guest: delete the process modules and cgroups (SL6.11b) - #1542

Leaving code only. This PR changes only code that this effort removes from NVX: the guest process modules (guest::{exec, spawn, process, cgroup, entry}), the layered root's bootstrap, and the per-execution OS support that only they used, with the edits that remove references to them. Nothing that stays changes, and no later PR uses what it changes, so the size limits for kept code don't apply.

The second commit is #1123's follow-up K1, which the group issue gives this PR once guest::sys::entry's per-execution parts leave: it drops CONFIG_MAGIC_SYSRQ from the guest kernel and names the kernel features' current consumers and validators. It changes kept code, within the limits for kept code (43 core lines in 1 counted file).

Part of #1123 (SL6.11b, "The process modules and cgroups are gone"). Parent #1087, umbrella #1076.

What and why

SL7.8b (#1534) and SL7.8c (#1536) deleted the old layered init, the managed agent's sandbox mode and the one-shot container helpers, the last users of the guest process modules: guest::exec ran a layered root's executions, which guest::spawn started, guest::entry entered into their namespaces, view and identity, guest::cgroup placed and guest::process collected, and guest::root's bootstrap moved the init's processes into the cgroups that held them. nvx-init runs its workloads as plain processes through sys::spawn, without per-execution containment, so nothing calls them any more. Two commits: b4e4937c does SL6.11b's Scope, and 9830b1e1 does follow-up K1.

The process modules and cgroups (b4e4937c)

• The modules: guest::{exec, spawn, process, cgroup, entry}, with their submodules and tests, and guest::root::{bootstrap, Bootstrap, BootstrapStep, Resources}, with root::Error::Bootstrap.
• The per-execution entry of sys::entry: EntryChild, its clone3 start in new mount, PID and UTS namespaces, its view of /proc, /sys and /dev with the procfs entries that it masked or made read-only, its move into the root, its umask and its working directory's resolution beneath the root, and the CloneArgs and OpenHow structures. sys::entry keeps a layered root's runtime file systems and the workload identity, which nvx-init and Root use.
• The spawn child's per-execution stages, with their ChildSpec setters: the root, the working directory's credentials check, inherited descriptors, the cgroup placement, the session, the barrier and the entry. The child keeps the path of nvx-init's workloads, unchanged. LaunchStage, whose numbers the child's launch report carries and which guest::spawn held, moves into sys::spawn as a crate-private enum of the 10 stages that the child still takes, each with its number (1, 4, 13 to 16, 18 to 21), which nvx-init's launch report and the managed agent decode; from_code, which only guest::spawn used, goes.
• The signal helpers that only exec used: process_group_of, WaitTarget and wait_named, and the sys re-exports of signal_process_group and signal_through_pidfd, which sys::process keeps for kill_process_group and kill_through_pidfd.
• Every cgroup helper: guest::cgroup, and root::kernel's Kernel::write, which only the bootstrap's cgroup and sysctl writes called.
• fd's per-execution support: shut_down_sending, take_pipe_end, open_at and create_socket_pair, which only guest::exec's pipes and sockets used. Its per-execution memfd and seals already left with guest: run direct workloads on the init exec core #1310.
• Crate-private code that the warning-denied builds then flag as unused: root::bind_runtime_file, whose retained variant bind_runtime_file_retained takes its rustdoc, and guest::mappings' bind_with re-export. guest::account's items, which only guest::entry re-exported, become crate-private.
• Public API: nvx-rs/public-api/linux.txt drops the five modules (299 lines), with guest::entry's account re-exports, and the hidden guest::root::{bootstrap, Bootstrap, BootstrapStep, Resources} and root::Error::Bootstrap; windows.txt doesn't change, as the guest is Linux-only.
• Docs: the rustdoc of guest, guest::root, sys and the kept OS modules, the crate's guest summary in lib.rs, nvx-rs/README.md, whose module table and sections drop the five modules and whose root row and section drop the bootstrap, and doc/guest-agent-guidelines.md no longer describe them. scripts/test-layout-allowlist.json is tightened (check_test_layout.py --tighten): the deleted modules' test hooks go, and sys/spawn.rs's count falls from 7 to 5.
• The case matrix: the deleted modules' 8 doc tests become retired Docs rows (guest::cgroup line 36, guest::entry 90, guest::exec 79 and Execution::adopt 619, guest::process 12 and 39, guest::spawn 41, LaunchStage::from_code 201), and the kept doc tests of guest/mod.rs, guest/root.rs and lib.rs move to lines 34, 126 and 53, with the summary's counts.

What stays: Root::switch, with its move of the root and its change of root (Kernel::enter_root, through sys::spawn::enter_root), the rooted open's EAGAIN retry (sys::rooted), nvx-init's spawn child, the workload identity and runtime file systems of sys::entry, and every OS helper with a kept caller.

