boxlite 0.9.2

Embeddable virtual machine runtime for secure, isolated code execution
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118

//! Container volume management.
//!
//! Manages bind mounts from guest VM paths into container namespace.
//! Works with GuestVolumeManager to set up the underlying virtiofs shares.
//!
//! Uses convention-based paths following Kata pattern:
//! - Host: Only tracks volume_name, doesn't know guest paths
//! - Guest: Constructs paths from `/run/boxlite/shared/containers/{container_id}/volumes/{volume_name}`

use std::path::PathBuf;

use super::guest_volume::GuestVolumeManager;

/// Container bind mount entry.
///
/// Uses convention-based paths - guest constructs full path from volume_name:
/// `/run/boxlite/shared/containers/{container_id}/volumes/{volume_name}`
#[derive(Debug, Clone)]
pub struct ContainerMount {
    /// Volume name (guest constructs full path using convention)
    pub volume_name: String,
    /// Destination path in container
    pub destination: String,
    /// Read-only mount
    pub read_only: bool,
    /// Owner UID of host directory (for auto-idmap in guest)
    pub owner_uid: u32,
    /// Owner GID of host directory (for auto-idmap in guest)
    pub owner_gid: u32,
}

/// Manages container-level volume configuration.
///
/// Holds a reference to GuestVolumeManager and tracks bind mounts
/// from guest VM paths into container namespace.
pub struct ContainerVolumeManager<'a> {
    guest: &'a mut GuestVolumeManager,
    container_mounts: Vec<ContainerMount>,
}

impl<'a> ContainerVolumeManager<'a> {
    /// Create a new container volume manager.
    pub fn new(guest: &'a mut GuestVolumeManager) -> Self {
        Self {
            guest,
            container_mounts: Vec::new(),
        }
    }

    /// Add a user volume using convention-based paths.
    ///
    /// Follows Kata pattern:
    /// - Host: Only knows volume_name and virtiofs tag
    /// - Proto: Sends volume_name + container_id to guest
    /// - Guest: Constructs full path from convention + container_id + volume_name
    /// - Container: Bind mount from guest path to user-specified container path
    ///
    /// Convention (guest-side only):
    /// `/run/boxlite/shared/containers/{container_id}/volumes/{volume_name}`
    ///
    /// # Arguments
    /// * `container_id` - Container ID for path construction
    /// * `volume_name` - Volume identifier (e.g., "data", "config")
    /// * `tag` - Virtiofs tag name (e.g., "uservol0")
    /// * `host_path` - Path on host to share
    /// * `container_path` - Mount point in container (user-specified)
    /// * `read_only` - Whether the mount is read-only
    #[allow(clippy::too_many_arguments)]
    pub fn add_volume(
        &mut self,
        container_id: &str,
        volume_name: &str,
        tag: &str,
        host_path: PathBuf,
        container_path: &str,
        read_only: bool,
        owner_uid: u32,
        owner_gid: u32,
    ) {
        // Add virtiofs share to guest with container_id
        // Guest will mount at convention path: /run/boxlite/shared/containers/{container_id}/volumes/{tag}
        self.guest.add_fs_share(
            tag,
            host_path,
            None,
            read_only,
            Some(container_id.to_string()),
        );

        // Record container bind mount - guest constructs source path from convention
        self.container_mounts.push(ContainerMount {
            volume_name: volume_name.to_string(),
            destination: container_path.to_string(),
            read_only,
            owner_uid,
            owner_gid,
        });
    }

    /// Add a container bind mount directly.
    ///
    /// Use when guest path already exists (e.g., from block device mount).
    #[allow(dead_code)]
    pub fn add_bind(&mut self, volume_name: &str, container_path: &str, read_only: bool) {
        self.container_mounts.push(ContainerMount {
            volume_name: volume_name.to_string(),
            destination: container_path.to_string(),
            read_only,
            owner_uid: 0,
            owner_gid: 0,
        });
    }

    /// Build container mount configuration.
    pub fn build_container_mounts(&self) -> Vec<ContainerMount> {
        self.container_mounts.clone()
    }
}