feat: add microvm kernel flavor for Firecracker sandboxes (CORE-79)

[AprilNEA]

What

Adds a second kernel flavor, microvm: a dedicated minimal guest kernel for the Firecracker sandbox microVMs that run nested inside the System VM. Today the sandboxes boot the stock Firecracker CI kernel (vmlinux-6.1.155, pulled verbatim from their S3 CI bucket by boot-assets) — a kernel built to run their whole test matrix, which costs ~1.7 s from kernel entry to /sbin/vm-agent under nested virt. Target class for this config: 200–300 ms.

• configs/arcbox-microvm-arm64.config — new fragment, same olddefconfig style as the System VM config. Firecracker aarch64 device model only (virtio-mmio via DT, 16550 ttyS0, PL031, GICv3/PSCI). Cut vs. the FC CI kernel: PCI/ACPI/EFI, netfilter/conntrack, NFS/SUNRPC/XFS/SquashFS/overlayfs, audit, BPF, NUMA, swap/hibernation/PM, VT/INPUT/USB/HID, lockup detectors, DHCP/BOOTP autoconf. Load-bearing keeps: DEVTMPFS_MOUNT (sandbox template rootfs ships an empty /dev), Unix98 PTYs (vm-agent PTY exec), vsock, static ip= (IP_PNP), ext4, PL031+RTC_HCTOSYS (cold-boot wall clock), ptp_kvm (CORE-75 post-restore resync), VMGenID (restored-clone RNG reseed), IKCONFIG.
• scripts/build-kernel.sh — FLAVOR=system|microvm dimension (default system; existing invocations unchanged). Flavor resolves config file, output name, and a per-flavor post-olddefconfig assertion set; the microvm set also asserts the cut subsystems stayed cut. Native and Docker paths share one flavor resolution.
• .github/workflows/build.yml — matrix gains an arm64 microvm job; tag releases attach microvm-kernel-arm64 (+ .sha256) next to kernel-arm64/kernel-x86_64. The kernel-release repository-dispatch to boot-assets is untouched.

The System VM flavor is not modified in any way — same config, same artifact names, same assertions.

microvm is arm64-only for now: Firecracker x86_64 boots an ELF vmlinux (not a bzImage) and needs its own config (VIRTIO_MMIO_CMDLINE_DEVICES, kvmclock), so x86_64 sandboxes stay on the FC CI kernel via boot-assets upstream.toml.

Merge order (cross-repo release train)

1. Merge this PR.
2. Tag a release (next: v0.0.23) → CI publishes microvm-kernel-arm64 + sha256.
3. boot-assets PR (switches the vmlinux upstream pin to that release URL) — confirm the tag in its URL, then merge → sync-binaries uploads to the CDN; the next boot-assets release embeds the sha256 into manifest.json.
4. arcbox: assets.lock bump (+ daemon rebuild; the lock is compile-time-embedded) — out of scope here. The sandbox boot_args cleanup (quiet loglevel=1, drop pci=off) rides that change.

Rollback at any point = revert the boot-assets upstream.toml pin (CDN version keys are immutable).

[linear-code]

CORE-79

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[greptile-apps]

Greptile Summary

Adds an arm64-only microVM kernel flavor optimized for nested Firecracker sandboxes while preserving the existing System VM build behavior.

• Adds a minimal Firecracker-oriented arm64 kernel configuration.
• Resolves flavor-specific configuration, assertions, and artifact names in the shared build script.
• Builds, packages, and publishes the new microvm-kernel-arm64 artifact alongside existing kernels.
• Documents the flavor boundary and local build invocation.

Confidence Score: 5/5

The PR appears safe to merge because no concrete changed-code failure was established.

Flavor selection, native and Docker output paths, CI artifact names, checksums, and release packaging remain internally consistent, while unsupported x86_64 microVM builds are rejected explicitly.

Important Files Changed

Filename	Overview
configs/arcbox-microvm-arm64.config	Adds the minimal arm64 Firecracker guest configuration with built-in boot, storage, networking, PTY, clock, and snapshot-related support.
scripts/build-kernel.sh	Adds validated flavor resolution while retaining the existing System VM config, assertions, and artifact naming by default.
.github/workflows/build.yml	Extends the build matrix and release assets with a distinct arm64 microVM artifact.
scripts/package-release.sh	Includes the microVM binary and checksum in local release packaging without changing existing artifact names.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Build invocation] --> B{FLAVOR}
    B -->|system| C[System config for selected architecture]
    B -->|microvm + arm64| D[MicroVM arm64 config]
    B -->|microvm + x86_64| E[Reject unsupported combination]
    C --> F[olddefconfig and system assertions]
    D --> G[olddefconfig and microVM assertions]
    F --> H[kernel-arm64 or kernel-x86_64]
    G --> I[microvm-kernel-arm64]
    H --> J[Release assets]
    I --> J

Loading

_{Reviews (1): Last reviewed commit: "feat(build): build the microvm flavor al..." | Re-trigger Greptile}