feat(kernel): build-time lean/net kernel selection by G4614 · Pull Request #596 · boxlite-ai/boxlite

G4614 · 2026-05-26T14:35:30Z

Build-time kernel-lean (default) / kernel-net cargo features control which kernel blob is embedded. Runtime --kernel net selects the net kernel in dual-mode builds.

Net kernel adds netfilter/nf_tables/bridge/NET_NS modules for dockerd/dind workloads.

🤖 Generated with Claude Code

DorianZheng · 2026-05-27T05:38:55Z

+    /// default lean kernel. Only effective when the binary was built
+    /// with `--features kernel-net` (or both `kernel-lean,kernel-net`).
+    #[serde(default)]
+    pub kernel_net: bool,


i think it would be make sense for user to specify kernel path themself?

@DorianZheng

Addresses @DorianZheng's boxlite-ai#596 review: users should be able to compile their own kernel, not just pick the built-in lean/net presets. The load side already accepts arbitrary blobs (`--kernel <path>` → stage_custom_kernel symlinks + dlopens at runtime, no rebuild). This adds the build side: - Extract the net build into a generalized `scripts/build/build-libkrunfw.sh` parameterized by OVERLAY / KCONFIG / SONAME / OUT, with a DRY_RUN mode that validates the overlay + config merge without the ~10-20 min build. - `build-libkrunfw-net.sh` becomes a thin wrapper pinning the net overlay, the distinct `libkrunfw-net.so.5` SONAME, and the canonical embed path (behavior unchanged — DRY_RUN confirms identical resolved config/paths). - `make libkrunfw-custom OVERLAY=... [OUT=...]` builds a blob with the default `libkrunfw.so.5` SONAME; load it with `boxlite run --kernel <OUT>`. - README documents the custom workflow. Validated via DRY_RUN (net delegation + custom + missing-OVERLAY error); real kernel build not run. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

@DorianZheng

Addresses @DorianZheng's boxlite-ai#596 review: users should be able to compile their own kernel, not just pick the built-in lean/net presets. The load side already accepts arbitrary blobs (`--kernel <path>` → stage_custom_kernel symlinks + dlopens at runtime, no rebuild). This adds the build side: - Extract the net build into a generalized `scripts/build/build-libkrunfw.sh` parameterized by OVERLAY / KCONFIG / SONAME / OUT, with a DRY_RUN mode that validates the overlay + config merge without the ~10-20 min build. - `build-libkrunfw-net.sh` becomes a thin wrapper pinning the net overlay, the distinct `libkrunfw-net.so.5` SONAME, and the canonical embed path (behavior unchanged — DRY_RUN confirms identical resolved config/paths). - `make libkrunfw-custom OVERLAY=... [OUT=...]` builds a blob with the default `libkrunfw.so.5` SONAME; load it with `boxlite run --kernel <OUT>`. - README documents the custom workflow. Validated via DRY_RUN (net delegation + custom + missing-OVERLAY error); real kernel build not run. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

@DorianZheng

Addresses @DorianZheng's boxlite-ai#596 review: users should be able to compile their own kernel, not just pick the built-in lean/net presets. The load side already accepts arbitrary blobs (`--kernel <path>` → stage_custom_kernel symlinks + dlopens at runtime, no rebuild). This adds the build side: - Extract the net build into a generalized `scripts/build/build-libkrunfw.sh` parameterized by OVERLAY / KCONFIG / SONAME / OUT, with a DRY_RUN mode that validates the overlay + config merge without the ~10-20 min build. - `build-libkrunfw-net.sh` becomes a thin wrapper pinning the net overlay, the distinct `libkrunfw-net.so.5` SONAME, and the canonical embed path (behavior unchanged — DRY_RUN confirms identical resolved config/paths). - `make libkrunfw-custom OVERLAY=... [OUT=...]` builds a blob with the default `libkrunfw.so.5` SONAME; load it with `boxlite run --kernel <OUT>`. - README documents the custom workflow. Validated via DRY_RUN (net delegation + custom + missing-OVERLAY error); real kernel build not run. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

@DorianZheng

Addresses @DorianZheng's boxlite-ai#596 review: users should be able to compile their own kernel, not just pick the built-in lean/net presets. The load side already accepts arbitrary blobs (`--kernel <path>` → stage_custom_kernel symlinks + dlopens at runtime, no rebuild). This adds the build side: - Extract the net build into a generalized `scripts/build/build-libkrunfw.sh` parameterized by OVERLAY / KCONFIG / SONAME / OUT, with a DRY_RUN mode that validates the overlay + config merge without the ~10-20 min build. - `build-libkrunfw-net.sh` becomes a thin wrapper pinning the net overlay, the distinct `libkrunfw-net.so.5` SONAME, and the canonical embed path (behavior unchanged — DRY_RUN confirms identical resolved config/paths). - `make libkrunfw-custom OVERLAY=... [OUT=...]` builds a blob with the default `libkrunfw.so.5` SONAME; load it with `boxlite run --kernel <OUT>`. - README documents the custom workflow. Validated via DRY_RUN (net delegation + custom + missing-OVERLAY error); real kernel build not run. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

coderabbitai · 2026-07-14T08:28:31Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: aaa55347-58bf-49d8-b6a8-a4549e3e6507

