2.0.0

aleph-vm 2.0 restructures the orchestrator into two services, an agent (network-facing: messages, allocations, HTTP API) and a supervisor (host-facing: VMs, networking, disks) that communicate over gRPC. On top of this split, this release ships a Rust implementation of the supervisor and VM controller, SEV-SNP confidential instances with measured boot and remote attestation, the new V-PROGRAM verifiable workload type, NUMA-aware placement, and multi-disk storage pools.

⚠️ Breaking changes and upgrade notes

• Legacy X-Auth-Signature scheduler authentication is removed (#1133). Schedulers and tooling must authenticate with Authorization: Aleph-EIP191-V1 signatures (available since 1.13, where the legacy path already logged deprecation warnings).
• Instances are QEMU-only. Firecracker-based persistent VMs (persistent programs, and instances created before 1.11 without an explicit hypervisor) are not re-adopted after the upgrade and cannot be restarted on 2.0. Stop or migrate them before upgrading. Ephemeral (on-demand) programs still run on Firecracker as before.
• Downgrading to 1.x is not supported once 2.0 has run: the agent's execution records are not readable by the 1.x supervisor.
• The in-place upgrade from 1.15.0 was validated on live nodes: running QEMU and SEV instances are re-adopted by the new supervisor without a reboot, keeping their processes, disks, addresses and port forwards.

✨ Agent / supervisor split

The monolithic orchestrator is now two systemd services with a strict boundary (#981, #1012):

• The supervisor is message-free: it manages VMs from self-contained specs and knows nothing about the Aleph network (#950-#997).
• Each actor owns its own database; no cross-actor table access (#1009, #1010).
• Resource reservations (#1020), backups (#1151) and guest IPv6 allocation (#1139) moved to the side of the boundary that owns them.
• VMs are admitted against available disk, memory and vCPUs before their resources are downloaded (#1153).
• Reattachment after a supervisor restart is hardened: per-VM failure isolation, bounded retries, live controllers re-adopted instead of clobbered, SEV VMs and GPU attachments included (#1001-#1008, #1023, #1085).

🦀 Rust supervisor and controller

• A Rust implementation of the supervisor daemon, feature-complete for QEMU workloads: lifecycle, nftables, backups, confidential VMs (#1021-#1028).
• A Rust VM controller with argv parity for plain, SEV/SEV-ES and SEV-SNP QEMU launches; it is now the launch path for persistent QEMU VMs (#1030-#1032).
• The deb ships both implementations. Selection is one line in /etc/aleph-vm/supervisor.env: ALEPH_VM_SUPERVISOR_IMPL=rust || python (default: rust).
• NUMA-aware placement: topology discovery, pack-first placement, cpuset pinning, memory binding and opt-in hugepages with configurable headroom (#1037, #1038, #1058).
• alephctl, a debug CLI for the supervisor gRPC socket (#1039, #1086).

🔐 SEV-SNP confidential instances

Confidential computing moves from SEV to full SEV-SNP with measured boot:

• SNP host launch with automatic backend selection and host-derived C-bit position (#1035, #1040).
• A reproducible, measured Nix guest image (OVMF + kernel + initrd) with a hardened in-guest attestation agent (#1034); launch measurements are golden-file checked in CI (#1163, #1164, #1166).
• Instance disks are LUKS-encrypted; the disk secret is injected by the owner only after verifying the attestation report (#1128, #1129).
• The kernel command line is fixed and measured; per-instance parameters travel out-of-band (#1130, #1131).
• The QEMU CPU model is part of the measurement and selected from the message (#1145).
• attest-cli verifies reports against the pinned AMD ARK root before any secret is sent (#1033, #1036).
• Guest kernel on LTS 6.18 with an evaluation-time security floor and 32-bit syscall entry paths compiled out (#1117-#1122).

🧾 V-PROGRAM: verifiable programs

A new workload type where the entire stack, image and application, is measured and remotely attestable:

• Runtime bundle tooling and a typed manifest format (#1050, #1123), with two workload contracts: aleph.exec/1 (#1077) and aleph.compose/1 for Docker Compose workloads (#1132).
• The workload ships as a dm-verity volume whose root hash is part of the measured kernel command line (#1072, #1073, #1075, #1076).
• SEV-SNP launch path and scheduler support, including SNP vCPU advertising (#1052, #1071).
• The attestation port is mapped to a host IPv4 port (#1079) and guests get static IPv6 via per-tap DHCPv6 + RA (#1087).

💾 Storage

• Multi-disk volume pools: VM storage can spread over several disks via ALEPH_VM_VOLUME_POOLS, with media classes and Firecracker pinned to pool 0 (#1049, #1064, #1067, #1069).
• The agent has sole ownership of a VM's disks; the supervisor only quiesces guests for backups (#1149, #1151).

