[ananos]

This branch puts hvi in the bundle and moves urunc to the stack that boots a container on it: one urunit binary as the whole initrd, an overlay root on two disks, and stop signals handed to the guest init. cloud-hypervisor stays in the bundle, as the fallback and as the A/B control.

The bundle names no default monitor. urunc boots whatever com.urunc.unikernel.hypervisor asks for, and brig sets that annotation. So a brig that knows hvi on Linux (brig-sh/brig feat/linux-rootfs-mode) boots hvi from this bundle, and an older brig keeps getting cloud-hypervisor. The same holds for com.urunc.unikernel.rootfsMode=overlay-block. The two land in that order: this bundle first, then the brig change with the install.sh pin.

Changes

• hvi, built from source. brig-sh/hvi-vmm publishes no Linux binary, so the build compiles it at a pinned commit (24dc2c5, main), static against musl in a rust:1.95.0 container, and installs it as bin/hvi with a [monitors.hvi] section. MONITORS lists it first. The pin is main 24dc2c5, which carries the vsock half-close fix (fix(vsock): End each direction of a connection on its own brig-sh/hvi-vmm#266); that one changes the Linux binary, so the branch follows it.
• urunc at ff1063a, feat/linux-overlay-block: feat/unchanged_containers with the exec fixes, the Linux hvi backend with exec over its agent socket, urunit's single binary in the initrd, rootfsMode=overlay-block (a read-only lower disk and a writable upper, both with serials), stop signals to the guest init, and urunit.conf as the NUL-terminated records of fix(unikernels): use NUL separation for urunit config values urunc-dev/urunc#1111. It sits on urunc main 6545f17.
• urunit from urunc's pin. The build reads packaging/container-initrd/urunit.pin from the urunc checkout (today de324cf, stack/9-nul-without-magic), so the initrd always matches the shim that talks to it. URUNIT_REPO/URUNIT_REF override it for one build; a urunc commit without the file is refused. busybox and container-init leave the initrd: it is /urunit with /init and /vz-init linked to it.
• Pin test and CI check follow: the stub urunc checkout plants a urunit.pin, and CI compares URUNIT_REF in pins.env with the pin at the recorded urunc commit.
• Docs say who picks the monitor, count hvi among the four things the build compiles, and close the open question on where hvi comes from.

Tested (amd64, nofire-cerno)

Built with this branch at e07701d (--rootless): pins.env records urunc ff1063a, urunit de324cf, hvi 7766307, all PINNED=true; bin/hvi --version is hvi 0.1.0 (core 0.1.0), static-pie musl; the initrd is urunit (136 KB) plus the two links.

User install over an rc17 install, then ubuntu:24.04 through brig-ctl run with brig's boot annotations:

Boot	Result
hvi, virtio-fs root	boots (guest 6.18.55), exec prints both lines of a two-line command
cloud-hypervisor, virtio-fs root	same
hvi, rootfsMode=overlay-block	--disk ro lower (disk0) + rw upper (disk1), / is overlay, a file written to the guest root is still there after nerdctl stop and start

No monitor or virtiofsd left after rm. tests/source-pins.sh, the other tests/*.sh, sh -n and shellcheck are clean.

Earlier runs of the same pins (21 and 23 October, reduced then full size) on nuc8, jetson6 and rpi5-11: hvi at parity with cloud-hypervisor on every stress row, 0 truncated of 2000 concurrent brig sh, 0 of 20 overlay-block writes lost, 0 of 500 execs failed.

nuc8, from the CI artifacts of e07701d (fresh rootless install, then the full s6 gate): stress 60/60 on hvi, cloud-hypervisor, and both with the overlay-block root; conc3 2000/2000 on each monitor with 0 truncated and 0 ^@; nul-ab 500/500; persist 0 of 20 lost; exec 0 of 500 failed; flock across sandboxes 9 and 14 of 1000 (virtiofsd, same on both). Then a system install from the plain artifact, one hvi boot as root through /usr/local/bin/brig, and an uninstall that leaves no /var/lib/brig, launcher or /etc/urunc; the user install was intact afterwards and came back after a reboot of the host.

The pin bump to brig v0.4.1, hvi 24dc2c5 and assets 0.1.10 came after that gate; the hvi move changes the Linux binary (vsock), so nuc8 was re-gated from the CI artifact of 8db81ee: in-place user upgrade (pins.env hvi 24dc2c5, brig v0.4.1, assets 0.1.10), the three smoke boots, a 4 MB guest-to-host stream complete on both monitors, conc3 2000/2000 with 0 truncated and 0 ^@ on hvi and on cloud-hypervisor, persist 0 of 20 lost and exec 0 of 500 failed on hvi, no leftovers. The urunc pin will move once the stack is rebased on current main (7 commits behind, CI and deps only).

Release sequence

1. Merge this and cut v0.1.0-rc18.
2. brig: feat/linux-rootfs-mode plus the install.sh RUNTIME_VERSION bump to that tag, in one PR.