Mar 25 2024 marcus.schaefer@gmail.com
- Drop upx binary compression
Startup time seems more important than binary size on
target. The original reason for the compression was due
to very limited size constraints from a former customer
who no longer sticks to them.
* Mon Mar 25 2024 marcus.schaefer@gmail.com
- Drop obsolete gcc static fix
* Mon Mar 25 2024 marcus.schaefer@gmail.com
- Break long commandline for better readability
* Mon Mar 25 2024 marcus.schaefer@gmail.com
- Update documentation
Added a delta container example registration
* Mon Jan 29 2024 marcus.schaefer@gmail.com
- Bump version: 3.0.7 → 3.0.8
* Fri Jan 26 2024 marcus.schaefer@gmail.com
- Drop build-deb support
Building a debian package from a given oci container using the
debbuild tool was an extra helper command to turn a container
into a package. However, flake-pilot should not have this
responsibility and if it should provide it, it should be done
with the native tools from the respective distribution.
* Fri Jan 26 2024 marcus.schaefer@gmail.com
- Update README
Add information about console settings and limitations with
regards to firecracker VMs
* Fri Jan 26 2024 marcus.schaefer@gmail.com
- Add support for force vsock on firecracker pilot
The vsock communication between guest and host was established
with the firecracker pilot only for resume type registrations.
For those it's required because you cannot mux one serial
terminal between parallel applications running at the same
time in the guest. So in resume mode each call has its own
socket and channels. However, there is no reason to not also
support that type of data flow between guest and host for one
time calls which fires up the VM, starts the application and
shuts down the VM. This commit adds support for forcing the
vsock communication also for the simple app registration.
The default stays on serial though.
* Fri Jan 19 2024 marcus.schaefer@gmail.com
- Bump version: 3.0.6 → 3.0.7
* Fri Jan 19 2024 marcus.schaefer@gmail.com
- Make sure /mnt mountpoint exists for firecracker
When using an overlay sci mounts the new root to /mnt prior pivot.
Thus make sure /mnt exists as mountpoint directory in the image
at import time
* Wed Jan 17 2024 marcus.schaefer@gmail.com
- Bump version: 3.0.5 → 3.0.6
* Wed Jan 17 2024 marcus.schaefer@gmail.com
- Use raw channel fallback if pty setup failed
In resume mode the firecracker pilot uses a vsock connection
for the host <-> guest data transfer. On the guest the command
is by default called in a new PTY. However if this is not possible
e.g because the guest does not support pty allocation there
should be a fallback allocating the standard channels directly.
* Wed Jan 17 2024 marcus.schaefer@gmail.com
- Update documentation
Don't use static arch names
* Mon Jan 15 2024 marcus.schaefer@gmail.com
- Bump version: 3.0.4 → 3.0.5
* Mon Jan 15 2024 marcus.schaefer@gmail.com
- Make sure system mount point exists for sci
Reboot, terminal allocation and pivot of a firecracker machine
requires access to sysrq, pts devices and more. sci mounts all
kernel filesystems but this requires the mountpoints /proc, /sys
/dev, /dev/pts to be available. Some prebuild firecracker
images comes without these mountpoints (non FHS compliant btw).
With this commit we make sure that at registration time the image
has this mountpoint such that the sci issued system mounts
can succeed.
* Tue Jan 09 2024 marcus.schaefer@gmail.com
- Complement copyright holder
* Tue Jan 09 2024 marcus.schaefer@gmail.com
- Updates due to move from master to main
Update workflows and documentation to match the branch move
* Tue Jan 09 2024 marcus.schaefer@gmail.com
- Bump version: 3.0.3 → 3.0.4
* Wed Jan 03 2024 marcus.schaefer@gmail.com
- Update documentation
Add more details on the main idea of this version of flake-pilot
and provide a diagram to illustrate the use cases better
* Tue Jan 02 2024 marcus.schaefer@gmail.com
- Update compilation git action
Run compile step in the same way as it's done when
compiling the package, e.g sci as static binary
* Sun Dec 31 2023 marcus.schaefer@gmail.com
- Prevent use of socat in sci
Replace external socat call in sci with rust implementation
based on the pty, libc and vsock crates. This Fixes #8
* Sun Dec 31 2023 marcus.schaefer@gmail.com
- Fix workspace resolver
Edition 2021 is used in several src setup which implies
workspace resolver version 2. Make this a permanent setting
and don't let it assume an implicit resolver version
* Mon Nov 13 2023 marcus.schaefer@gmail.com
- Bump version: 3.0.2 → 3.0.3
* Mon Nov 13 2023 marcus.schaefer@gmail.com
- Fix package build
* Mon Nov 13 2023 marcus.schaefer@gmail.com
- Bump version: 3.0.1 → 3.0.2
* Fri Nov 10 2023 marcus.schaefer@gmail.com
- make shellcheck happy
* Fri Nov 10 2023 marcus.schaefer@gmail.com
- Add bash completion
Add completion for flake-ctl. This Fixes #18
* Sat Oct 28 2023 marcus.schaefer@gmail.com
- Revert "Delete kiwi-settings from build requires"
This reverts commit e5b8b146344cc1cf6736c51b2584031f80dbf6ba.
* Sat Oct 28 2023 marcus.schaefer@gmail.com
- Delete kiwi-settings from build requires
* Tue Oct 24 2023 marcus.schaefer@gmail.com
- Fixup documentation
Fix URL references
* Mon Oct 23 2023 marcus.schaefer@gmail.com
- Fixed clippy warning
call of unwrap after checking its variant with is_some()
* Mon Oct 23 2023 marcus.schaefer@gmail.com
- Update documentation
Fix changed URL to example image
* Wed Oct 11 2023 marcus.schaefer@gmail.com
- Update documentation
Package location has changed
* Sat Oct 07 2023 marcus.schaefer@gmail.com
- Force cleanup of resume type flakes
In case a resume type flake has lost its cid metadata which can
happen on e.g powerfail, the resume of the instance should cleanup
the left over container instance and start from scratch.
This Fixes #23
* Sat Oct 07 2023 marcus.schaefer@gmail.com
- Make sure perform() reports all execution data
The perform function only included the caller arguments but
did not provide stdour/stderr information in case of an
unsuccessful invocation of the command
* Sat Oct 07 2023 marcus.schaefer@gmail.com
- Update gcc static-pie workaround
Apply for gcc-12
* Thu Sep 14 2023 marcus.schaefer@gmail.com
- Document contents of /etc/flakes
Documentation for the system wide config file.
This Fixes #17
* Thu Sep 14 2023 marcus.schaefer@gmail.com
- Bump version: 3.0.0 → 3.0.1
* Thu Sep 14 2023 marcus.schaefer@gmail.com
- Consolidate common code to IO mod
* Thu Sep 14 2023 marcus.schaefer@gmail.com
- Add support for --include-path on all pilots
Allow to provision files/directories. So far only tar
archives could be used to provision arbitrary data to
the instance
* Wed Sep 13 2023 marcus.schaefer@gmail.com
- Make clippy happy on sci
* Wed Sep 13 2023 marcus.schaefer@gmail.com
- Don't mix tests with implementation
A matter of taste, but I value test code to be separated from
the actual implementation code
* Mon Sep 04 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.26 → 3.0.0
* Sat Sep 02 2023 marcus.schaefer@gmail.com
- Added support for systemwide flake config
Let podman and firecracker pilots read /etc/flakes.yml if present
to allow configuration of several general settings. Proper defaults
are encoded in case no data is provided
* Thu Aug 31 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.25 → 2.2.26
* Thu Aug 31 2023 marcus.schaefer@gmail.com
- Fixed firecracker serde schema
Allowed values for cache_type are Writeback and Unsafe
* Thu Aug 31 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.24 → 2.2.25
* Thu Aug 31 2023 marcus.schaefer@gmail.com
- Fixed firecracker provision
Check if overlay size is requested not only at creation
time of the overlay filesystem image but also at usage
time
* Thu Aug 31 2023 marcus.schaefer@gmail.com
- Delete meta authors information
The authors information at this point was used in the cli
interface and printed on the console in the usage information.
