Files
T
Michael Crosby b438e97b93 Add cloud-hypervisor VMM backend for Linux hosts (#782)
apple/containerization currently runs containers in per-container VMs on
macOS hosts via Virtualization.framework. This adds a second VMM backend
so the same Swift orchestration layer (LinuxContainer / LinuxPod /
Vminitd gRPC contract) runs on Linux hosts via cloud-hypervisor + KVM.

**CloudHypervisor Swift package** (`Sources/CloudHypervisor/`) — a thin
client for cloud-hypervisor's REST-over-UDS API, layered on
AsyncHTTPClient. Endpoints cover VMM / VM lifecycle / hotplug (disk, fs,
net, vsock, remove-device). Cross-platform (compiles on macOS for unit
tests; consumed at runtime only by the Linux side of Containerization).

**CH backend in Containerization** — one cloud-hypervisor subprocess per
VM, gated behind `#if os(Linux)`. CHVirtualMachineManager /
CHVirtualMachineInstance mirror the VZ shape behind the existing
VirtualMachineManager / VirtualMachineInstance protocol. CHProcess and
VirtiofsdProcess manage the binaries; CHHotplugProvider handles
virtio-blk and virtio-fs runtime hotplug (with one virtiofsd per unique
source-hash tag, refcounted across containers).

**Linux host networking** — BridgeManager brings up a Linux bridge with
an IPv4 subnet and (opt-in via `--enable-nat`) iptables MASQUERADE +
scoped FORWARD rules. LinuxBridgedNetwork enslaves a fresh TAP per
container to the bridge. State is recorded under `/run/containerization`
so `cctl bridge delete` reverses exactly what create did. Bridge
teardown verifies the link kind via sysfs to refuse deleting non-bridge
interfaces.

**cctl run / bridge** — end-to-end Linux container run path (image pull,
ext4 rootfs assembly, VM boot, container exec) plus `cctl bridge
create|delete` for the host network plumbing.

**Build & dist** — `make linux-build` / `make linux-integration` build
and exercise the host side inside an apple/container `--virtualization`
dev container. `make dist-x86_64` produces a deployment tarball (cctl +
cloud-hypervisor + virtiofsd + initfs + kernel) cross-compiled from the
aarch64 dev container; pipeline documented in `docs/x86_64-build.md`.
Static-musl C deps and the Zig cross compiler are pinned by SHA256.

The host orchestrator runs as root. Per-VM runtime state lives under
`/run/containerization/ch/<UUID>` with mode 0700; UDS sockets inside are
bound with mode 0600. Vminitd's gRPC channel inherits that trust
boundary — socket-file perms are the auth.

Sandbox flags are upstream-secure by default. Two per-component opt-outs
exist for the apple/container dev-container case (where the host seccomp
profile SIGSYS-kills CH and virtiofsd):
- `CONTAINERIZATION_NO_CH_SECCOMP=1` — `cloud-hypervisor --seccomp
false`.
- `CONTAINERIZATION_NO_VIRTIOFSD_SANDBOX=1` — `virtiofsd --sandbox
none`. Each emits a one-shot `logger.warning` at process start. Legacy
alias `CONTAINERIZATION_RELAXED_SANDBOX=1` flips both. cctl spawns both
binaries with `setsid` and a minimal env allowlist (PATH / HOME /
RUST_LOG / RUST_BACKTRACE) so the parent's secrets don't leak to
children.

`make linux-integration` runs the cross-platform integration suite
against a real cloud-hypervisor VM inside the dev container. Linux runs
the cross-platform subset (`process true`/`false`/`echo hi`, virtiofs
round-trip, hotplug); the macOS suite is unchanged.

Signed-off-by: michael_crosby <michael_crosby@apple.com>
2026-07-02 11:20:22 -04:00

123 lines
4.4 KiB
Swift

//===----------------------------------------------------------------------===//
// Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//===----------------------------------------------------------------------===//
/// Describes an IPv4 CIDR address block.
@frozen
public struct CIDRv4: CustomStringConvertible, Equatable, Sendable, Hashable {
/// The IP component of this CIDR address.
public let address: IPv4Address
/// The prefix length of this CIDR address.
public let prefix: Prefix
/// Create a CIDR address block.
public init(_ cidr: String) throws {
let split = cidr.split(separator: "/")
guard split.count == 2 else {
throw CIDR.Error.invalidCIDR(cidr: cidr)
}
guard let prefixLength = UInt8(split[1]), let prefix = Prefix(length: prefixLength) else {
throw CIDR.Error.invalidCIDR(cidr: cidr)
}
let address = try IPv4Address(String(split[0]))
try self.init(address, prefix: prefix)
}
/// Create a CIDR address from a member IP and a prefix length.
public init(_ address: IPv4Address, prefix: Prefix) throws {
guard prefix.length <= 32 else {
throw CIDR.Error.invalidCIDR(cidr: "\(address)/\(prefix)")
}
self.address = address
self.prefix = prefix
}
/// Create the smallest IPv4 CIDR block that includes the lower and upper bounds.
///
/// - Parameters:
/// - lower: The lower bound IPv4 address
/// - upper: The upper bound IPv4 address
/// - Returns: The smallest CIDR block containing both addresses
/// - Throws: If lower > upper
public init(lower: IPv4Address, upper: IPv4Address) throws {
guard lower.value <= upper.value else {
throw CIDR.Error.invalidAddressRange(lower: lower.description, upper: upper.description)
}
for length in 1...32 {
let prefixLength = Prefix(unchecked: UInt8(length))
let mask = prefixLength.prefixMask32
if (lower.value & mask) != (upper.value & mask) {
let prefix = Prefix(unchecked: UInt8(length - 1))
let networkAddr = IPv4Address(lower.value & prefix.prefixMask32)
try self.init(networkAddr, prefix: prefix)
return
}
}
// Same address - /32 block
let prefix = Prefix(unchecked: 32)
let networkAddr = IPv4Address(lower.value & prefix.prefixMask32)
try self.init(networkAddr, prefix: prefix)
}
/// The lowest address in this CIDR block
@inlinable
public var lower: IPv4Address {
IPv4Address(address.value & prefix.prefixMask32)
}
/// The highest address in this CIDR block (broadcast address).
@inlinable
public var upper: IPv4Address {
IPv4Address(address.value | prefix.suffixMask32)
}
/// Return true if the CIDR block contains the specified address.
///
/// Compares network portion of the given IP address.
@inlinable
public func contains(_ ip: IPv4Address) -> Bool {
(address.value & prefix.prefixMask32) == (ip.value & prefix.prefixMask32)
}
/// Retrieve the text representation of the CIDR block.
public var description: String {
"\(address)/\(prefix)"
}
}
extension CIDRv4: Codable {
public init(from decoder: Decoder) throws {
let container = try decoder.singleValueContainer()
let string = try container.decode(String.self)
try self.init(string)
}
public func encode(to encoder: Encoder) throws {
var container = encoder.singleValueContainer()
try container.encode(description)
}
}
extension CIDRv4 {
/// The gateway address of the network. Conventionally the first usable
/// address in the subnet (`lower + 1`).
public var gateway: IPv4Address {
IPv4Address(self.lower.value + 1)
}
}