feat: add Hermit unikernel backend support

[jim-junior]

Description

This PR adds initial support for the Hermit unikernel backend in urunc.

The implementation introduces a new unikernel type (Hermit) that integrates Hermit-based applications with the urunc runtime and QEMU as the underlying VM monitor. It also uses Initrd for storage and currently supports and is only tested on x86 arch.

Related issues

• Fixes Add support for Hermit-rs #97

How was this tested?

• Built a Hermit unikernel image using a custom bunnyfile including:
  • Hermit loader as kernel
  • Hermit application as initrd
  • Code base used: https://github.com/jim-junior/hermit-rs-sample
  • Container Image: https://hub.docker.com/r/jimjuniorb/hermit-qemu-hello-world
• Ran the container using:

  sudo nerdctl run --rm -ti --runtime io.containerd.urunc.v2 jimjuniorb/hermit-qemu-hello-world:latest

• Verified:
  • QEMU launches correctly
  • Unikernel boots successfully
  • Networking device (virtio-net) attaches without vhost
  • No crashes during VM initialization
  • Tested with networking disabled and enabled:
  • Without networking: boots successfully
  • With networking (virtio-net, no vhost): boots successfully

LLM usage

N/A

Checklist

• I have read the contribution guide.
• The linter passes locally (make lint).
• The e2e tests of at least one tool pass locally (make test_ctr, make test_nerdctl, make test_docker, make test_crictl).
• If LLMs were used: I have read the llm policy.

[netlify]

✅ Deploy Preview for urunc ready!

Name	Link
🔨 Latest commit	c90d0a7
🔍 Latest deploy log	https://app.netlify.com/projects/urunc/deploys/69ce540e8973e2000834f545
😎 Deploy Preview	https://deploy-preview-540--urunc.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[IrvingMg]

Thanks! Would it be possible to add at least some basic test cases for this?

[jim-junior]

Alright @IrvingMg , let me update the PR basing on your feedback

[cmainas]

Hello @jim-junior , thank you a lot for this PR.

I have tested it locally with your image and it worked. Well done!

As @IrvingMg suggested, it would be useful to add at least one end-to-end test.
Since, you already have an image that works, adding an end-to-end test will be straightforward.
For example, check this change in the Mewz PR 7b95216#diff-7d1fc1e232b55677582b51e2623aae6d8c15b5f0960ac6100fc7d733cb795dacR696.. Also, I saw quite a lot of logs from the unikernel, but we can change the image later.

Furthermore, it would also be usefule to document the current support for hermit-rs, in a similar way as with other guests. (Mewz for example 09ec31b). There is no need for long text, just:

• a short description of the guest,
• which monitors are supported,
• which rootfs types are supported,
• the integration with urunc, regarding network and storage,
• and one example (like in you r PR description).
  You can add the documentation later if you want, but we would like to have an up-to-date documentation (as much as possible).

[jim-junior]

Hello @cmainas , I have added the end-to-end test and other recommendations from @IrvingMg . For now I have added one test using the TestFunc as seccompTest. In the meantime, i will be looking through other TestFuncs to see how they can be intergrated.

Also, I saw quite a lot of logs from the unikernel, but we can change the image later.

Concerning this, its the default behavior of hermit unikernels, I haven't honestly ever tried to disable the logs, but i will try to do some research is its possible to reduce the logs, in case i find something, i will drop the solution into the urunc slack and maybe it can be used.

Lastly concerning the documentation, I am requesting I work on them it a separate PR. I promise to start on it immediately after this PR is done.

[cmainas]

Hello @jim-junior ,

I looked in more details the PR and I have added a few comments in the code. Furthermore, some more generic comments:

• It seems the changes for Qemu have not been reverted. I understand though why the linter does not like these lines, but it is quite weird that the linter in our CI did not complain about it in the past.
• Unfortunately, the seccompTest does not test the functionality of the guest, but the monitor's. Therefore, it would be better to use the matchTest (e.g. https://github.com/urunc-dev/urunc/blob/main/tests/e2e/test_cases.go#L34). Also, since it is a matchTest, it would be better to be placed under str tests. The nerdctl tests are already too many. Also can you use this image instead harbor.nbfc.io/nubificus/urunc/hello-workd-qemu-hermit-initrd:latest. It is the same as yours, but for security reasons, we should not rely on images that can change in the future.