Exposing this information might be unwanted and the information
is also printed in a not well formatted way.
* Thu Aug 31 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.23 → 2.2.24
* Thu Aug 31 2023 marcus.schaefer@gmail.com
- Fixup clippy warnings
* Wed Aug 30 2023 marcus.schaefer@gmail.com
- Cleanup code
Removed out of scope and unused poc code
Fixed bumpversion setup to handle all Cargo.toml files
Update Makefile for better target readability
Fixed Cargo files to follow the major.minor dependency policy
Fixed spec file due to removal of unused poc code
* Wed Aug 30 2023 marcus.schaefer@gmail.com
- Move is_debug to common lib
Along with the change update podman and firecracker pilots
to make use of is_debug from the common space and print
debug messages through the debug! macro. The former double
formatting of the debug message broke the output display
In addition to the debug changes also a method do_trace()
was added to create trace reports. However, the method is
currently not in use as I'm still looking for a way to
create a useful trace report without spreading do_trace()
over the code
* Tue Aug 29 2023 marcus.schaefer@gmail.com
- Better error message for fs::read_dir
Added FlakeError for this condition. Related to Issue #9
* Tue Aug 29 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.22 → 2.2.23
* Tue Aug 29 2023 marcus.schaefer@gmail.com
- Improve error handling for firecracker
Ported upstream patches from Michael Meyer <mijomeyer@t-online.de>
* Tue Aug 29 2023 marcus.schaefer@gmail.com
- Refactor error handling for command execution
Apply Upstream patch from Michael Meyer <mijomeyer@t-online.de>
which consolidates further methods mkdir and chmod in the
common space and also moves error handling out of the
podman pilot into the common space
* Tue Aug 29 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.21 → 2.2.22
* Mon Aug 28 2023 marcus.schaefer@gmail.com
- Add support for %silent pilot option
Allow to switch off the progress spinner for the podman
and firecracker pilots
* Mon Aug 28 2023 marcus.schaefer@gmail.com
- Refactor pilot options handling
Add methods to read pilot options into the common space
and adapt firecracker and podman pilots to make use of
them
* Mon Aug 28 2023 marcus.schaefer@gmail.com
- podman-pilot cleanup changes
Upstream patch from Michael Meyer <mijomeyer@t-online.de>
which shortens some code parts.
* Mon Aug 28 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.20 → 2.2.21
* Mon Aug 28 2023 marcus.schaefer@gmail.com
- Firecracker sanity check
The firecracker startup procedure in resume mode needs to setup
the control channels prior launching the actual firecracker program
to allow synchronisation of guest vs. host data flow. If there is
no check that the firecracker binary exists we still perform all
the pre setup and waiting calls and the actual error condition is
only visible in debug mode. Therefore an early exit condition that
checks if there is a firecracker binary found on the host improves
the user experience. This Fixes #129
* Mon Aug 28 2023 marcus.schaefer@gmail.com
- Move errors to the common space
Allow error handling to be used on all pilots and utils
* Mon Aug 28 2023 marcus.schaefer@gmail.com
- Add static profile for building sci binary
* Mon Aug 28 2023 marcus.schaefer@gmail.com
- Fix cargo setup
Move profiles to the toplevel
Fix contributors list and mail addresses
Fix use of unused manifest key crate-type
* Mon Aug 28 2023 marcus.schaefer@gmail.com
- Fix package build
Source files from new common subdirectory were not added
to the source tarball. Thus the compile stage failed
* Mon Aug 28 2023 marcus.schaefer@gmail.com
- Consolidate actions workload files
consistent naming, the same version of actions, no missing line endings
* Mon Aug 28 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.19 → 2.2.20
* Fri Aug 25 2023 mijomeyer@t-online.de
- Extract common code
Start to refactor pilot code that is shared across multiple implementations into a common ground.
The commit here adds a common way to handle sudo based command calls properly
* Wed Aug 23 2023 ichmed95@gmail.com
- Add logging for easier debugging
* Tue Aug 22 2023 marcus.schaefer@gmail.com
- Refactor port allocation for UDS socket
When using the firecracker-pilot in a resume type flake, the pilot
creates a UDS socket for listening on data. Each of this socket
connections requires a free port. The former implementation selects
the socket by a random number within a given range. However, this
is not a stable solution and the risk to select an already occupied
port is high. This commit refactors the port allocation to
FIRECRACKER_VSOCK_PORT_START + the PID of the pilot process.
In addition the commit adds to allow to read runtime options which
are only meant to be used for the pilot and should not interfere with
the standard arguments passed along to the command call. For this
purpose we deviate from the standard Unix/Linux commandline format
and treat options passed as %name:value to be a pilot option.
This commit adds the handling of the followng pilot option:
%port:number
Allows to specify a custom UDS port used for the
VSOCK based communication channel in a firecracker flake
configured for resume mode
This Fixes #114
* Tue Aug 22 2023 mijomeyer@t-online.de
- Use serde to read config in firecracker-pilot
Move firecracker to serde
* Mon Aug 21 2023 mijomeyer@t-online.de
- Reduce source tarball size
Remove unneeded files and hollow out all windows and wasm dependencie
* Sat Aug 19 2023 mijomeyer@t-online.de
- Add integration testing based on the robot framework
Implement a first collection of flake-ctl and engine tests to run as a github action.
The implementation of the test uses the python based robot framework. The test
matrix is expected to grow
* Thu Aug 17 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.18 → 2.2.19
* Thu Aug 17 2023 mijomeyer@t-online.de
- Use one top level Cargo definition
Updated the Makefile and the .spec file to fit the new structure with a top level Cargo.toml
This also reduces the package size by combining the vendored dependencies
* Mon Aug 14 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.17 → 2.2.18
* Mon Aug 14 2023 marcus.schaefer@gmail.com
- Revert "Makefile Fix"
This reverts commit bebffd4f421b98c2d78e4d4117c4ae92fa135912.
The package build was broken due to this commit and needs
to be reverted. The original intend to consolidate the
compilation into a more rust like structure is a good change
but it needs to be done without breaking the existing
package build.
* Mon Aug 14 2023 marcus.schaefer@gmail.com
- Revert "Fix man path"
This reverts commit ef7733f78019d89276ee05f00d647dab9c790139.