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

RAII guard that SIGKILLs detached boxes on Drop. Scans /proc/*/fd for FDs referencing the box's working directory — the only reliable fingerprint after the shim daemonizes and removes its PID file. Runs on panic too, preventing test leakage of libkrun VMs. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Kernel blob selection is now split across two layers: **Build time** (cargo features): cargo build → lean only (default) cargo build --features kernel-net → net only cargo build --features kernel-lean,kernel-net → both (dual mode) **Runtime** (CLI flag, only meaningful in dual mode): boxlite run alpine → uses default (lean) kernel boxlite run --kernel net alpine → uses net kernel Single-kernel builds ignore --kernel; mismatch (e.g. --kernel net on a lean-only build) produces a clear error pointing to the missing feature flag. The net kernel adds ~50 modules (netfilter/nf_tables/bridge/NET_NS) on top of the lean kernel. Required by dockerd/dind workloads that need iptables and bridge networking inside the VM. Build infra: kconfig overlays, build-libkrunfw-net.sh, auto-download from GitHub releases (same pipeline as lean kernel). Developers can override with BOXLITE_LIBKRUNFW_NET_PATH for locally built blobs. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

kernel_net_has_iptables tried to skip when binary lacks --features kernel-net, but checked stdout while the dependency error surfaces via tracing on stderr — skip never triggered, test hard-failed on default lean builds. Capture both streams; check either for the dependency requirement string. Default build now skips correctly; --features kernel-net build still exercises the assertion. Also fix sdks/node/src/options.rs: BoxOptions gained a kernel field in this PR but the Node SDK's JS-to-Rust conversion still built BoxOptions without it (clippy E0063). Add kernel: None there (Node SDK doesn't yet expose --kernel; runtime defaults to lean).

@DorianZheng

Addresses @DorianZheng's boxlite-ai#596 review: users should be able to compile their own kernel, not just pick the built-in lean/net presets. The load side already accepts arbitrary blobs (`--kernel <path>` → stage_custom_kernel symlinks + dlopens at runtime, no rebuild). This adds the build side: - Extract the net build into a generalized `scripts/build/build-libkrunfw.sh` parameterized by OVERLAY / KCONFIG / SONAME / OUT, with a DRY_RUN mode that validates the overlay + config merge without the ~10-20 min build. - `build-libkrunfw-net.sh` becomes a thin wrapper pinning the net overlay, the distinct `libkrunfw-net.so.5` SONAME, and the canonical embed path (behavior unchanged — DRY_RUN confirms identical resolved config/paths). - `make libkrunfw-custom OVERLAY=... [OUT=...]` builds a blob with the default `libkrunfw.so.5` SONAME; load it with `boxlite run --kernel <OUT>`. - README documents the custom workflow. Validated via DRY_RUN (net delegation + custom + missing-OVERLAY error); real kernel build not run. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

The path arm already worked (apply_to's `_` => opts.kernel = Some(k)), but the flag help only mentioned `net`, so the public custom-kernel capability was undiscoverable. Update the doc + value_name to `net|PATH` and point at `make libkrunfw-custom`. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

G4614 mentioned this pull request May 26, 2026

feat(box): --cap option, default all open #597

Draft

DorianZheng reviewed May 27, 2026

View reviewed changes

G4614 force-pushed the feat/kernel-selection branch from 5598e40 to 83afe8c Compare May 27, 2026 07:24

G4614 marked this pull request as draft May 27, 2026 11:58

G4614 force-pushed the feat/kernel-selection branch from 8af6fa2 to 6718a8c Compare May 28, 2026 03:23

G4614 force-pushed the feat/kernel-selection branch from 1e94a09 to 2756b81 Compare June 1, 2026 04:22

G4614 mentioned this pull request Jun 2, 2026

feat(box): add privileged plumbing for DinD #646

Draft

G4614 force-pushed the feat/kernel-selection branch from 2756b81 to 6f87201 Compare June 2, 2026 10:03

G4614 force-pushed the feat/kernel-selection branch from 6f87201 to df59d59 Compare July 14, 2026 08:28

G4614 and others added 5 commits July 23, 2026 18:09

G4614 force-pushed the feat/kernel-selection branch from df59d59 to a07c1f9 Compare July 23, 2026 10:15

G4614 added 2 commits July 23, 2026 21:06

fix(kernel): activate selected firmware in jailer

20da81d

fix(cli): expose net kernel feature

c6b441b

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(kernel): build-time lean/net kernel selection#596

feat(kernel): build-time lean/net kernel selection#596
G4614 wants to merge 7 commits into
boxlite-ai:mainfrom
G4614:feat/kernel-selection

G4614 commented May 26, 2026

Uh oh!

DorianZheng May 27, 2026

Uh oh!

coderabbitai Bot commented Jul 14, 2026 •

edited

Loading

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

G4614 commented May 26, 2026

Uh oh!

DorianZheng May 27, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Jul 14, 2026 •

edited

Loading