Port freeze/migrate off host Docker (last docker-bootstrap in the firecracker path) #397

New Issue

2026-07-17T00:16:48-04:00

didericis-claude commented

2026-07-17 00:16:48 -04:00

Context

The last host-Docker dependency in the Firecracker launch path (PRD 0069 / #348). Stage 2 (#395) removed Docker from the infra-image bootstrap by pulling a prebuilt rootfs artifact; Stage 3 already builds agent images in-VM with buildah. What remains is freeze/migrate.

Where Docker still runs on the launch host

Freeze / commit — firecracker/freezer.py:73 runs docker build to snapshot a running agent VM into an image.
Resuming a frozen/migrated agent — the committed-image branch of _build_agent_base (firecracker/launch.py:222) calls util.build_base_rootfs_dir(committed), which is docker create + docker export | tar (firecracker/util.py:188-206), plus docker_image_id (util.py:153).

Goal

Port both off host Docker so the Firecracker backend needs firecracker + KVM only — no Docker daemon, no docker group — completing #348. Likely shape: commit the agent VM's rootfs directly (it's already an ext4 we control) rather than round-tripping through a Docker image, and export/prepare it without docker export.

Note: docker_mod.build_image / build_base_rootfs_dir also back the opt-in BOT_BOTTLE_INFRA_BUILD=local dev escape hatch and the off-host publish_infra step — those are intentional and out of scope; this issue is only the freeze/migrate launch-path use.

## Context The **last** host-Docker dependency in the Firecracker launch path (PRD 0069 / #348). Stage 2 (#395) removed Docker from the infra-image bootstrap by pulling a prebuilt rootfs artifact; Stage 3 already builds agent images in-VM with buildah. What remains is **freeze/migrate**. ## Where Docker still runs on the launch host 1. **Freeze / commit** — `firecracker/freezer.py:73` runs `docker build` to snapshot a running agent VM into an image. 2. **Resuming a frozen/migrated agent** — the committed-image branch of `_build_agent_base` (`firecracker/launch.py:222`) calls `util.build_base_rootfs_dir(committed)`, which is `docker create` + `docker export | tar` (`firecracker/util.py:188-206`), plus `docker_image_id` (`util.py:153`). ## Goal Port both off host Docker so the Firecracker backend needs **firecracker + KVM only** — no Docker daemon, no `docker` group — completing #348. Likely shape: commit the agent VM's rootfs directly (it's already an ext4 we control) rather than round-tripping through a Docker image, and export/prepare it without `docker export`. Note: `docker_mod.build_image` / `build_base_rootfs_dir` also back the opt-in `BOT_BOTTLE_INFRA_BUILD=local` dev escape hatch and the off-host `publish_infra` step — those are intentional and out of scope; this issue is only the freeze/migrate launch-path use.

didericis-claude referenced this issue

2026-07-17 00:17:02 -04:00

Firecracker-native, Docker-free backend (PRD 0069) #348

didericis added the Kind/Enhancement

Priority

High

2

labels 2026-07-17 00:18:43 -04:00

didericis referenced this issue from a commit

2026-07-17 00:31:09 -04:00

feat(firecracker): port freeze/migrate off host Docker (PRD 0069 / #397)

didericis-claude referenced a pull request that will close this issue