mirror of
https://github.com/nestriness/nestri.git
synced 2026-09-19 09:15:19 +03:00
a461cbafa5
A microVM has no init unless something is it, and three of the jobs belong to nothing else in the guest: reaping whatever the workload orphans, turning a signal into an ordered shutdown, and being the guest end of the one channel out. None of it knows what it is running. The guest dials out on a fixed vsock port, says its protocol version first, is handed one boot descriptor — a command line, shares, output geometry, and what an exit means — and carries that out. There is no code path that branches on which workload started, which is the property the component exists to keep. It reports and does not supervise. When the workload ends, the exit goes up the channel and the session is over; `on_exit` says what the exit means, and starting something again is a decision for the end that can see whether restarting is repair or a loop. A signalled workload is reported as signalled with no exit code, because reporting 0 for a killed process makes a kill look like a clean run. Two seams keep this testable without a VM, which is the reason for both of them. Reaping runs against real forked children, with the subreaper bit making a test process inherit orphans the way PID 1 does. The channel is generic over the byte stream, so the exchange is driven over an in-memory pipe — the transport contributes nothing to the protocol beyond ordering and framing. The lifecycle types live in nesprotocol behind a feature, off by default: both ends of the channel read one definition and cannot drift from it silently, while the media components keep building without serde. Mounting shares is not implemented in this build. The descriptor's mounts are refused rather than ignored — a workload started without the shares it was promised fails later, somewhere else, for a reason nobody can see from here.
56 lines
1.8 KiB
TOML
56 lines
1.8 KiB
TOML
# The Rust half of this monorepo. The JS/TS half is `package.json`.
|
|
#
|
|
# Layout, per the same rule on both sides: split by *what a thing is*, not by
|
|
# what language it is written in.
|
|
#
|
|
# apps/ deployables — a binary someone runs
|
|
# crates/ shared Rust — a library another crate depends on
|
|
# packages/ shared JS/TS
|
|
#
|
|
# Members are added as components move in. An empty list is honest: nothing has
|
|
# landed yet.
|
|
|
|
[workspace]
|
|
resolver = "3"
|
|
members = [
|
|
"apps/nescapture",
|
|
"apps/nescope",
|
|
"apps/nesdoctor",
|
|
"apps/neshub",
|
|
"apps/nesinit",
|
|
"apps/neswire",
|
|
"crates/nesprotocol",
|
|
]
|
|
|
|
# One pin per dependency, here. A member never writes a version — that is what
|
|
# stops two crates in one tree from disagreeing about tokio.
|
|
[workspace.dependencies]
|
|
anyhow = "1"
|
|
clap = { version = "4", features = ["derive", "env"] }
|
|
libc = "0.2"
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
thiserror = "2"
|
|
tokio = { version = "1", features = ["full"] }
|
|
tokio-vsock = "0.7"
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
|
|
# Cargo only reads `[profile.*]` from the workspace root, and warns about a
|
|
# member that writes one. `apps/nescapture` had exactly this block and was
|
|
# getting none of it: `cargo build --release --workspace` — which is what
|
|
# build/Dockerfile runs — silently ignored it, so the Vulkan capture layer
|
|
# shipped at the default release profile.
|
|
#
|
|
# `opt-level = 3` is already the release default; `lto = "thin"` is the part
|
|
# that was actually being lost. It applies to the whole workspace now, which is
|
|
# the same rule as `[workspace.dependencies]` above: settings that must not
|
|
# differ between members live in one place.
|
|
[profile.release]
|
|
lto = "thin"
|
|
|
|
[workspace.package]
|
|
edition = "2024"
|
|
license = "Apache-2.0"
|
|
repository = "https://github.com/nestrilabs/nestri"
|