Skip to content

chore(vm): bump libkrun to v1.19.4 and libkrunfw to v5.6.1 - #3451

Merged
elezar merged 1 commit into
NVIDIA:mainfrom
benoitf:bump-libkrun-v1.19.4
Sep 18, 2026
Merged

chore(vm): bump libkrun to v1.19.4 and libkrunfw to v5.6.1#3451
elezar merged 1 commit into
NVIDIA:mainfrom
benoitf:bump-libkrun-v1.19.4

Conversation

@benoitf

@benoitf benoitf commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Bump libkrun from v1.17.4 to v1.19.4 and libkrunfw from commit 463f717b to v5.6.1
  • Update GitHub org from containers/ to libkrun/ for both repositories
  • Centralise LIBKRUN_REF in pins.env instead of hardcoding in each build script

Related Issue

Ref: #2585

libkrun v1.19.4 introduces krun_add_virtiofs4 with a permissions semantics parameter, enabling correct file ownership mapping on host-to-guest bind mounts.

Changes

  • pins.env: Update libkrunfw to v5.6.1 from libkrun/libkrunfw, add LIBKRUN_REF=v1.19.4 from libkrun/libkrun
  • build-libkrun.sh: Update clone URLs to new org, source LIBKRUN_REF from pins.env, remove obsolete make init/init step (libkrun@05c4eb7)
  • build-libkrun-macos.sh: Update clone URL to new org, add pins.env sourcing for consistency

Testing

  • FROM_SOURCE=1 mise run vm:setup succeeds on Linux (builds libkrunfw v5.6.1 + libkrun v1.19.4 from source)
  • mise run pre-commit passes
  • cargo build -p openshell-driver-vm compiles
  • Nix hashes updated after CI rebuild of vm-runtime artifacts

Checklist

  • Follows conventional commit format
  • No secrets or credentials committed
  • Changes scoped to the issue at hand
  • Signed off for DCO compliance

@copy-pr-bot

copy-pr-bot Bot commented Sep 18, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@elezar

elezar commented Sep 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

I think this is already covered in #3446, but yours does add some additional cleanups.

elezar
elezar reviewed Sep 18, 2026
View reviewed changes
Comment thread crates/openshell-driver-vm/runtime/pins.env Outdated
@elezar elezar mentioned this pull request Sep 18, 2026
Merged
9 of 10 tasks
@benoitf
chore(vm): bump libkrun to v1.19.4 and libkrunfw to v5.6.1
5069f35 
The libkrun and libkrunfw projects moved from the containers/ GitHub
org to libkrun/. Update all clone URLs and version pins accordingly.

libkrun v1.19.4 introduces krun_add_virtiofs4 with a permissions
semantics parameter, enabling correct file ownership mapping on
host-to-guest bind mounts — required for issue NVIDIA#2585.

- libkrun: v1.17.4 → v1.19.4 (libkrun/libkrun)
- libkrunfw: 463f717b → v5.6.1 (libkrun/libkrunfw)
- Centralise LIBKRUN_REF in pins.env instead of hardcoding in each
  build script
- Source pins.env in the macOS build script for consistency with the
  Linux build script
- Remove the init/init make target step — since libkrun/libkrun@05c4eb7
  the init blob moved into the init_blob crate and is built by cargo

Ref: NVIDIA#2585
Signed-off-by: Florent Benoit <fbenoit@redhat.com>
@benoitf
benoitf force-pushed the bump-libkrun-v1.19.4 branch from cd0250f to 5069f35 Compare September 18, 2026 11:59
@benoitf

benoitf commented Sep 18, 2026

Copy link
Copy Markdown
Contributor Author

I think this is already covered in #3446, but yours does add some additional cleanups.

depending on which PR is merged first, I will do a rebase if mine is second

@elezar
elezar enabled auto-merge September 18, 2026 12:59
@elezar

elezar commented Sep 18, 2026

Copy link
Copy Markdown
Member

/ok-to-test 5069f35

@elezar

elezar commented Sep 18, 2026

Copy link
Copy Markdown
Member

I think this is already covered in #3446, but yours does add some additional cleanups.

depending on which PR is merged first, I will do a rebase if mine is second

Let's get this in. I'll rebase the other one.

@elezar
elezar added this pull request to the merge queue Sep 18, 2026
Merged via the queue into NVIDIA:main with commit c5a8c4d Sep 18, 2026
57 checks passed
benoitf added a commit to benoitf/OpenShell that referenced this pull request Oct 14, 2026
@benoitf
fix(nix): refresh vm-runtime hashes to the libkrun v1.19.4 runtime
bc0683a 
The Nix vm-runtime package fetches the rolling vm-runtime release with
fixed hashes pinned on 2026-09-16. The release was rebuilt on
2026-09-21 after the libkrun v1.19.4 / libkrunfw v5.6.1 bump (NVIDIA#3451),
but the hashes were not updated, so CI kept substituting the
2026-09-15 runtime (libkrun v1.17.4) from the binary cache.

