fcvm/Containerfile.nested at main · ejc3/fcvm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
# Nested virtualization test container - self-contained with fcvm, fc-agent, firecracker
#
# Uses Ubuntu 24.04 to match host glibc (2.39).
#
# Build:
#   cp target/release/fcvm target/release/fc-agent artifacts/
#   cp /mnt/fcvm-btrfs/firecracker/firecracker-nested-*.bin artifacts/firecracker-nested
#   sudo podman build -t localhost/nested-test -f Containerfile.nested .
#
# The nested test is driven by test_nested_chain tests which:
# 1. Runs L1 with --cmd "sleep infinity"
# 2. Execs into L1's container to verify KVM works
# 3. Execs into L1's container to start L2
# 4. Repeats for each level

FROM ubuntu:24.04

RUN apt-get update && apt-get install -y --no-install-recommends \
    iproute2 iptables podman python3 kmod procps fuse3 curl nginx \
    fuse-overlayfs sudo iperf3 rsync btrfs-progs iputils-ping \
    && rm -rf /var/lib/apt/lists/*

# Configure podman to use fuse-overlayfs (required for nested containers)
# Must set runroot/graphroot explicitly for nested container environments
RUN mkdir -p /etc/containers /var/lib/containers/storage && \
    printf '%s\n' \
        '[storage]' \
        'driver = "overlay"' \
        'runroot = "/run/containers/storage"' \
        'graphroot = "/var/lib/containers/storage"' \
        '[storage.options.overlay]' \
        'mount_program = "/usr/bin/fuse-overlayfs"' \
        > /etc/containers/storage.conf

# Copy pre-built binaries (host glibc 2.39 matches ubuntu:24.04)
COPY artifacts/fcvm artifacts/fc-agent /usr/local/bin/
COPY artifacts/firecracker-nested /usr/local/bin/firecracker-nested
RUN chmod +x /usr/local/bin/fcvm /usr/local/bin/fc-agent /usr/local/bin/firecracker-nested && \
    ln -s firecracker-nested /usr/local/bin/firecracker

# Copy config file for nested fcvm (uses same paths as host via FUSE mount)
RUN mkdir -p /etc/fcvm
COPY rootfs-config.toml /etc/fcvm/rootfs-config.toml

# Recursive nesting script: /usr/local/bin/nested
# Usage: nested <current_level> <max_level> <kernel_path> <image_cache_path>
# When current == max, echoes success marker. Otherwise starts nested VM.
COPY nested.sh /usr/local/bin/nested
RUN chmod +x /usr/local/bin/nested

# Default command - create runtime dirs, start nginx (for health checks), and sleep
# /run/netns is needed for ip netns (bridged networking)
# /run/containers/storage is needed for podman
CMD ["sh", "-c", "mkdir -p /run/netns /run/containers/storage && nginx && sleep infinity"]