* Mon Aug 14 2023 ichmed95@gmail.com
- Fix man path
* Mon Aug 14 2023 ichmed95@gmail.com
- Update .gitignore
* Fri Aug 11 2023 ichmed95@gmail.com
- Makefile Fix
* Fri Aug 11 2023 mijomeyer@t-online.de
- Flake ctl exit with a correct return code
Add failure returncodes and use them depending on the success/failed state of the action
Co-authored-by: Michael Meyer <ichmed95@gmail.com>
* Fri Aug 11 2023 mijomeyer@t-online.de
- Refactor error handling
Created error types and replace all panics, unwraps and exits with errors
Co-authored-by: Michael Meyer <ichmed95@gmail.com>
* Fri Aug 11 2023 ichmed95@gmail.com
- Moved spinners to stderr
* Mon Aug 07 2023 marcus.schaefer@gmail.com
- Keep comment format consistent
Maybe nitpick but I think consistency makes things easier.
I only adapted the comment block for this place in code
as it was mine before. There are other places which I did not touch
since I don't want to step on other peoples toes, but I recommend
that we decide for one comment format and stick to it everywhere
* Mon Aug 07 2023 mijomeyer@t-online.de
- podman-pilot: replace adhoc yaml with serde
Use serde to read and validate the flake setup when calling podman-pilot. This is related to #128
Co-authored-by: Michael Meyer <ichmed95@gmail.com>
* Wed Jul 26 2023 ichmed95@gmail.com
- match clippy action to othes
* Fri Jul 14 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.16 → 2.2.17
* Fri Jul 14 2023 marcus.schaefer@gmail.com
- Regression and partial revert from the clippy set
The changes done to make clippy happy also changed the logic
of the code at several places. This was exactly the reason
why I wanted small reviewable pull requests. The commit here
is a partial revert of the code prior the big clippy changes.
The reason for the changes here is because the template
data was was no longer imported and also options given on the
commandline were no longer added to the flake yaml file.
I reverted to the version before clippy and manually fixed
all clippy issues while testing the code to be still functional.
This is the result commit of this action.
* Fri Jul 14 2023 marcus.schaefer@gmail.com
- Update flake-ctl man page
The page was missing that we now also support firecracker
* Sun Jul 09 2023 marcus.schaefer@gmail.com
- Use rst2man instead of pandoc to render man pages
pandoc is pretty big and adds a lot of haskel lib requirements
rst2man just requires python3-docutils and is more lightweight
* Sun Jul 09 2023 marcus.schaefer@gmail.com
- Better sanity check for gcc static fix
* Sat Jul 08 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.15 → 2.2.16
* Sat Jul 08 2023 marcus.schaefer@gmail.com
- Fixed broken reading of resume config
The clippy change introduced a regression on reading the
resume option from the command. I guess a cut&paste bug
* Fri Jul 07 2023 marcus.schaefer@gmail.com
- Fixed Makefile clean target
make sure no stale Cargo.lock files will be packaged
on make package
* Fri Jul 07 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.14 → 2.2.15
* Fri Jul 07 2023 mijomeyer@t-online.de
- Fixes to the code to make clippy happy
Added linter checks via clippy and simplify the code at several places.
Also activate a github action for automated checking
* Fri Jul 07 2023 marcus.schaefer@gmail.com
- Clarify on license
Add missing license information to update_changelog.py
license is MIT in alignment with the overall flake-pilot
license. The license setting is in agreement with the
only copyright holder of the software which is the
person of this signed commit. This Fixes #125
* Wed Jul 05 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.13 → 2.2.14
* Wed Jul 05 2023 marcus.schaefer@gmail.com
- Rename oci-registry -> flake-registry
For consistency reasons, all tools are named flake-XX
and oci-registry is not only used for storing container
images but also firecracker VMs
* Wed Jul 05 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.12 → 2.2.13
* Wed Jul 05 2023 marcus.schaefer@gmail.com
- Better error message for seek os-error
* Tue Jul 04 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.11 → 2.2.12
* Tue Jul 04 2023 marcus.schaefer@gmail.com
- Create flake tmp for new registries
* Tue Jul 04 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.10 → 2.2.11
* Tue Jul 04 2023 marcus.schaefer@gmail.com
- Handle potential error on seek/write
The unconditional unwrap here is evil since it only
reports unwrap on a null value of either seek() or
write() fails. The real error message e.g "no space left"
is hidden in this case
* Mon Jul 03 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.9 → 2.2.10
* Mon Jul 03 2023 marcus.schaefer@gmail.com
- Make sure to create flakes tmp with permissions
* Mon Jul 03 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.8 → 2.2.9
* Mon Jul 03 2023 marcus.schaefer@gmail.com
- Fixed dir creation
Make sure to create the entire path
* Mon Jul 03 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.7 → 2.2.8
* Mon Jul 03 2023 marcus.schaefer@gmail.com
- Increase max retries on resume type VM
When connecting to a resume type VM for the first time, the
wait time was not long enough. Increasing the retry count
will solve this issue. If after this delay the VM is still
not responsive on the vsock it's likely an issue on the
VM startup itself and ok to close. This Fixes #122
* Sun Jul 02 2023 marcus.schaefer@gmail.com
- Fix sync output in case of an error
In case tar fails it prints relevant data to stderr.
This information should be part of the debug output
when calling with PILOT_DEBUG=1
* Sat Jul 01 2023 marcus.schaefer@gmail.com
- Move flake metadata dir to persistent location
flakes metadata was written to /tmp, but this is a
non persistent storage area (tmpfs). For resume type
instances it is required to keep the information to
allow resume a stopped container. This Fixes #119
* Fri Jun 30 2023 marcus.schaefer@gmail.com
- Add firecracker include provisioning
This commit implements reading of the flake include section
for the firecracker pilot. With the include tar support it's
possible to provision any arbitrary data into the VM instance
prior launch. For firecracker the include feature requires the
use of an overlay. This Fixes #95
* Thu Jun 29 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.6 → 2.2.7
* Thu Jun 29 2023 marcus.schaefer@gmail.com
- Don't apply gcc static fix on TW
* Thu Jun 29 2023 marcus.schaefer@gmail.com
- Disable loop feature in sys_mount
By default sys_mount supports loop devices. In sci
we don't use them and for kernel 6.x the code does
not compiled anymore and fails with:
enum_(unnamed_at_/usr/include/linux/loop_h_16_1)" is not a valid Ident
* Tue Jun 27 2023 bo@maryniuk.net
- Add flake-ctl and podman-pilot licenses
* Tue Jun 27 2023 bo@maryniuk.net
- Run SPDX sboms and list all vendor tree dependencies licenses
* Tue Jun 27 2023 bo@maryniuk.net
- Add MIT licenses to the sub-packages
* Mon Jun 26 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.5 → 2.2.6
* Sat Jun 24 2023 marcus.schaefer@gmail.com
- Fixed sci command quoting in resume mode
In resume mode sci calls commands through a vsock using
socat EXEC. This commit makes sure that the quoting of
the command string doesn't get lost and becomes effective
at socket connection time. This Fixes #113
* Thu Jun 22 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.4 → 2.2.5
* Thu Jun 22 2023 marcus.schaefer@gmail.com
- Added socat requirement
* Thu Jun 22 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.3 → 2.2.4
* Tue Jun 20 2023 marcus.schaefer@gmail.com
- Refactor sci and support resume mode
The former implementation used the vsock channel to
read the command, call it in a child and send the output
back through the vsock channel. This works until the command
is not interactive. With this refactor I propose a different
way to handle the command execution.
start vsock listener on VM_PORT, wait for command(s) in a loop
A received command turns into an socat process calling
the command with an expected listener
Example:
sudo socat UNIX-CONNECT:/run/sci_cmd_XXX.sock -
CONNECT defaults::VM_PORT(52)
- -> send the command to call and quit
sudo socat VSOCK-CONNECT:2:exec_port EXEC:cmd
- -> connects to the listener instance on the host (pilot)
The above procedure got also implemeted as
part of the firecracker-pilot resume code.
