Feature/pty network repair v2

[abhishek-anand]

Summary

Checklist

• For each workspace you touched (vmm/, orch/, proto/): cargo fmt --all -- --check, cargo clippy --workspace --all-targets -- -D warnings, and
  cargo test --workspace pass locally.
• For changes to boot, devices, memory, snapshot/restore, net, or the
  jailer, review the protected-main KVM workflow after merge (or manually
  dispatch it from main). Privileged self-hosted runners never execute
  pull-request refs.
• Startup-path changes report cold, snapshot restore, suspend/resume, and
  warm-pool latency through the first successful guest exec, with explicit
  median/p95/p99 and success-rate gates.
• Wire-protocol changes were made in proto/ only (not copied into vmm/ or
  orch/), if this changes requests, responses, config, VM status, or PTY
  frames.
• No breaking change to the stable control contract (vmm serve --socket,
  ApiRequest/ApiResponse, length-prefixed JSON). If there is, it is called
  out above and versioned.
• Every unsafe block has a // SAFETY: comment.
• Docs updated if behavior or architecture changed.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[Copilot]

Pull request overview

This PR expands Tarit’s isolation and recovery capabilities by (1) launching jailed VMMs with optional dedicated PID + process network namespaces while passing host-owned TAP queues by fd, and (2) replacing restore-time guest network repair with a typed VMM API operation. It also updates PTY session semantics to allow reconnects while preventing concurrent attaches, with cleanup on VM stop/exit.

Changes:

• Add --isolate-network and --pid-namespace support for vmm serve, plus jailer support for creating an empty netns and launching the VMM as PID 1 in a new pidns.
• Pass validated host-owned TAP queue fds from taritd → vmm (env VMM_TAP_FDS) and validate inherited TAP fds before wiring virtio-net.
• Introduce typed repair_guest_network usage during restore and update PTY sessions for reconnect + cleanup on VM termination.

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
vmm/src/main.rs	Adds CLI flags and wiring for PID namespace + empty netns in jailed serve.
vmm/docs/STANDALONE.md	Documents new serve flags for isolation.
vmm/docs/INTEGRATION.md	Documents repair_guest_network request semantics.
vmm/docs/BUILD-AND-API.md	Documents new serve flags and guest_network_repaired response.
vmm/crates/vmm-net/src/tap.rs	Adds Tap::from_inherited_fd with ioctl-based validation and nonblocking setup.
vmm/crates/vmm-jailer/src/lib.rs	Re-exports PID-namespace launcher API.
vmm/crates/vmm-jailer/src/jailer.rs	Adds isolate_network to jailer config.
vmm/crates/vmm-jailer/src/executor.rs	Implements netns unshare and PID-namespace launcher + liveness/PDEATHSIG wiring.
vmm/crates/vmm-integration/comprehensive_tests.rs	Updates jailer config construction for new field.
vmm/crates/vmm-integration/comprehensive_e2e.rs	Updates jailer config construction for new field.
vmm/crates/vmm-core/src/controller.rs	Uses inherited TAP fd mapping when present; parses VMM_TAP_FDS.
README.md	Updates high-level description of PID/netns isolation and TAP fd passing.
PRODUCTION_READINESS.md	Updates production gating text to reflect implemented isolation/repair steps.
orch/README.md	Updates PTY WebSocket description (single active connection + reconnect).
orch/docs/RESILIENCE.md	Documents PTY reconnect + cleanup expectations.
orch/docs/QUICKSTART.md	Updates PTY token/reconnect behavior docs.
orch/docs/OPERATIONS.md	Documents enabling strict jailed launch path env toggles.
orch/docs/ISOLATION.md	Updates production confinement gate description for PID/netns + TAP fd passing.
orch/docs/CONFIGURATION.md	Documents new VM jail env vars and updates production gate wording.
orch/docs/API.md	Updates PTY token semantics and WebSocket behavior docs.
orch/crates/taritd/src/supervisor.rs	Provisions network earlier, opens TAP queue for inheritance, passes VMM_TAP_FDS, adjusts cleanup, and switches restore networking to typed repair.
orch/crates/taritd/src/pty.rs	Adds reconnectable sessions with single active connection, plus VM-session cleanup hooks.
orch/crates/taritd/src/ops.rs	Ensures PTY sessions are cleaned up on stop and unexpected exits.
orch/crates/taritd/src/config.rs	Adds jail pidns/netns config parsing and enforces production gating.

Suppressed comments (2)

orch/crates/taritd/src/supervisor.rs:96

• This unsafe ioctl call lacks a // SAFETY: justification. Please add one (matching the file’s existing convention) describing why fd and the TapIfreq pointer are valid for TUNSETIFF.

    if unsafe { libc::ioctl(fd.as_raw_fd(), TUNSETIFF as _, &mut ifreq) } < 0 {

orch/crates/taritd/src/supervisor.rs:107

• clear_cloexec_for_child uses multiple unsafe fcntl calls without a // SAFETY: comment. Add a brief justification for why these syscalls are safe with the provided fd (and that the calls don't retain pointers).

    let descriptor_flags = unsafe { libc::fcntl(fd, libc::F_GETFD) };

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.