feat(vmm): pass pre-opened tap chardevs and drop VM privileges via systemd - #1047

Draft

Leechael wants to merge 13 commits into

Dstack-TEE:codex/experimental-systemd-vm-processesfrom

Leechael:feature/systemd-openfile-fd

Commits on Aug 12, 2026

feat(vmm): generate QEMU netdev from a pre-opened tap chardev
Leechael
committed
a8dc36a
feat(vmm): open VM chardevs from the systemd transient unit
Leechael
committed
a9ec926
fix: reject pre-opened chardevs where descriptors cannot be passed
Leechael
committed
23b5bf3
feat(vmm): drop VM privileges through the systemd unit instead of sudo
Leechael
committed
739c99d
fix(supervisor): default ProcessConfig builder fields for user and open_files
Leechael
committed
8c9e005
fix(vmm): accept numeric cvm.user for sudo and systemd
Leechael
committed
2d16a9c
fix(vmm): chown swtpm state under systemd User=
Leechael
committed
f66f609
fix(vmm): stop open_file from inheriting host custom netdev
Leechael
committed
bf9f80f
fix(vmm): omit empty open_file from networking json
Leechael
committed
fd1b8b3
fix(vmm): clarify one-shot dry-run limits for open_file and user
Leechael
committed
c2d970a
docs: document OpenFile and User on the systemd process manager
Leechael
committed
9dfa196
fix(vmm): stop swtpm chown from following symlinks
Leechael
committed
8cd77b2

Commits on Aug 13, 2026

refactor(vmm): make open_file/netdev handling explicit in resolve_networking
Leechael
committed
22a100f