Add host agent RPC server with sandbox lifecycle management

Implement the host agent as a Connect RPC server that orchestrates
sandbox creation, destruction, pause/resume, and command execution.
Includes sandbox manager with TTL-based reaper, network slot allocator,
rootfs cloning, hostagent proto definition with generated stubs, and
test/debug scripts. Fix Firecracker process lifetime bug where VM was
tied to HTTP request context instead of background context.

proto/hostagent/buf.gen.yaml

@@ -0,0 +1,13 @@
+version: v2
+plugins:
+  - protoc_builtin: go
+    out: gen
+    opt: paths=source_relative
+  - local: protoc-gen-connect-go
+    out: gen
+    opt: paths=source_relative
+managed:
+  enabled: true
+  override:
+    - file_option: go_package_prefix
+      value: git.omukk.dev/wrenn/sandbox/proto/hostagent/gen

proto/hostagent/buf.yaml

@@ -0,0 +1,3 @@
+version: v2
+modules:
+  - path: .

proto/hostagent/gen/hostagent.pb.go

@@ -0,0 +1,848 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        (unknown)
+// source: hostagent.proto
+
+package hostagentv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type CreateSandboxRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Template name (e.g., "minimal", "python311"). Determines base rootfs.
+	Template string `protobuf:"bytes,1,opt,name=template,proto3" json:"template,omitempty"`
+	// Number of virtual CPUs (default: 1).
+	Vcpus int32 `protobuf:"varint,2,opt,name=vcpus,proto3" json:"vcpus,omitempty"`
+	// Memory in MB (default: 512).
+	MemoryMb int32 `protobuf:"varint,3,opt,name=memory_mb,json=memoryMb,proto3" json:"memory_mb,omitempty"`
+	// TTL in seconds. Sandbox is auto-destroyed after this duration of
+	// inactivity. 0 means no auto-destroy.
+	TimeoutSec    int32 `protobuf:"varint,4,opt,name=timeout_sec,json=timeoutSec,proto3" json:"timeout_sec,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateSandboxRequest) Reset() {
+	*x = CreateSandboxRequest{}
+	mi := &file_hostagent_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateSandboxRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateSandboxRequest) ProtoMessage() {}
+
+func (x *CreateSandboxRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_hostagent_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateSandboxRequest.ProtoReflect.Descriptor instead.
+func (*CreateSandboxRequest) Descriptor() ([]byte, []int) {
+	return file_hostagent_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *CreateSandboxRequest) GetTemplate() string {
+	if x != nil {
+		return x.Template
+	}
+	return ""
+}
+
+func (x *CreateSandboxRequest) GetVcpus() int32 {
+	if x != nil {
+		return x.Vcpus
+	}
+	return 0
+}
+
+func (x *CreateSandboxRequest) GetMemoryMb() int32 {
+	if x != nil {
+		return x.MemoryMb
+	}
+	return 0
+}
+
+func (x *CreateSandboxRequest) GetTimeoutSec() int32 {
+	if x != nil {
+		return x.TimeoutSec
+	}
+	return 0
+}
+
+type CreateSandboxResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	SandboxId     string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
+	Status        string                 `protobuf:"bytes,2,opt,name=status,proto3" json:"status,omitempty"`
+	HostIp        string                 `protobuf:"bytes,3,opt,name=host_ip,json=hostIp,proto3" json:"host_ip,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateSandboxResponse) Reset() {
+	*x = CreateSandboxResponse{}
+	mi := &file_hostagent_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateSandboxResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateSandboxResponse) ProtoMessage() {}
+
+func (x *CreateSandboxResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_hostagent_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateSandboxResponse.ProtoReflect.Descriptor instead.
+func (*CreateSandboxResponse) Descriptor() ([]byte, []int) {
+	return file_hostagent_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *CreateSandboxResponse) GetSandboxId() string {
+	if x != nil {
+		return x.SandboxId
+	}
+	return ""
+}
+
+func (x *CreateSandboxResponse) GetStatus() string {
+	if x != nil {
+		return x.Status
+	}
+	return ""
+}
+
+func (x *CreateSandboxResponse) GetHostIp() string {
+	if x != nil {
+		return x.HostIp
+	}
+	return ""
+}
+
+type DestroySandboxRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	SandboxId     string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DestroySandboxRequest) Reset() {
+	*x = DestroySandboxRequest{}
+	mi := &file_hostagent_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DestroySandboxRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DestroySandboxRequest) ProtoMessage() {}
+
+func (x *DestroySandboxRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_hostagent_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DestroySandboxRequest.ProtoReflect.Descriptor instead.
+func (*DestroySandboxRequest) Descriptor() ([]byte, []int) {
+	return file_hostagent_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *DestroySandboxRequest) GetSandboxId() string {
+	if x != nil {
+		return x.SandboxId
+	}
+	return ""
+}
+
+type DestroySandboxResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DestroySandboxResponse) Reset() {
+	*x = DestroySandboxResponse{}
+	mi := &file_hostagent_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DestroySandboxResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DestroySandboxResponse) ProtoMessage() {}
+
+func (x *DestroySandboxResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_hostagent_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DestroySandboxResponse.ProtoReflect.Descriptor instead.
