feat: use vzNAT for vz networking, gate socket_vmnet behind config for qemu#1749
Open
ayush-panta wants to merge 1 commit into
Open
feat: use vzNAT for vz networking, gate socket_vmnet behind config for qemu#1749ayush-panta wants to merge 1 commit into
ayush-panta wants to merge 1 commit into
Conversation
ayush-panta
force-pushed
the
socket-vmnet-config
branch
3 times, most recently
from
d242adb to
a5937eb
Compare
…r qemu Signed-off-by: ayush-panta <ayushkp@amazon.com>
ayush-panta
force-pushed
the
socket-vmnet-config
branch
from
a5937eb to
4c1ca06
Compare
ayush-panta
changed the title
| // Configure vzNAT networking for vz (no sudo required, always enabled) | ||
| if lca.cfg.VMType != nil && *lca.cfg.VMType == "vz" { | ||
| limaCfg.Networks = append(limaCfg.Networks, limatype.Network{ | ||
| VZNAT: pointer.Bool(true), |
Contributor
There was a problem hiding this comment.
Should we try disabling vmnet by default and only enabling it for both vz (through vzNAT) and qemu (via socket_vmnet) when vmnet: true in finch config for consistency? And then rename the config flag to vmnet?
| func (bin *binaries) Install() error { | ||
| if bin.l != nil { | ||
| bin.l.Infof("Shared networking setup requires sudo. If this hangs " + | ||
| "(may be the case in non-interactive sesh or clamshell mode), " + |
Contributor
There was a problem hiding this comment.
Should we try to detect interactive mode?
Also nit: maybe we can shorten this message?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue #, if available: Closes #1173
Description of changes:
Eliminates the requirement for root privilege during
finch vm initfor the default (vz) VM type by using vzNAT for networking instead of socket_vmnet.Previously,
finch vm initunconditionally installed socket_vmnet to/opt/finch/(requiring sudo) regardless of VM type. This caused silent hangs in non-interactive environments (AI terminals, CI, clamshell mode) where the sudo prompt cannot be fulfilled.Summary of changes:
vzNAT: truein the Lima default config. This provides host-to-VM IP access via Apple's Virtualization framework without any privilege escalation. The VM gets alima0interface (a secondary network interface providing direct IP connectivity from the host) powered by vzNAT instead of socket_vmnet.socketVMNet: trueconfig option infinch.yaml. Without it, qemu uses SLIRP networking (port forwarding still works). When enabled, socket_vmnet creates thelima0interface via a privileged daemon, giving the VM a routable IP on a shared virtual network (192.168.105.0/24).Note:
lima0is the secondary network interface inside the VM that provides direct IP access from the macOS host. Without it, the VM is only reachable via port forwarding onlocalhost. With vzNAT (vz) or socket_vmnet (qemu),lima0gets an IP address that the host can reach directly.Testing done:
finch vm initwith vz (default): no sudo prompt, vzNAT configured,lima0created, VM reachable from host via IPv6 pingfinch vm initwith qemu (nosocketVMNet): no sudo prompt, no socket_vmnet, nolima0, port forwarding works (finch run -p 8080:80 nginx && curl localhost:8080)finch vm initwith qemu +socketVMNet: true: warning shown, sudo prompt appears, socket_vmnet installs,lima0created, VM reachable from host via IPv6 pingfinch vm stop && finch vm startwith socket_vmnet: no re-prompt (NOPASSWD sudoers rule works)Unit tests added for dependency gating logic (4 test cases, all pass)
Existing vmnet unit tests pass
I've reviewed the guidance in CONTRIBUTING.md
License Acceptance
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.