This Fixes #87
* Tue Jun 20 2023 marcus.schaefer@gmail.com
- Added instance resume process to firecracker pilot
When using a firecracker instance in resume mode the first
call has to run firecracker in the background, open a connection
to the vsock and send the command. Any subsequent call only
sends commands to the existing instance. If the instance gets
deleted the pilot has to check if the VM is still there and
behave properly. Meaning vmid (PID) and uds socket file must
be cleaned up prior launching a new instance. The commit here
implements the processing of this workflow. It does not
implement the actual connection to the instance and sending
of commands. This will follow. As of now only debug messages
telling what should happen are printed. This is related
to Issue #87
* Mon Jun 19 2023 marcus.schaefer@gmail.com
- Change name of UDS socket for vsock communication
The name of the uds socket was set to /run/sci_cmd_PID.sock
The used PID was the firecracker process ID. This name doesn't
make much sense because for one command registration there will
always be only one dedicated firecracker process instance
assigned. For the use case of --resume there can be multiple
connections through the same uds socket
* Mon Jun 19 2023 marcus.schaefer@gmail.com
- Add resume support to firecracker app registration
Write sci_resume=1 to the boot cmdline arguments if --resume
is set at app registration for the firecracker pilot.
This is related to Issue #87
* Sun Jun 18 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.2 → 2.2.3
* Sun Jun 18 2023 marcus.schaefer@gmail.com
- Fixed loading of vsock transport
Within the guest the vsock virtio transport module
must be loaded, not the vhost module
* Fri Jun 16 2023 marcus.schaefer@gmail.com
- Cleanup sci on style and consistency
Use a constant for the guest CID, properly pass the ok
status in case of an error, reduce code duplication
* Fri Jun 16 2023 marcin.katulski@gmail.com
- VSock communication on firecracker side in sci (#106)
* VSock communication on firecracker side in sci
* Fix the resume variable name
* Fixes after review
* Fixes after found bug
* Removal of unnessecary debug log
* Removing unnessecary counter
* Thu Jun 15 2023 marcin.katulski@gmail.com
- FIX for wrongly handled CID in json configuration
The CID in VM shall always be equall 3 as the connection generated by
firecracker is vsock less connection, means static cid bound on vm to
the unix domain socket bound on host
* Fri Jun 09 2023 marcus.schaefer@elektrobit.com
- Add firecracker vsock at instance startup (#105)
This commit adds the init code to create a vsock per instance.
This is related to Issue #87
* Thu May 25 2023 marcus.schaefer@gmail.com
- Fix project link
* Thu May 25 2023 marcus.schaefer@gmail.com
- update README
* Thu May 25 2023 marcus.schaefer@gmail.com
- Update README
* Thu May 25 2023 marcus.schaefer@gmail.com
- Update README
* Wed May 24 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.1 → 2.2.2
* Wed May 24 2023 marcus.schaefer@gmail.com
- Fix vm and container purge
If used together it's required to sanity check in the
different template types between vm and containers
* Tue May 23 2023 marcus.schaefer@gmail.com
- Bump version: 2.2.0 → 2.2.1
* Tue May 23 2023 marcus.schaefer@gmail.com
- Fixed setup of firecracker registry layout
For firecracker the layout looks like the following:
/var/lib/firecracker/
├── images
└── storage
The code in flake-ctl setting it up only cared for the
images subdirectory and did not allow /var/lib/firecracker
to be a symlink location
* Mon May 22 2023 marcus.schaefer@gmail.com
- Bump version: 2.1.14 → 2.2.0
* Sun May 21 2023 marcus.schaefer@gmail.com
- Update README
* Sun May 21 2023 marcus.schaefer@gmail.com
- Allow to disable networking at registration time
* Sun May 21 2023 marcus.schaefer@gmail.com
- Update man page
* Sat May 20 2023 marcus.schaefer@gmail.com
- Create overlayroot mount point on pull
As the rootfs is used read-only in firecracker the overlayroot
mountpoint cannot be created in sci
* Fri May 19 2023 marcus.schaefer@gmail.com
- Make sure to create /overlayroot
When using arbitrary rootfs images it might happen that there
is no /overlayroot mountpoint which we use in the pilot to
setup an overlay. In addition search for tools like switch_root
in the former location /sbin to stay backward compatible with
linux versions prior the /usr/sbin move. Newer linux versions
still maintains symlinks from /sbin to /usr/sbin for compat
reasons.
* Fri May 19 2023 marcus.schaefer@gmail.com
- Package sci also in pilot
Usually sci is provided as guestvm tool and the package
gets installed as part of the rootfs building. But we also
want to support adding sci to rootfs images which doesn't
provide it. Therefore also provide sci in the pilot package
that gets installed on the host
* Thu May 18 2023 marcus.schaefer@gmail.com
- Support pulling image from components
So far pulling a firecracker image was limited to the KIWI
kis image type. With this commit it's also possible to pull
an image from it's components; rootfs, kernel and optional
initrd. This allows for example to make use of the firecracker
hosted CI images or any other rootfs image in combination
with some kernel/initrd. During the pull of such an image
there is also a check for the sci binary inside of the rootfs.
If it does not exist it gets added to the rootfs such that
the firecracker-pilot can work with it. This Fixes #99
* Wed May 17 2023 marcus.schaefer@gmail.com
- Add network configuration guide
Those parts of the network setup for firecracker instances
that cannot be done in code (or out of scope for this project)
are documented with this commit as one possible example
This Fixes #76
* Wed May 17 2023 marcus.schaefer@gmail.com
- Build sci as static binary
This would allow to incorporate it into any arbitrary rootfs
* Tue May 16 2023 barthel_a@web.de
- Revision of the sci man page
* Tue May 16 2023 marcus.schaefer@gmail.com
- Bump version: 2.1.13 → 2.1.14
* Tue May 16 2023 marcus.schaefer@gmail.com
- Fixed off by one in byte_size for sparse size
* Tue May 16 2023 marcus.schaefer@gmail.com
- Update flake-ctl firecracker register man page
Update suffix format for size values
* Mon May 15 2023 marcus.schaefer@gmail.com
- Addded man page for sci guest utility
sci is used in combination with the firecracker engine
and allows to execute the registered application inside
of the guest VM. It also takes over responsiblity to
setup an eventual overlay as well as perform the shutdown
of the VM after the command execution. Further versions
of sci will also implement the vsoc communication channels
between host and guest. This commit adds a first version
of the man page to describe sci in more detail.
