52 lines
1.7 KiB
Plaintext
Executable File
52 lines
1.7 KiB
Plaintext
Executable File
# Firecracker MicroVM Configuration for a Sorcery-Go Sanctum
|
|
# File: Referenced by pkg/runtime/firecracker.go
|
|
#
|
|
# Firecracker provides VM-level isolation — the strongest isolation
|
|
# option available. Each sanctum runs in its own microVM with a
|
|
# dedicated kernel and rootfs.
|
|
#
|
|
# Unlike LXC/Podman, Firecracker does NOT use cgroups on the host.
|
|
# The eBPF cgroup filters do not apply inside the guest. However,
|
|
# the eBPF Tomb Guard LSM hook still protects the HOST's Tomb from
|
|
# any process including the Firecracker VMM itself.
|
|
#
|
|
# Network isolation is handled by:
|
|
# 1. Firecracker jailer (chroot + seccomp)
|
|
# 2. Per-VM TAP devices with bridge filtering
|
|
# 3. Host-level eBPF network filters on the bridge
|
|
#
|
|
# Required files:
|
|
# - SORCERY_GO_FIRECRACKER_KERNEL: path to vmlinux (host kernel image)
|
|
# - Root drive: qcow2 or raw rootfs image
|
|
|
|
# Memory: 256MB default (sufficient for build workloads)
|
|
# VCPUs: 1 (scale up for parallel builds)
|
|
# Boot: serial console only (no graphical)
|
|
# Kernel args: console=ttyS0 reboot=k panic=1 pci=off
|
|
|
|
# Example Firecracker API configuration:
|
|
# {
|
|
# "boot-source": {
|
|
# "kernel_image_path": "/var/lib/sorcery-go/vmlinux",
|
|
# "boot_args": "console=ttyS0 reboot=k panic=1 pci=off ip=dhcp"
|
|
# },
|
|
# "drives": [
|
|
# {
|
|
# "drive_id": "rootfs",
|
|
# "path_on_host": "/var/lib/sorcery-go/sanctums/<name>/rootfs.qcow2",
|
|
# "is_root_device": true,
|
|
# "is_read_only": false
|
|
# }
|
|
# ],
|
|
# "machine-config": {
|
|
# "vcpu_count": 1,
|
|
# "mem_size_mib": 256
|
|
# },
|
|
# "network-interfaces": [
|
|
# {
|
|
# "iface_id": "eth0",
|
|
# "guest_mac": "02:FC:XX:XX:XX:XX",
|
|
# "host_dev_name": "tap-<name>"
|
|
# }
|
|
# ]
|
|
# } |