v0.14.0: cooperative step model for long-running guests - #114
Merged
Merged
Conversation
The plat-hyperlight-v2 kernel gains the cooperative step model, per-call and process exit status, and a serial terminal that honors the ECHO flag. Bump the submodule and ship the rebuilt elfloader, its defconfig, and the native test fixture. Signed-off-by: danbugs <danilochiarlone@gmail.com>
AppSandbox with run/submit/step/join, snapshot at any boundary and resume in-process or from disk, a typed Error/Result, env and mount validation, and the host filesystem functions (listing cap and errno replies). Co-authored-by: Jorge Prendes <jorge.prendes@gmail.com> Signed-off-by: danbugs <danilochiarlone@gmail.com>
Hostnames are checked as the guest's DNS queries leave and again at the destination, with no host-side re-resolution under an allow list; IPv4-mapped addresses are canonicalized so a dual-stack socket cannot bypass the rules. Signed-off-by: danbugs <danilochiarlone@gmail.com>
Runtime drivers read calls from /dev/hlcall on their own thread, report per-call and process exit status, handle an exit inside a call uniformly, quote host env values safely, and set a working PATH; the FunctionCall reader is bounds-checked. Co-authored-by: Jorge Prendes <jorge.prendes@gmail.com> Signed-off-by: danbugs <danilochiarlone@gmail.com>
New tests/step.rs and updates across the suites for AppSandbox, snapshot-to-disk, exit handling and the network policy; snapshots and mounts use self-cleaning tempfile directories. Signed-off-by: danbugs <danilochiarlone@gmail.com>
New execution.md, driver.md, clock.md and random.md; fs.md, net.md and concurrency.md updated for the step model and the network policy; README links the new pages. Signed-off-by: danbugs <danilochiarlone@gmail.com>
Add examples/c/status.c, examples/python/asyncio_demo.py and examples/go/counter.go; fold the Native AOT programs into examples/dotnet-aot/{hello,env_vars,caps}; refresh the Python examples.
Signed-off-by: danbugs <danilochiarlone@gmail.com>
Drop the removed dotnet-aot-envvars path from the CI cache key; build the new status and counter test binaries and the reorganized dotnet-aot programs. Signed-off-by: danbugs <danilochiarlone@gmail.com>
Update pptx-gen for AppSandbox and refresh its lock. Signed-off-by: danbugs <danilochiarlone@gmail.com>
Bump the crate to 0.14.0 and move the changelog's Unreleased entries under [v0.14.0], keeping an empty Unreleased section. Signed-off-by: danbugs <danilochiarlone@gmail.com>
danbugs
force-pushed
the
coop-pause-vm-v0.14.0
branch
from
September 19, 2026 01:59
e538ef1 to
2f39a1d
Compare
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
One or more issues must be addressed before approval.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 7
Open (8)
What changed in this PR
Introduces the v0.14 cooperative guest execution model, including stepping, snapshots, entry-point guests, typed errors, network-policy updates, and refreshed runtime drivers/tests.
Changes:
- Replaces callback/halt drivers with
/dev/hlcallcooperative serving. - Adds long-running guest, snapshot/restore, networking, exit-status, and filesystem tests.
- Updates documentation, examples, AOT builds, and release metadata.
| File | Description |
|---|---|
| tests/python.rs | Updated as part of this pull request. |
| tests/python_shell.rs | Updated as part of this pull request. |
| tests/powershell.rs | Updated as part of this pull request. |
| tests/node.rs | Updated as part of this pull request. |
| tests/networking.rs | Updated as part of this pull request. |
| tests/native_kernel.rs | Updated as part of this pull request. |
| tests/dotnet_jit.rs | Updated as part of this pull request. |
| tests/compiled.rs | Updated as part of this pull request. |
| tests/common/mod.rs | Updated as part of this pull request. |
| tests/cli.rs | Updated as part of this pull request. |
| tests/bash.rs | Updated as part of this pull request. |
| tests/agent.rs | Updated as part of this pull request. |
| src/hostfs.rs | Updated as part of this pull request. |
| src/errno.rs | Updated as part of this pull request. |
| README.md | Updated as part of this pull request. |
| kernel/README.md | Updated as part of this pull request. |
| justfile | Updated as part of this pull request. |
| examples/python/subprocess_demo.py | Updated as part of this pull request. |
| examples/python/env_vars.py | Updated as part of this pull request. |
| examples/python/asyncio_demo.py | Updated as part of this pull request. |
| examples/go/README.md | Updated as part of this pull request. |
| examples/go/counter.go | Updated as part of this pull request. |
| examples/dotnet-aot/README.md | Updated as part of this pull request. |
| examples/dotnet-aot/hello/Hello.csproj | Updated as part of this pull request. |
| examples/dotnet-aot/hello/Hello.cs | Updated as part of this pull request. |
| examples/dotnet-aot/Hello.csproj | Updated as part of this pull request. |
| examples/dotnet-aot/env_vars/Program.cs | Updated as part of this pull request. |
| examples/dotnet-aot/env_vars/EnvVars.csproj | Updated as part of this pull request. |
| examples/dotnet-aot/Directory.Build.props | Updated as part of this pull request. |
| examples/dotnet-aot/caps/Program.cs | Updated as part of this pull request. |
| examples/dotnet-aot/caps/Caps.csproj | Updated as part of this pull request. |
| examples/dotnet-aot-envvars/EnvVars.csproj | Updated as part of this pull request. |
| examples/dotnet-aot-envvars/.gitignore | Updated as part of this pull request. |