* Mon May 15 2023 marcus.schaefer@gmail.com
- Get rid of qemu tools to create sparse file
Use native methods to create a sparse overlay file
* Mon May 15 2023 marcus.schaefer@gmail.com
- Added dracut-netstart package for firecracker
The new package flake-pilot-firecracker-dracut-netstart
supports users with building firecracker images that supports
networking using systemd-networkd and systemd-resolved
activated and persistent inside of the initrd. This is
related to Issue #76
* Sun May 14 2023 marcus.schaefer@gmail.com
- Bump version: 2.1.12 → 2.1.13
* Sun May 14 2023 marcus.schaefer@gmail.com
- Create resolver link in sci
* Sun May 14 2023 marcus.schaefer@gmail.com
- Bump version: 2.1.11 → 2.1.12
* Sun May 14 2023 marcus.schaefer@gmail.com
- Fixed sci filesystem propagation
Make sure /run is used from the initrd if present and only
if not create a fresh tmpfs mount. This is required to e.g
hand over resolver information created in the initrd via
systemd-resolved, but also other runtime data from the initrd
should be available to the system if present
* Sun May 14 2023 marcus.schaefer@gmail.com
- Bump version: 2.1.10 → 2.1.11
* Sun May 14 2023 marcus.schaefer@gmail.com
- Fixed handing of tap names
make sure each instance uses its own tap name.
* Sun May 14 2023 marcus.schaefer@gmail.com
- Bump version: 2.1.9 → 2.1.10
* Sun May 14 2023 marcus.schaefer@gmail.com
- Add default network setup
Use initrd options rd.neednet=1 ip=dhcp to let systemd inside
of the initrd know how to setup the network. This design requires
the firecracker image to use an initrd and that initrd must use
systemd (typically created by dracut) in order to process the
above cmdline arguments. If this concept is not acceptable by
the users use case (e.g no initrd wanted) then the user needs
to provide its own network setup mechanics as part of the
firecracker rootfs image and also need to find a way to activate
it prior launching the application, e.g by using systemd instead
of sci as the init process.
* Sun May 14 2023 marcus.schaefer@gmail.com
- don't panic in sci
In case of an error report and reboot because otherwise the
firecracker process blocks forever on the running console
* Sun May 14 2023 marcus.schaefer@gmail.com
- Handle all boot args in the flake yaml
* Sat May 13 2023 marcus.schaefer@gmail.com
- Fix indentation
* Sat May 13 2023 marcus.schaefer@gmail.com
- Fix menu
* Sat May 13 2023 marcus.schaefer@gmail.com
- Add doc link to README
* Sat May 13 2023 marcus.schaefer@gmail.com
- Update README
* Sat May 13 2023 marcus.schaefer@gmail.com
- Update README
* Sat May 13 2023 marcus.schaefer@gmail.com
- Bump version: 2.1.8 → 2.1.9
* Sat May 13 2023 marcus.schaefer@gmail.com
- Do not compress sci binary
When used without an initrd it's not possible for the kernel
to run the binary if it was upx compressed. For further
details also let sci print the user env in debug mode
* Fri May 12 2023 marcus.schaefer@gmail.com
- Bump version: 2.1.7 → 2.1.8
* Fri May 12 2023 marcus.schaefer@gmail.com
- Fix firecracker initrd_path serialization
Make sure initrd_path is not written at all if empty
* Fri May 12 2023 marcus.schaefer@gmail.com
- Fix build on ubuntu/debian
* Fri May 12 2023 marcus.schaefer@gmail.com
- Bump version: 2.1.6 → 2.1.7
* Fri May 12 2023 marcus.schaefer@gmail.com
- Handle wait result better
* Fri May 12 2023 marcus.schaefer@gmail.com
- Fix firecracker package requirements
* Fri May 12 2023 marcus.schaefer@gmail.com
- Bump version: 2.1.5 → 2.1.6
* Fri May 12 2023 marcus.schaefer@gmail.com
- Fixed bumpversion config
wrong path to guestvm tools for firecracker
* Fri May 12 2023 marcus.schaefer@gmail.com
- Add firecracker-pilot to bumpversion
* Thu May 11 2023 marcus.schaefer@gmail.com
- Fixed app registration
Check if app path exist prior trying to register
* Wed May 10 2023 marcus.schaefer@gmail.com
- Add firecracker-pilot launcher
The firecracker-pilot launcher binary will run the registered
application through firecracker. This Fixes #86
* Thu May 04 2023 marcus.schaefer@gmail.com
- Add flake-ctl firecracker register/remove
Add app registration/removal for the firecracker engine
This Fixes #84
* Thu May 04 2023 marcin.katulski@gmail.com
- firecracker-service manual page (#88)
* firecracker-service manual page
* Fixes after review
* Fix after review adding man page to package
* Thu May 04 2023 Andre.Barthel@elektrobit.com
- .spec file fix
* Wed May 03 2023 marcus.schaefer@gmail.com
- Add compile step to CI workflow
* Tue May 02 2023 marcus.schaefer@gmail.com
- Added support for flake-ctl firecracker pull
Added the pull command for the firecracker engine to download
and register remote firecracker images into a local storage
location below /var/lib/firecracker/images. This Fixes #83
* Tue May 02 2023 marcus.schaefer@gmail.com
- Fixed podman specific man pages
Some man pages still contains non engine specific section names
* Thu Apr 27 2023 marcus.schaefer@gmail.com
- Add firecracker guest VM tools package
Add flake-pilot-firecracker-guestvm-tools sub-package
providing tools needed inside of the firecracker VM
image to help implementing the application launcher
workflow
* Thu Apr 27 2023 marcus.schaefer@gmail.com
- Use an extra cmdline argument to handle the call
To avoid conflicts with other code reading proc/cmdline it
is more stable to introduce our own run=... argument and
parse that in a shell like way. To do this the shell_words
crate is used.
* Thu Apr 27 2023 marcus.schaefer@gmail.com
- Maintain /overlayroot as package directory
Create and maintain the /overlayroot mountpoint
directory in the flake-pilot-firecracker package
* Wed Apr 26 2023 marcus.schaefer@gmail.com
- Fixed sci setup and command execution
sci was a bit too picky on mounting proc, sys and run.
If called from within an initrd it could happen that these
mountpoints already exists. I turned this condition into
a warning rather an error. Furthermore sci executes itself
when the idea was that sci executes a given command. I
refactored the code to allow calling a given command and
also let the firecracker instance shut down after the
command execution. The code also leaves two TODO code
points which I'd like to fix later and together with the
team
* Wed Apr 26 2023 marcus.schaefer@gmail.com
- Fixed use of static variables
* Wed Apr 26 2023 marcus.schaefer@gmail.com
- Package firecracker service command interface
sci is used as VM init tool to prepare the command
execution environment, e.g overlay and actually call
the given command
* Wed Apr 26 2023 extern.marcin.katulski@elektrobit.com
- Correct the folder naming
* Wed Apr 26 2023 extern.marcin.katulski@elektrobit.com
- Fixes after review
* Fri Apr 21 2023 extern.marcin.katulski@elektrobit.com
- Newline at the end of bump version file
* Fri Apr 21 2023 extern.marcin.katulski@elektrobit.com
- Update bump version for sci tool
* Fri Apr 21 2023 extern.marcin.katulski@elektrobit.com
- SCI implementation
Simple Command Init purpose is to mount proper system folders and the
overlay fs if such has been configured and provided by the kernel boot
arguments and start the Simple Command Executor
* Fri Apr 21 2023 marcus.schaefer@gmail.com
- Bump version: 2.1.4 → 2.1.5
* Fri Apr 21 2023 marcus.schaefer@elektrobit.com
- Refactor packaging (#73)
Provide sub-packages flake-pilot-podman and flake-pilot-firecracker
This Fixes #72
* Wed Apr 19 2023 marcus.schaefer@gmail.com
- Bump version: 2.1.3 → 2.1.4
* Tue Apr 18 2023 marcus.schaefer@gmail.com
- Fetch output channels when pulling
In case of an error, panic including the error message.
