[PR #358] [MERGED] feat: integrate nested KVM and support legacy v9 snapshot recovery #377

New issue

Closed

opened 2026-10-29 14:22:46 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-29 14:22:46 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/kvcache-ai/AgentENV/pull/358
Author: @Hygge-Gezelligheid
Created: 10/10/2026
Status: ✅ Merged
Merged: 10/29/2026
Merged by: @yingdi-shan

Base: main ← Head: agent/nestedvirt-opt-in-20261010

📝 Commits (3)

73b2886 feat: integrate nested KVM runtime and end-to-end tests
2e2dee1 fix: enable legacy v9 snapshot recovery with the v1000 runtime
87c512e feat(kernel): default KVM to prebuilt Linux 6.18

📊 Changes

7 files changed (+1001 additions, -117 deletions)

View changed files

📝 .github/workflows/integration-tests.yml (+17 -0)
📝 config/deps_manifest.toml (+4 -4)
📝 docs/src/internals/sandbox-testing.md (+75 -0)
➕ scripts/tests/nestedvirt-guest.sh (+45 -0)
➕ scripts/tests/nestedvirt-smoke.py (+502 -0)
📝 src/sandbox/firecracker/sandbox.rs (+41 -0)
📝 tests/integration/orchestrator.rs (+317 -113)

📄 Description

What

Integrate the nested-KVM runtime and prebuilt Linux 6.18 kernels, and enable legacy v9 snapshot recovery with the configured Firecracker.

Why

After upgrading the runtime, existing snapshots should remain recoverable using the configured Firecracker, consistent with the prewarmed process pool.

Companion runtime: Firecracker #27.

Scope and non-goals

Runtime selection changes apply to the shared snapshot restore path. Default runtime and kernel upgrades apply to KVM on x86_64 and aarch64; PVM defaults remain unchanged.

Design and behavior changes

Upgrade the default KVM Firecracker from 1.15.1-patch-v1 to 1.15.1-patch-v2, including its matching helper.
Use the configured Firecracker in the shared snapshot restore path, including paused-sandbox recovery and fork creation, while preserving captured guest assets.
Upgrade the default KVM guest kernel from Linux 6.1.175 to prebuilt Linux 6.18 on x86_64 and aarch64. Explicit configuration overrides retain precedence.
Add nested-KVM end-to-end tests covering template restoration, fork isolation, and pause/resume with guest-side QEMU workloads.
Exercise persisted recovery across separate processes and add an opt-in x86_64 v9-to-v1000 upgrade test.

Compatibility and operations

Restart AgentENV after upgrading. The KVM runtime reads v9 snapshots and writes v1000; old runtimes cannot read v1000. Existing snapshots retain their captured kernel and boot arguments. Fresh guests use the configured kernel.

Public APIs and the paused-record schema remain unchanged. Runtime archives and both guest kernels are available in the patch-v2 release. Installations with cached historical pre-fault patch-v2 binaries must replace that cache.

Validation

Intel and AMD nested-KVM API and raw matrices passed, 9/9 each. The AMD GIF regression and three-state raw matrix passed after the GIF fix; the full AMD API matrix preceded that fix.
Native ARM64 KVM with Linux 6.18 passed template restoration, fork isolation, pause/resume and restart recovery with the process pool enabled and disabled. Real v9 templates and paused records were restored, saved as v1000 and restored again.
ARM installation-upgrade testing passed using staged old/new AgentENV packages. Empty-cache public downloads, cold start and pause/resume passed on Intel x86_64 and ARM64 with the published patch-v2 assets.
Earlier Rust integration and Docker Compose E2E runs passed. Script syntax, CLI help and fixture checks passed. Hosted CI checks the nested-test scripts and fixtures; the nested lifecycle matrix and opt-in cross-version test run separately on prepared hosts.

Risks and reviewer notes

Three commits: runtime and test integration; legacy v9 recovery; Linux 6.18 KVM defaults. Review runtime selection in src/sandbox/firecracker/sandbox.rs and dependency defaults in config/deps_manifest.toml.

Checklist

Changes are scoped to runtime integration, recovery and kernel defaults.
New behavior is covered by tests.
Examples and logs contain no credentials or private registry references.
Generated code was not manually edited.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/kvcache-ai/AgentENV/pull/358 **Author:** [@Hygge-Gezelligheid](https://github.com/Hygge-Gezelligheid) **Created:** 10/10/2026 **Status:** ✅ Merged **Merged:** 10/29/2026 **Merged by:** [@yingdi-shan](https://github.com/yingdi-shan) **Base:** `main` ← **Head:** `agent/nestedvirt-opt-in-20261010` --- ### 📝 Commits (3) - [`73b2886`](https://github.com/kvcache-ai/AgentENV/commit/73b28868a62aaea85150c381282b4a1accabe8b5) feat: integrate nested KVM runtime and end-to-end tests - [`2e2dee1`](https://github.com/kvcache-ai/AgentENV/commit/2e2dee1d3fa0952731e9330d73c72ce2b024b800) fix: enable legacy v9 snapshot recovery with the v1000 runtime - [`87c512e`](https://github.com/kvcache-ai/AgentENV/commit/87c512e8c2199d28b0d1ac76ddb73202ca0085a1) feat(kernel): default KVM to prebuilt Linux 6.18 ### 📊 Changes **7 files changed** (+1001 additions, -117 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/integration-tests.yml` (+17 -0) 📝 `config/deps_manifest.toml` (+4 -4) 📝 `docs/src/internals/sandbox-testing.md` (+75 -0) ➕ `scripts/tests/nestedvirt-guest.sh` (+45 -0) ➕ `scripts/tests/nestedvirt-smoke.py` (+502 -0) 📝 `src/sandbox/firecracker/sandbox.rs` (+41 -0) 📝 `tests/integration/orchestrator.rs` (+317 -113) </details> ### 📄 Description ## What Integrate the nested-KVM runtime and prebuilt Linux 6.18 kernels, and enable legacy v9 snapshot recovery with the configured Firecracker. ## Why After upgrading the runtime, existing snapshots should remain recoverable using the configured Firecracker, consistent with the prewarmed process pool. ## Related issue Companion runtime: [Firecracker #27](https://github.com/kvcache-ai/firecracker/pull/27). ## Scope and non-goals Runtime selection changes apply to the shared snapshot restore path. Default runtime and kernel upgrades apply to KVM on x86_64 and aarch64; PVM defaults remain unchanged. ## Design and behavior changes - Upgrade the default KVM Firecracker from `1.15.1-patch-v1` to `1.15.1-patch-v2`, including its matching helper. - Use the configured Firecracker in the shared snapshot restore path, including paused-sandbox recovery and fork creation, while preserving captured guest assets. - Upgrade the default KVM guest kernel from Linux 6.1.175 to prebuilt Linux 6.18 on x86_64 and aarch64. Explicit configuration overrides retain precedence. - Add nested-KVM end-to-end tests covering template restoration, fork isolation, and pause/resume with guest-side QEMU workloads. - Exercise persisted recovery across separate processes and add an opt-in x86_64 v9-to-v1000 upgrade test. ## Compatibility and operations Restart AgentENV after upgrading. The KVM runtime reads v9 snapshots and writes v1000; old runtimes cannot read v1000. Existing snapshots retain their captured kernel and boot arguments. Fresh guests use the configured kernel. Public APIs and the paused-record schema remain unchanged. Runtime archives and both guest kernels are available in the [patch-v2 release](https://github.com/kvcache-ai/firecracker/releases/tag/v1.15.1-patch-v2). Installations with cached historical pre-fault patch-v2 binaries must replace that cache. ## Validation - Intel and AMD nested-KVM API and raw matrices passed, 9/9 each. The AMD GIF regression and three-state raw matrix passed after the GIF fix; the full AMD API matrix preceded that fix. - Native ARM64 KVM with Linux 6.18 passed template restoration, fork isolation, pause/resume and restart recovery with the process pool enabled and disabled. Real v9 templates and paused records were restored, saved as v1000 and restored again. - ARM installation-upgrade testing passed using staged old/new AgentENV packages. Empty-cache public downloads, cold start and pause/resume passed on Intel x86_64 and ARM64 with the published patch-v2 assets. - Earlier Rust integration and Docker Compose E2E runs passed. Script syntax, CLI help and fixture checks passed. Hosted CI checks the nested-test scripts and fixtures; the nested lifecycle matrix and opt-in cross-version test run separately on prepared hosts. ## Risks and reviewer notes Three commits: runtime and test integration; legacy v9 recovery; Linux 6.18 KVM defaults. Review runtime selection in `src/sandbox/firecracker/sandbox.rs` and dependency defaults in `config/deps_manifest.toml`. ## Checklist - [x] Changes are scoped to runtime integration, recovery and kernel defaults. - [x] New behavior is covered by tests. - [x] Examples and logs contain no credentials or private registry references. - [x] Generated code was not manually edited. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-29 14:22:46 +00:00