feat: complete Firecracker preview rollout coverage - #7138
Open
lpcox wants to merge 11 commits into
Open
Conversation
Contributor
Contributor
There was a problem hiding this comment.
Pull request overview
Completes the opt-in Firecracker preview rollout with deterministic artifacts, runtime diagnostics, KVM validation, release distribution, and operator documentation.
Changes:
- Builds and distributes pinned Firecracker guest artifacts with checksums, SBOM, and provenance.
- Adds host preflight, live KVM security tests, diagnostics, and lifecycle hardening.
- Documents architecture, compatibility, testing, and release behavior.
Show a summary per file
| File | Description |
|---|---|
src/firecracker/workspace-image.ts |
Replaces the supervisor and strengthens copy-back conflict detection. |
src/firecracker/workspace-image.test.ts |
Tests supervisor replacement and host-only conflicts. |
src/firecracker/preflight.ts |
Adds host, Docker, tool, and cgroup checks. |
src/firecracker/preflight.test.ts |
Updates preflight expectations. |
src/firecracker/manager.ts |
Adds cgroup selection and bounded diagnostic collection. |
src/firecracker/manager.test.ts |
Tests diagnostics and new API configuration. |
src/firecracker/api-client.ts |
Adds logger and metrics endpoints. |
src/firecracker-runtime-backend.ts |
Adds startup observability, diagnostics, and BusyBox shell execution. |
src/firecracker-runtime-backend.test.ts |
Updates backend test fixtures and shell expectations. |
src/commands/main-action.ts |
Integrates external-runtime diagnostics into workflow cleanup. |
scripts/ci/firecracker-live-smoke.sh |
Adds live KVM smoke and security coverage. |
scripts/ci/firecracker-host-preflight.sh |
Validates KVM runner readiness and artifacts. |
README.md |
Links the Firecracker preview guide. |
guest/firecracker/verify-test-artifacts.sh |
Verifies generated preview artifacts. |
guest/firecracker/build-test-artifacts.sh |
Builds deterministic kernel, rootfs, supervisor, manifest, and SBOM artifacts. |
docs/releasing.md |
Documents preview artifact distribution policy. |
docs/INTEGRATION-TESTS.md |
Describes Firecracker CI coverage. |
docs/firecracker-integration.md |
Adds the comprehensive integration and operations guide. |
docs/compatibility.md |
Lists supported host requirements. |
docs/awf-config-spec.md |
Expands Firecracker configuration guidance. |
docs/architecture.md |
Summarizes the microVM architecture. |
.github/workflows/test-firecracker.yml |
Adds artifact-build and gated live-KVM CI jobs. |
.github/workflows/release.yml |
Publishes Firecracker preview artifacts with releases. |
Review details
Tip
Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Suppressed comments (3)
src/commands/main-action.ts:115
- Diagnostic collection is inside the same
tryasstop()/preserve(). If flushing metrics or writing an audit file fails, control jumps tocatchand the external runtime is never stopped, leaving the VM, jail, and network namespace behind. Treat diagnostic failure separately so teardown always runs.
if (config.diagnosticLogs) {
await externalRuntimeBackend.collectDiagnostics();
}
if (config.keepContainers && externalRuntimeBackend.preserve) {
await externalRuntimeBackend.preserve();
} else if (!config.keepContainers) {
await externalRuntimeBackend.stop();
docs/firecracker-integration.md:199
- The root drive passed to Firecracker is writable (
is_read_only: false), so guest filesystem writes are not limited toworkspace.ext4; only persistent copy-back to the host workspace is limited to that image. Reword this guarantee to avoid overstating the guest filesystem boundary.
- **No virtiofs / live bind mounts** — the preview does not expose any live
filesystem passthrough. Guest filesystem writes are bounded to `workspace.ext4`
and are checked on copy-back.
docs/firecracker-integration.md:173
- This control-flow description also calls the rootfs block device read-only, but the manager sends
is_read_only: false. Describe the staged rootfs as a private writable copy; otherwise operators are told the VMM enforces a read-only root that it does not.
