feat: nested sandbox support (sandbox-in-sandbox)#424
Open
SauravMishraaa wants to merge 2 commits into
Open
Conversation
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe PR adds nested-guest boot markers, guest detection, QEMU selection updates, and CLI defaults. It also expands image bootstrapping with pip, networking, and QEMU packages. ChangesNested guest startup and runtime selection
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
SauravMishraaa
force-pushed
the
feature/smolvm-in-smolvm
branch
2 times, most recently
from
286f970 to
330955f
Compare
SauravMishraaa
force-pushed
the
feature/smolvm-in-smolvm
branch
from
330955f to
f512e3b
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/ci/preset-init.sh`:
- Around line 85-90: The nested SmolVM guest marker is only being created in
/run, so it disappears after reboot and breaks the auto-detection used by
src/smolvm/runtime/backends.py. Update the first-boot init logic in the
preset-init.sh flow to either store the marker in a persistent location or
recreate /run/smolvm-guest on every boot, and make sure the runtime detection
path continues to find the marker reliably.
In `@src/smolvm/cli/commands/app.py`:
- Around line 921-927: The new `--disk-mode` option in `start` is not wired
through and `VMConfig` cannot accept the raw "auto" value. Update the `start`
callback signature to include `disk_mode`, pass it through to `_run_start`, and
convert "auto" to a supported `VMConfig` value before constructing the config.
Use the `start`, `_run_start`, and `VMConfig` symbols to locate and fix the flow
so the command starts without rejecting the option.
In `@src/smolvm/cli/commands/options.py`:
- Around line 113-120: The _boot_timeout_default helper accepts non-real or
non-positive values because it only catches ValueError, so update this function
to validate the parsed timeout from SMOLVM_BOOT_TIMEOUT before returning it. In
_boot_timeout_default, after converting the string to float, reject nan, inf,
zero, and negative values by checking finiteness and positivity, and fall back
to 30.0 for invalid inputs.
In `@src/smolvm/images/builder.py`:
- Around line 562-564: The Alpine package list in build_alpine_ssh() contains a
typo in the qemu system package name, causing apk add to fail. Update the
package entry alongside the other install items in builder.py so the qemu system
package is spelled correctly, keeping the existing install flow unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f2d8436d-2aa6-4953-b1cd-3919ea40e8a5
📒 Files selected for processing (10)
scripts/ci/Dockerfile.base-rootfsscripts/ci/preset-init.shsrc/smolvm/cli/commands/app.pysrc/smolvm/cli/commands/options.pysrc/smolvm/comm/select.pysrc/smolvm/images/builder.pysrc/smolvm/images/cloud_init.pysrc/smolvm/runtime/backends.pysrc/smolvm/runtime/qemu_args.pytests/test_qemu_args.py
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (1)
src/smolvm/cli/commands/app.py (1)
921-927: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winResolve
autobefore it leaves the CLI.Line 962 still sends raw
"auto"downstream, butsrc/smolvm/types.pyonly accepts"isolated"or"shared"fordisk_mode. So the default path can still go bang unless you map"auto"to a supported value before_run_start/VMConfigsees it.Also applies to: 962-962
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/smolvm/cli/commands/app.py` around lines 921 - 927, The CLI disk mode option currently allows "auto", but downstream code only accepts "isolated" or "shared", so the default path must be normalized before it reaches VMConfig or _run_start. Update the app command flow in the CLI handler around the disk-mode option so that any "auto" value is resolved to a supported value before invoking VMConfig, while keeping the existing "isolated" and "shared" behavior unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@src/smolvm/cli/commands/app.py`:
- Around line 921-927: The CLI disk mode option currently allows "auto", but
downstream code only accepts "isolated" or "shared", so the default path must be
normalized before it reaches VMConfig or _run_start. Update the app command flow
in the CLI handler around the disk-mode option so that any "auto" value is
resolved to a supported value before invoking VMConfig, while keeping the
existing "isolated" and "shared" behavior unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 59a5dd8b-7249-4ef5-b732-9f4c8f7e6d7b
📒 Files selected for processing (10)
scripts/ci/Dockerfile.base-rootfsscripts/ci/preset-init.shsrc/smolvm/cli/commands/app.pysrc/smolvm/cli/commands/options.pysrc/smolvm/comm/select.pysrc/smolvm/images/builder.pysrc/smolvm/images/cloud_init.pysrc/smolvm/runtime/backends.pysrc/smolvm/runtime/qemu_args.pytests/test_qemu_args.py
🚧 Files skipped from review as they are similar to previous changes (9)
- scripts/ci/preset-init.sh
- src/smolvm/comm/select.py
- scripts/ci/Dockerfile.base-rootfs
- src/smolvm/images/builder.py
- src/smolvm/images/cloud_init.py
- src/smolvm/runtime/backends.py
- tests/test_qemu_args.py
- src/smolvm/cli/commands/options.py
- src/smolvm/runtime/qemu_args.py
Collaborator
|
this PR is different from expected flow #328 GoalAs a user, I should be able to spin up a SmolVM sandbox, SSH into it, install SmolVM inside a sandbox, and run it like that, similar to how you run Docker in Docker, so sandbox inside a sandbox. Expected flow |
