Add NixOS image for bare-metal Kata #1019
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
msanft
force-pushed
the
msanft/kata/nixos-image
branch
6 times, most recently
from
1140233 to
304fca3
Compare
|
msanft
force-pushed
the
msanft/kata/nixos-image
branch
2 times, most recently
from
c7dbe2c to
ad338fa
Compare
msanft
force-pushed
the
msanft/kata/nixos-image
branch
3 times, most recently
from
4d4e74c to
4148507
Compare
katexochen
reviewed
Nov 28, 2024
There was a problem hiding this comment.
package comment seems outdated. What part of this is microvm specific at this point? Looks like it's just an image in parts compared to packaging it as uki.
There was a problem hiding this comment.
I think it's still a valid name for a non-bootable image like this, as you can boot it without a rootfs.
But I'm also open for other suggestions here.
katexochen
reviewed
Nov 28, 2024
msanft
force-pushed
the
msanft/kata/nixos-image
branch
from
4148507 to
d14b544
Compare
katexochen
reviewed
Nov 29, 2024
msanft
force-pushed
the
msanft/kata/nixos-image
branch
2 times, most recently
from
963b695 to
2d6b621
Compare
burgerdev
reviewed
Dec 2, 2024
packages/by-name/kata/contrast-node-installer-image/package.nix
Outdated
Show resolved
Hide resolved
packages/by-name/qemu-tdx-static/0004-hw-x86-load-initrd-to-static-address.patch
Outdated
Show resolved
Hide resolved
msanft
force-pushed
the
msanft/kata/nixos-image
branch
from
2d6b621 to
6b903fc
Compare
msanft
force-pushed
the
msanft/kata/nixos-image
branch
from
6b903fc to
8fcb77d
Compare
msanft
force-pushed
the
msanft/kata/nixos-image
branch
from
8fcb77d to
a48527f
Compare
This adds a Nix builder to build a micro VM image for direct Linux boot, specifically for the bare-metal Kata image where this is necessary to satisfy Contrast's security assumptions made on the SNP launch digest computation.
Using the Kata kernel with a baremetal NixOS image requires some additional config options to specify NixOS' sanity checks, so add them here.
Kata has a check to see if only image OR initrd are supplied, which is not needed for our use-case. So add a patch to remove that. This should probably be brought upstream in a usable fashion later on.
This adds a little helper script to boot a Micro VM, as we build them for Kata bare-metal, via QEMU.
This switches the image used in our bare-metal Kata uses (e.g. non-AKS and non-peerpods) to a NixOS image that we build in-tree as a MicroVM image (e.g. separated kernel, initrd, cmdline and rootfs).
msanft
force-pushed
the
msanft/kata/nixos-image
branch
from
a48527f to
7dc21e1
Compare
katexochen
added
changelog
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This switches the image used in our bare-metal Kata uses (e.g. non-AKS and non-peerpods) to a NixOS image that we build in-tree as a MicroVM image (e.g. separated kernel, initrd, cmdline and rootfs).
I tried to split this up into digestible commits as much as possible, but a large part still has to be done in one commit in order to ensure bisectability through all commits. I also tried to write meaningful commit messages, so please consult these to find out about the specific changes.