+func (*DestroySandboxResponse) Descriptor() ([]byte, []int) {
+	return file_hostagent_proto_rawDescGZIP(), []int{3}
+}
+
+type PauseSandboxRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	SandboxId     string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PauseSandboxRequest) Reset() {
+	*x = PauseSandboxRequest{}
+	mi := &file_hostagent_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PauseSandboxRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PauseSandboxRequest) ProtoMessage() {}
+
+func (x *PauseSandboxRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_hostagent_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PauseSandboxRequest.ProtoReflect.Descriptor instead.
+func (*PauseSandboxRequest) Descriptor() ([]byte, []int) {
+	return file_hostagent_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *PauseSandboxRequest) GetSandboxId() string {
+	if x != nil {
+		return x.SandboxId
+	}
+	return ""
+}
+
+type PauseSandboxResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PauseSandboxResponse) Reset() {
+	*x = PauseSandboxResponse{}
+	mi := &file_hostagent_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PauseSandboxResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PauseSandboxResponse) ProtoMessage() {}
+
+func (x *PauseSandboxResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_hostagent_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PauseSandboxResponse.ProtoReflect.Descriptor instead.
+func (*PauseSandboxResponse) Descriptor() ([]byte, []int) {
+	return file_hostagent_proto_rawDescGZIP(), []int{5}
+}
+
+type ResumeSandboxRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	SandboxId     string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ResumeSandboxRequest) Reset() {
+	*x = ResumeSandboxRequest{}
+	mi := &file_hostagent_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ResumeSandboxRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResumeSandboxRequest) ProtoMessage() {}
+
+func (x *ResumeSandboxRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_hostagent_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResumeSandboxRequest.ProtoReflect.Descriptor instead.
+func (*ResumeSandboxRequest) Descriptor() ([]byte, []int) {
+	return file_hostagent_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *ResumeSandboxRequest) GetSandboxId() string {
+	if x != nil {
+		return x.SandboxId
+	}
+	return ""
+}
+
+type ResumeSandboxResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ResumeSandboxResponse) Reset() {
+	*x = ResumeSandboxResponse{}
+	mi := &file_hostagent_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ResumeSandboxResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResumeSandboxResponse) ProtoMessage() {}
+
+func (x *ResumeSandboxResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_hostagent_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResumeSandboxResponse.ProtoReflect.Descriptor instead.
+func (*ResumeSandboxResponse) Descriptor() ([]byte, []int) {
+	return file_hostagent_proto_rawDescGZIP(), []int{7}
+}
+
+type ExecRequest struct {
+	state     protoimpl.MessageState `protogen:"open.v1"`
+	SandboxId string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
+	Cmd       string                 `protobuf:"bytes,2,opt,name=cmd,proto3" json:"cmd,omitempty"`
+	Args      []string               `protobuf:"bytes,3,rep,name=args,proto3" json:"args,omitempty"`
+	// Timeout for the command in seconds (default: 30).
+	TimeoutSec    int32 `protobuf:"varint,4,opt,name=timeout_sec,json=timeoutSec,proto3" json:"timeout_sec,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ExecRequest) Reset() {
+	*x = ExecRequest{}
+	mi := &file_hostagent_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ExecRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExecRequest) ProtoMessage() {}
+
+func (x *ExecRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_hostagent_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExecRequest.ProtoReflect.Descriptor instead.
+func (*ExecRequest) Descriptor() ([]byte, []int) {
+	return file_hostagent_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *ExecRequest) GetSandboxId() string {
+	if x != nil {
+		return x.SandboxId
+	}
+	return ""
+}
+
+func (x *ExecRequest) GetCmd() string {
+	if x != nil {
+		return x.Cmd
+	}
+	return ""
+}
+
+func (x *ExecRequest) GetArgs() []string {
+	if x != nil {
+		return x.Args
+	}
+	return nil
+}
+
+func (x *ExecRequest) GetTimeoutSec() int32 {
+	if x != nil {
+		return x.TimeoutSec
+	}
+	return 0
+}
+
+type ExecResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Stdout        []byte                 `protobuf:"bytes,1,opt,name=stdout,proto3" json:"stdout,omitempty"`
+	Stderr        []byte                 `protobuf:"bytes,2,opt,name=stderr,proto3" json:"stderr,omitempty"`
+	ExitCode      int32                  `protobuf:"varint,3,opt,name=exit_code,json=exitCode,proto3" json:"exit_code,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ExecResponse) Reset() {
+	*x = ExecResponse{}
+	mi := &file_hostagent_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ExecResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExecResponse) ProtoMessage() {}
+
+func (x *ExecResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_hostagent_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExecResponse.ProtoReflect.Descriptor instead.
+func (*ExecResponse) Descriptor() ([]byte, []int) {
+	return file_hostagent_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *ExecResponse) GetStdout() []byte {
+	if x != nil {
+		return x.Stdout
+	}
+	return nil
+}
+
+func (x *ExecResponse) GetStderr() []byte {
+	if x != nil {
+		return x.Stderr
+	}
+	return nil
+}
+
+func (x *ExecResponse) GetExitCode() int32 {
+	if x != nil {
+		return x.ExitCode
+	}
+	return 0
+}
+
+type ListSandboxesRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListSandboxesRequest) Reset() {
+	*x = ListSandboxesRequest{}
+	mi := &file_hostagent_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListSandboxesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListSandboxesRequest) ProtoMessage() {}
+
+func (x *ListSandboxesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_hostagent_proto_msgTypes[10]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListSandboxesRequest.ProtoReflect.Descriptor instead.