Follow-up K1: the kernel's magic SysRq and the features' consumers (9830b1e1)

The decision is on #1123 (#1123 (comment)).

• Magic SysRq leaves the guest kernel. The diagnostics feature kept CONFIG_MAGIC_SYSRQ for the per-execution entry, which made /proc/sysrq-trigger read-only for user ID 0 and leaves in the first commit, and its only validator was the deleted adapter's vm_layered test. Nothing that stays reads or writes /proc/sysrq-trigger or kernel.sysrq, and nvx-init and the managed agent refuse user ID 0 and drop every capability, so their workloads couldn't write the trigger anyway. It had a live side effect: the hvc console took ^O on the kernel console, where an nvx-rs run shell reads, as a SysRq prefix, so ^O never reached bash, vim or nano there, and ^O c, b or o crashed, rebooted or powered off the guest.
• The configuration is regenerated with nvx.py kernel-config in the Docker build's image: kernel/config-microvm has # CONFIG_MAGIC_SYSRQ is not set in place of CONFIG_MAGIC_SYSRQ=y, CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1 and # CONFIG_MAGIC_SYSRQ_SERIAL is not set, and kernel/config-microvm.derived drops CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE. The configuration sets 767 symbols, 174 by the inventory's 25 features and 593 derived, 52 of them with a prompt (from 769, 175, 594 and 53). vmlinux shrinks from 21,594,072 to 21,581,680 bytes.
• The features name what uses them now: processors and memory-hotplug name nvx::guest::snapshot::capture, whose restore repair replaced the clone repair, and the snapshot helper, and are validated by the restore-processors, platform-restore-processors and restore-memory scenarios rather than the adapter's clone tests; virtio-console, block-storage, sandbox-filesystems and host-filesystem name nvx-init, nvx::guest::root and nvx::guest::activation rather than nvx-init-agent and nvx::guest::clone, and block-storage is validated by the sandbox-gpt-layer and snapshot-tiers scenarios rather than the adapter's GPT tests; linux-abi and diagnostics no longer name the adapter, and diagnostics' only consumer is CI's logs, validated by build-kernel's configuration checks.
• sandbox-isolation keeps its settings (decision 2, follow-up K2): its rationale now says that no NVX component uses them since SL7.8b, SL7.8c and SL6.11b, that only root programs in a guest, such as an nvx-rs run shell, can use them, and that NAMESPACES also stays for NET_NS. It no longer names nvx-init-agent, nvx-container-launch, nvx::guest::cgroup, nvx::guest::entry or nvx-snapshot, whose freezer path nothing reaches; build-kernel's sandbox group validates it. nvx-container-enter was never named in the file.
• doc/build.md lists magic SysRq among what the inventory removed, drops "serial sysrq", which no longer appears, from the platform options, updates the configuration's counts, and rewrites the cgroup row and the Sandbox group's purpose, which described the old sandbox, to match decision 2.
• Tests: no test names CONFIG_MAGIC_SYSRQ or the diagnostics feature; test_kernel_config.py's checks of the checked-in configuration and the inventory pass with the regenerated files.
• CI will build both kernels again, since the inventory and the configuration are kernel inputs, and builds them on ubuntu-26.04 for the first time.

Deliberately left

• guest/common/nvx-snapshot's cgroup freezer and nsenter -u paths, which nothing reaches any more, and guest/common/nvx-sandbox-smoke's checks of the old entry, which only its unit tests reach: recorded as follow-ups on nvx-rs slimming 4.2.4: the exec engine, the process modules and the old layered init are gone #1123.
• doc/build.md's Alpine paragraph about the sandbox PID-1 bootstrap and its container scripts, which SL6.10e rewrites.
• Removing sandbox-isolation's settings: follow-up K2.
• doc/modules, whose diagrams still draw the deleted modules: CI redraws and commits them (doc/ci.md).
• The 4.x design docs, which nvx-rs slimming 5.2.1: the library's guide, its design and the guest-agent guidelines #1130 rewrites.

