From 71a4a78875e016cd7896b895faddc577c024e811 Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Fri, 7 Aug 2026 12:17:44 +0200 Subject: [PATCH 1/2] build(bazel): stage VM runtime bundle Signed-off-by: Simon Scatton --- MODULE.bazel | 50 +++++++++++++++++++++++++ bazel/BUILD.bazel | 5 ++- bazel/releases/BUILD.bazel | 2 + bazel/vm-runtime/BUILD.bazel | 72 ++++++++++++++++++++++++++++++++++++ bazel/vm_runtime.bzl | 46 +++++++++++++++++++++++ 5 files changed, 174 insertions(+), 1 deletion(-) create mode 100644 bazel/vm-runtime/BUILD.bazel create mode 100644 bazel/vm_runtime.bzl diff --git a/MODULE.bazel b/MODULE.bazel index 5946d072f7..d54b7ba404 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -6,6 +6,56 @@ bazel_dep(name = "rules_cc", version = "0.2.20") bazel_dep(name = "rules_proto", version = "7.1.0") bazel_dep(name = "protobuf", version = "34.0.bcr.1") +bazel_lib_toolchains = use_extension("@bazel_lib//lib:extensions.bzl", "toolchains") +bazel_lib_toolchains.zstd() +use_repo(bazel_lib_toolchains, "zstd_toolchains") + +register_toolchains("@zstd_toolchains//:all") + +http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") + +http_archive( + name = "vm_runtime_darwin_aarch64", + build_file_content = """ +exports_files([ + "gvproxy", + "libkrun.dylib", + "libkrunfw.5.dylib", + "umoci", +]) +""", + integrity = "sha256-KSAKryBFZiytwYwXB0CR++u4tGlA5ficf7X/nen7qQE=", + urls = ["https://github.com/NVIDIA/OpenShell/releases/download/vm-runtime/vm-runtime-darwin-aarch64.tar.zst"], +) + +http_archive( + name = "vm_runtime_linux_aarch64", + build_file_content = """ +exports_files([ + "gvproxy", + "libkrun.so", + "libkrunfw.so.5", + "umoci", +]) +""", + integrity = "sha256-zn0P4NtEKp7Euy44HfQ3YoBNijF2VWFTaLLsase+Y1A=", + urls = ["https://github.com/NVIDIA/OpenShell/releases/download/vm-runtime/vm-runtime-linux-aarch64.tar.zst"], +) + +http_archive( + name = "vm_runtime_linux_x86_64", + build_file_content = """ +exports_files([ + "gvproxy", + "libkrun.so", + "libkrunfw.so.5", + "umoci", +]) +""", + integrity = "sha256-urdMjarDN5WJ6eCmpddlcnEn2v3qp28D7+e6PtyhPr0=", + urls = ["https://github.com/NVIDIA/OpenShell/releases/download/vm-runtime/vm-runtime-linux-x86_64.tar.zst"], +) + include("//bazel/annotations:aws-lc-sys.MODULE.bazel") include("//bazel/annotations:z3-sys.MODULE.bazel") include("//bazel/annotations:zstd-sys.MODULE.bazel") diff --git a/bazel/BUILD.bazel b/bazel/BUILD.bazel index 8d61bb55cf..ceba7d2e2c 100644 --- a/bazel/BUILD.bazel +++ b/bazel/BUILD.bazel @@ -1 +1,4 @@ -exports_files(["cargo_version.bzl"]) +exports_files([ + "cargo_version.bzl", + "vm_runtime.bzl", +]) diff --git a/bazel/releases/BUILD.bazel b/bazel/releases/BUILD.bazel index e424cef404..bc859ed16c 100644 --- a/bazel/releases/BUILD.bazel +++ b/bazel/releases/BUILD.bazel @@ -44,6 +44,7 @@ platform_transition_binary( binary = "//crates/openshell-sandbox:openshell-sandbox-bin", tags = ["manual"], target_platform = "@rules_rs//rs/platforms:x86_64-unknown-linux-musl", + visibility = ["//visibility:public"], ) platform_transition_binary( @@ -52,6 +53,7 @@ platform_transition_binary( binary = "//crates/openshell-sandbox:openshell-sandbox-bin", tags = ["manual"], target_platform = "@rules_rs//rs/platforms:aarch64-unknown-linux-musl", + visibility = ["//visibility:public"], ) platform_transition_binary( diff --git a/bazel/vm-runtime/BUILD.bazel b/bazel/vm-runtime/BUILD.bazel new file