Skip to content

doc: define the single-slot host filesystem boundary #500

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Pedro Henrique Penna (ppenna) merged 2 commits into from
Oct 12, 2026
Merged

doc: define the single-slot host filesystem boundary #500

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6c47854
doc: define the single-slot host filesystem boundary
ppenna Oct 11, 2026
55a8626
Enhance clarity on restore vs cold boot configurations
ppenna Oct 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions doc/design/configuration-boundary.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,14 @@ snapshots are also supported and do not use sandbox tier metadata. The
management RPC constructs only blockless microVMs without a NIC or control
console; it can attach portb, the boot console, and one HostFs export.

Host filesystem sharing uses the fixed `fs:microvm0` slot instead of adding
devices. The [host-filesystem attachment layer](../../openvmm/openvmm/openvmm_entry/src/microvm/filesystem.rs)
accepts either `--mount` for one host directory or `--mount-aggregate` with
`--mount-child` for named directory or regular-file children. Each child has
its own access mode, and the aggregate root is read-only. The
[filesystem contract](machine-and-device-abi.md#filesystem) defines the
option syntax, export restrictions, and snapshot compatibility rules.

The microVM rejects UEFI, PCAT, IGVM, caller-supplied ACPI, SMBIOS, device
tree, PCI/PCIe, VPCI, VMBus, ISA DMA, IDE, floppy, VMGS, graphics, VGA
firmware, debugger resources, and devices outside the profile. The profile
Expand All @@ -69,8 +77,10 @@ identity and a live, authenticated control console.

Restore is stricter than cold boot. Guest-visible configuration is read from
the snapshot's machine contract. Restore-time input may select the same backend
kind recorded by the snapshot, supply required attachments, and select
processor and RAM activation targets explicitly allowed by the contract. Those
kind recorded by the snapshot, supply required attachments, bind a new directory
export to a [captured dormant filesystem slot](machine-and-device-abi.md#filesystem) only when
the snapshot records that restore-attachment capability, and select processor
and RAM activation targets explicitly allowed by the contract. Those
process-local targets do not change processor capacity, RAM capacity, command
line, device placement, feature masks, or filesystem and network identity.
Restore always uses the snapshot's CPU profile, never falls back, and requires
Expand Down
Loading