| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
feat(network): initialize guest networking from CNI Guest networking used fixed values before the host could pass its address and DNS information for the selected network slot. The guest resolver therefore could not reflect the CNI network. Add a framed host-agent initialization handshake carrying identity, environment, and guest network settings. Configure or revalidate the guest before starting services, use CNI as the sole DNS source, and close the handshake connection once readiness is established. Assisted-by: Codex:GPT-5.6-sol Signed-off-by: Yifan Zhao <stopire@gmail.com> | 1 个月前 | |
fix(agent): recognize normalized default routes netlink.RouteList represents the restored default route as 0.0.0.0/0, while route validation previously accepted only a nil destination. This made checkpoint-resumed sandboxes reject a valid default route via 192.168.100.2 with NETWORK_MISMATCH. Treat both representations as the same default route. Assisted-by: Codex:GPT-5.6-sol Signed-off-by: jingrui <jingrui@huawei.com> | 1 个月前 | |
[diagnostics]: trace shutdown and cleanup stages | 3 个月前 | |
added sandbox delete and list methods [Minor revision by Yifan Zhao] | 1 个月前 | |
feat: integrate incremental sandbox checkpoints | 27 天前 | |
feat: configure sandbox memory mode | 27 天前 | |
feat: manage conch cow lifecycle | 27 天前 | |
feat: manage conch cow lifecycle | 27 天前 | |
feat: version checkpoint memory OCI layers | 27 天前 | |
feat: configure sandbox memory mode | 27 天前 | |
fix: preserve versioned memory restore artifacts | 27 天前 | |
fix(startup): wait for warm pool before ready Startup cleanup could take time without any visible progress, and conchd reported systemd readiness before the network warm pool was populated. Sandbox creation could therefore race with asynchronous slot prefill and fail with an empty pool. Log before stale resource cleanup, complete the initial warm pool synchronously before starting the background refill loop, and fail daemon startup if prefill cannot reach its target. This keeps READY=1 after network resources are available. Assisted-by: Codex:GPT-5.6-sol Signed-off-by: hu-zhangying <huzhangying@huawei.com> | 1 个月前 | |
feat(network): add configurable sandbox policies Sandboxes previously inherited unrestricted network behavior from warm network slots, with no API for per-sandbox ingress or egress controls. Slot reuse could also retain policy and conntrack state across sandbox assignments. Add typed allow and deny configuration across the daemon, runtime service, persistent state, and Python SDK. Validate destinations before slot allocation and apply live changes with batched iptables updates. Compensate persistent state when updates fail, and clear policy and conntrack state before returning slots to the warm pool. Co-authored-by: Yifan Zhao <stopire@gmail.com> Assisted-by: Codex:GPT-5.6-sol Signed-off-by: Yifan Zhao <stopire@gmail.com> | 1 个月前 | |
feat: integrate incremental sandbox checkpoints | 27 天前 | |
fix: preserve versioned memory restore artifacts | 27 天前 | |
refactor(runtime): remove user-facing namespace support Namespace-aware APIs exposed isolation, but state and runtime paths did not consistently enforce it. Sandbox, template, image, snapshot, and volume identifiers could therefore have conflicting scopes. Adopt a single runtime scope and make identifiers globally unique within the daemon. Remove namespace fields from APIs, state records, CLI flags, SDK payloads, configuration, and documentation. Route containerd access through the adapter's fixed internal scope. Keep sandbox uniqueness policy in the runtime service while BoltStore remains an upsert-only persistence layer. Return configuration parsing errors from client construction so namespace removal does not hide malformed YAML. This intentionally provides no migration for namespace-scoped state. Assisted-by: Codex:GPT-5.6-sol Signed-off-by: Yifan Zhao <stopire@gmail.com> | 1 个月前 | |
feat: run conchd as a systemd service conchd could only be started by running the binary directly, so there was no systemctl start conchd path. Add a conchd.service unit modelled on containerd's, and report readiness and shutdown through sd_notify so the unit can use Type=notify: systemctl start returns only once conchd is listening, and a following conch image pull no longer races the daemon. KillMode=process keeps sandbox VMM processes alive across a stop or restart so conchd re-adopts them on the next start, and ExecStartPre loads the erofs and vhost_vsock modules the daemon depends on. The unit is installed by the RPM package as %{_unitdir}/conchd.service. Signed-off-by: wangzicheng <wangzicheng15@huawei.com> Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> | 1 个月前 | |
cli: add --version support usage example: root@localhost:~# conch --version conch version v0.0.1, build v0.0.1-dae2fc05 root@localhost:~# conchd --version conch version v0.0.1, build v0.0.1-dae2fc05 Signed-off-by: jingrui <jingrui@huawei.com> | 1 个月前 | |
feat: add StratoVirt incremental memory primitives | 27 天前 | |
fix(sandbox): clean stale resources A killed daemon can leave VMM processes and sockets, virtiofs backends, network slots, and persisted sandbox records behind. These resources can conflict with CNI allocation and prevent the next warm pool from starting. Delay warm pool startup until SandboxManager recovers VMM, volume, and network resources. During startup, release stale boot layouts through an explicit recovery path before removing their persistent records. Keep normal Delete semantics scoped to sandboxes owned by the current Manager instance. Remove live sandboxes through the normal Delete path during graceful shutdown. Retry a network slot creation once after rollback so one-shot CNI residue can be cleared without changing background refill and exponential backoff. Assisted-by: Codex:GPT-5.6-sol Signed-off-by: hu-zhangying <huzhangying@huawei.com> | 1 个月前 |