🐛 Bug fixes

• Report FAILED instead of hanging when a controller unit dies (#1152).
• Return 404, not 500, for /vm/<hash> when the network has no such message (#1165).
• Retry a failed SNP vCPU probe instead of caching the failure forever (#1150).
• Never collect stale migration export artifacts as source disks (#1066).
• Record the owner identity of confidential VMs before resource download (#987) and register them early so they are not destroyed while awaiting owner initialization (#985).
• Return 400 on invalid restore images (regression fix, #998).

🔧 Internal

• Typed error refactor across the Rust workspace: every subsystem has a dedicated error type and no untyped errors reach the wire (#1088-#1113).
• A current-architecture documentation set replaces the historical plans (#1115, #1116).
• CodeQL scope, shellcheck gating and droplet CI cleanups (#1017, #1045, #1048, #1056, #1057).

How to upgrade

1. Upgrade the packages

Auto detect

wget -qO /tmp/crn_upgrade.sh https://raw.githubusercontent.com/aleph-im/aleph-vm/main/scripts/crn_upgrade.sh && sudo bash /tmp/crn_upgrade.sh --version 2.0.0

This part did not change, download and install the new package as usual.

On Debian 13 (Trixie):

rm -f /opt/aleph-vm.debian-13.deb
wget -P /opt https://github.com/aleph-im/aleph-vm/releases/download/2.0.0/aleph-vm.debian-13.deb
apt install /opt/aleph-vm.debian-13.deb

On Debian 12 (Bookworm):

rm -f /opt/aleph-vm.debian-12.deb
wget -P /opt https://github.com/aleph-im/aleph-vm/releases/download/2.0.0/aleph-vm.debian-12.deb
apt install /opt/aleph-vm.debian-12.deb

On Ubuntu 24.04 (Noble Numbat):

sudo rm -f /opt/aleph-vm.ubuntu-24.04.deb
sudo wget -P /opt https://github.com/aleph-im/aleph-vm/releases/download/2.0.0/aleph-vm.ubuntu-24.04.deb
sudo apt install /opt/aleph-vm.ubuntu-24.04.deb

On Ubuntu 22.04 (Jammy Jellyfish):

sudo rm -f /opt/aleph-vm.ubuntu-22.04.deb
sudo wget -P /opt https://github.com/aleph-im/aleph-vm/releases/download/2.0.0/aleph-vm.ubuntu-22.04.deb
sudo apt install /opt/aleph-vm.ubuntu-22.04.deb

2. Restart the supervisor

sudo systemctl restart aleph-vm-supervisor

Running QEMU and confidential VMs are re-adopted automatically after the restart.

Full changelog: 1.15.0...2.0.0

What's Changed

• fix(nix): wait out link-local DAD before the guest's DHCPv6 solicit by @odesenfans in #1125
• fix(nix): scope the udhcpc deconfig flush to IPv4 by @odesenfans in #1126
• feat(snp-instances): owner-authenticated secret injection (attestation) by @odesenfans in #1128
• chore: dead imports, dead locals, and a broken all by @odesenfans in #1134
• feat(snp-instances) 2/4: LUKS guest image + instance runtime manifest by @odesenfans in #1129
• refactor(auth): drop the legacy X-Auth-Signature allocation auth path by @odesenfans in #1133
• feat(nix): aleph.compose/1 compose-runner runtime flavor by @odesenfans in #1132
• refactor: move guest IPv6 allocation from the supervisor to the agent by @odesenfans in #1139
• feat(snp-instances) 3/4: supervisor opaque-cmdline SNP arm by @odesenfans in #1130
• docs(proto): fix VmSpec field order and a stale confidential note by @odesenfans in #1141
• feat(snp-instances) 4/4: agent launch path for mode=sev_snp by @odesenfans in #1131
• chore(vprogram): adopt measurement registers from aleph-message by @odesenfans in #1143
• fix(tests): build the SNP instance measurement with registers by @odesenfans in #1146
• fix(packaging): ship the registers-schema aleph-message in the deb by @odesenfans in #1147
• fix(agent): land the V-PROGRAM agent fixes from the validation branch by @odesenfans in #1148
• feat(snp): launch with the measured CPU model instead of a hardcoded EPYC-v4 by @odesenfans in #1145
• fix(storage)!: give the agent sole ownership of a VM's disks by @odesenfans in #1149
• fix(agent): retry a failed SNP vCPU probe instead of caching it forever by @odesenfans in #1150
• Move backups to the agent; the supervisor keeps guest quiescence by @odesenfans in #1151
• fix(agent): admit VMs against disk before downloading their resources by @odesenfans in #1153
• proto: drop the reservations left by the removed wipe flag and backup error code by @odesenfans in #1154
• fix(supervisor): report FAILED for a controller unit that died by @odesenfans in #1152
• fix(agent): 404, not 500, for a /vm/ the network has no message for by @odesenfans in #1165
• ci(nix): golden-file check of the SEV-SNP launch measurements by @odesenfans in #1140
• aleph-vm 2.0 by @odesenfans in #1167

Full Changelog: 1.15.0...2.0.0