mode 100644 index 0000000000..073bcf047a --- /dev/null +++ b/bazel/vm-runtime/BUILD.bazel @@ -0,0 +1,72 @@ +load("//bazel:vm_runtime.bzl", "vm_runtime_bundle") + +config_setting( + name = "darwin_aarch64", + constraint_values = [ + "@platforms//cpu:aarch64", + "@platforms//os:osx", + ], +) + +config_setting( + name = "linux_aarch64", + constraint_values = [ + "@platforms//cpu:aarch64", + "@platforms//os:linux", + ], +) + +config_setting( + name = "linux_x86_64", + constraint_values = [ + "@platforms//cpu:x86_64", + "@platforms//os:linux", + ], +) + +vm_runtime_bundle( + name = "runtime", + gvproxy = select({ + ":darwin_aarch64": "@vm_runtime_darwin_aarch64//:gvproxy", + ":linux_aarch64": "@vm_runtime_linux_aarch64//:gvproxy", + ":linux_x86_64": "@vm_runtime_linux_x86_64//:gvproxy", + }), + libkrun = select({ + ":darwin_aarch64": "@vm_runtime_darwin_aarch64//:libkrun.dylib", + ":linux_aarch64": "@vm_runtime_linux_aarch64//:libkrun.so", + ":linux_x86_64": "@vm_runtime_linux_x86_64//:libkrun.so", + }), + libkrun_name = select({ + ":darwin_aarch64": "libkrun.dylib", + ":linux_aarch64": "libkrun.so", + ":linux_x86_64": "libkrun.so", + }), + libkrunfw = select({ + ":darwin_aarch64": "@vm_runtime_darwin_aarch64//:libkrunfw.5.dylib", + ":linux_aarch64": "@vm_runtime_linux_aarch64//:libkrunfw.so.5", + ":linux_x86_64": "@vm_runtime_linux_x86_64//:libkrunfw.so.5", + }), + libkrunfw_name = select({ + ":darwin_aarch64": "libkrunfw.5.dylib", + ":linux_aarch64": "libkrunfw.so.5", + ":linux_x86_64": "libkrunfw.so.5", + }), + supervisor = select({ + ":darwin_aarch64": "//bazel/releases:openshell_sandbox_linux_aarch64", + ":linux_aarch64": "//bazel/releases:openshell_sandbox_linux_aarch64", + ":linux_x86_64": "//bazel/releases:openshell_sandbox_linux_x86_64", + }), + tags = ["manual"], + target_compatible_with = select({ + ":darwin_aarch64": [], + ":linux_aarch64": [], + ":linux_x86_64": [], + "//conditions:default": ["@platforms//:incompatible"], + }), + umoci = select({ + ":darwin_aarch64": "@vm_runtime_darwin_aarch64//:umoci", + ":linux_aarch64": "@vm_runtime_linux_aarch64//:umoci", + ":linux_x86_64": "@vm_runtime_linux_x86_64//:umoci", + }), + visibility = ["//visibility:public"], +) diff --git a/bazel/vm_runtime.bzl b/bazel/vm_runtime.bzl new file mode 100644 index 0000000000..1f611fd446 --- /dev/null +++ b/bazel/vm_runtime.bzl @@ -0,0 +1,46 @@ +"""Rules for staging the embedded openshell-driver-vm runtime.""" + +_ZSTD_TOOLCHAIN = "@bazel_lib//lib:zstd_toolchain_type" + +def _vm_runtime_bundle_impl(ctx): + output = ctx.actions.declare_directory(ctx.label.name) + zstd = ctx.toolchains[_ZSTD_TOOLCHAIN].zstdinfo.binary + + resources = [ + (ctx.file.libkrun, ctx.attr.libkrun_name), + (ctx.file.libkrunfw, ctx.attr.libkrunfw_name), + (ctx.file.gvproxy, "gvproxy"), + (ctx.executable.supervisor, "openshell-sandbox"), + (ctx.file.umoci, "umoci"), + ] + commands = ["mkdir -p '{}'".format(output.path)] + for source, name in resources: + commands.append("'{}' -q -f '{}' -o '{}/{}.zst'".format( + zstd.path, + source.path, + output.path, + name, + )) + + ctx.actions.run_shell( + command = "set -euo pipefail\n{}".format("\n".join(commands)), + inputs = [source for source, _ in resources], + outputs = [output], + tools = [zstd], + ) + + return [DefaultInfo(files = depset([output]))] + +vm_runtime_bundle = rule( + implementation = _vm_runtime_bundle_impl, + attrs = { + "gvproxy": attr.label(allow_single_file = True, mandatory = True), + "libkrun": attr.label(allow_single_file = True, mandatory = True), + "libkrun_name": attr.string(mandatory = True), + "libkrunfw": attr.label(allow_single_file = True, mandatory = True), + "libkrunfw_name": attr.string(mandatory = True), + "supervisor": attr.label(executable = True, cfg = "target", mandatory = True), + "umoci": attr.label(allow_single_file = True, mandatory = True), + }, + toolchains = [_ZSTD_TOOLCHAIN], +) From 784bb922d38a1a01ae3061f09c89daefd0629a2f Mon Sep 17 00:00:00 2001 From: Simon Scatton Date: Fri, 7 Aug 2026 12:23:55 +0200 Subject: [PATCH 2/2] build(bazel): add VM driver targets Signed-off-by: Simon Scatton --- crates/openshell-driver-vm/BUILD.bazel | 74 ++++++++++++++++++++++++++ crates/openshell-vfio/BUILD.bazel | 1 + 2 files changed, 75 insertions(+) create mode 100644 crates/openshell-driver-vm/BUILD.bazel diff --git a/crates/openshell-driver-vm/BUILD.bazel b/crates/openshell-driver-vm/BUILD.bazel new file mode 100644 index 0000000000..d433b78423 --- /dev/null +++ b/crates/openshell-driver-vm/BUILD.bazel @@ -0,0 +1,74 @@ +load("@crates//:defs.bzl", "aliases", "all_crate_deps") +load("@rules_rs//rs:rust_binary.bzl", "rust_binary") +load("@rules_rs//rs:rust_library.bzl", "rust_library") +load("@rules_rs//rs:rust_test.bzl", "rust_test") +load("@rules_rust//rust:defs.bzl", "rustfmt_test") +load("@workspace_version//:version.bzl", "WORKSPACE_VERSION") + +VM_RUNTIME = "//bazel/vm-runtime:runtime" + +VM_RUNTIME_ENV = { + "OUT_DIR": "$(execpath //bazel/vm-runtime:runtime)", +} + +rust_library( + name = "openshell-driver-vm", + srcs = glob( + ["src/**/*.rs"], + exclude = ["src/main.rs"], + ), + aliases = aliases(), + compile_data = [ + "scripts/openshell-vm-sandbox-init.sh", + VM_RUNTIME, + ], + crate_features = ["telemetry"], + rustc_env = VM_RUNTIME_ENV, + version = WORKSPACE_VERSION, + visibility = ["//visibility:public"], + deps = all_crate_deps(normal = True), +) + +rust_binary( + name = "openshell-driver-vm_bin", + srcs = ["src/main.rs"], + aliases = aliases(), + binary_name = "openshell-driver-vm", + version = WORKSPACE_VERSION, + visibility = ["//visibility:public"], + deps = all_crate_deps(normal = True) + [":openshell-driver-vm"], +) + +rust_test( + name = "openshell-driver-vm_lib_test", + compile_data = [ + "scripts/openshell-vm-sandbox-init.sh", + VM_RUNTIME, + ], + crate = ":openshell-driver-vm", + crate_features = ["telemetry"], + rustc_env = VM_RUNTIME_ENV, + deps = all_crate_deps(normal_dev = True), +) + +rust_test( + name = "openshell-driver-vm_bin_test", + srcs = ["src/main.rs"], + aliases = aliases(), + version = WORKSPACE_VERSION, + deps = all_crate_deps( + normal = True, + normal_dev = True, + ) + [":openshell-driver-vm"], +) + +rustfmt_test( + name = "rustfmt_test", + targets = [ + ":openshell-driver-vm", + ":openshell-driver-vm_bin", + ":openshell-driver-vm_bin_test", + ":openshell-driver-vm_lib_test", + ], + visibility = ["//crates:__pkg__"], +) diff --git a/crates/openshell-vfio/BUILD.bazel b/crates/openshell-vfio/BUILD.bazel index 1e08c0bb93..0ec5f0679d 100644 --- a/crates/openshell-vfio/BUILD.bazel +++ b/crates/openshell-vfio/BUILD.bazel @@ -9,6 +9,7 @@ rust_library( srcs = glob(["src/**/*.rs"]), aliases = aliases(), target_compatible_with = ["@platforms//os:linux"], + visibility = ["//visibility:public"], deps = all_crate_deps(normal = True), )