Size

Measured as #1076 defines them, against feature/nvx-refactor, 22163771:

• Core lines (55): 45 in guest/sys/spawn.rs, of which 29 are LaunchStage and its code, moved from guest::spawn with the stages that stay, and the rest its imports and the child's conditions without the deleted stages; 7 in guest/sys/mod.rs, the re-export lists without the deleted items, as rustfmt wraps them; and 1 each in guest/sys/entry.rs and guest/sys/fd.rs (imports) and guest/mappings.rs (the re-export without bind_with). guest/account.rs's 6 lines only make items crate-private, so they don't count.
• Counted files (10): guest/mod.rs, guest/mappings.rs, guest/root.rs, guest/root/kernel.rs, guest/view.rs and guest/sys/{entry,fd,mod,process,spawn}.rs, in nvx-rs/src/. Not counted: guest/account.rs (crate-private only), lib.rs, guest/activation.rs and guest/time/api.rs (rustdoc only), the 12 deleted files, tests, docs, the allowlist and the generated API snapshot. - K1 (43 core lines, 1 counted file): scripts/nvx_tools/kernel_features.py, whose rationales, consumers and validations change, and whose diagnostics feature drops CONFIG_MAGIC_SYSRQ=y. The regenerated kernel/config-microvm and config-microvm.derived are generated files, and doc/build.md is docs.

Old tests of the area

• Retired, with the code that they tested: 125 tests and the 8 doc tests above.
  • guest::exec::tests::a_stalled_sink_stalls_only_its_own_execution_and_loses_nothing, which failed on GitHub's ubuntu-26.04 runners until tests: keep the Linux tests true with Ubuntu 26.04's coreutils #1535, leaves with guest::exec.
  • guest::root::tests' 6 bootstrap tests and guest::sys::spawn::tests' a_child_enters_its_root_or_reports_why_not, the_check_s_credentials_keep_the_parent_s_supplementary_groups and an_entry_leads_a_session_and_keeps_its_barrier_from_the_program test the deleted bootstrap and child stages.

• Rewritten (10 tests, which keep what their names say without a deleted item):
  • guest::sys::spawn::tests: invalid_specs_are_refused_before_forking, stream_sources_below_the_standard_streams_are_raised_and_kept_from_the_program and the_launch_descriptors_are_close_on_exec lose their cases of the credentials check, inherited descriptors and the cgroup placement.
  • guest::sys::entry::tests::the_kernel_structures_have_their_uapi_sizes loses CloneArgs and OpenHow.
  • guest::sys::port::tests::transactions::a_thread_that_may_hold_the_permission_spawns_no_command spawns through sys::spawn's ChildSpec and PreparedChild rather than guest::spawn::Command, with the same refusals and the same empty launch report.
  • guest::sys::signal::tests::a_write_takes_back_its_own_sigpipe_beside_one_pending_for_the_process and guest::init::tests::exec::a_stolen_or_auto_reaped_status_is_reported_once_and_never_reclassified_by_an_ending wait with sys::wait rather than guest::process::Child::wait and wait_named, for the same statuses.
  • guest::init::tests::exec::privileged_capture_sweep_kills_setsid_escapees_and_spares_both_helpers reads process groups with getpgid rather than process_group_of.
  • guest::sys::process::tests::a_real_time_signal_goes_through_a_pidfd_and_to_a_process_group drops its check of process_group_of; its signals to the group still succeed.
  • guest::managed_agent::dispatch::tests::runtime::privileged_layered_runtime_stops_before_attach_on_pending_sigterm, with the helpers termination, prelaunch_termination and backpressured_termination, signals through sys::tests' re-export of signal_through_pidfd: only the path changes.
• Modified: scripts/test_nvx_tools.py's NvxRsTests.test_readme_gives_each_module_a_short_row_and_a_section expects more than 30 rows in nvx-rs/README.md's module table rather than 40: the table keeps 39 of its 44 rows. The floor only shows that the test reads the module table, and SL6.13b will leave 36.
• Kept: every other test of nvx-init, the managed agent, guest::root and the kept OS modules.

Test changes

python scripts/check_test_changes.py --base origin/feature/nvx-refactor lists 268 changes to existing tests, hence tests-modified:

• Removed: the 125 tests retired above; the 6 deleted test modules, with their inner attributes and imports; 96 helpers that only the retired tests used, among them root::kernel::tests' fake writes and process moves (pin, writes, move_process, write), root::tests' bootstrap fixtures (Process, hierarchy, bootstrap_in, interface_files), sys::entry::tests' Simulation, sys::fd::tests' set_descriptor_limit, sys::process::tests' spawn_child_without_exit_signal, spawn_traced_child and continue_traced, and sys::spawn::tests' CAP_SYS_CHROOT; and the 10 test hooks of deleted code (ExecutionCgroup::{prepare, remove}, Entry::prepare, guest::exec's leads_its_group and signal_through_pidfd, EntryChild with clone_flags and stage, and PreparedChild::{take_credentials, restore_credentials}).
• Modified: the 10 tests rewritten above and the README test above; the helpers Operation, Call and State of root::kernel::tests, which lose the write; the three runtime helpers above (paths only); and the imports of root::tests and sys::tests, whose re-exports follow the deleted helpers.

