Add Firecracker control-plane preview - #7133
Conversation
There was a problem hiding this comment.
Pull request overview
Adds the fail-closed Firecracker v1.16.1 control-plane preview.
Changes:
- Registers Firecracker as an external microVM runtime.
- Adds CLI, configuration, schema, and documentation surfaces.
- Adds preflight validation, jail management, API client, and tests.
Show a summary per file
| File | Description |
|---|---|
src/types/runtime-options.ts |
Defines Firecracker options and defaults. |
src/types/index.ts |
Exports Firecracker configuration types. |
src/firecracker/preflight.ts |
Validates host, binaries, artifacts, and checksums. |
src/firecracker/preflight.test.ts |
Tests Firecracker preflight behavior. |
src/firecracker/manager.ts |
Implements jailer lifecycle and VM configuration. |
src/firecracker/manager.test.ts |
Tests jail paths, startup, and cleanup. |
src/firecracker/config.test.ts |
Tests configuration mapping and validation. |
src/firecracker/api-client.ts |
Implements the Unix-socket API client. |
src/firecracker/api-client.test.ts |
Tests API requests and errors. |
src/firecracker-runtime-backend.ts |
Adds the fail-closed runtime backend. |
src/external-runtime-backend.test.ts |
Tests backend resolution. |
src/external-runtime-backend-resolver.ts |
Registers the Firecracker backend. |
src/enclave/runtime-preflight.ts |
Recognizes and rejects unsupported enclave integration. |
src/enclave/runtime-preflight.test.ts |
Tests enclave rejection behavior. |
src/container-runtime.ts |
Registers Firecracker runtime capabilities. |
src/container-runtime.test.ts |
Tests runtime capability resolution. |
src/config-mapper.ts |
Maps file configuration to CLI options. |
src/config-file.ts |
Adds Firecracker config-file typing. |
src/commands/build-config.ts |
Builds normalized Firecracker configuration. |
src/cli-options.ts |
Adds Firecracker CLI flags. |
src/awf-config-schema.json |
Adds runtime schema validation. |
docs/awf-config.schema.json |
Updates the published schema. |
docs/awf-config-spec.md |
Documents the preview configuration. |
Review details
Tip
Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 23/23 changed files
- Comments generated: 7
- Review effort level: Balanced
| readonly start: WorkflowDependencies['startContainers'] = async () => { | ||
| await this.preflight(); | ||
| throw new Error(FIRECRACKER_INCOMPLETE_CAPABILITY_ERROR); |
| const defaultDependencies: FirecrackerPreflightDependencies = { | ||
| platform: process.platform, | ||
| arch: process.arch, | ||
| uid: process.getuid?.() ?? -1, |
| const stat = await dependencies.lstat(filePath); | ||
| if (stat.isSymbolicLink() || !stat.isFile()) { | ||
| throw new Error(`${label} must be a regular file and not a symbolic link: ${filePath}`); | ||
| } | ||
| if ((stat.mode & 0o022) !== 0) { |
| request.setTimeout(this.timeoutMs, () => { | ||
| request.destroy(new Error( | ||
| `Firecracker API ${method} ${requestPath} timed out after ${this.timeoutMs}ms`, | ||
| )); | ||
| }); |
| 'Content-Length': Buffer.byteLength(body), | ||
| }, | ||
| }, (response) => { | ||
| const chunks: Buffer[] = []; |
| if (this.process?.exitCode !== null) { | ||
| throw new Error( | ||
| `Firecracker jailer exited before API readiness with code ${this.process?.exitCode}`, | ||
| ); | ||
| } |
1a62809 to
634fde9
Compare
|
✅ Copilot review passed with no inline comments. @lpcox Add the |
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 94.11% | 93.61% | 📉 -0.50% |
| Statements | 93.10% | 92.61% | 📉 -0.49% |
| Functions | 94.54% | 92.57% | 📉 -1.97% |
| Branches | 86.31% | 85.41% | 📉 -0.90% |
📁 Per-file Coverage Changes (3 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/commands/build-config.ts |
97.2% → 90.0% (-7.22%) | 97.2% → 90.4% (-6.84%) |
src/enclave/runtime-preflight.ts |
64.7% → 67.6% (+2.86%) | 66.7% → 70.0% (+3.34%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
✨ New Files (5 files)
src/firecracker-runtime-backend.ts: 82.3% linessrc/firecracker/api-client.ts: 76.9% linessrc/firecracker/manager.ts: 75.3% linessrc/firecracker/preflight.ts: 72.3% linessrc/types/runtime-options.ts: 100.0% lines
Coverage comparison generated by scripts/ci/compare-coverage.ts
1 similar comment
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 94.11% | 93.61% | 📉 -0.50% |
| Statements | 93.10% | 92.61% | 📉 -0.49% |
| Functions | 94.54% | 92.57% | 📉 -1.97% |
| Branches | 86.31% | 85.41% | 📉 -0.90% |
📁 Per-file Coverage Changes (3 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/commands/build-config.ts |
