Repository navigation
Conversation
An overlay root on a block device needs two disks: a read-only lower
built from the image and a writable upper per instance. ExecArgs had a
single BlockDevPath, so the darwin builders could attach one disk only.
On vz that disk also replaced the root share.
ExecArgs gains BlockDevs, a list of BlockDevSpec{Path, ReadOnly} in
command-line order. The VMM gives each disk the serial disk<N> by its
position, and the guest finds its disks by serial. BlockDevPath stays
as the single-disk form. It counts as one writable disk when BlockDevs
is empty. EffectiveBlockDevs returns either form as a list. Only the
darwin builders read BlockDevs; the Linux hvi and the QEMU builders
still read BlockDevPath.
- hvi: emit --disk or --disk-ro per entry, in order. BlockDevPath alone
still gives one --disk.
- vz: BlockDevPath alone still goes out as --rootfs and replaces the
root share. Entries in BlockDevs go out as --disk or --disk-ro after
the root share. The root share stays on the command line, both the
Sharedfs one and the RootfsPath one.
- Both builders reject an entry with no path and a path listed twice,
as they do for shares. A missing or repeated disk would shift the
serials of the disks after it.
- docs/vz-runner-contract.md: document --disk, --disk-ro and the
disk<N> serial, counted over those two flags only. Add the missing
--share-ro row.
The Linux hvi builder is unchanged.
TestHviDarwinDisks and TestVzDarwinDisks cover the legacy path and a
read-only lower followed by a writable upper. The *DisksRejected tests
cover the empty and duplicate path errors on both builders.
TestVzDarwinDisksKeepRootShare and TestVzDarwinDisksKeepRootfsPathShare
check that BlockDevs keep the root share on vz, and that BlockDevPath
still drops it. The BlockDevs cases fail against the previous builders.
Signed-off-by: Anastassios Nanos <ananos@nofire.ai>
This was referenced Oct 9, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
hull is moving container roots on macOS to an overlay of a read-only
image disk and a per-instance writable disk, with virtio-fs left for the
home share. That needs more than one block device per guest, and
ExecArgshas a singleBlockDevPath.This PR adds
ExecArgs.BlockDevs []BlockDevSpec{Path, ReadOnly}andEffectiveBlockDevs(), which returnsBlockDevswhen set and otherwiseBlockDevPathas one writable disk. The darwin hvi builder emits--disk/--disk-roper entry, in order. The darwin vz builder emitsthem after the root share and no longer drops
Sharedfswhen blockdevices are present;
--rootfsstays the legacy single-root path and isonly used when
BlockDevsis empty. Both builders refuse an empty or aduplicate path. The Linux hvi and the QEMU builders still read
BlockDevPathonly.docs/vz-runner-contract.mddocuments the new flags and the serial rule(
disk<N>counted over--disk*only).Related issues
HULL_ROOTFS_MODE=overlay-block),with feat: Attach up to four disks, read-only ones included brig-sh/hvi-vmm#276 and NOFireAI/hull-assets#26.
How was this tested?
Unit tests in
hvi_darwin_test.goandvz_darwin_test.gopin the exactflag sequence for the legacy path, two disks (ro then rw), disks beside a
share, the
RootfsPathshare with disks, and the empty/duplicaterejections; the new cases fail against the old builders.
go build ./...,go test ./pkg/unikontainers/...andGOOS=linux go vet ./pkg/unikontainers/...pass. End to end through hull on this Mac: aguest boots with
overlay /overdisk0(ro) anddisk1on both hviand vz, with the home share mounted on top.
LLM usage
Claude Code (Opus 4.8 for the implementation, a second model for
review). Review pending on my side.
Checklist
make lint).golangci-lintis cleanon the changed packages; the two
unusedfindings are in files this PRdoes not touch.
make test_ctr,make test_nerdctl,make test_docker,make test_crictl). Not run; darwin-only change.🤖 Generated with Claude Code