boxlite 0.10.1

Embeddable virtual machine runtime for secure, isolated code execution
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

//! gvisor-tap-vsock ("gvproxy") integration.
//!
//! ## Module structure
//!
//! - `services` — [`GvproxyBackend`], the host-side [`NetworkBackend`](super::NetworkBackend):
//!   it produces the wire spec and dials gvproxy's ServicesMux for runtime control.
//!   This side has no dependency on `libgvproxy-sys`.
//! - `ffi` — safe wrappers around the raw `libgvproxy-sys` FFI, compiled only
//!   with the `gvproxy` feature.
//! - `instance` — `GvproxyInstance`, the shim-side RAII handle that creates
//!   gvproxy through the FFI and produces the VM's
//!   [`NetworkBackendEndpoint`](super::NetworkBackendEndpoint)
//! - `logging` — Go `slog` → Rust `tracing` bridge (target `"gvproxy"`)
//! - `config` / `stats` — the JSON config sent to Go and the stats read back
//!
//! ## Logging integration
//!
//! When the `gvproxy` feature is enabled, logs from the Go side are forwarded
//! to Rust's `tracing` with the target `"gvproxy"`. To see them:
//!
//! ```bash
//! RUST_LOG=gvproxy=debug cargo run
//! ```
//!
//! ## Platform-specific behavior
//!
//! - **macOS**: VFKit protocol with `UnixDgram` sockets (`SOCK_DGRAM`)
//! - **Linux**: Qemu protocol with `UnixStream` sockets (`SOCK_STREAM`)

mod config;
#[cfg(feature = "gvproxy")]
mod ffi;
#[cfg(feature = "gvproxy")]
mod instance;
#[cfg(feature = "gvproxy")]
mod logging;
mod services;
mod stats;

// Re-export public API
pub use config::{DnsRecord, DnsZone, GvproxyConfig, GvproxySecretConfig};
#[cfg(feature = "gvproxy")]
pub use instance::GvproxyInstance;
#[cfg(feature = "gvproxy")]
pub use logging::init_logging;
pub use services::GvproxyBackend;
pub use stats::{NetworkStats, TcpStats};

use std::path::{Path, PathBuf};

/// Filename of gvproxy's control (ServicesMux) socket — a sibling of the data
/// socket (`net.sock`) in the box's sockets dir. Kept shorter than the longest
/// name `BoxSockets` tracks (`net.sock-krun.sock`, 18 bytes) so the `sun_path`
/// budget is unaffected. See [`crate::net::socket_path`].
const CONTROL_SOCK: &str = "gvproxy-ctl.sock";

/// gvproxy's control socket path, derived as a sibling of the data socket.
///
/// Deriving it here keeps this gvproxy-only detail out of the neutral
/// socket/layout/backend-config types: both the shim (which binds it) and the
/// core client (which dials it) compute it from the one `net.sock` path they
/// already share — mirroring how libkrun derives `net.sock-krun.sock`.
pub(crate) fn control_socket_path(data_socket: &Path) -> PathBuf {
    data_socket.with_file_name(CONTROL_SOCK)
}

/// Concrete [`NetworkBackendFactory`](super::NetworkBackendFactory) for gvproxy —
/// produces a [`GvproxyBackend`] from the box's [`NetworkBackendConfig`].
pub struct GvproxyFactory;

impl super::NetworkBackendFactory for GvproxyFactory {
    fn create(
        &self,
        config: &super::NetworkBackendConfig,
    ) -> Option<Box<dyn super::NetworkBackend>> {
        Some(Box::new(GvproxyBackend::from_config(config)) as Box<dyn super::NetworkBackend>)
    }
}