didericis
c276f7b0b1
Adds a Firecracker-based backend for Linux, providing mature KVM-based microVM isolation to replace smolmachines/libkrun (issue #342, closes the dead-end tracked in #332). Architecture: - Guest control over SSH (dropbear injected into the rootfs) on a point-to-point TAP link. `ssh -t` forwards SIGWINCH natively, so no resize bridge is needed. - Networking: a one-time, root-provisioned pool of user-owned TAP devices (no shared bridge → no docker0/virbr0/cni0 collisions) plus a dedicated `table inet bot_bottle_fc` nftables table (independent of Docker/ufw/firewalld rules). `./cli.py firecracker setup` prints the host-appropriate config (NixOS module or sudo script). - Rootfs: `docker export` → ext4 via `mke2fs -d` (rootless, no mount), cached by image digest; per-bottle SSH pubkey + IP passed via the kernel cmdline. - Sidecar: reuses the Docker bundle, published on the slot's host TAP IP. - Fail-closed isolation: TAP pool verified at preflight; the egress boundary is proven empirically post-boot (before the agent runs) by a canary probe — the VM must fail to reach the host directly, or launch is refused. Linux hosts with Firecracker + KVM now default to this backend; macOS stays on macos-container. Not yet validated end-to-end on live hardware (requires the one-time network pool). Unit tests + pyright pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G8p32HJgPoS1hLPWubbftM
111 lines
3.3 KiB
Python
111 lines
3.3 KiB
Python
"""Main CLI dispatcher.
|
|
|
|
Commands: cleanup, commit, edit, info, init, list, resume, start, supervise
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import sys
|
|
|
|
from ..errors import MissingEnvVarError
|
|
from ..log import Die, die, error
|
|
from ..manifest import ManifestError
|
|
from ..store_manager import StoreManager
|
|
from ._common import PROG
|
|
from . import list as _list_mod
|
|
from .cleanup import cmd_cleanup
|
|
from .commit import cmd_commit
|
|
from .edit import cmd_edit
|
|
from .firecracker import cmd_firecracker
|
|
from .info import cmd_info
|
|
from .init import cmd_init
|
|
from .resume import cmd_resume
|
|
from .start import cmd_start
|
|
from .supervise import cmd_supervise
|
|
|
|
cmd_list = _list_mod.cmd_list
|
|
|
|
COMMANDS = {
|
|
"cleanup": cmd_cleanup,
|
|
"commit": cmd_commit,
|
|
"edit": cmd_edit,
|
|
"firecracker": cmd_firecracker,
|
|
"info": cmd_info,
|
|
"init": cmd_init,
|
|
"list": cmd_list,
|
|
"resume": cmd_resume,
|
|
"start": cmd_start,
|
|
"supervise": cmd_supervise,
|
|
}
|
|
|
|
|
|
def usage() -> None:
|
|
sys.stderr.write(f"usage: {PROG} <command> [args...]\n\n")
|
|
sys.stderr.write("Commands:\n")
|
|
sys.stderr.write(" cleanup stop and remove all active bot-bottle containers\n")
|
|
sys.stderr.write(" commit snapshot a running bottle's container state to a Docker image\n")
|
|
sys.stderr.write(" edit open an agent in vim for editing\n")
|
|
sys.stderr.write(" firecracker one-time network setup for the Firecracker backend\n")
|
|
sys.stderr.write(" info print env, skills, and prompt details for a named agent\n")
|
|
sys.stderr.write(" init interactively create a new agent and add it to bot-bottle.json\n")
|
|
sys.stderr.write(" list list available agents or active containers\n")
|
|
sys.stderr.write(
|
|
" resume re-launch a bottle by its identity "
|
|
"(continues state from PRD 0016)\n"
|
|
)
|
|
sys.stderr.write(
|
|
" start boot a container for a named agent and "
|
|
"attach an interactive session\n"
|
|
)
|
|
sys.stderr.write(
|
|
" supervise view + approve/modify/reject pending supervise "
|
|
"proposals (PRD 0013)\n\n"
|
|
)
|
|
sys.stderr.write(f"Run '{PROG} <command> --help' for command-specific usage.\n")
|
|
|
|
|
|
def main(argv: list[str] | None = None) -> int:
|
|
if argv is None:
|
|
argv = sys.argv[1:]
|
|
if not argv:
|
|
usage()
|
|
return 2
|
|
command = argv[0]
|
|
rest = argv[1:]
|
|
if command in ("-h", "--help"):
|
|
usage()
|
|
return 0
|
|
handler = COMMANDS.get(command)
|
|
if handler is None:
|
|
usage()
|
|
die(f"unknown command: {command}")
|
|
mgr = StoreManager.instance()
|
|
if not mgr.is_migrated():
|
|
sys.stderr.write("bot-bottle: database schema is out of date\n")
|
|
sys.stderr.write("Migrate now? [y/N] ")
|
|
sys.stderr.flush()
|
|
try:
|
|
answer = sys.stdin.readline().strip().lower()
|
|
except EOFError:
|
|
answer = ""
|
|
if answer != "y":
|
|
error("migration required — re-run and confirm to migrate")
|
|
return 1
|
|
mgr.migrate()
|
|
try:
|
|
return handler(rest) or 0
|
|
except MissingEnvVarError as e:
|
|
error(str(e))
|
|
return 1
|
|
except ManifestError as e:
|
|
error(str(e))
|
|
return 1
|
|
except Die as e:
|
|
return e.code if isinstance(e.code, int) else 1
|
|
except KeyboardInterrupt:
|
|
return 130
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|