From 617e3b9a42ecab2c686efb84e4e5b8f29ce6119a Mon Sep 17 00:00:00 2001
From: Luca Di Maio <luca.dimaio1@gmail.com>
Date: Wed, 8 Jul 2026 16:29:26 +0200
Subject: [PATCH] feat(control): add ZoneSpec.vm_image for VM-image zones

V1 scope of the VM Image Support PRD. qcow2 launches with in-image backing files
disabled to keep the V1 trust boundary narrow.

Fixes https://github.com/edera-dev/protect/issues/2878

Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
---
 protect/control/v1/common.proto | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/protect/control/v1/common.proto b/protect/control/v1/common.proto
index 3e63c2d..60e59ec 100644
--- a/protect/control/v1/common.proto
+++ b/protect/control/v1/common.proto
@@ -38,6 +38,10 @@ message ZoneSpec {
   string fork_parent_zone_id = 12;
   // Configures Control API access for the zone.
   ZoneControlApiSpec control_api = 13;
+  // Boots the zone from a disk image via UEFI firmware instead of the
+  // container path. KVM-only; mutually exclusive with `kernel`, `initrd`,
+  // `addons`, `scratch_disk` (rejected by the daemon).
+  ZoneVmImageSpec vm_image = 14;
 }
 
 // Access control specification on the Control API for a zone.
@@ -627,6 +631,22 @@ message ZoneScratchDiskSpecStaticBlock {
   string device = 2;
 }
 
+message ZoneVmImageSpec {
+  // Resolved against the daemon's VM-image directory; absolute paths and
+  // paths escaping it are rejected.
+  string path = 1;
+  // No autodetection: mitigates CHV format-probing CVE GHSA-jmr4-g2hv-mjj6
+  // (hardened in CHV v51.0).
+  ZoneVmImageFormat format = 2;
+}
+
+enum ZoneVmImageFormat {
+  ZONE_VM_IMAGE_FORMAT_UNSPECIFIED = 0;
+  ZONE_VM_IMAGE_FORMAT_RAW = 1;
+  // V1: launched with in-image backing files disabled.
+  ZONE_VM_IMAGE_FORMAT_QCOW2 = 2;
+}
+
 message ZoneDeviceStatus {
   repeated ZoneDiskStatus disks = 1;
   ZoneMountStatus mount = 2;