In any other case suppress the pull messages. In debug
mode show the pull command for reproducibility
* Tue Apr 18 2023 marcus.schaefer@gmail.com
- Log prune results in debug mode
* Tue Apr 18 2023 marcus.schaefer@gmail.com
- Make sure prune errors are logged in debug mode
* Tue Apr 18 2023 marcus.schaefer@gmail.com
- Handle error condition of podman image exists
The call should actually never fail but if it does we
should not continue
* Mon Apr 17 2023 marcus.schaefer@gmail.com
- Make sure container layer get pulled in
If using additional container layers, the launcher should
make sure they get pulled if not yet done.
* Fri Apr 14 2023 marcus.schaefer@gmail.com
- Bump version: 2.1.2 → 2.1.3
* Fri Apr 14 2023 marcus.schaefer@gmail.com
- Use XFS for oci-registry
* Fri Apr 14 2023 marcin.katulski@gmail.com
- Service communication implementation (#70)
* Service communication implementation
Protocol implementation with three base commands, register/unregister to
store information about runnig vm's at the moment, ps to list running
vm's
* Cargo toml cleanup, removal of unused crates
* Added missing newline at the end of lib.rs
* Fixes after review
- --------
Co-authored-by: Marcin Katulski <extern.marcin.katulski@elektrobit.com>
* Fri Apr 07 2023 marcin.katulski@gmail.com
- Initial commit with firecracker-service (#69)
* Initial commit with firecracker-service
Base skeleton for firecracker-service
* Cleaned up names for stdout and stderr
* Fixes after review
- --------
Co-authored-by: Marcin Katulski <extern.marcin.katulski@elektrobit.com>
* Wed Apr 05 2023 marcus.schaefer@gmail.com
- Bump version: 2.1.1 → 2.1.2
* Tue Apr 04 2023 marcus.schaefer@gmail.com
- Add support for --info to podman register command
If provided in the container the --info command will print
the embedded default registration information. Along with
the change some refactoring on the option handling as well
as moving code engine specific vs. generic registration
implementation. This Fixes #67
* Sat Apr 01 2023 marcus.schaefer@gmail.com
- Update README
* Sat Apr 01 2023 marcus.schaefer@gmail.com
- Update README
* Fri Mar 31 2023 marcus.schaefer@gmail.com
- Bump version: 2.1.0 → 2.1.1
* Fri Mar 31 2023 marcus.schaefer@gmail.com
- Added shellcheck action
* Fri Mar 31 2023 marcus.schaefer@gmail.com
- Add oci-registry utility
Create, activate and deactivate OCI read-write storage
This Fixes #66
* Fri Mar 31 2023 marcus.schaefer@gmail.com
- Increase spinner scope
* Thu Mar 30 2023 marcus.schaefer@gmail.com
- Add spinner to feedback user on progress
Add a spinner to show progress during provisioning
This Fixes #59
* Thu Mar 30 2023 marcus.schaefer@gmail.com
- Suppress podman start output if detached
Do not show the podman start output of the container
gets started in detached mode. podman by default prints
the container ID to stdout but podman-pilot already
knows it and it's useless information for the user
* Thu Mar 30 2023 marcus.schaefer@gmail.com
- Bump version: 2.0.5 → 2.1.0
* Thu Mar 30 2023 marcus.schaefer@gmail.com
- Fixup bumpversion
* Thu Mar 30 2023 marcus.schaefer@elektrobit.com
- Fixed github workflow due to name change
* Thu Mar 30 2023 marcus.schaefer@elektrobit.com
- Add flake-pilot-rpmlintrc
* Thu Mar 30 2023 marcus.schaefer@elektrobit.com
- Rename oci-pilot -> podman-pilot
This Fixes #60
* Thu Mar 30 2023 marcus.schaefer@elektrobit.com
- Rename oci-ctl -> flake-ctl
* Thu Mar 30 2023 marcus.schaefer@elektrobit.com
- Update packaging due to name change
* Thu Mar 30 2023 marcus.schaefer@elektrobit.com
- Update manual pages due to name changes
* Thu Mar 30 2023 marcus.schaefer@elektrobit.com
- Cleanup README to match name changes
* Thu Mar 30 2023 marcus.schaefer@elektrobit.com
- Bump version: 2.0.4 → 2.0.5
* Thu Mar 30 2023 marcus.schaefer@elektrobit.com
- Update README
* Wed Mar 29 2023 marcus.schaefer@elektrobit.com
- Add support for podman settings on the commandline
Allow to specify podman runtime options as part of the flake
registration. This Fixes #41
* Tue Mar 28 2023 marcus.schaefer@elektrobit.com
- Add support for user setting on the commandline
Allow to specify --run-as username as part of the flake
registration. This Fixes #54
* Tue Mar 28 2023 marcus.schaefer@elektrobit.com
- Update lock files due to version bump
* Tue Mar 28 2023 marcus.schaefer@elektrobit.com
- Bump version: 2.0.3 → 2.0.4
* Tue Mar 28 2023 marcus.schaefer@elektrobit.com
- Fix reading of flake directory
* Mon Mar 27 2023 marcus.schaefer@elektrobit.com
- Update lock files due to version bump
* Mon Mar 27 2023 marcus.schaefer@elektrobit.com
- Bump version: 2.0.2 → 2.0.3
* Mon Mar 27 2023 marcus.schaefer@elektrobit.com
- Update manual pages
less duplication of information and update of new options
* Mon Mar 27 2023 marcus.schaefer@elektrobit.com
- Add support for includes on commandline
Allow to specify --include-tar as part of the
flake registration
* Mon Mar 27 2023 marcus.schaefer@elektrobit.com
- Add support for includes
Allow to include custom tarball to provision container.
This Fixes #52
* Mon Mar 27 2023 marcus.schaefer@elektrobit.com
- Fixed build
Make sure flake directory is created
* Mon Mar 27 2023 marcus.schaefer@elektrobit.com
- Install flake templates to /etc/flakes
* Mon Mar 27 2023 marcus.schaefer@elektrobit.com
- Follow symlinks to reach flake registry
* Mon Mar 27 2023 marcus.schaefer@elektrobit.com
- Fix README due to namespace changes
* Mon Mar 27 2023 jiyang.liu@elektrobit.com
- Add missing subcommands in examples
* Fri Mar 24 2023 marcus.schaefer@elektrobit.com
- cargo has updated the lock files
* Fri Mar 24 2023 marcus.schaefer@elektrobit.com
- Bump version: 2.0.1 → 2.0.2
* Fri Mar 24 2023 marcus.schaefer@elektrobit.com
- Update package spec
Distinguish the flake template by a namespace
* Fri Mar 24 2023 marcus.schaefer@elektrobit.com
- Refactor user interface
Add a namespace to distinguish between runtime engines.
The currently supported runtime engine is podman.
This Fixes #44
* Fri Mar 24 2023 marcus.schaefer@elektrobit.com
- Update pilot documentation
* Fri Mar 24 2023 marcus.schaefer@elektrobit.com
- Update oci-pilot due to flake format changes
The container flake format got its own namespace.