+func (*ListSandboxesRequest) Descriptor() ([]byte, []int) {
+	return file_hostagent_proto_rawDescGZIP(), []int{10}
+}
+
+type ListSandboxesResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Sandboxes     []*SandboxInfo         `protobuf:"bytes,1,rep,name=sandboxes,proto3" json:"sandboxes,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListSandboxesResponse) Reset() {
+	*x = ListSandboxesResponse{}
+	mi := &file_hostagent_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListSandboxesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListSandboxesResponse) ProtoMessage() {}
+
+func (x *ListSandboxesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_hostagent_proto_msgTypes[11]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListSandboxesResponse.ProtoReflect.Descriptor instead.
+func (*ListSandboxesResponse) Descriptor() ([]byte, []int) {
+	return file_hostagent_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *ListSandboxesResponse) GetSandboxes() []*SandboxInfo {
+	if x != nil {
+		return x.Sandboxes
+	}
+	return nil
+}
+
+type SandboxInfo struct {
+	state            protoimpl.MessageState `protogen:"open.v1"`
+	SandboxId        string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
+	Status           string                 `protobuf:"bytes,2,opt,name=status,proto3" json:"status,omitempty"`
+	Template         string                 `protobuf:"bytes,3,opt,name=template,proto3" json:"template,omitempty"`
+	Vcpus            int32                  `protobuf:"varint,4,opt,name=vcpus,proto3" json:"vcpus,omitempty"`
+	MemoryMb         int32                  `protobuf:"varint,5,opt,name=memory_mb,json=memoryMb,proto3" json:"memory_mb,omitempty"`
+	HostIp           string                 `protobuf:"bytes,6,opt,name=host_ip,json=hostIp,proto3" json:"host_ip,omitempty"`
+	CreatedAtUnix    int64                  `protobuf:"varint,7,opt,name=created_at_unix,json=createdAtUnix,proto3" json:"created_at_unix,omitempty"`
+	LastActiveAtUnix int64                  `protobuf:"varint,8,opt,name=last_active_at_unix,json=lastActiveAtUnix,proto3" json:"last_active_at_unix,omitempty"`
+	TimeoutSec       int32                  `protobuf:"varint,9,opt,name=timeout_sec,json=timeoutSec,proto3" json:"timeout_sec,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
+}
+
+func (x *SandboxInfo) Reset() {
+	*x = SandboxInfo{}
+	mi := &file_hostagent_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SandboxInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SandboxInfo) ProtoMessage() {}
+
+func (x *SandboxInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_hostagent_proto_msgTypes[12]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SandboxInfo.ProtoReflect.Descriptor instead.
+func (*SandboxInfo) Descriptor() ([]byte, []int) {
+	return file_hostagent_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *SandboxInfo) GetSandboxId() string {
+	if x != nil {
+		return x.SandboxId
+	}
+	return ""
+}
+
+func (x *SandboxInfo) GetStatus() string {
+	if x != nil {
+		return x.Status
+	}
+	return ""
+}
+
+func (x *SandboxInfo) GetTemplate() string {
+	if x != nil {
+		return x.Template
+	}
+	return ""
+}
+
+func (x *SandboxInfo) GetVcpus() int32 {
+	if x != nil {
+		return x.Vcpus
+	}
+	return 0
+}
+
+func (x *SandboxInfo) GetMemoryMb() int32 {
+	if x != nil {
+		return x.MemoryMb
+	}
+	return 0
+}
+
+func (x *SandboxInfo) GetHostIp() string {
+	if x != nil {
+		return x.HostIp
+	}
+	return ""
+}
+
+func (x *SandboxInfo) GetCreatedAtUnix() int64 {
+	if x != nil {
+		return x.CreatedAtUnix
+	}
+	return 0
+}
+
+func (x *SandboxInfo) GetLastActiveAtUnix() int64 {
+	if x != nil {
+		return x.LastActiveAtUnix
+	}
+	return 0
+}
+
+func (x *SandboxInfo) GetTimeoutSec() int32 {
+	if x != nil {
+		return x.TimeoutSec
+	}
+	return 0
+}
+
+var File_hostagent_proto protoreflect.FileDescriptor
+
+const file_hostagent_proto_rawDesc = "" +
+	"\n" +
+	"\x0fhostagent.proto\x12\fhostagent.v1\"\x86\x01\n" +
+	"\x14CreateSandboxRequest\x12\x1a\n" +
+	"\btemplate\x18\x01 \x01(\tR\btemplate\x12\x14\n" +
+	"\x05vcpus\x18\x02 \x01(\x05R\x05vcpus\x12\x1b\n" +
+	"\tmemory_mb\x18\x03 \x01(\x05R\bmemoryMb\x12\x1f\n" +
