v0.0.1 (#8)

Co-authored-by: Tasnim Kabir Sadik <tksadik92@gmail.com>
Reviewed-on: wrenn/sandbox#8

internal/vm/config.go

@@ -4,9 +4,13 @@ import "fmt"
 
 // VMConfig holds the configuration for creating a Firecracker microVM.
 type VMConfig struct {
-	// SandboxID is the unique identifier for this sandbox (e.g., "sb-a1b2c3d4").
+	// SandboxID is the unique identifier for this sandbox (e.g., "cl-a1b2c3d4").
 	SandboxID string
 
+	// TemplateID is the template UUID string used to populate MMDS metadata
+	// so that envd can read WRENN_TEMPLATE_ID from inside the guest.
+	TemplateID string
+
 	// KernelPath is the path to the uncompressed Linux kernel (vmlinux).
 	KernelPath string
 
@@ -91,7 +95,7 @@ func (c *VMConfig) kernelArgs() string {
 	)
 
 	return fmt.Sprintf(
-		"console=ttyS0 reboot=k panic=1 pci=off quiet loglevel=1 init=%s %s",
+		"console=ttyS0 reboot=k panic=1 pci=off quiet loglevel=1 clocksource=kvm-clock init=%s %s",
 		c.InitPath, ipArg,
 	)
 }

internal/vm/fc.go

@@ -101,6 +101,31 @@ func (c *fcClient) setMachineConfig(ctx context.Context, vcpus, memMB int) error
 	})
 }
 
+// setMMDSConfig enables MMDS V2 token-based access on the given network interface.
+// Must be called before startVM.
+func (c *fcClient) setMMDSConfig(ctx context.Context, ifaceID string) error {
+	return c.do(ctx, http.MethodPut, "/mmds/config", map[string]any{
+		"version":            "V2",
+		"network_interfaces": []string{ifaceID},
+	})
+}
+
+// mmdsMetadata is the metadata payload written to the Firecracker MMDS store.
+// envd reads this via PollForMMDSOpts to populate WRENN_SANDBOX_ID and WRENN_TEMPLATE_ID.
+type mmdsMetadata struct {
+	SandboxID  string `json:"instanceID"`
+	TemplateID string `json:"envID"`
+}
+
+// setMMDS writes sandbox metadata to the Firecracker MMDS store.
+// Can be called after the VM has started.
+func (c *fcClient) setMMDS(ctx context.Context, sandboxID, templateID string) error {
+	return c.do(ctx, http.MethodPut, "/mmds", mmdsMetadata{
+		SandboxID:  sandboxID,
+		TemplateID: templateID,
+	})
+}
+
 // startVM issues the InstanceStart action.
 func (c *fcClient) startVM(ctx context.Context) error {
 	return c.do(ctx, http.MethodPut, "/actions", map[string]string{

internal/vm/manager.go

@@ -71,6 +71,13 @@ func (m *Manager) Create(ctx context.Context, cfg VMConfig) (*VM, error) {
 		return nil, fmt.Errorf("start VM: %w", err)
 	}
 
+	// Step 5: Push sandbox metadata into MMDS so envd can read
+	// WRENN_SANDBOX_ID and WRENN_TEMPLATE_ID from inside the guest.
+	if err := client.setMMDS(ctx, cfg.SandboxID, cfg.TemplateID); err != nil {
+		_ = proc.stop()
+		return nil, fmt.Errorf("set MMDS metadata: %w", err)
+	}
+
 	vm := &VM{
 		Config:  cfg,
 		process: proc,
@@ -108,6 +115,12 @@ func configureVM(ctx context.Context, client *fcClient, cfg *VMConfig) error {
 		return fmt.Errorf("set machine config: %w", err)
 	}
 
+	// MMDS config — enable V2 token access on eth0 so that envd can read
+	// WRENN_SANDBOX_ID and WRENN_TEMPLATE_ID from inside the guest.
+	if err := client.setMMDSConfig(ctx, "eth0"); err != nil {
+		return fmt.Errorf("set MMDS config: %w", err)
+	}
+
 	return nil
 }
 
@@ -238,6 +251,12 @@ func (m *Manager) CreateFromSnapshot(ctx context.Context, cfg VMConfig, snapPath
 		return nil, fmt.Errorf("resume VM: %w", err)
 	}
 
+	// Step 5: Push sandbox metadata into MMDS.
+	if err := client.setMMDS(ctx, cfg.SandboxID, cfg.TemplateID); err != nil {
+		_ = proc.stop()
+		return nil, fmt.Errorf("set MMDS metadata: %w", err)
+	}
+
 	vm := &VM{
 		Config:  cfg,
 		process: proc,
@@ -250,6 +269,12 @@ func (m *Manager) CreateFromSnapshot(ctx context.Context, cfg VMConfig, snapPath
 	return vm, nil
 }
 
+// PID returns the process ID of the unshare wrapper process.
+// The actual Firecracker process is a direct child of this PID.
+func (v *VM) PID() int {
+	return v.process.cmd.Process.Pid
+}
+
 // Get returns a running VM by sandbox ID.
 func (m *Manager) Get(sandboxID string) (*VM, bool) {
 	vm, ok := m.vms[sandboxID]