6. **API configuration** — AWF configures the VMM via its Unix socket:
kernel boot params, vcpu count, memory, TAP network interface, rootfs block
device (read-only), workspace block device (read-write), vsock device (CID 3,
port 52)
- Files reviewed: 23/23 changed files
- Comments generated: 11
- Review effort level: Balanced
Comment on lines
123
to
125
| const uid = Number(getSafeHostUid()); | ||
| const gid = Number(getSafeHostGid()); | ||
| if (uid === undefined || gid === undefined || uid === 0 || gid === 0) { |
Comment on lines
+574
to
+580
| private async copyBoundedDiagnostic(source: string, destination: string): Promise<void> { | ||
| try { | ||
| const contents = await this.dependencies.readFile(source); | ||
| const bounded = contents.length <= FIRECRACKER_CAPTURE_LIMIT_BYTES | ||
| ? contents | ||
| : contents.subarray(contents.length - FIRECRACKER_CAPTURE_LIMIT_BYTES); | ||
| await this.dependencies.writeFile(destination, bounded, { mode: 0o600 }); |
Comment on lines
+79
to
+81
| if: >- | ||
| (github.event_name == 'workflow_dispatch' && inputs.run_live_kvm) || | ||
| (github.event_name == 'pull_request' && github.event.label.name == 'firecracker-kvm') |
Comment on lines
+117
to
+120
| The main release workflow does **not** publish Firecracker guest artifacts. | ||
| Firecracker test artifacts (`firecracker-test-x86_64`) are built and attested | ||
| separately by the `test-firecracker.yml` CI workflow and uploaded as | ||
| **7-day workflow artifacts**, not as GitHub Release assets. |
Comment on lines
+390
to
+392
| - **Not** distributed as a standalone GitHub Release asset of the main AWF | ||
| release process (the main release workflow does not publish Firecracker | ||
| artifacts) |
Comment on lines
+564
to
+569
| Provider API calls made by the agent: | ||
| 1. Agent makes an HTTPS request to a provider endpoint (e.g., `api.anthropic.com`) | ||
| 2. Request is transparently intercepted by Squid (HTTP CONNECT proxy) | ||
| 3. Request traverses to the API proxy on the host | ||
| 4. API proxy injects the real `Authorization` / `x-api-key` header | ||
| 5. Request continues to the provider |
Comment on lines
+123
to
+125
| │ │ API Proxy │ │ │ Kernel: vmlinux.bin ││ │ | ||
| │ │ (Docker) │ │ │ Rootfs: rootfs.ext4 (read-only) ││ │ | ||
| │ │ 172.30.0.30 │ │ │ Workspace: workspace.ext4 (rw) ││ │ |
Comment on lines
+218
to
+222
| "packages": [ | ||
| { | ||
| "name": "firecracker", | ||
| "SPDXID": "SPDXRef-Firecracker", | ||
| "versionInfo": "${FIRECRACKER_VERSION}", |
Contributor
|
✅ Copilot review passed with no inline comments. @lpcox Add the |
lpcox
force-pushed
the
lpcox-firecracker-rollout-coverage
branch
from
August 9, 2026 16:05
e1d109c to
5808669
Compare
Contributor
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 92.21% | 91.93% | 📉 -0.28% |
| Statements | 91.08% | 90.82% | 📉 -0.26% |
| Functions | 90.46% | 89.96% | 📉 -0.50% |
| Branches | 83.74% | 83.55% | 📉 -0.19% |
📁 Per-file Coverage Changes (7 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/firecracker/preflight.ts |
66.7% → 55.0% (-11.66%) | 66.3% → 55.3% (-10.92%) |
src/commands/main-action.ts |
91.7% → 87.6% (-4.08%) | 91.1% → 87.1% (-4.00%) |
src/firecracker/api-client.ts |
78.8% → 75.9% (-2.92%) | 79.2% → 76.4% (-2.88%) |
src/firecracker/workspace-image.ts |
91.6% → 91.6% (+0.00%) | 90.0% → 90.4% (+0.39%) |
src/firecracker-runtime-backend.ts |
73.4% → 74.5% (+1.03%) | 69.8% → 70.7% (+0.81%) |
src/firecracker/manager.ts |