That libkrun lacks krun_add_virtiofs4, which VM bind mounts need.
Point the hashes at the current release assets.

Signed-off-by: Florent Benoit <fbenoit@redhat.com>
benoitf added a commit to benoitf/OpenShell that referenced this pull request Oct 14, 2026
@benoitf
fix(nix): refresh vm-runtime hashes to the libkrun v1.19.4 runtime
8093a7a 
The Nix vm-runtime package fetches the rolling vm-runtime release with
fixed hashes pinned on 2026-09-16. The release was rebuilt on
2026-09-21 after the libkrun v1.19.4 / libkrunfw v5.6.1 bump (NVIDIA#3451),
but the hashes were not updated, so CI kept substituting the
2026-09-15 runtime (libkrun v1.17.4) from the binary cache.

That libkrun lacks krun_add_virtiofs4, which VM bind mounts need.
Point the hashes at the current release assets.

Signed-off-by: Florent Benoit <fbenoit@redhat.com>
peppywolfym-lab pushed a commit to peppywolfym-lab/OpenShell that referenced this pull request Oct 16, 2026
@benoitf
feat(vm): add host bind mount support via virtiofs (libkrun) (NVIDIA#…
a4c848a 
…3463)

* feat(vm): add host bind mount support via virtiofs (libkrun)

Introduce host directory bind mounts for libkrun VM sandboxes using
the virtiofs4 API with simplified permission semantics. The gateway
accepts `enable_bind_mounts` in the `[openshell.drivers.vm]` TOML
table and forwards it to the VM driver subprocess.

Mounts are specified per-sandbox in driver_config.mounts[] with
source, target, optional read_only (default: read-only), and an
optional `type` that must be `bind`, so Docker and Podman bind entries
(without `selinux_label`) parse unchanged.

At sandbox validation the driver rejects mounts unless bind mounts
are enabled and resource admission is disabled. It rejects GPU and
other QEMU launches, sources with control characters, and more mounts
than libkrun has interrupt lines for (32 on aarch64, 3 on x86_64), and
checks targets against reserved VM-internal directories and each other
(no nested targets). The QEMU check runs again once the launch backend
is resolved.

Host source directories are checked at provisioning, before image
preparation, so a briefly missing source fails provisioning visibly
instead of denying recovery of a persisted sandbox. Missing,
inaccessible, symlinked, non-directory, and unreadable sources are
rejected: libkrun does not follow a final symlink, and on macOS it
panics during guest boot when it cannot open the share root.

The driver generates virtiofs tags and always writes a guest-side
manifest into the overlay disk, together with the init drop-ins, so an
image-supplied manifest can never drive guest mounts. The launcher
parses its tab-separated --vm-mount arguments from the right, so a
source can never shift the tag or mode, and the driver logs each
shared directory at launch.

Guest init mounts the shares after every /sandbox ownership fixup
and the init drop-ins, so recursive chowns never reach host files.
It refuses targets that traverse symlinks in the image, hands newly
created mount point parents under /sandbox to the sandbox user, and
skips an empty manifest.

krun_add_virtiofs4 is resolved optionally, so older libkrun runtimes
still boot sandboxes without mounts.

The kernel config lists CONFIG_FUSE_FS and CONFIG_VIRTIO_FS
explicitly; the pinned libkrunfw base config already enables both.

A vm_bind_mount e2e test checks a read-write share round-trips data
with the host, accepts a new file, directory, and nested file that the
host then sees, and that a read-only share rejects writes. libkrun on
rootless Linux refuses file creation by a guest user whose UID/GID
differ from its own, so the VM e2e gateway runs the sandbox as the
gateway user there. It enables bind mounts like the Docker and Podman
e2e gateways.

The runtimes docs cover the mount limit, the symlink restriction, the
guest-kernel exposure, and the rootless Linux UID/GID note. The
debug-openshell-cluster skill lists VM bind mount checks.

Signed-off-by: Florent Benoit <fbenoit@redhat.com>

* fix(nix): refresh vm-runtime hashes to the libkrun v1.19.4 runtime

The Nix vm-runtime package fetches the rolling vm-runtime release with
fixed hashes pinned on 2026-09-16. The release was rebuilt on
2026-09-21 after the libkrun v1.19.4 / libkrunfw v5.6.1 bump (NVIDIA#3451),
but the hashes were not updated, so CI kept substituting the
2026-09-15 runtime (libkrun v1.17.4) from the binary cache.

That libkrun lacks krun_add_virtiofs4, which VM bind mounts need.
Point the hashes at the current release assets.

Signed-off-by: Florent Benoit <fbenoit@redhat.com>

---------

Signed-off-by: Florent Benoit <fbenoit@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@elezar elezar elezar approved these changes
@mrunalp mrunalp Awaiting requested review from mrunalp
@sjenning sjenning Awaiting requested review from sjenning
@derekwaynecarr derekwaynecarr Awaiting requested review from derekwaynecarr

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@benoitf @elezar