Validation

local_gates.py --files (from dev) selects test-changes, markdown-links, test-layout, every step of check-nvx-rs and nvx-cli (validate-nvx), on both systems; its runtime-adapter gates no longer exist on this branch. I ran them from this branch's action definitions, at the heads that the tables give. The branch moved with its stack, with rerere off each time:

• onto guest: delete the Alpine one-shot container helpers (SL7.8c) #1536's head 321bd2b5, where the only conflict was guest/exec/tests.rs, which tests: keep the Linux tests true with Ubuntu 26.04's coreutils #1535 changed and this PR deletes;
• onto guest: delete the Alpine one-shot container helpers (SL7.8c) #1536's head bf2c816e, after SL6.4 (host: make image staging and artifact discovery private to the CLI (SL6.4) #1533) merged, and onto 04fbbd48, as which guest: delete the Alpine one-shot container helpers (SL7.8c) #1536 merged with the same tree, without conflicts;
• onto SL4.4b's head 22163771 (nvx-rs: serve NVXC v2 in the guest loop and the fake OpenVMM (SL4.4b) #1531), without conflicts: SL4.4b's NVXC v2 changes to the guest loop and the managed agent use nothing that this PR deletes, and git range-diff shows only context changes.

The README floor. test_readme_gives_each_module_a_short_row_and_a_section required more than 40 rows in nvx-rs/README.md's module table. This PR's runs of validate-nvx's unittest list, at 004d770e and 543248e7, sat on 321bd2b5, where the table had 46 rows and this PR left 41. SL6.4 then removed 2 (nvx::host::artifacts and nvx::host::seal), so from the restack onto bf2c816e on the table kept 39, and after that restack I had rerun only the Rust gates and the K1 smoke run, not the Python tests. The deletion commit now lowers the floor to 30 (see Old tests of the area), and the list passes again on the final head.

On the final head, 9830b1e1, on 22163771:

Windows, this workstation (Rust 1.95.0), on 004d770e (the deletion before the second restack):

Linux, nvx-mshv-test (Azure Linux 3, kernel 6.18, MSHV, virtual machine) and nvx-kvm-test (Azure Linux 3, kernel 6.6, KVM, virtual machine), each in a worktree of this branch with its own target directory, every signal at its default disposition, on 004d770e:

The base, 00341544 (SL7.8b's head) measured on the same hosts, failed the same KVM tests plus three that this PR deletes (guest::entry::tests::runtime_binds_need_a_mount_root_unless_there_are_none and two guest::exec tests); MSHV passed everything there too.

microVM scenarios on both backends, with the Alpine, Ubuntu and Azure Linux initramfses built from this branch on nvx-kvm-test (SHA-256 22c52f69…, af1610af… and 73ca3879…, identical before and after the restack, and copied to nvx-mshv-test with their digests checked), and CI run 43185976865's kernel, Ubuntu distro layer, scratch template and OpenVMM (692ac2a9…, 86c6685a…, 1d0d8c89… and 75fb488d…, checked by SHA-256), whose inputs match this branch's:

No OpenVMM process was left. These scenarios ran on CI's kernel, before K1.

K1, on 543248e7 (K1 before the second restack, the same tree for the kernel's inputs) unless a row says otherwise:

The K1 kernel, with this branch's Alpine image and CI's distro layer, scratch template and OpenVMM, booted on all three backends: guest-boot, console-exit, sandbox-lifecycle, snapshot-core (named snapshot restores) and restore-processors (1 and 2 vCPUs and untargeted) passed on KVM (nvx-kvm-test), MSHV (nvx-mshv-test) and WHP (nvx-whp-test, a Windows WHP virtual machine, with CI's Windows OpenVMM 7abd8c8d…), and no OpenVMM process was left.

On MSHV, typing a, ^O, h, b and Enter into read -r line in an nvx-rs run shell:

CI, run 43268333520 on 9830b1e1: both kernels built on ubuntu-26.04 for the first time (runner image 20261101.186.1), from the Docker build rather than a cache, with "kernel configuration matches its inventory (188 settings, 593 derived symbols)"; its vmlinux.config is the one built above (60f480bf…, # CONFIG_MAGIC_SYSRQ is not set). Every job passed on the first attempt but nvx-rs / windows-latest, where tests/cli/exec_lock.rs::exec_processes_contend_but_other_sandboxes_and_stop_proceed's nvx-rs sandbox stop --timeout 0.1 failed with error[still-running]: cannot confirm exit of VM process 7540: a host CLI test with the fake OpenVMM on Windows, whose build this PR doesn't change (it changes only Linux guest code, docs, scripts and the kernel's configuration), and which passed on the base's push run (43263930955), on this workstation at 9830b1e1, and on the rerun of the failed jobs, with which the run completed green.