76.7% → 78.7% (+2.00%) | 74.2% → 76.6% (+2.40%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
1 similar comment
Contributor
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 92.21% | 91.93% | 📉 -0.28% |
| Statements | 91.08% | 90.82% | 📉 -0.26% |
| Functions | 90.46% | 89.96% | 📉 -0.50% |
| Branches | 83.74% | 83.55% | 📉 -0.19% |
📁 Per-file Coverage Changes (7 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/firecracker/preflight.ts |
66.7% → 55.0% (-11.66%) | 66.3% → 55.3% (-10.92%) |
src/commands/main-action.ts |
91.7% → 87.6% (-4.08%) | 91.1% → 87.1% (-4.00%) |
src/firecracker/api-client.ts |
78.8% → 75.9% (-2.92%) | 79.2% → 76.4% (-2.88%) |
src/firecracker/workspace-image.ts |
91.6% → 91.6% (+0.00%) | 90.0% → 90.4% (+0.39%) |
src/firecracker-runtime-backend.ts |
73.4% → 74.5% (+1.03%) | 69.8% → 70.7% (+0.81%) |
src/firecracker/manager.ts |
76.7% → 78.7% (+2.00%) | 74.2% → 76.6% (+2.40%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
lpcox
force-pushed
the
lpcox-firecracker-rollout-coverage
branch
from
August 9, 2026 16:33
5808669 to
a7698a7
Compare
Contributor
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 92.21% | 91.93% | 📉 -0.28% |
| Statements | 91.08% | 90.82% | 📉 -0.26% |
| Functions | 90.46% | 89.96% | 📉 -0.50% |
| Branches | 83.74% | 83.55% | 📉 -0.19% |
📁 Per-file Coverage Changes (7 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/firecracker/preflight.ts |
66.7% → 55.0% (-11.66%) | 66.3% → 55.3% (-10.92%) |
src/commands/main-action.ts |
91.7% → 87.6% (-4.08%) | 91.1% → 87.1% (-4.00%) |
src/firecracker/api-client.ts |
78.8% → 75.9% (-2.92%) | 79.2% → 76.4% (-2.88%) |
src/firecracker/workspace-image.ts |
91.6% → 91.6% (+0.00%) | 90.0% → 90.4% (+0.39%) |
src/firecracker-runtime-backend.ts |
73.4% → 74.5% (+1.03%) | 69.8% → 70.7% (+0.81%) |
src/firecracker/manager.ts |
76.7% → 78.7% (+2.00%) | 74.2% → 76.6% (+2.40%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
1 similar comment
Contributor
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 92.21% | 91.93% | 📉 -0.28% |
| Statements | 91.08% | 90.82% | 📉 -0.26% |
| Functions | 90.46% | 89.96% | 📉 -0.50% |
| Branches | 83.74% | 83.55% | 📉 -0.19% |
📁 Per-file Coverage Changes (7 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/firecracker/preflight.ts |
66.7% → 55.0% (-11.66%) | 66.3% → 55.3% (-10.92%) |
src/commands/main-action.ts |
91.7% → 87.6% (-4.08%) | 91.1% → 87.1% (-4.00%) |
src/firecracker/api-client.ts |
78.8% → 75.9% (-2.92%) | 79.2% → 76.4% (-2.88%) |
src/firecracker/workspace-image.ts |
91.6% → 91.6% (+0.00%) | 90.0% → 90.4% (+0.39%) |
src/firecracker-runtime-backend.ts |
73.4% → 74.5% (+1.03%) | 69.8% → 70.7% (+0.81%) |
src/firecracker/manager.ts |
76.7% → 78.7% (+2.00%) | 74.2% → 76.6% (+2.40%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
lpcox
force-pushed
the
lpcox-firecracker-rollout-coverage
branch
from
August 9, 2026 19:17
a7698a7 to
49776d9
Compare
Contributor
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 92.24% | 91.96% | 📉 -0.28% |
| Statements | 91.10% | 90.85% | 📉 -0.25% |
| Functions | 90.67% | 90.26% | 📉 -0.41% |
| Branches | 83.85% | 83.64% | 📉 -0.21% |
📁 Per-file Coverage Changes (7 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/firecracker/preflight.ts |
70.2% → 59.6% (-10.57%) | 69.4% → 59.3% (-10.06%) |
src/commands/main-action.ts |
91.8% → 87.7% (-4.04%) | 91.2% → 87.3% (-3.95%) |
src/firecracker/api-client.ts |
84.5% → 82.2% (-2.31%) | 84.0% → 81.8% (-2.19%) |
src/firecracker/workspace-image.ts |