| examples/c/status.c | Updated as part of this pull request. |
| examples/c/README.md | Updated as part of this pull request. |
| drivers/python/hl_pydriver.c | Updated as part of this pull request. |
| drivers/powershell/hl_pwshdriver.c | Updated as part of this pull request. |
| drivers/hl_pywarmdriver.c | Updated as part of this pull request. |
| drivers/hl_py.h | Updated as part of this pull request. |
| drivers/hl_fc.h | Updated as part of this pull request. |
| drivers/hl_execdriver.c | Updated as part of this pull request. |
| drivers/hl_env.h | Updated as part of this pull request. |
| drivers/hl_driver.h | Updated as part of this pull request. |
| drivers/dotnet-jit/HlDotnetDispatch/RoslynCompiler.cs | Updated as part of this pull request. |
| drivers/dotnet-jit/hl_dotnetdriver.c | Updated as part of this pull request. |
| drivers/bash/hl_bashdriver.c | Updated as part of this pull request. |
| docs/random.md | Updated as part of this pull request. |
| docs/net.md | Updated as part of this pull request. |
| docs/fs.md | Updated as part of this pull request. |
| docs/execution.md | Updated as part of this pull request. |
| docs/driver.md | Updated as part of this pull request. |
| docs/concurrency.md | Updated as part of this pull request. |
| docs/clock.md | Updated as part of this pull request. |
| demos/pptx-gen/src/main.rs | Updated as part of this pull request. |
| demos/pptx-gen/Cargo.lock | Updated as part of this pull request. |
| defconfig-elfloader | Updated as part of this pull request. |
| conformance/python/known_failures.toml | Updated as part of this pull request. |
| CHANGELOG.md | Updated as part of this pull request. |
| Cargo.toml | Updated as part of this pull request. |
| Cargo.lock | Updated as part of this pull request. |
| .github/workflows/ci.yml | Updated as part of this pull request. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
danbugs
force-pushed
the
coop-pause-vm-v0.14.0
branch
10 times, most recently
from
September 20, 2026 21:15
21a3ec2 to
882caed
Compare
The interpreter that runs guest calls is loaded with execve(), so it takes its C stack from the execve() program stack, not from any thread sized by CONFIG_STACK_SIZE_PAGE_ORDER. Unikraft has no procfs, so CPython's pthread_getattr_np() cannot read the stack bounds and its C-recursion guard never calibrates: deep Python recursion overruns the guard page and faults instead of raising RecursionError. Bump the platform kernel to ac3e6f17, which makes the execve() program stack size configurable (and decouples the boot stack from the thread-stack order), and set it to 2048 pages (8 MiB) here. That gives the interpreter the C-stack room it needs while leaving the default thread stack small, so .NET's many worker threads stay within the memory budget. Rebuild the elfloader and native fixture kernels. Signed-off-by: danbugs <danilochiarlone@gmail.com>
Re-run against the fixed kernel: 20 modules that were listed as failing now pass (frame, struct, generators, unicodedata and other deep-C-stack crashes cleared by the larger execve() stack, plus select/poll, asyncgen and several threaded-server clients on revalidation); drop them. Add test_syslog, whose threaded and subinterpreter tests hang the cooperative scheduler. Signed-off-by: danbugs <danilochiarlone@gmail.com>
join() loops until the process exits, but a driver never exits on its own -- its calls just complete. On a driver sandbox that made join() spin forever on an idle driver. Return Error::NothingToJoin when a driver call finishes instead, and cover it with a test. Signed-off-by: danbugs <danilochiarlone@gmail.com>
A std name lookup cannot be cancelled and runs to completion even after the caller stops waiting, so a guest that floods connects while DNS is slow could pile resolver threads up without limit. Bound the live count at 32; over the cap the lookup is skipped and the block list fails closed, exactly as it does for a lookup that misses its deadline. Signed-off-by: danbugs <danilochiarlone@gmail.com>
…t down On the single-vCPU cooperative scheduler, Environment.Exit tears the .NET runtime down by coordinating its threads, and that teardown can leave a background thread parked with no wake -- the shutdown never finishes and the guest call deadlocks (seen only under KVM; Windows and local runs complete). The concurrent GC's background thread never runs concurrently on a single vCPU anyway; dropping it (DOTNET_gcConcurrent=0) removes a thread from the shutdown handoff and lets it complete. Signed-off-by: danbugs <danilochiarlone@gmail.com>
restore-cost/hello measures around 3.7 ms with the fixed kernel; lift the linux ceilings to 4 ms (python) and 5 ms (python-shell) so the benchmark gate is not tripped by ordinary run-to-run noise. Signed-off-by: danbugs <danilochiarlone@gmail.com>
danbugs
force-pushed
the
coop-pause-vm-v0.14.0
branch
from
September 20, 2026 22:00
882caed to
9edd688
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
0.14.0 adds a cooperative step model so a guest can run long-lived servers, be stepped and snapshotted at any boundary, and report how each call and the guest itself ended. It is a breaking guest-side change: rootfs images must be rebuilt (
just build-rootfs).run/submit/step/join, snapshot at any boundary (even mid-call), resume in-process or from disk.hluk run/AppSandbox::join.hyperlight_unikraft::Error/Result, a variant per condition instead of string matching.clock_nanosleep, socket readiness, crash reporting).execution.md,driver.md,clock.md,random.md.Full detail in
CHANGELOG.md.