Follow the change in the pilot launcher
* Fri Mar 24 2023 marcus.schaefer@elektrobit.com
- Refactor container flake file
Provide flakes for a container engine inside of a
container namespace
* Thu Mar 23 2023 marcus.schaefer@elektrobit.com
- Add commandline switches for attach/resume setting
Allow to specify --attach or --resume setting at app
registration. This Fixes #48 and Fixes #39
* Wed Mar 22 2023 marcus.schaefer@elektrobit.com
- Fixed yaml writing
Don't unwrap on None value
* Tue Mar 21 2023 marcus.schaefer@elektrobit.com
- Refactor yaml processing
Use serde for reading/writing yaml content.
This Fixes #40
* Sun Mar 19 2023 marcus.schaefer@elektrobit.com
- Refactor resume behavior
Allow calling the application with different caller options
in the same container instance. This Fixes #45
* Sun Mar 19 2023 marcus.schaefer@elektrobit.com
- Seek to start of tempfile prior reading
* Fri Mar 17 2023 marcus.schaefer@elektrobit.com
- Take all removed files into consideration
During delta provisioning take all removed files information
from all containers used in the provisioning process into
account. This Fixes #46
* Fri Mar 17 2023 marcus.schaefer@elektrobit.com
- Fixed section name, layers vs. layer
* Fri Mar 17 2023 marcus.schaefer@elektrobit.com
- Allow multiple container layers for provisioning
So far delta containers can be provisioned against one base
container and optional host dependencies. However when creating
delta of deltas this introduces additional layers that needs to
be taken into account for provisioning the container.
This Fixes #43
* Wed Mar 08 2023 marcus.schaefer@elektrobit.com
- Change the filename of the removed file reference
In line with the changes proposed to kiwi from here
https://github.com/OSInside/kiwi/pull/2252
the file name to store removed files has been changed
from 'vanished' to 'removed'
* Sat Mar 04 2023 marcus.schaefer@elektrobit.com
- Fix package requires
Needs rsync
* Thu Mar 02 2023 marcus.schaefer@elektrobit.com
- Provide info message when removing an app
* Wed Mar 01 2023 marcus.schaefer@elektrobit.com
- Generate proper changes information
* Wed Mar 01 2023 marcus.schaefer@elektrobit.com
- Update man pages
Add information about PILOT_DEBUG
* Wed Mar 01 2023 marcus.schaefer@elektrobit.com
- Only attach to running containers
* Wed Mar 01 2023 marcus.schaefer@elektrobit.com
- Add debugging information
If the env variable PILOT_DEBUG is set this will cause
more details about the container startup and provisioning
* Wed Mar 01 2023 marcus.schaefer@elektrobit.com
- Handle static file names in defaults
Put the name of the host dependencies file to defaults
* Wed Mar 01 2023 marcus.schaefer@elektrobit.com
- Refactor container startup
Delete the concept of respawn. We had respawn to support
restart of a container that could not be attached. However
with the changes to startup via create -> start (attached)
respawn became obsolete
* Tue Feb 28 2023 marcus.schaefer@elektrobit.com
- Added sync_host to resolve host dependencies
Based on the presence of a file containing information about
the host dependencies a provision step to include that information
into the instance to startup is performed.
This is related to Issue #37
* Tue Feb 28 2023 marcus.schaefer@elektrobit.com
- Cleanup dangling containers
podman keeps a dangling <none> container in the registry
on update. Make sure there is a clean state after pull
* Tue Feb 28 2023 marcus.schaefer@elektrobit.com
- Don't suppress error messages
Error messages from podman regarding the command call
should not be suppressed
* Mon Feb 27 2023 marcus.schaefer@elektrobit.com
- Added SBOM creation as github action
Make use of the cargo-bom tool to create a bill of materials
such that it becomes possible to check CVE information against
the build of oci-pilot
* Thu Feb 23 2023 marcus.schaefer@elektrobit.com
- Update man pages
* Thu Feb 23 2023 marcus.schaefer@elektrobit.com
- Added --base option to registration
* Thu Feb 23 2023 marcus.schaefer@elektrobit.com
- Added pull command to oci-ctl
Pull from remote registry. The command exists for convenience
reasons. As we currently only support the podman engine the
same could be achieved by podman pull
* Mon Feb 20 2023 marcus.schaefer@elektrobit.com
- Implement delta container support
Allow to orchestrate a container instance from a base
and a delta container
* Sat Feb 18 2023 marcus.schaefer@elektrobit.com
- Refactor resume/respawn
Change container startup to use create followed by start.
This allows to handle the delta containers which follows
next.
* Tue Jan 17 2023 marcus.schaefer@elektrobit.com
- Delete obsolete debian target from Makefile
Formerly used to build debian style package sources.
But this data was never maintained and suffered from
bitrot
* Tue Jan 17 2023 marcus.schaefer@elektrobit.com
- Bump version: 1.0.1 → 1.2.1
* Tue Jan 17 2023 marcus.schaefer@elektrobit.com
- Run engine through sudo
Run engine (e.g podman) through sudo and allow custom
user setting. This Fixes #33
* Sat Jan 14 2023 marcus.schaefer@elektrobit.com
- Added support for resume/respawn
Using resume in the flake setup will re-attach to the running
container instead of starting a new one. This setting is useful
for interactive container sessions as well as for long running
processes, e.g services. This addresses parts of Issue #32
* Fri Dec 16 2022 jiyang.liu@electrobit.com
- Fix typos
* Mon Dec 12 2022 marcus.schaefer@elektrobit.com
- Update README
* Fri Dec 02 2022 marcus.schaefer@elektrobit.com
- Add copyright notice pointing to Elektrobit
* Mon Oct 24 2022 marcus.schaefer@elektrobit.com
- Delete unused and outdated debian package setup
oci-pilot is build using .spec through debbuild. The
old debian based package data was not maintained anymore
as the original maintainer vanished. Keeping old and
unmaintained information is source for trouble. Thus
I'm afraid it needs to go
* Mon Oct 24 2022 marcus.schaefer@elektrobit.com
- Fix engine option handling
Runtime options were handled as hash values whereas the
hash key was used as option name and the hash value as
optional option value. This concept does not work for
options that can be specified multiple times because the
hash key must be unique or when options must be in order.
This commit changes the option handling such that the options
are provided as simple list values. Each value of the list
uses a space to separate the option name from its value.
The split by space happens only once and produces a tuple.
This Fixes #28
* Sat Oct 08 2022 marcus.schaefer@elektrobit.com
- Fix spec file requires
* Sat Sep 10 2022 marcus.schaefer@elektrobit.com
- Build binary only in build-deb
* Sat Sep 10 2022 marcus.schaefer@elektrobit.com
- Allow to register default entrypoint
Some containers provides a default entrypoint. To allow
using this entrypoint we can specify just "/" as target
path
* Sat Sep 10 2022 marcus.schaefer@elektrobit.com
- Prevent / in CONTAINER_NAME
Replace with _ character
* Mon Aug 29 2022 marcus.schaefer@elektrobit.com
- Added build arch option to build-deb
Add support for --arch option in build-deb. This option
allows to specify the package build arch. If not specified
the information from uname -m is taken as default
* Fri Aug 26 2022 marcus.schaefer@gmail.com
- Reduce binary size for oci-ctl and oci-pilot
The changes reduces the release binary size a lot
* Fri Aug 26 2022 marcus.schaefer@elektrobit.com
- Fix use of term OCI image and OCI container
* Tue Aug 23 2022 marcus.schaefer@gmail.com
- Added manual pages
Add man pages for all commands and integrate them with
the package build. This Fixes #17
* Mon Aug 22 2022 marcus.schaefer@gmail.com
- Refactor yaml configuration format
This is related to Issue #17 and changes the yaml
config file format to the format shown in the following
example:
```yaml
container: name
target_app_path: path/to/program/in/container
host_app_path: path/to/program/on/host
runtime:
podman:
- -storage-opt: size=10G
- -rm:
- ti:
```
The new attribute "host_app_path" was required to
allow the purge command to work correctly if the
app path inside of the container is different than
the path used on the host.
