mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.8
c2ac6b5aeb
Agent workloads execute model-generated code, so they need a kernel boundary on top of the app's own sandboxing: Kata plus Firecracker where hardware virtualisation is available, the gVisor userspace kernel otherwise, never plain runc. runsc is fetched as the upstream static release binary with its published sha512 and the host architecture in the URL, because Debian ships only a 2024 build and Arch and Fedora ship none at all; the same path serves the arm64 Raspberry Pi target. select_runtime.yml is a reusable task file: it picks kata only when /dev/kvm, the kata shim and a bare host all hold. /dev/kvm is visible inside a Docker-in-Docker daemon through host passthrough, but the microVM still cannot start there (fuse-overlayfs, no containerd block devices), so DinD is excluded explicitly and degrades to runsc. daemon.json gains a runtimes block gated on group membership. Under DinD runsc additionally needs --network=host: its netstack cannot pluck interfaces inside a nested netns and aborts with 'cannot run with network enabled in root network namespace'. The flag keeps the syscall sandbox and reaches the container netns through real sockets. The role bootstraps before the service-loader preload, alongside svc-storage and svc-registry, so the runtime is registered and the daemon restarted before the first workload compose file renders. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
6 lines
121 B
YAML
6 lines
121 B
YAML
---
|
|
- include_tasks: 00_core.yml
|
|
when: run_once_svc_virt_kata is not defined
|
|
vars:
|
|
application_id: svc-virt-kata
|