SauravMishraaa
force-pushed
the
feature/smolvm-in-smolvm
branch
from
f512e3b to
8e91fba
Compare
SauravMishraaa
force-pushed
the
feature/smolvm-in-smolvm
branch
from
8e91fba to
fd8e65d
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/ci/preset-init.sh`:
- Around line 103-110: The /etc/environment presence check is too broad because
the grep only looks for a SMOLVM_NESTED substring, so any comment or partial
match can skip the whole config block. Tighten the check in the preset-init.sh
environment setup block by anchoring the match to the actual key format
(SMOLVM_NESTED=) or, better, upsert each SMOLVM_* and PIP_BREAK_SYSTEM_PACKAGES
entry individually. Keep the existing cat/appending logic only for missing keys
so the script repairs drift instead of assuming the whole block already exists.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: dc6642f6-f7b6-47dd-8f51-bcd4251a36c2
📒 Files selected for processing (11)
scripts/ci/Dockerfile.base-rootfsscripts/ci/preset-init.shsrc/smolvm/cli/commands/app.pysrc/smolvm/cli/commands/options.pysrc/smolvm/comm/select.pysrc/smolvm/facade.pysrc/smolvm/images/builder.pysrc/smolvm/images/cloud_init.pysrc/smolvm/runtime/backends.pysrc/smolvm/runtime/qemu_args.pytests/test_qemu_args.py
🚧 Files skipped from review as they are similar to previous changes (10)
- tests/test_qemu_args.py
- src/smolvm/cli/commands/app.py
- src/smolvm/facade.py
- src/smolvm/comm/select.py
- src/smolvm/images/cloud_init.py
- src/smolvm/cli/commands/options.py
- scripts/ci/Dockerfile.base-rootfs
- src/smolvm/runtime/backends.py
- src/smolvm/images/builder.py
- src/smolvm/runtime/qemu_args.py
SauravMishraaa
force-pushed
the
feature/smolvm-in-smolvm
branch
4 times, most recently
from
b1ee9f0 to
1ee3f01
Compare
Contributor
Author
|
@aniketmaurya Can you review this now? |
aniketmaurya
requested changes
Jun 30, 2026
Allow running
╭───── VM Created ──────╮
│ Created VM 'sbx-ohm'. │
╰───────────────────────╯
VM Details
┌─────────┬─────────────────────────┐
│ Name │ sbx-ohm │
│ Status │ running │
│ OS │ ubuntu │
│ Started │ 2026-06-26 17:17:51 UTC │
└─────────┴─────────────────────────┘
Next: smolvm sandbox shell sbx-ohm
SSH: smolvm sandbox ssh sbx-ohm
Info: smolvm sandbox info sbx-ohm inside a SmolVM sandbox guest.
Changes:
- backends.py: add _running_inside_smolvm_guest() that detects nested
context via SMOLVM_NESTED env var or /run/smolvm-guest marker file;
auto-selects QEMU backend when nested instead of Firecracker
- qemu_args.py: force TCG accelerator when running inside a guest
(no KVM available); reads SMOLVM_QEMU_ACCEL env var first so it
can still be overridden explicitly
- comm/select.py: disable vsock when nested (no /dev/vhost-vsock in
guest); falls back to SSH for the control channel
- cloud_init.py: write nested env vars to /etc/environment (not just
profile.d), add /etc/pip.conf, write /run/smolvm-guest in bootcmd,
install arch-aware qemu-system package in runcmd
- Dockerfile.base-rootfs: bake python3-pip, python3-venv, qemu-utils,
qemu-system-arm/x86 (arch-detected), nftables into the base image
- preset-init.sh: write /run/smolvm-guest marker and /etc/pip.conf
at PID 1 startup on every boot
- tests/test_qemu_args.py: patch _KVM_DEV and _SMOLVM_GUEST_MARKER
in autouse fixture so Linux host simulation works from macOS runner
After image rebuild and new release, the user flow becomes:
smolvm sandbox create --name my-computer --memory 2048
smolvm sandbox ssh my-computer
pip install smolvm
smolvm sandbox create --name inner --os ubuntu --memory 512 --boot-timeout 300
SauravMishraaa
force-pushed
the
feature/smolvm-in-smolvm
branch
from
1ee3f01 to
b676f55
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Enables running
smolvm sandbox createinside a SmolVM sandbox (nested VM / sandbox-in-sandbox support).Previously, running
smolvminside a guest failed because:vsockwas selected even though/dev/vhost-vsockdoes not exist in guests.pipandqemu-system-*were not included in the base image.Changes
backends.py_running_inside_smolvm_guest()to detect nested execution via theSMOLVM_NESTEDenvironment variable or the/run/smolvm-guestmarker file.qemu_args.pySMOLVM_QEMU_ACCELenvironment variable so acceleration can still be overridden explicitly.select.pyvsockwhen nested (no/dev/vhost-vsockavailable).facade.py--memory.cloud_init.py/etc/environment.pip.conf./run/smolvm-guestduringbootcmd.qemu-system-*package duringruncmd.Dockerfile.base-rootfsBake the following packages into the base image:
python3-pippython3-venvqemu-utilsqemu-system-*nftablespreset-init.sh/run/smolvm-guestmarker at every boot.pip.conf./etc/environmentduring PID 1 startup.User Flow
After rebuilding the base image and publishing a new release:
Notes
--memoryif needed.Related Issues
Closes #328
Testing
Automated
uv run --with pytest python -m pytest \ tests/test_qemu_args.py \ tests/test_comm_select.py \ tests/test_backends.py \ tests/test_cli.pyuv run --with ruff ruff check .uv run --with ruff ruff format --check .Manual Validation
Validated end-to-end on Apple Silicon (aarch64):
Installed the modified wheel inside a sandbox.
Created the nested marker:
Ran:
Verified that the nested VM booted successfully without requiring any additional flags.
Checklist
Summary by CodeRabbit
New Features
Bug Fixes