+	"\vtimeout_sec\x18\x04 \x01(\x05R\n" +
+	"timeoutSec\"g\n" +
+	"\x15CreateSandboxResponse\x12\x1d\n" +
+	"\n" +
+	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x16\n" +
+	"\x06status\x18\x02 \x01(\tR\x06status\x12\x17\n" +
+	"\ahost_ip\x18\x03 \x01(\tR\x06hostIp\"6\n" +
+	"\x15DestroySandboxRequest\x12\x1d\n" +
+	"\n" +
+	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\"\x18\n" +
+	"\x16DestroySandboxResponse\"4\n" +
+	"\x13PauseSandboxRequest\x12\x1d\n" +
+	"\n" +
+	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\"\x16\n" +
+	"\x14PauseSandboxResponse\"5\n" +
+	"\x14ResumeSandboxRequest\x12\x1d\n" +
+	"\n" +
+	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\"\x17\n" +
+	"\x15ResumeSandboxResponse\"s\n" +
+	"\vExecRequest\x12\x1d\n" +
+	"\n" +
+	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x10\n" +
+	"\x03cmd\x18\x02 \x01(\tR\x03cmd\x12\x12\n" +
+	"\x04args\x18\x03 \x03(\tR\x04args\x12\x1f\n" +
+	"\vtimeout_sec\x18\x04 \x01(\x05R\n" +
+	"timeoutSec\"[\n" +
+	"\fExecResponse\x12\x16\n" +
+	"\x06stdout\x18\x01 \x01(\fR\x06stdout\x12\x16\n" +
+	"\x06stderr\x18\x02 \x01(\fR\x06stderr\x12\x1b\n" +
+	"\texit_code\x18\x03 \x01(\x05R\bexitCode\"\x16\n" +
+	"\x14ListSandboxesRequest\"P\n" +
+	"\x15ListSandboxesResponse\x127\n" +
+	"\tsandboxes\x18\x01 \x03(\v2\x19.hostagent.v1.SandboxInfoR\tsandboxes\"\xa4\x02\n" +
+	"\vSandboxInfo\x12\x1d\n" +
+	"\n" +
+	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x16\n" +
+	"\x06status\x18\x02 \x01(\tR\x06status\x12\x1a\n" +
+	"\btemplate\x18\x03 \x01(\tR\btemplate\x12\x14\n" +
+	"\x05vcpus\x18\x04 \x01(\x05R\x05vcpus\x12\x1b\n" +
+	"\tmemory_mb\x18\x05 \x01(\x05R\bmemoryMb\x12\x17\n" +
+	"\ahost_ip\x18\x06 \x01(\tR\x06hostIp\x12&\n" +
+	"\x0fcreated_at_unix\x18\a \x01(\x03R\rcreatedAtUnix\x12-\n" +
+	"\x13last_active_at_unix\x18\b \x01(\x03R\x10lastActiveAtUnix\x12\x1f\n" +
+	"\vtimeout_sec\x18\t \x01(\x05R\n" +
+	"timeoutSec2\x93\x04\n" +
+	"\x10HostAgentService\x12X\n" +
+	"\rCreateSandbox\x12\".hostagent.v1.CreateSandboxRequest\x1a#.hostagent.v1.CreateSandboxResponse\x12[\n" +
+	"\x0eDestroySandbox\x12#.hostagent.v1.DestroySandboxRequest\x1a$.hostagent.v1.DestroySandboxResponse\x12U\n" +
+	"\fPauseSandbox\x12!.hostagent.v1.PauseSandboxRequest\x1a\".hostagent.v1.PauseSandboxResponse\x12X\n" +
+	"\rResumeSandbox\x12\".hostagent.v1.ResumeSandboxRequest\x1a#.hostagent.v1.ResumeSandboxResponse\x12=\n" +
+	"\x04Exec\x12\x19.hostagent.v1.ExecRequest\x1a\x1a.hostagent.v1.ExecResponse\x12X\n" +
+	"\rListSandboxes\x12\".hostagent.v1.ListSandboxesRequest\x1a#.hostagent.v1.ListSandboxesResponseB\xb0\x01\n" +
+	"\x10com.hostagent.v1B\x0eHostagentProtoP\x01Z;git.omukk.dev/wrenn/sandbox/proto/hostagent/gen;hostagentv1\xa2\x02\x03HXX\xaa\x02\fHostagent.V1\xca\x02\fHostagent\\V1\xe2\x02\x18Hostagent\\V1\\GPBMetadata\xea\x02\rHostagent::V1b\x06proto3"
+
+var (
+	file_hostagent_proto_rawDescOnce sync.Once
+	file_hostagent_proto_rawDescData []byte
+)
+
+func file_hostagent_proto_rawDescGZIP() []byte {
+	file_hostagent_proto_rawDescOnce.Do(func() {
+		file_hostagent_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_hostagent_proto_rawDesc), len(file_hostagent_proto_rawDesc)))
+	})
+	return file_hostagent_proto_rawDescData
+}
+
+var file_hostagent_proto_msgTypes = make([]protoimpl.MessageInfo, 13)
+var file_hostagent_proto_goTypes = []any{
+	(*CreateSandboxRequest)(nil),   // 0: hostagent.v1.CreateSandboxRequest
+	(*CreateSandboxResponse)(nil),  // 1: hostagent.v1.CreateSandboxResponse
+	(*DestroySandboxRequest)(nil),  // 2: hostagent.v1.DestroySandboxRequest
+	(*DestroySandboxResponse)(nil), // 3: hostagent.v1.DestroySandboxResponse
+	(*PauseSandboxRequest)(nil),    // 4: hostagent.v1.PauseSandboxRequest
+	(*PauseSandboxResponse)(nil),   // 5: hostagent.v1.PauseSandboxResponse
+	(*ResumeSandboxRequest)(nil),   // 6: hostagent.v1.ResumeSandboxRequest
+	(*ResumeSandboxResponse)(nil),  // 7: hostagent.v1.ResumeSandboxResponse
+	(*ExecRequest)(nil),            // 8: hostagent.v1.ExecRequest
+	(*ExecResponse)(nil),           // 9: hostagent.v1.ExecResponse
+	(*ListSandboxesRequest)(nil),   // 10: hostagent.v1.ListSandboxesRequest
