mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-07-25 22:49:59 +00:00
98d7131337
The Go runtime confidential and NVIDIA GPU QEMU configs booted the monolithic rootfs images (kata-containers-confidential.img, kata-containers-nvidia-gpu.img, kata-containers-nvidia-gpu-confidential.img) that bake every guest component into a single rootfs. Switch them to the composable layout already used by runtime-rs: boot the measured base image (kata-containers.img / kata-containers-nvidia.img) and cold-plug the purpose-specific guest extension images: - qemu-coco-dev, qemu-tdx, qemu-snp: base + coco extension - qemu-nvidia-gpu: nvidia base + gpu extension - qemu-nvidia-gpu-snp/-tdx: nvidia base + gpu + coco extensions The dm-verity params for the NVIDIA confidential configs move from KERNELVERITYPARAMS_CONFIDENTIAL_NV to KERNELVERITYPARAMS_NV (the nvidia base hash), and the Makefile gains the coco/gpu extension image path and verity vars (COCOIMAGEPATH/COCOVERITYPARAMS, IMAGEPATH_NV_EXTENSION/NVIDIAGPUEXTENSIONVERITYPARAMS). No runtime code change is needed: the Go QEMU backend already cold-plugs guest_extension_images. The main motivation is size: the monolithic images duplicate content that already ships in the base + extension images, and once the Go runtime no longer needs them we can stop building them (see follow-up commits). That keeps the released kata-static tarball within GitHub's release asset size limit (2 GiB). The monolithic images are no longer referenced by any shipped config, but their build targets are intentionally left in place so they can still be built manually. Note: this composable path had only been validated for runtime-rs so far; the Go-runtime TEE/GPU boots (TDX, SEV-SNP, NVIDIA GPU) still need validation on real hardware. Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com> Assisted-by: Cursor <cursoragent@cursor.com> Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>