# Firecracker MicroVM Configuration for a Sorcery-Go Sanctum
# File: Referenced by pkg/runtime/firecracker.go
#
# Firecracker provides VM-level isolation — the strongest isolation
# option available. Each sanctum runs in its own microVM with a
# dedicated kernel and rootfs.
#
# Unlike LXC/Podman, Firecracker does NOT use cgroups on the host.
# The eBPF cgroup filters do not apply inside the guest. However,
# the eBPF Tomb Guard LSM hook still protects the HOST's Tomb from
# any process including the Firecracker VMM itself.
#
# Network isolation is handled by:
#   1. Firecracker jailer (chroot + seccomp)
#   2. Per-VM TAP devices with bridge filtering
#   3. Host-level eBPF network filters on the bridge
#
# Required files:
#   - SORCERY_GO_FIRECRACKER_KERNEL: path to vmlinux (host kernel image)
#   - Root drive: qcow2 or raw rootfs image

# Memory: 256MB default (sufficient for build workloads)
# VCPUs: 1 (scale up for parallel builds)
# Boot: serial console only (no graphical)
# Kernel args: console=ttyS0 reboot=k panic=1 pci=off

# Example Firecracker API configuration:
# {
#   "boot-source": {
#     "kernel_image_path": "/var/lib/sorcery-go/vmlinux",
#     "boot_args": "console=ttyS0 reboot=k panic=1 pci=off ip=dhcp"
#   },
#   "drives": [
#     {
#       "drive_id": "rootfs",
#       "path_on_host": "/var/lib/sorcery-go/sanctums/<name>/rootfs.qcow2",
#       "is_root_device": true,
#       "is_read_only": false
#     }
#   ],
#   "machine-config": {
#     "vcpu_count": 1,
#     "mem_size_mib": 256
#   },
#   "network-interfaces": [
#     {
#       "iface_id": "eth0",
#       "guest_mac": "02:FC:XX:XX:XX:XX",
#       "host_dev_name": "tap-<name>"
#     }
#   ]
# }