+	(*ListSandboxesResponse)(nil),  // 11: hostagent.v1.ListSandboxesResponse
+	(*SandboxInfo)(nil),            // 12: hostagent.v1.SandboxInfo
+}
+var file_hostagent_proto_depIdxs = []int32{
+	12, // 0: hostagent.v1.ListSandboxesResponse.sandboxes:type_name -> hostagent.v1.SandboxInfo
+	0,  // 1: hostagent.v1.HostAgentService.CreateSandbox:input_type -> hostagent.v1.CreateSandboxRequest
+	2,  // 2: hostagent.v1.HostAgentService.DestroySandbox:input_type -> hostagent.v1.DestroySandboxRequest
+	4,  // 3: hostagent.v1.HostAgentService.PauseSandbox:input_type -> hostagent.v1.PauseSandboxRequest
+	6,  // 4: hostagent.v1.HostAgentService.ResumeSandbox:input_type -> hostagent.v1.ResumeSandboxRequest
+	8,  // 5: hostagent.v1.HostAgentService.Exec:input_type -> hostagent.v1.ExecRequest
+	10, // 6: hostagent.v1.HostAgentService.ListSandboxes:input_type -> hostagent.v1.ListSandboxesRequest
+	1,  // 7: hostagent.v1.HostAgentService.CreateSandbox:output_type -> hostagent.v1.CreateSandboxResponse
+	3,  // 8: hostagent.v1.HostAgentService.DestroySandbox:output_type -> hostagent.v1.DestroySandboxResponse
+	5,  // 9: hostagent.v1.HostAgentService.PauseSandbox:output_type -> hostagent.v1.PauseSandboxResponse
+	7,  // 10: hostagent.v1.HostAgentService.ResumeSandbox:output_type -> hostagent.v1.ResumeSandboxResponse
+	9,  // 11: hostagent.v1.HostAgentService.Exec:output_type -> hostagent.v1.ExecResponse
+	11, // 12: hostagent.v1.HostAgentService.ListSandboxes:output_type -> hostagent.v1.ListSandboxesResponse
+	7,  // [7:13] is the sub-list for method output_type
+	1,  // [1:7] is the sub-list for method input_type
+	1,  // [1:1] is the sub-list for extension type_name
+	1,  // [1:1] is the sub-list for extension extendee
+	0,  // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_hostagent_proto_init() }
+func file_hostagent_proto_init() {
+	if File_hostagent_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_hostagent_proto_rawDesc), len(file_hostagent_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   13,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_hostagent_proto_goTypes,
+		DependencyIndexes: file_hostagent_proto_depIdxs,
+		MessageInfos:      file_hostagent_proto_msgTypes,
+	}.Build()
+	File_hostagent_proto = out.File
+	file_hostagent_proto_goTypes = nil
+	file_hostagent_proto_depIdxs = nil
+}

proto/hostagent/gen/hostagentv1connect/hostagent.connect.go

@@ -0,0 +1,265 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: hostagent.proto
+
+package hostagentv1connect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	gen "git.omukk.dev/wrenn/sandbox/proto/hostagent/gen"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// HostAgentServiceName is the fully-qualified name of the HostAgentService service.
+	HostAgentServiceName = "hostagent.v1.HostAgentService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// HostAgentServiceCreateSandboxProcedure is the fully-qualified name of the HostAgentService's
+	// CreateSandbox RPC.
+	HostAgentServiceCreateSandboxProcedure = "/hostagent.v1.HostAgentService/CreateSandbox"
+	// HostAgentServiceDestroySandboxProcedure is the fully-qualified name of the HostAgentService's
+	// DestroySandbox RPC.
+	HostAgentServiceDestroySandboxProcedure = "/hostagent.v1.HostAgentService/DestroySandbox"
+	// HostAgentServicePauseSandboxProcedure is the fully-qualified name of the HostAgentService's
+	// PauseSandbox RPC.
+	HostAgentServicePauseSandboxProcedure = "/hostagent.v1.HostAgentService/PauseSandbox"
+	// HostAgentServiceResumeSandboxProcedure is the fully-qualified name of the HostAgentService's
+	// ResumeSandbox RPC.
+	HostAgentServiceResumeSandboxProcedure = "/hostagent.v1.HostAgentService/ResumeSandbox"
+	// HostAgentServiceExecProcedure is the fully-qualified name of the HostAgentService's Exec RPC.
+	HostAgentServiceExecProcedure = "/hostagent.v1.HostAgentService/Exec"
+	// HostAgentServiceListSandboxesProcedure is the fully-qualified name of the HostAgentService's
+	// ListSandboxes RPC.
+	HostAgentServiceListSandboxesProcedure = "/hostagent.v1.HostAgentService/ListSandboxes"
+)
+
+// HostAgentServiceClient is a client for the hostagent.v1.HostAgentService service.