91.6% → 91.6% (+0.00%) | 90.0% → 90.4% (+0.39%) |
src/firecracker-runtime-backend.ts |
73.4% → 74.5% (+1.03%) | 69.8% → 70.7% (+0.81%) |
src/firecracker/manager.ts |
77.3% → 79.4% (+2.10%) | 74.7% → 77.4% (+2.67%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
lpcox
force-pushed
the
lpcox-firecracker-rollout-coverage
branch
from
August 9, 2026 19:25
49776d9 to
f935a60
Compare
lpcox
force-pushed
the
lpcox-firecracker-rollout-coverage
branch
from
August 9, 2026 19:26
f935a60 to
2f5e131
Compare
Contributor
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 92.24% | 91.96% | 📉 -0.28% |
| Statements | 91.10% | 90.85% | 📉 -0.25% |
| Functions | 90.67% | 90.26% | 📉 -0.41% |
| Branches | 83.85% | 83.64% | 📉 -0.21% |
📁 Per-file Coverage Changes (7 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/firecracker/preflight.ts |
70.2% → 59.6% (-10.57%) | 69.4% → 59.3% (-10.06%) |
src/commands/main-action.ts |
91.8% → 87.7% (-4.04%) | 91.2% → 87.3% (-3.95%) |
src/firecracker/api-client.ts |
84.5% → 82.2% (-2.31%) | 84.0% → 81.8% (-2.19%) |
src/firecracker/workspace-image.ts |
91.6% → 91.6% (+0.00%) | 90.0% → 90.4% (+0.39%) |
src/firecracker-runtime-backend.ts |
73.4% → 74.5% (+1.03%) | 69.8% → 70.7% (+0.81%) |
src/firecracker/manager.ts |
77.3% → 79.4% (+2.10%) | 74.7% → 77.4% (+2.67%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
1 similar comment
Contributor
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 92.24% | 91.96% | 📉 -0.28% |
| Statements | 91.10% | 90.85% | 📉 -0.25% |
| Functions | 90.67% | 90.26% | 📉 -0.41% |
| Branches | 83.85% | 83.64% | 📉 -0.21% |
📁 Per-file Coverage Changes (7 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/firecracker/preflight.ts |
70.2% → 59.6% (-10.57%) | 69.4% → 59.3% (-10.06%) |
src/commands/main-action.ts |
91.8% → 87.7% (-4.04%) | 91.2% → 87.3% (-3.95%) |
src/firecracker/api-client.ts |
84.5% → 82.2% (-2.31%) | 84.0% → 81.8% (-2.19%) |
src/firecracker/workspace-image.ts |
91.6% → 91.6% (+0.00%) | 90.0% → 90.4% (+0.39%) |
src/firecracker-runtime-backend.ts |
73.4% → 74.5% (+1.03%) | 69.8% → 70.7% (+0.81%) |
src/firecracker/manager.ts |
77.3% → 79.4% (+2.10%) | 74.7% → 77.4% (+2.67%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
lpcox
changed the title
Contributor
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 92.24% | 91.96% | 📉 -0.28% |
| Statements | 91.10% | 90.85% | 📉 -0.25% |
| Functions | 90.67% | 90.26% | 📉 -0.41% |
| Branches | 83.85% | 83.64% | 📉 -0.21% |
📁 Per-file Coverage Changes (7 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/firecracker/preflight.ts |
70.2% → 59.6% (-10.57%) | 69.4% → 59.3% (-10.06%) |
src/commands/main-action.ts |
91.8% → 87.7% (-4.04%) | 91.2% → 87.3% (-3.95%) |
src/firecracker/api-client.ts |
84.5% → 82.2% (-2.31%) | 84.0% → 81.8% (-2.19%) |
src/firecracker/workspace-image.ts |
91.6% → 91.6% (+0.00%) | 90.0% → 90.4% (+0.39%) |
src/firecracker-runtime-backend.ts |
73.4% → 74.5% (+1.03%) | 69.8% → 70.7% (+0.81%) |
src/firecracker/manager.ts |
77.3% → 79.4% (+2.10%) | 74.7% → 77.4% (+2.67%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
1 similar comment
Contributor
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 92.24% | 91.96% | 📉 -0.28% |
| Statements | 91.10% | 90.85% | 📉 -0.25% |
| Functions | 90.67% | 90.26% | 📉 -0.41% |
| Branches | 83.85% | 83.64% | 📉 -0.21% |
📁 Per-file Coverage Changes (7 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/firecracker/preflight.ts |
70.2% → 59.6% (-10.57%) | 69.4% → 59.3% (-10.06%) |
