Skip to content

[do not merge] Restore snapshots with less scratch - #162

Open
danbugs wants to merge 3 commits into
mainfrom
scratch-resize
Open

danbugs wants to merge 3 commits into
mainfrom
scratch-resize

Conversation

@danbugs

@danbugs danbugs commented Oct 16, 2026

Copy link
Copy Markdown
Contributor

Adds AppSandbox::snapshot_with_scratch_mb: boot with the scratch unpacking the rootfs needs, then restore guest function calls from a snapshot with far less. Built against hyperlight's scratch-resize branch (hyperlight-dev/hyperlight#1947) and a kernel branch on a fork, so it can't merge until both land upstream.

  • Kernel: stops allocating at the host's reserved pages and the transport arena, aborts cleanly when scratch runs out in a copy-on-write fault, and runs from a smaller restored scratch. It works on hyperlight 0.18.0 too.
  • snapshot_with_scratch_mb, SNAPSHOT_CONTRACT 6, tests/resize.rs (also run in the arm64 job), plus CHANGELOG and execution docs.
  • Restore plus guest function call at 8 MiB: python on MSHV 32.6 → 1.07 ms, node 66.2 → 1.62 ms; on WHP 11.6 → 3.80 ms. Tested on KVM, MSHV, WHP and macOS HVF.

Pin hyperlight-host and hyperlight-common to hyperlight's scratch-resize
branch, and point the kernel submodule at the scratch-resize branch of
the danbugs/unikraft fork (off plat-hyperlight-v2). A hyperlight release
and the upstream kernel branch replace both before this merges.

Signed-off-by: danbugs <danilochiarlone@gmail.com>
Bump the kernel to the scratch-resize branch (plat-hyperlight-v2
c1051427 -> 11e01f8a), and rebuild the kernels and the native-kernel
fixture:

- The allocator stopped two pages below the top of scratch, but
  Hyperlight reserves twelve there, and the early fault handlers had no
  limit.  Allocation now stops at the reserved pages, or at the
  transport arena when the host places it below them.
- A guest that ran out of scratch inside a copy-on-write fault crashed
  again reporting it and triple-faulted the VM.  It now aborts.
- The scratch base follows the scratch size, so the kernel runs from a
  snapshot restored with less scratch.

The kernel runs on hyperlight 0.18.0 as well as on the scratch-resize
host.

Signed-off-by: danbugs <danilochiarlone@gmail.com>
Booting needs room to unpack the rootfs; guest function calls need far
less.  snapshot_with_scratch_mb takes a snapshot that a sandbox restores
with `mb` MiB of scratch, so every restore of a warm image costs less.
It errors on a size above the sandbox's scratch or too small for the
transport and page tables; a size too small for the kernel fails the
restore, and a restore of a snapshot that fits recovers the sandbox.

The host's scratch layout changed (the transport arena sits at a fixed
address below the top of scratch), so SNAPSHOT_CONTRACT goes to 6 and
older snapshots are refused.  tests/resize.rs covers the round trip,
the error paths and a guest function call that outgrows the snapshot;
the arm64 job runs it too.

Signed-off-by: danbugs <danilochiarlone@gmail.com>
Copilot AI balanced review requested due to automatic review settings October 16, 2026 23:32
@danbugs danbugs added the ci/arm64 Run the arm64 guest tests (self-hosted KVM and HVF runners) label Oct 16, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Snapshot memory-layout changes depend on unmerged host and kernel work and require final human validation.

No open issues 🎉

What changed in this PR

Adds smaller-scratch snapshots so guests can boot with ample memory and restore with less, reducing restore costs.

Changes:

  • Adds snapshot_with_scratch_mb and documents sizing and recovery behavior.
  • Tests resized snapshots, persistence, and failure recovery.
  • Updates snapshot compatibility and temporarily pins unmerged host and kernel dependencies.
File Description
tests/​resize.rs Tests resizing, persistence, limits, and recovery.
src/​lib.rs Adds the resized-snapshot API and saturating size conversion.
docs/​execution.md Documents smaller-scratch restores.
CHANGELOG.md Records the API and compatibility changes.
Cargo.toml Pins experimental Hyperlight dependencies.
Cargo.lock Locks the pinned Hyperlight revision.
build.rs Bumps the snapshot contract to 6.
.gitmodules Selects the scratch-resize kernel fork.
.github/​workflows/​arm64.yml Includes resize tests in arm64 CI.

Review effort: Balanced

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ci/arm64 Run the arm64 guest tests (self-hosted KVM and HVF runners)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants