Skip to content

feat(control): add ZoneSpec.vm_image for VM-image zones #41

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
89luca89 merged 2 commits into from
Jul 13, 2026
Merged

feat(control): add ZoneSpec.vm_image for VM-image zones #41

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
617e3b9
feat(control): add ZoneSpec.vm_image for VM-image zones
89luca89 Jul 8, 2026
89b798d
Merge branch 'main' into 89luca89/feat/vm_image_support
89luca89 Jul 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions protect/control/v1/common.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,10 @@ message ZoneSpec {
string fork_parent_zone_id = 12;
// Configures Control API access for the zone.
ZoneControlApiSpec control_api = 13;
// Boots the zone from a disk image via UEFI firmware instead of the
// container path. KVM-only; mutually exclusive with `kernel`, `initrd`,
// `addons`, `scratch_disk` (rejected by the daemon).
Comment thread
bleggett marked this conversation as resolved.
ZoneVmImageSpec vm_image = 14;
}

// Access control specification on the Control API for a zone.
Expand Down Expand Up @@ -637,6 +641,22 @@ message ZoneScratchDiskSpecStaticBlock {
string device = 2;
}

message ZoneVmImageSpec {
// Resolved against the daemon's VM-image directory; absolute paths and
// paths escaping it are rejected.
string path = 1;
// No autodetection: mitigates CHV format-probing CVE GHSA-jmr4-g2hv-mjj6
// (hardened in CHV v51.0).
ZoneVmImageFormat format = 2;
}

enum ZoneVmImageFormat {
ZONE_VM_IMAGE_FORMAT_UNSPECIFIED = 0;
ZONE_VM_IMAGE_FORMAT_RAW = 1;
// V1: launched with in-image backing files disabled.
ZONE_VM_IMAGE_FORMAT_QCOW2 = 2;
}

message ZoneDeviceStatus {
repeated ZoneDiskStatus disks = 1;
ZoneMountStatus mount = 2;
Expand Down
Loading