'ecrou run alpine -- "apk add x && y"' reached the guest as one argv
element and execvp'd a program named after the whole line. One
argument containing whitespace is a quoted shell line: hand it to the
image's shell as 'sh -c'. Argv vectors stay literal, including ones
that begin with sh -c.
The exit-code contract needed a rethink once the real libkrun was in
the loop: on a normal payload exit the VMM ends its own process with
the payload's code, so run() forks and the child enters the VM loop.
The parent reaps it and the code flows to the consumer; the control
file stays as the boot-failure diagnostic, and the guest script no
longer powers off - the init blob does that when the script exits,
since the libkrunfw kernel has no sysrq.
The console cannot ride stdio: with a tty on fd 0 libkrun stops a
background caller with SIGTTOU, and without one it routes guest bytes
through its logger. So the console goes to a file in the scratch that
the parent streams to real stdout, with a final drain after the reap;
the child unwires fd 0 to /dev/null so the terminal is never touched
and a Ctrl-C to the process group still reaches the guest. PDEATHSIG
keeps T4: a killed consumer is a killed machine. The hostname and
workdir now ride the set_exec config natively (the init blob applies
them); log level follows quiet/verbose.
Also in the CLI: the command after '--' was parsed but never copied
into RunOptions, so every run executed the image's default shell.
run maps the flags onto RunOptions, promotes the first read-write share
to the workspace, inherits stdio, and exits with the guest's code; probe
reports what a run would find (KVM, libkrun loadability with the
remediation, nested virt, cache writability) and fails when a run
would. T6, the no-mount audit, lives here where the binary is built,
ignored behind ECROU_BIN for CI.
ecrou's workspace starts from ecr's confinement-neutral half: image
reference resolution, the content cache with digest freshness, layer
extraction with whiteouts and deferred directory modes, provisioned
hot cells, and the progress/error/config plumbing. Adaptations: the
cache lives in ~/.cache/ecrou, the namespace-era error variants and
utils constants are gone, KvmUnavailable arrives ahead of its caller,
rootfs loses its exec() delegation, and uname(2) goes through libc
now that nix is no longer a dependency. The CLI crate is a stub until
its commit.
Valentin Haudiquet