+type HostAgentServiceClient interface {
+	// CreateSandbox boots a new microVM with the given configuration.
+	CreateSandbox(context.Context, *connect.Request[gen.CreateSandboxRequest]) (*connect.Response[gen.CreateSandboxResponse], error)
+	// DestroySandbox stops and cleans up a sandbox (VM, network, rootfs).
+	DestroySandbox(context.Context, *connect.Request[gen.DestroySandboxRequest]) (*connect.Response[gen.DestroySandboxResponse], error)
+	// PauseSandbox pauses a running sandbox's VM.
+	PauseSandbox(context.Context, *connect.Request[gen.PauseSandboxRequest]) (*connect.Response[gen.PauseSandboxResponse], error)
+	// ResumeSandbox resumes a paused sandbox's VM.
+	ResumeSandbox(context.Context, *connect.Request[gen.ResumeSandboxRequest]) (*connect.Response[gen.ResumeSandboxResponse], error)
+	// Exec runs a command inside a sandbox and returns the collected output.
+	Exec(context.Context, *connect.Request[gen.ExecRequest]) (*connect.Response[gen.ExecResponse], error)
+	// ListSandboxes returns all sandboxes managed by this host agent.
+	ListSandboxes(context.Context, *connect.Request[gen.ListSandboxesRequest]) (*connect.Response[gen.ListSandboxesResponse], error)
+}
+
+// NewHostAgentServiceClient constructs a client for the hostagent.v1.HostAgentService service. By
+// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
+// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
+// connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewHostAgentServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) HostAgentServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	hostAgentServiceMethods := gen.File_hostagent_proto.Services().ByName("HostAgentService").Methods()
+	return &hostAgentServiceClient{
+		createSandbox: connect.NewClient[gen.CreateSandboxRequest, gen.CreateSandboxResponse](
+			httpClient,
+			baseURL+HostAgentServiceCreateSandboxProcedure,
+			connect.WithSchema(hostAgentServiceMethods.ByName("CreateSandbox")),
+			connect.WithClientOptions(opts...),
+		),
+		destroySandbox: connect.NewClient[gen.DestroySandboxRequest, gen.DestroySandboxResponse](
+			httpClient,
+			baseURL+HostAgentServiceDestroySandboxProcedure,
+			connect.WithSchema(hostAgentServiceMethods.ByName("DestroySandbox")),
+			connect.WithClientOptions(opts...),
+		),
+		pauseSandbox: connect.NewClient[gen.PauseSandboxRequest, gen.PauseSandboxResponse](
+			httpClient,
+			baseURL+HostAgentServicePauseSandboxProcedure,
+			connect.WithSchema(hostAgentServiceMethods.ByName("PauseSandbox")),
+			connect.WithClientOptions(opts...),
+		),
+		resumeSandbox: connect.NewClient[gen.ResumeSandboxRequest, gen.ResumeSandboxResponse](
+			httpClient,
+			baseURL+HostAgentServiceResumeSandboxProcedure,
+			connect.WithSchema(hostAgentServiceMethods.ByName("ResumeSandbox")),
+			connect.WithClientOptions(opts...),
+		),
+		exec: connect.NewClient[gen.ExecRequest, gen.ExecResponse](
+			httpClient,
+			baseURL+HostAgentServiceExecProcedure,
+			connect.WithSchema(hostAgentServiceMethods.ByName("Exec")),
+			connect.WithClientOptions(opts...),
+		),
+		listSandboxes: connect.NewClient[gen.ListSandboxesRequest, gen.ListSandboxesResponse](
+			httpClient,
+			baseURL+HostAgentServiceListSandboxesProcedure,
+			connect.WithSchema(hostAgentServiceMethods.ByName("ListSandboxes")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// hostAgentServiceClient implements HostAgentServiceClient.
+type hostAgentServiceClient struct {
+	createSandbox  *connect.Client[gen.CreateSandboxRequest, gen.CreateSandboxResponse]
+	destroySandbox *connect.Client[gen.DestroySandboxRequest, gen.DestroySandboxResponse]
+	pauseSandbox   *connect.Client[gen.PauseSandboxRequest, gen.PauseSandboxResponse]
+	resumeSandbox  *connect.Client[gen.ResumeSandboxRequest, gen.ResumeSandboxResponse]
+	exec           *connect.Client[gen.ExecRequest, gen.ExecResponse]
+	listSandboxes  *connect.Client[gen.ListSandboxesRequest, gen.ListSandboxesResponse]
+}
+
+// CreateSandbox calls hostagent.v1.HostAgentService.CreateSandbox.
+func (c *hostAgentServiceClient) CreateSandbox(ctx context.Context, req *connect.Request[gen.CreateSandboxRequest]) (*connect.Response[gen.CreateSandboxResponse], error) {
+	return c.createSandbox.CallUnary(ctx, req)
+}
+
+// DestroySandbox calls hostagent.v1.HostAgentService.DestroySandbox.
+func (c *hostAgentServiceClient) DestroySandbox(ctx context.Context, req *connect.Request[gen.DestroySandboxRequest]) (*connect.Response[gen.DestroySandboxResponse], error) {
+	return c.destroySandbox.CallUnary(ctx, req)
+}
+
+// PauseSandbox calls hostagent.v1.HostAgentService.PauseSandbox.
