diff --git a/docs/design/proposals/composable-vm-images.md b/docs/design/composable-vm-images.md similarity index 99% rename from docs/design/proposals/composable-vm-images.md rename to docs/design/composable-vm-images.md index eddfdfaba6..db9ee26c97 100644 --- a/docs/design/proposals/composable-vm-images.md +++ b/docs/design/composable-vm-images.md @@ -1,9 +1,6 @@ # Composable VM Images for Kata Containers -> **Status**: Proposal -> -> Once accepted and implemented, this document should be moved to -> `docs/design/composable-vm-images.md`. +> **Status**: Implemented ## Summary diff --git a/src/agent/kata-extension-mount.sh b/src/agent/kata-extension-mount.sh index 1292af3f6a..adb979e59b 100755 --- a/src/agent/kata-extension-mount.sh +++ b/src/agent/kata-extension-mount.sh @@ -94,7 +94,7 @@ HASH_DEV="${REAL_DEV}${PART_SEP}2" # NO hash device + NO params -> raw mount (genuinely unmeasured extension) # # See "Integrity policy: measured vs. unmeasured, and failing closed" in -# docs/design/proposals/composable-vm-images.md for the rationale. +# docs/design/composable-vm-images.md for the rationale. if [[ -b "${HASH_DEV}" ]]; then if [[ -z "${VERITY_PARAMS}" ]]; then echo "ERROR: extension ${EXTENSION_NAME} ships a dm-verity hash device but no verity params were provided on the kernel command line; refusing to mount it unverified" >&2 diff --git a/src/agent/src/guest_extension_image.rs b/src/agent/src/guest_extension_image.rs index 6ea489eadf..b5bc8f3e46 100644 --- a/src/agent/src/guest_extension_image.rs +++ b/src/agent/src/guest_extension_image.rs @@ -21,7 +21,7 @@ //! //! The manifest schema, the `${var}` substitution variables the agent publishes, //! and the attester-variant / NVRC contract are documented in -//! `docs/design/proposals/composable-vm-images.md`, which is the source of +//! `docs/design/composable-vm-images.md`, which is the source of //! truth; this module must stay consistent with it. use anyhow::{anyhow, bail, Context, Result}; diff --git a/tools/osbuilder/rootfs-builder/nvidia/nvidia_rootfs.sh b/tools/osbuilder/rootfs-builder/nvidia/nvidia_rootfs.sh index 3c99f6d522..3cddf913af 100644 --- a/tools/osbuilder/rootfs-builder/nvidia/nvidia_rootfs.sh +++ b/tools/osbuilder/rootfs-builder/nvidia/nvidia_rootfs.sh @@ -546,7 +546,7 @@ partition_gpu_extension() { # This is subtractive on purpose while the monolith still exists: the base is # the monolith minus the GPU allow-list. The planned next step inverts this into # a purely additive base/extension assembly (monolith = base + extension); see -# "Additive image assembly" in docs/design/proposals/composable-vm-images.md. +# "Additive image assembly" in docs/design/composable-vm-images.md. partition_base() { echo "nvidia: building driver-agnostic base layout" diff --git a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh index 9b61ae2f9b..9035a65ec6 100755 --- a/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh +++ b/tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh @@ -918,7 +918,7 @@ install_image_nvidia_gpu_confidential() { } # Install the driver-agnostic nvidia base image: the NVRC-init half of the -# chiseled NVIDIA tree (see docs/design/proposals/composable-vm-images.md). +# chiseled NVIDIA tree (see docs/design/composable-vm-images.md). # The driver still has to be installed to build the shared stage-one (the GPU # files are carved out afterwards), so keep the same NVIDIA_GPU_STACK as the # monolith. @@ -936,7 +936,7 @@ install_image_nvidia() { # Install the gpu extension image: the driver half of the chiseled NVIDIA tree, # laid out for /run/kata-extensions/gpu (see -# docs/design/proposals/composable-vm-images.md). It is an erofs+verity image +# docs/design/composable-vm-images.md). It is an erofs+verity image # (MEASURED_ROOTFS) and is driver-versioned, so multiple driver extensions can # coexist against a single nvidia base image. install_image_nvidia_gpu_extension() {