src/commands/main-action.ts |
91.8% → 87.7% (-4.04%) | 91.2% → 87.3% (-3.95%) |
src/firecracker/api-client.ts |
84.5% → 82.2% (-2.31%) | 84.0% → 81.8% (-2.19%) |
src/firecracker/workspace-image.ts |
91.6% → 91.6% (+0.00%) | 90.0% → 90.4% (+0.39%) |
src/firecracker-runtime-backend.ts |
73.4% → 74.5% (+1.03%) | 69.8% → 70.7% (+0.81%) |
src/firecracker/manager.ts |
77.3% → 79.4% (+2.10%) | 74.7% → 77.4% (+2.67%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
lpcox
force-pushed
the
lpcox-firecracker-rollout-coverage
branch
from
August 9, 2026 20:17
3cb3fd6 to
7d4aebb
Compare
lpcox
force-pushed
the
lpcox-firecracker-rollout-coverage
branch
from
August 9, 2026 20:39
7d4aebb to
eb52799
Compare
Contributor
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 92.25% | 91.97% | 📉 -0.28% |
| Statements | 91.11% | 90.85% | 📉 -0.26% |
| Functions | 90.84% | 90.42% | 📉 -0.42% |
| Branches | 83.77% | 83.55% | 📉 -0.22% |
📁 Per-file Coverage Changes (7 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/firecracker/preflight.ts |
70.2% → 59.6% (-10.57%) | 69.4% → 59.3% (-10.06%) |
src/commands/main-action.ts |
91.8% → 87.7% (-4.04%) | 91.2% → 87.3% (-3.95%) |
src/firecracker/api-client.ts |
84.5% → 82.2% (-2.31%) | 84.0% → 81.8% (-2.19%) |
src/firecracker/workspace-image.ts |
89.7% → 89.8% (+0.04%) | 88.2% → 88.3% (+0.04%) |
src/firecracker-runtime-backend.ts |
73.4% → 74.5% (+1.03%) | 69.8% → 70.7% (+0.81%) |
src/firecracker/manager.ts |
79.4% → 80.9% (+1.57%) | 77.7% → 79.6% (+1.93%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
Contributor
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 93.56% | 93.31% | 📉 -0.25% |
| Statements | 92.41% | 92.17% | 📉 -0.24% |
| Functions | 93.12% | 92.60% | 📉 -0.52% |
| Branches | 85.37% | 85.14% | 📉 -0.23% |
📁 Per-file Coverage Changes (7 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/firecracker/preflight.ts |
96.8% → 81.7% (-15.11%) | 96.0% → 81.5% (-14.44%) |
src/commands/main-action.ts |
95.1% → 90.7% (-4.35%) | 95.1% → 90.8% (-4.29%) |
src/firecracker/manager.ts |
92.1% → 90.7% (-1.43%) | 90.4% → 89.4% (-1.02%) |
src/firecracker/workspace-image.ts |
89.7% → 89.8% (+0.04%) | 88.2% → 88.3% (+0.04%) |
src/firecracker-runtime-backend.ts |
98.4% → 98.6% (+0.15%) | 94.9% → 94.7% (-0.19%) |
src/firecracker/api-client.ts |
84.5% → 84.9% (+0.43%) | 84.0% → 84.4% (+0.41%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
lpcox
force-pushed
the
lpcox-firecracker-rollout-coverage
branch
from
August 9, 2026 21:29
b2af22e to
57abde4
Compare
Contributor
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (7 files)
Coverage comparison generated by |
lpcox
force-pushed
the
lpcox-firecracker-rollout-coverage
branch
from
August 9, 2026 22:21
68ef67f to
ae39c50
Compare
lpcox
force-pushed
the
lpcox-firecracker-rollout-coverage
branch
from
August 9, 2026 22:46
ae39c50 to
5f3245e
Compare
lpcox
force-pushed
the
lpcox-firecracker-rollout-coverage
branch
from
August 9, 2026 23:10
5f3245e to
f7ebae7
Compare
Add deterministic guest artifacts, self-hosted KVM coverage, bounded diagnostics, security fixes, release distribution, and authoritative preview documentation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Keep live KVM execution gated behind the explicit firecracker-kvm label while allowing hosted artifact-build validation on ordinary PR events. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Update the generated BusyBox .config directly instead of relying on the Linux-only scripts/config helper that BusyBox does not ship. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