* Fri Aug 19 2022 marcus.schaefer@gmail.com
- Fixed Cargo.toml glob setting
typo in version statement leading to compile time warnings
* Fri Aug 19 2022 marcus.schaefer@gmail.com
- Fixed remove command
The remove command did not delete the main config file
only the pilot link and the config .d directory. In addition
the removing code was not strict enough on checking if the
provided app path is really something that should be deleted
by oci-ctl. Thus I also added sanity checks to prevent
accidental deletion of arbitrary files on the system
* Fri Aug 19 2022 marcus.schaefer@gmail.com
- Add support for oci-ctl list
List all registered applications. This Fixes #21
* Thu Aug 18 2022 marcus.schaefer@gmail.com
- Fixed space issues and add docstrings for methods
* Thu Aug 18 2022 marcin.katulski@gmail.com
- Implement removal of single registered app link (#23)
Implement removal of single registered app link. Also implement container purge functionality
This Fixes #13
* Thu Aug 18 2022 marcus.schaefer@gmail.com
- Add oci-ctl build subcommand (#22)
Implements building a debian package including oci-pilot
app registration hooks from a given OCI container tar file.
The produced package(s) will be organized as local debian
repository such that they can be consumed via apt.
This Fixes #18
* Thu Jul 28 2022 marcus.schaefer@gmail.com
- Fixed reading runtime section
* Wed Jul 27 2022 marcus.schaefer@gmail.com
- Refactor register subcommand
Follow the change of the oci-pilot refactoring and
adapt the registration code. The registration of an
app now performs the following steps:
1. Create the app symlink pointing to /usr/bin/oci-pilot
2. Create the app config file and custom app config.d directory
* Wed Jul 27 2022 marcus.schaefer@gmail.com
- Rename oci-register to oci-ctl
* Wed Jul 27 2022 marcus.schaefer@gmail.com
- refactor pilot link structure and config file
The former implementation of osc-pilot did not require
an app config file and solved the required parts of
a registration by a symlink name structure. However,
this concept is not flexible enough and will now be
changed. In this commit the osc-pilot code changed
in two ways:
1. The app symlink must point to the osc-pilot binary
2. The osc-pilot binary requires an app config below
/usr/share/flakes supporting the following structure
/usr/share/flakes
├── app.d
│ └── custom.yaml
└── app.yaml
app.yaml is mandatory and created when registering
the app. The optional app.d directory allows to add
additional config information which could be provided
via external packages. All yaml snippets are combined
to one prior passing to the yaml parser. The files
in app.d are read in alpha sort order.
* Wed Jul 20 2022 marcus.schaefer@gmail.com
- Implement oci-register register subcommand
This commit implements the symlink procedure to register
a container application. This Fixes #12
* Wed Jul 20 2022 marcus.schaefer@gmail.com
- fixed function doc
* Wed Jul 20 2022 marcus.schaefer@gmail.com
- Improve usage message
* Wed Jul 20 2022 marcus.schaefer@gmail.com
- Change location for optional app config file
Read config file from /usr/share/flakes/APP.yaml
* Tue Jul 19 2022 marcus.schaefer@gmail.com
- Install to /usr/bin
* Tue Jul 19 2022 marcus.schaefer@gmail.com
- Fixed package build
Cleanup Makefile, de-duplicate source tar setup
and fixed spec file and rules file for new sourcetar
* Tue Jul 19 2022 naderinsa@gmail.com
- Add debian target to Makefile
This enables building a non-native debian package for oci-pilot.
* Tue Jul 19 2022 marcus.schaefer@gmail.com
- Add init method prior registration task
For creating the symlink structure to a container application
a directory is needed which stores the container symlinks. This
commit adds the needed init method to create this directory prior
any registration tasks. All container symlinks will be stored
in /usr/share/flakes. This means an application link structure
for "app@container" would look like this:
/usr/bin/app -> /usr/share/flakes/container -> /usr/bin/oci-pilot
A flake is also the name we invented to handle and package
OCI containers which gets managed by oci-pilot
* Tue Jul 19 2022 marcus.schaefer@gmail.com
- Implementation for oci-register load
The load subcommand calls podman to load the given
OCI tarball into the local registry
* Tue Jul 19 2022 marcus.schaefer@gmail.com
- Added basic CLI implementation interface
Add structure and method bodies to implement commandline
capabilities
* Mon Jul 18 2022 marcus.schaefer@gmail.com
- Added unit testing via actions
* Sat Jul 16 2022 marcus.schaefer@gmail.com
- Added initial cli interface for oci-register
Use a command based positional cli interface
supporting sub-commands and its options
* Sat Jul 16 2022 marcus.schaefer@gmail.com
- Restructure source tree
Move launcher to oci-pilot for consistency
* Fri Jul 15 2022 naderinsa@gmail.com
- Add install & uninstall targets to Makefile
* Fri Jul 15 2022 naderinsa@gmail.com
- Add test target to Makefile
* Fri Jul 15 2022 naderinsa@gmail.com
- Add build & clean targets to Makefile
* Tue Jul 12 2022 marcus.schaefer@gmail.com
- Support program runtime config file
Options to control how podman starts the container can now be
provided as /etc/pilot/program_name.yaml like the following
example shows:
runtime:
- -storage-opt: size=10G
- -rm:
If no runtime configuration exists the following defaults apply
* Container resources will be automatically deleted after the call.
* Interactive sessions will be allowed
* Tue Jul 12 2022 marcus.schaefer@gmail.com
- Fixed launcher_test example link structure
The pilot binary was renamed to oci-pilot. The symlinks got
forgotten. This commit fixes it
* Mon Jul 11 2022 marcus.schaefer@gmail.com
- Rename to oci-pilot
* Mon Jul 11 2022 marcus.schaefer@gmail.com
- Add packaging infrastructure
Adds a "make package" target which produces all files
needed to build pilot with vendoring. Simple copy all
files produced below the package/ directory and put
them into OBS.
* Sun Jul 10 2022 marcus.schaefer@gmail.com
- Add tests for app_path and container_link
* Sun Jul 10 2022 marcus.schaefer@gmail.com
- Refactor source structure
* Fri Jul 08 2022 marcus.schaefer@gmail.com
- Allow to search in path
* Tue Jul 05 2022 marcus.schaefer@gmail.com
- Added more launcher examples
* Tue Jul 05 2022 marcus.schaefer@gmail.com
- More flexible symlink structure
* Tue Jul 05 2022 marcus.schaefer@gmail.com
- Added pilot launcher
Run container according to a symlink structure
/overlayroot /usr/sbin/sci /usr/share/man/man8/sci.8.gz
Generated by rpm2html 1.8.1
Fabrice Bellet, Sat Nov 14 01:22:13 2026