mirror of
https://github.com/nestriness/nestri.git
synced 2026-09-19 17:25:19 +03:00
8246aa5538
Get this thing going..
<!-- greptile_comment -->
<!-- greptile_summary -->
<h2><a
href="https://app.greptile.com/api/retrigger?id=63134761"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://greptile-static-assets.s3.amazonaws.com/badges/RetriggerDark.svg?v=1"><source
media="(prefers-color-scheme: light)"
srcset="https://greptile-static-assets.s3.amazonaws.com/badges/Retrigger.svg?v=1"><img
alt="Retrigger"
src="https://greptile-static-assets.s3.amazonaws.com/badges/Retrigger.svg?v=1"
align="right"></picture></a>Confidence Score: 5/5</h2>
The PR appears safe to merge; all previous findings are resolved and the
latest readiness change introduces no established actionable regression.
<h3>Summary</h3>
- Establishes required guest filesystems, runtime directories, device
permissions, and service processes.
- Reports initialization and service deaths over the lifecycle channel.
- Supports launch, restart, and shutdown commands for a resident guest.
- Separates service and workload identities and configures per-launch
runtime environments.
- Removes the currently inactive nescope screenshot option and makes
capture-chain verification fail explicitly when compositor readback is
unavailable.
- Reworks the guest image around `nesinit` as PID 1 without a
distribution service manager.
<h3>Diagram</h3>
```mermaid
sequenceDiagram
participant Host
participant Init as nesinit
participant FS as Guest filesystems
participant Services as Service stack
participant Workload
Init->>Host: Ready(protocol version)
Host->>Init: Boot(mount descriptors)
Init->>FS: Establish and mount shares
Init->>Services: Spawn services in order
Services-->>Init: Required sockets ready
Init->>Host: Initialized(service names)
Host->>Init: Launch(id, exec, on_exit)
Init->>Workload: Spawn with isolated UID/runtime
Init->>Host: Started(id)
Workload-->>Init: Exit status
Init->>Host: WorkloadExited(id, status)
Host->>Init: Launch / Restart / Shutdown
```
<sub>Reviews (4) · Last reviewed commit: ["fix(nesinit): readiness is a
socket
that..."](731d34df9d)</sub>
<!-- /greptile_comment -->
---------
Co-authored-by: DatCaptainHorse <DatCaptainHorse@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
68 lines
2.8 KiB
Bash
68 lines
2.8 KiB
Bash
#!/usr/bin/env bash
|
|
# Pack a built container image into a raw ext4 disk for nesbox's virtio-blk.
|
|
#
|
|
# Docker/Buildx has no native "export a raw disk image" step, so this is the
|
|
# one part of the pipeline that still has to run outside the Dockerfile.
|
|
#
|
|
# Run this as yourself, not under sudo. Only mkfs/mount/umount actually need
|
|
# root, and those are escalated individually below — `sudo bash mkimage.sh`
|
|
# for the whole script is exactly the wrong shape for rootless Podman: the
|
|
# image `make build` produced lives in *your* rootless storage, and running
|
|
# `podman create` as root afterwards looks in root's separate storage, where
|
|
# the tag does not exist. `sudo -v` up front just avoids being prompted
|
|
# mid-script for the escalated calls that follow.
|
|
set -euo pipefail
|
|
|
|
IMAGE="${1:?usage: mkimage.sh <image-tag> <output-path> [size]}"
|
|
OUT="${2:?usage: mkimage.sh <image-tag> <output-path> [size]}"
|
|
SIZE="${3:-3G}"
|
|
|
|
if [[ "$(id -u)" -eq 0 ]]; then
|
|
echo "mkimage.sh should run as yourself, not root/sudo — see the comment at the top of this script" >&2
|
|
exit 1
|
|
fi
|
|
|
|
CONTAINER_RT="$(command -v podman || command -v docker || true)"
|
|
[[ -n "$CONTAINER_RT" ]] || { echo "Neither docker nor podman found in PATH" >&2; exit 1; }
|
|
|
|
sudo -v # cache credentials once, rather than prompting mid-pipeline
|
|
|
|
WORK="$(mktemp -d)"
|
|
cleanup() {
|
|
mountpoint -q "$WORK/mnt" 2>/dev/null && sudo umount "$WORK/mnt"
|
|
rm -rf "$WORK"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
echo "Exporting ${IMAGE}..."
|
|
cid="$("$CONTAINER_RT" create "$IMAGE")"
|
|
"$CONTAINER_RT" export "$cid" -o "$WORK/rootfs.tar"
|
|
"$CONTAINER_RT" rm -f "$cid" >/dev/null
|
|
|
|
echo "Creating ${SIZE} ext4 image at ${OUT}..."
|
|
mkdir -p "$(dirname "$OUT")"
|
|
truncate -s "$SIZE" "$OUT"
|
|
sudo mkfs.ext4 -q -L nestri-root "$OUT"
|
|
|
|
mkdir -p "$WORK/mnt"
|
|
sudo mount -o loop "$OUT" "$WORK/mnt"
|
|
# Same excludes as the old bootstrap extraction: .dockerenv is Docker's own
|
|
# marker file, and /dev is devtmpfs at boot, populated by the kernel — a
|
|
# tarred copy of the build container's /dev would just be dead weight.
|
|
#
|
|
# Root, deliberately: the rootfs's own files are owned by root (that is
|
|
# correct — it is the guest's root filesystem), and only root can write
|
|
# root-owned files onto the loop-mounted ext4.
|
|
sudo tar -xf "$WORK/rootfs.tar" -C "$WORK/mnt" --exclude='.dockerenv' --exclude='dev/*'
|
|
sudo umount "$WORK/mnt"
|
|
|
|
# The image *file* itself was created by `truncate` above as the invoking
|
|
# user and never needs to change hands — mkfs/mount/umount touch its
|
|
# contents, not its ownership. Asserted, not assumed, since a stray `sudo`
|
|
# reordering above would silently hand root ownership of a file the rest of
|
|
# this pipeline expects to read and delete without sudo.
|
|
[[ "$(stat -c '%U' "$OUT")" == "$(id -un)" ]] || {
|
|
echo "warning: ${OUT} is not owned by $(id -un) — sudo chown $(id -un) ${OUT}" >&2
|
|
}
|
|
echo "Wrote ${OUT}"
|