BusyBox 1.36.1 tc uses CBQ kernel UAPI removed from current Ubuntu build headers; the minimal guest does not need tc because host nftables owns enforcement. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Preserve the fail-closed sudo identity requirement while using the shared safe UID/GID policy consistently for jailer, workspace ownership, and guest execution. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Use exclusive 0600 creation for per-run ext4 workspace images to prevent temporary-path replacement races and satisfy CodeQL's insecure temporary file finding. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Document exclusive 0600 workspace image creation, authoritative deletion copy-back, and fail-closed conflict recovery semantics. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Document the versioned release assets, separate seven-day CI artifacts, extracted-file checksum semantics, and continued explicit preview-only usage. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Cover logger, metrics, and FlushMetrics requests while adapting layer-5 identity coverage to the fail-closed sudo policy without duplicating its broader host and lifecycle tests. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Exercise only host-policy, Docker, diagnostic aggregation, and bounded stream branches introduced by layer 6 so stack-aware coverage remains above the layer-5 baseline. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
lpcox
force-pushed
the
lpcox-firecracker-rollout-coverage
branch
from
August 10, 2026 00:05
f7ebae7 to
aad6f5b
Compare
Collaborator
Author
|
@copilot address review feedback |
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stack
Layer 6/6 of the Firecracker preview stack. Targets
lpcox-firecracker-runtime-integrationat exact parent92e9ddb5e342d28705c8c7b2cbc6663e99089e27after PR #7135 merged.Previous layer: #7136
Full stack: #7129 → #7133 → #7134 → #7135 → #7136 → this PR.
Summary
[self-hosted, linux, x64, kvm, awf-firecracker]; live execution additionally requires thefirecracker-kvmPR label or an explicit manual dispatch0600workspace image creation, authoritative supervisor replacement, host-only concurrent workspace conflict detection, bounded child output, and non-sensitive failure-stage observabilityPreview limitations
This remains an explicit opt-in preview with no automatic fallback. It supports Linux KVM only; macOS and Windows are unsupported. GitHub-hosted nested virtualization is experimental/unsupported, so explicitly labeled capable self-hosted runners are recommended. Jailer and Firecracker v1.16.1 are mandatory. Operators must supply compatible kernel/rootfs/supervisor artifacts and all five SHA-256 digests. The release artifacts are x86_64 test/preview inputs, not production defaults. There is no virtiofs or live bind mount: workspaces use bounded ext4 copy-in/copy-back. Firecracker is primary-agent-only; DinD, host access, extra mounts, TTY, topology peers, and enclaves fail closed.
Validation
actionlintand YAML parsing for release and Firecracker workflows (custom self-hosted labels explicitly allowed)go test ./..., Go build, deterministic Linux ELF build, and SHA-256 verificationf7ebae75d0e73193b32022d447051db2b1afb898A live KVM boot was not run locally because this child session is on macOS without
/dev/kvm. The live workflow job remains gated on the explicitfirecracker-kvmlabel.