97.2% → 90.0% (-7.22%) | 97.2% → 90.4% (-6.84%) |
src/enclave/runtime-preflight.ts |
64.7% → 67.6% (+2.86%) | 66.7% → 70.0% (+3.34%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
✨ New Files (5 files)
src/firecracker-runtime-backend.ts: 82.3% linessrc/firecracker/api-client.ts: 76.9% linessrc/firecracker/manager.ts: 75.3% linessrc/firecracker/preflight.ts: 72.3% linessrc/types/runtime-options.ts: 100.0% lines
Coverage comparison generated by scripts/ci/compare-coverage.ts
634fde9 to
3f2eb33
Compare
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 94.11% | 93.61% | 📉 -0.50% |
| Statements | 93.10% | 92.61% | 📉 -0.49% |
| Functions | 94.54% | 92.57% | 📉 -1.97% |
| Branches | 86.31% | 85.41% | 📉 -0.90% |
📁 Per-file Coverage Changes (3 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/commands/build-config.ts |
97.2% → 90.0% (-7.22%) | 97.2% → 90.4% (-6.84%) |
src/enclave/runtime-preflight.ts |
64.7% → 67.6% (+2.86%) | 66.7% → 70.0% (+3.34%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
✨ New Files (5 files)
src/firecracker-runtime-backend.ts: 82.3% linessrc/firecracker/api-client.ts: 76.9% linessrc/firecracker/manager.ts: 75.3% linessrc/firecracker/preflight.ts: 72.3% linessrc/types/runtime-options.ts: 100.0% lines
Coverage comparison generated by scripts/ci/compare-coverage.ts
|
@copilot address review feedback and resolve merge conflicts |
Addressed and pushed in 2312538. I resolved the merge conflicts and implemented the Firecracker review fixes (early backend preflight gate, trusted sudo UID handling, parent-path trust checks, jailer ID validation, absolute API timeout + response error handling, and signal-aware jailer readiness exit handling), with targeted tests updated and passing. |
|
@copilot resolve merge conflicts |
Resolved the merge conflicts and pushed the merge commit ( |
|
@copilot resolve merge conflicts |
I checked and there are no active merge conflicts now. The branch is mergeable (PR merge ref |
|
✅ Build Test Suite completed successfully!
|
|
❌ Contribution Check failed. Please review the logs for details.
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
✅ Smoke Claude passed
|
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
|
❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...
|
|
❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...
|
Smoke Test: Copilot BYOK (Direct) Mode
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com Overall: PASS cc @lpcox
|
Smoke Test: Claude Engine Validation
Overall result: PASS
|
|
Smoke Test: Copilot Engine — @lpcox
Overall: PASS
|
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (github.com) reachable: Overall status: PASS cc @lpcox Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
Smoke Test Results
Overall: FAIL —
|
|
Gemini Engine Smoke Test Results:
Overall status: FAIL
|
|
Smoke Test: API Proxy OTel Tracing — all scenarios pass ✅
No regressions or unexpected failures detected.
|
Chroot Version Comparison
Overall: FAILED — Node.js version mismatch between host and chroot environment.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS All 18 projects across all 8 language ecosystems built and tested successfully through the AWF firewall. Note: Java builds initially failed due to a stale
|
|
Smoke Test: Docker Sbx — @lpcox
Overall: PASS
|
|
Smoke test: FAIL PR titles:
GitHub reads ✅ | Playwright ✅ | File write/read ✅ | Discussion comment ❌ | Build ❌ Warning Firewall blocked 5 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "msfeed12.pkgs.visualstudio.com"
- "msfeed17.pkgs.visualstudio.com"
- "msfeed2.pkgs.visualstudio.com"
- "msfeed25.pkgs.visualstudio.com"
- "registry.npmjs.org"See Network Configuration for more information.
|
Stack
Layer 2/6 of the Firecracker runtime stack.
mainWhat this adds
firecrackeras amicrovmruntime with no Docker OCI runtime or host-agent iptables.Intentionally unavailable
This layer does not implement networking, workspace images, guest agent/vsock command execution, end-to-end main workflow dispatch, or Firecracker enclave executors. Selecting Firecracker remains an explicit preview and fails closed before a workload or infrastructure starts; there is no Docker/runtime fallback.
Validation
npm test -- --runInBand src/container-runtime.test.ts src/external-runtime-backend.test.ts src/enclave/runtime-preflight.test.ts src/commands/main-action.test.ts src/firecracker/config.test.ts src/firecracker/api-client.test.ts src/firecracker/preflight.test.ts src/firecracker/manager.test.ts— 101 tests passednpm run type-checknpm run build