Some general notes for future work:

• This PR does not add support for virtiofs which hermit-rs seems to support.

[jim-junior]

Alright @cmainas , let me update the PR basing on your comments.

[jim-junior]

@cmainas , I have updated the PR basing on your feedback.

[jim-junior]

hello @cmainas , some tests are failing, one of them seems to be concerning the image name, harbor.nbfc.io/nubificus/urunc/hello-workd-qemu-hermit-initrd:latest its using workd instead of world.

Furthermore, the one of the test_nerdctl tests is failing, I didn't torch the nerdctl testcases thought.

Maybe whats failing because of my is the linting of commit messages, I committed a long message that doesn't align with commit conventions, I think i will have to edit or revert and recommit.

As for the others, you can advise how i can handle them

[cmainas]

Hello @jim-junior ,

hello @cmainas , some tests are failing, one of them seems to be concerning the image name, harbor.nbfc.io/nubificus/urunc/hello-workd-qemu-hermit-initrd:latest its using workd instead of world.

That is my fault. I have tagged the image with harbor.nbfc.io/nubificus/urunc/hello-world-qemu-hermit-initrd:latest, so please replace it and the spell check error will go away.

Furthermore, the one of the test_nerdctl tests is failing, I didn't torch the nerdctl testcases thought.

Feel free to ignore these failures. They happen due to slow image pulling. I manually check them and will re-run the test if the reason is during the image pulling.

Maybe whats failing because of my is the linting of commit messages, I committed a long message that doesn't align with commit conventions, I think i will have to edit or revert and recommit.

Yeah, just follow the guidelines for the commit message and everything should be ok. Also do not forget to add yourself here
https://github.com/urunc-dev/urunc/blob/main/.github/contributors.yaml, rebase over main and squash your commits.

Regarding the documentation, overall it is not a good practice to add a new feature without testing and documentation. There are already some parts of our documentation that need to get refined and unfortunately, we do not have enough maintainers to focus entirely on documentation. Therefore, we want to be quite strict with new features and keeping the documentation up to date, Also, we have experienced quite a lot of drive-by PRs and it is not very easy to trust new contributors for follow up PRs.

[IrvingMg]

Hi @jim-junior, could you please mark review comments as resolved once they’re addressed? That makes it easier to track what’s left. Thanks!

[jim-junior]

Hello @jim-junior ,

hello @cmainas , some tests are failing, one of them seems to be concerning the image name, harbor.nbfc.io/nubificus/urunc/hello-workd-qemu-hermit-initrd:latest its using workd instead of world.

That is my fault. I have tagged the image with harbor.nbfc.io/nubificus/urunc/hello-world-qemu-hermit-initrd:latest, so please replace it and the spell check error will go away.

Furthermore, the one of the test_nerdctl tests is failing, I didn't torch the nerdctl testcases thought.

Feel free to ignore these failures. They happen due to slow image pulling. I manually check them and will re-run the test if the reason is during the image pulling.

Maybe whats failing because of my is the linting of commit messages, I committed a long message that doesn't align with commit conventions, I think i will have to edit or revert and recommit.

Yeah, just follow the guidelines for the commit message and everything should be ok. Also do not forget to add yourself here https://github.com/urunc-dev/urunc/blob/main/.github/contributors.yaml, rebase over main and squash your commits.

Regarding the documentation, overall it is not a good practice to add a new feature without testing and documentation. There are already some parts of our documentation that need to get refined and unfortunately, we do not have enough maintainers to focus entirely on documentation. Therefore, we want to be quite strict with new features and keeping the documentation up to date, Also, we have experienced quite a lot of drive-by PRs and it is not very easy to trust new contributors for follow up PRs.

Okay noted. I will add the documentation withing this PR too

[jim-junior]

Hi @jim-junior, could you please mark review comments as resolved once they’re addressed? That makes it easier to track what’s left. Thanks!

Alright, I will be marking them as resolved once addressed. My bad

[jim-junior]

Hello @cmainas , I've updated the PR, fixed the commits with a rebase, added my details to the contributors.yml, updated the test case and updated the documentation. You can review the what docs i have written if they fit the standard you require.