+func (c *hostAgentServiceClient) PauseSandbox(ctx context.Context, req *connect.Request[gen.PauseSandboxRequest]) (*connect.Response[gen.PauseSandboxResponse], error) {
+	return c.pauseSandbox.CallUnary(ctx, req)
+}
+
+// ResumeSandbox calls hostagent.v1.HostAgentService.ResumeSandbox.
+func (c *hostAgentServiceClient) ResumeSandbox(ctx context.Context, req *connect.Request[gen.ResumeSandboxRequest]) (*connect.Response[gen.ResumeSandboxResponse], error) {
+	return c.resumeSandbox.CallUnary(ctx, req)
+}
+
+// Exec calls hostagent.v1.HostAgentService.Exec.
+func (c *hostAgentServiceClient) Exec(ctx context.Context, req *connect.Request[gen.ExecRequest]) (*connect.Response[gen.ExecResponse], error) {
+	return c.exec.CallUnary(ctx, req)
+}
+
+// ListSandboxes calls hostagent.v1.HostAgentService.ListSandboxes.
+func (c *hostAgentServiceClient) ListSandboxes(ctx context.Context, req *connect.Request[gen.ListSandboxesRequest]) (*connect.Response[gen.ListSandboxesResponse], error) {
+	return c.listSandboxes.CallUnary(ctx, req)
+}
+
+// HostAgentServiceHandler is an implementation of the hostagent.v1.HostAgentService service.
+type HostAgentServiceHandler interface {
+	// CreateSandbox boots a new microVM with the given configuration.
+	CreateSandbox(context.Context, *connect.Request[gen.CreateSandboxRequest]) (*connect.Response[gen.CreateSandboxResponse], error)
+	// DestroySandbox stops and cleans up a sandbox (VM, network, rootfs).
+	DestroySandbox(context.Context, *connect.Request[gen.DestroySandboxRequest]) (*connect.Response[gen.DestroySandboxResponse], error)
+	// PauseSandbox pauses a running sandbox's VM.
+	PauseSandbox(context.Context, *connect.Request[gen.PauseSandboxRequest]) (*connect.Response[gen.PauseSandboxResponse], error)
+	// ResumeSandbox resumes a paused sandbox's VM.
+	ResumeSandbox(context.Context, *connect.Request[gen.ResumeSandboxRequest]) (*connect.Response[gen.ResumeSandboxResponse], error)
+	// Exec runs a command inside a sandbox and returns the collected output.
+	Exec(context.Context, *connect.Request[gen.ExecRequest]) (*connect.Response[gen.ExecResponse], error)
+	// ListSandboxes returns all sandboxes managed by this host agent.
+	ListSandboxes(context.Context, *connect.Request[gen.ListSandboxesRequest]) (*connect.Response[gen.ListSandboxesResponse], error)
+}
+
+// NewHostAgentServiceHandler builds an HTTP handler from the service implementation. It returns the
+// path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewHostAgentServiceHandler(svc HostAgentServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	hostAgentServiceMethods := gen.File_hostagent_proto.Services().ByName("HostAgentService").Methods()
+	hostAgentServiceCreateSandboxHandler := connect.NewUnaryHandler(
+		HostAgentServiceCreateSandboxProcedure,
+		svc.CreateSandbox,
+		connect.WithSchema(hostAgentServiceMethods.ByName("CreateSandbox")),
+		connect.WithHandlerOptions(opts...),
+	)
+	hostAgentServiceDestroySandboxHandler := connect.NewUnaryHandler(
+		HostAgentServiceDestroySandboxProcedure,
+		svc.DestroySandbox,
+		connect.WithSchema(hostAgentServiceMethods.ByName("DestroySandbox")),
+		connect.WithHandlerOptions(opts...),
+	)
+	hostAgentServicePauseSandboxHandler := connect.NewUnaryHandler(
+		HostAgentServicePauseSandboxProcedure,
+		svc.PauseSandbox,
+		connect.WithSchema(hostAgentServiceMethods.ByName("PauseSandbox")),
+		connect.WithHandlerOptions(opts...),
+	)
+	hostAgentServiceResumeSandboxHandler := connect.NewUnaryHandler(
+		HostAgentServiceResumeSandboxProcedure,
+		svc.ResumeSandbox,
+		connect.WithSchema(hostAgentServiceMethods.ByName("ResumeSandbox")),
+		connect.WithHandlerOptions(opts...),
+	)
+	hostAgentServiceExecHandler := connect.NewUnaryHandler(
+		HostAgentServiceExecProcedure,
+		svc.Exec,
+		connect.WithSchema(hostAgentServiceMethods.ByName("Exec")),
+		connect.WithHandlerOptions(opts...),
+	)
+	hostAgentServiceListSandboxesHandler := connect.NewUnaryHandler(
+		HostAgentServiceListSandboxesProcedure,
+		svc.ListSandboxes,
+		connect.WithSchema(hostAgentServiceMethods.ByName("ListSandboxes")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/hostagent.v1.HostAgentService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case HostAgentServiceCreateSandboxProcedure:
+			hostAgentServiceCreateSandboxHandler.ServeHTTP(w, r)
+		case HostAgentServiceDestroySandboxProcedure:
+			hostAgentServiceDestroySandboxHandler.ServeHTTP(w, r)
+		case HostAgentServicePauseSandboxProcedure:
+			hostAgentServicePauseSandboxHandler.ServeHTTP(w, r)
+		case HostAgentServiceResumeSandboxProcedure:
