github/kata-containers
1
0
Fork 2
mirror of https://github.com/kata-containers/kata-containers.git synced 2026-07-25 14:18:54 +00:00
Code Issues Projects Releases Wiki Activity

hypervisor/qemu: note seccomp sandbox as Phase 3 consideration

Browse Source 
seccompsandbox already maps to -sandbox in cmdline_generator.rs via
seccomp_sandbox: Option<String> in HypervisorConfig. When Platform
takes over argument emission in Phase 3, sandbox support needs a typed
Objects::seccomp_sandbox field so the legacy generator can be removed
cleanly.

Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Zvonko Kaiser <zkaiser@nvidia.com>
This commit is contained in:
Zvonko Kaiser
2026-07-13 20:54:30 +00:00
parent 9ae0ceca59
commit 75f032153c
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/runtime-rs/crates/hypervisor/src/qemu/ARCHITECTURE.md
View File

@@ -644,6 +644,11 @@ Final PR in Phase 2: remove all remaining `#[cfg(target_arch)]` blocks from
`MemoryBackend::File`.
- Wire hugepages via `Platform::with_hugepages`.
- Lift `ObjectIoThread` / `ObjectRngRandom` into `Objects`.
- Consider wiring `seccompsandbox` (QEMU `-sandbox`) through `Platform`:
the config field `seccomp_sandbox: Option<String>` already maps to
`-sandbox` in `cmdline_generator.rs`, but the new path needs a typed
`Objects::seccomp_sandbox: Option<SeccompSandbox>` so the emission
is controlled by `Platform` rather than the legacy generator.
This is the phase that enables hugepages for `runtime-rs` (issue #12125).