+			hostAgentServiceResumeSandboxHandler.ServeHTTP(w, r)
+		case HostAgentServiceExecProcedure:
+			hostAgentServiceExecHandler.ServeHTTP(w, r)
+		case HostAgentServiceListSandboxesProcedure:
+			hostAgentServiceListSandboxesHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedHostAgentServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedHostAgentServiceHandler struct{}
+
+func (UnimplementedHostAgentServiceHandler) CreateSandbox(context.Context, *connect.Request[gen.CreateSandboxRequest]) (*connect.Response[gen.CreateSandboxResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("hostagent.v1.HostAgentService.CreateSandbox is not implemented"))
+}
+
+func (UnimplementedHostAgentServiceHandler) DestroySandbox(context.Context, *connect.Request[gen.DestroySandboxRequest]) (*connect.Response[gen.DestroySandboxResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("hostagent.v1.HostAgentService.DestroySandbox is not implemented"))
+}
+
+func (UnimplementedHostAgentServiceHandler) PauseSandbox(context.Context, *connect.Request[gen.PauseSandboxRequest]) (*connect.Response[gen.PauseSandboxResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("hostagent.v1.HostAgentService.PauseSandbox is not implemented"))
+}
+
+func (UnimplementedHostAgentServiceHandler) ResumeSandbox(context.Context, *connect.Request[gen.ResumeSandboxRequest]) (*connect.Response[gen.ResumeSandboxResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("hostagent.v1.HostAgentService.ResumeSandbox is not implemented"))
+}
+
+func (UnimplementedHostAgentServiceHandler) Exec(context.Context, *connect.Request[gen.ExecRequest]) (*connect.Response[gen.ExecResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("hostagent.v1.HostAgentService.Exec is not implemented"))
+}
+
+func (UnimplementedHostAgentServiceHandler) ListSandboxes(context.Context, *connect.Request[gen.ListSandboxesRequest]) (*connect.Response[gen.ListSandboxesResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("hostagent.v1.HostAgentService.ListSandboxes is not implemented"))
+}

proto/hostagent/hostagent.proto

@@ -0,0 +1,96 @@
+syntax = "proto3";
+
+package hostagent.v1;
+
+// HostAgentService manages sandbox VMs on a single physical host.
+// The control plane calls these RPCs to orchestrate sandbox lifecycle.
+service HostAgentService {
+  // CreateSandbox boots a new microVM with the given configuration.
+  rpc CreateSandbox(CreateSandboxRequest) returns (CreateSandboxResponse);
+
+  // DestroySandbox stops and cleans up a sandbox (VM, network, rootfs).
+  rpc DestroySandbox(DestroySandboxRequest) returns (DestroySandboxResponse);
+
+  // PauseSandbox pauses a running sandbox's VM.
+  rpc PauseSandbox(PauseSandboxRequest) returns (PauseSandboxResponse);
+
+  // ResumeSandbox resumes a paused sandbox's VM.
+  rpc ResumeSandbox(ResumeSandboxRequest) returns (ResumeSandboxResponse);
+
+  // Exec runs a command inside a sandbox and returns the collected output.
+  rpc Exec(ExecRequest) returns (ExecResponse);
+
+  // ListSandboxes returns all sandboxes managed by this host agent.
+  rpc ListSandboxes(ListSandboxesRequest) returns (ListSandboxesResponse);
+}
+
+message CreateSandboxRequest {
+  // Template name (e.g., "minimal", "python311"). Determines base rootfs.
+  string template = 1;
+
+  // Number of virtual CPUs (default: 1).
+  int32 vcpus = 2;
+
+  // Memory in MB (default: 512).
+  int32 memory_mb = 3;
+
+  // TTL in seconds. Sandbox is auto-destroyed after this duration of
+  // inactivity. 0 means no auto-destroy.
+  int32 timeout_sec = 4;
+}
+
+message CreateSandboxResponse {
+  string sandbox_id = 1;
+  string status = 2;
+  string host_ip = 3;
+}
+
+message DestroySandboxRequest {
+  string sandbox_id = 1;
+}
+
+message DestroySandboxResponse {}
+
+message PauseSandboxRequest {
+  string sandbox_id = 1;
+}
+
+message PauseSandboxResponse {}
+
+message ResumeSandboxRequest {
+  string sandbox_id = 1;
+}
+
+message ResumeSandboxResponse {}
+
+message ExecRequest {
+  string sandbox_id = 1;
+  string cmd = 2;
+  repeated string args = 3;
+  // Timeout for the command in seconds (default: 30).
+  int32 timeout_sec = 4;
+}
+
+message ExecResponse {
+  bytes stdout = 1;
+  bytes stderr = 2;
+  int32 exit_code = 3;
+}
+
+message ListSandboxesRequest {}
+
+message ListSandboxesResponse {
+  repeated SandboxInfo sandboxes = 1;
+}
+
+message SandboxInfo {
+  string sandbox_id = 1;
+  string status = 2;
+  string template = 3;
+  int32 vcpus = 4;
+  int32 memory_mb = 5;
+  string host_ip = 6;
+  int64 created_at_unix = 7;
+  int64 last_active_at_unix = 8;
+  int32 timeout_sec = 9;
+}