feat(bazel): build vm driver and pull runtime from Github

MODULE.bazel

@@ -6,6 +6,56 @@ bazel_dep(name = "rules_cc", version = "0.2.20")
 bazel_dep(name = "rules_proto", version = "7.1.0")
 bazel_dep(name = "protobuf", version = "34.0.bcr.1")
 
+bazel_lib_toolchains = use_extension("@bazel_lib//lib:extensions.bzl", "toolchains")
+bazel_lib_toolchains.zstd()
+use_repo(bazel_lib_toolchains, "zstd_toolchains")
+
+register_toolchains("@zstd_toolchains//:all")
+
+http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+http_archive(
+    name = "vm_runtime_darwin_aarch64",
+    build_file_content = """
+exports_files([
+    "gvproxy",
+    "libkrun.dylib",
+    "libkrunfw.5.dylib",
+    "umoci",
+])
+""",
+    integrity = "sha256-KSAKryBFZiytwYwXB0CR++u4tGlA5ficf7X/nen7qQE=",
+    urls = ["https://github.com/NVIDIA/OpenShell/releases/download/vm-runtime/vm-runtime-darwin-aarch64.tar.zst"],
+)
+
+http_archive(
+    name = "vm_runtime_linux_aarch64",
+    build_file_content = """
+exports_files([
+    "gvproxy",
+    "libkrun.so",
+    "libkrunfw.so.5",
+    "umoci",
+])
+""",
+    integrity = "sha256-zn0P4NtEKp7Euy44HfQ3YoBNijF2VWFTaLLsase+Y1A=",
+    urls = ["https://github.com/NVIDIA/OpenShell/releases/download/vm-runtime/vm-runtime-linux-aarch64.tar.zst"],
+)
+
+http_archive(
+    name = "vm_runtime_linux_x86_64",
+    build_file_content = """
+exports_files([
+    "gvproxy",
+    "libkrun.so",
+    "libkrunfw.so.5",
+    "umoci",
+])
+""",
+    integrity = "sha256-urdMjarDN5WJ6eCmpddlcnEn2v3qp28D7+e6PtyhPr0=",
+    urls = ["https://github.com/NVIDIA/OpenShell/releases/download/vm-runtime/vm-runtime-linux-x86_64.tar.zst"],
+)
+
 include("//bazel/annotations:aws-lc-sys.MODULE.bazel")
 include("//bazel/annotations:z3-sys.MODULE.bazel")
 include("//bazel/annotations:zstd-sys.MODULE.bazel")

bazel/BUILD.bazel

@@ -1 +1,4 @@
-exports_files(["cargo_version.bzl"])
+exports_files([
+    "cargo_version.bzl",
+    "vm_runtime.bzl",
+])

bazel/releases/BUILD.bazel

@@ -44,6 +44,7 @@ platform_transition_binary(
     binary = "//crates/openshell-sandbox:openshell-sandbox-bin",
     tags = ["manual"],
     target_platform = "@rules_rs//rs/platforms:x86_64-unknown-linux-musl",
+    visibility = ["//visibility:public"],
 )
 
 platform_transition_binary(
@@ -52,6 +53,7 @@ platform_transition_binary(
     binary = "//crates/openshell-sandbox:openshell-sandbox-bin",
     tags = ["manual"],
     target_platform = "@rules_rs//rs/platforms:aarch64-unknown-linux-musl",
+    visibility = ["//visibility:public"],
 )
 
 platform_transition_binary(

bazel/vm-runtime/BUILD.bazel

@@ -0,0 +1,72 @@
+load("//bazel:vm_runtime.bzl", "vm_runtime_bundle")
+
+config_setting(
+    name = "darwin_aarch64",
+    constraint_values = [
+        "@platforms//cpu:aarch64",
+        "@platforms//os:osx",
+    ],
+)
+
+config_setting(
+    name = "linux_aarch64",
+    constraint_values = [
+        "@platforms//cpu:aarch64",
+        "@platforms//os:linux",
+    ],
+)
+
+config_setting(
+    name = "linux_x86_64",
+    constraint_values = [
+        "@platforms//cpu:x86_64",
+        "@platforms//os:linux",
+    ],
+)
+
+vm_runtime_bundle(
+    name = "runtime",
+    gvproxy = select({
+        ":darwin_aarch64": "@vm_runtime_darwin_aarch64//:gvproxy",
+        ":linux_aarch64": "@vm_runtime_linux_aarch64//:gvproxy",
+        ":linux_x86_64": "@vm_runtime_linux_x86_64//:gvproxy",
+    }),
+    libkrun = select({
+        ":darwin_aarch64": "@vm_runtime_darwin_aarch64//:libkrun.dylib",
+        ":linux_aarch64": "@vm_runtime_linux_aarch64//:libkrun.so",
+        ":linux_x86_64": "@vm_runtime_linux_x86_64//:libkrun.so",
+    }),
+    libkrun_name = select({
+        ":darwin_aarch64": "libkrun.dylib",
+        ":linux_aarch64": "libkrun.so",
+        ":linux_x86_64": "libkrun.so",
+    }),
+    libkrunfw = select({
+        ":darwin_aarch64": "@vm_runtime_darwin_aarch64//:libkrunfw.5.dylib",
+        ":linux_aarch64": "@vm_runtime_linux_aarch64//:libkrunfw.so.5",
+        ":linux_x86_64": "@vm_runtime_linux_x86_64//:libkrunfw.so.5",
+    }),
+    libkrunfw_name = select({
+        ":darwin_aarch64": "libkrunfw.5.dylib",
+        ":linux_aarch64": "libkrunfw.so.5",
+        ":linux_x86_64": "libkrunfw.so.5",
+    }),
+    supervisor = select({
+        ":darwin_aarch64": "//bazel/releases:openshell_sandbox_linux_aarch64",
+        ":linux_aarch64": "//bazel/releases:openshell_sandbox_linux_aarch64",
+        ":linux_x86_64": "//bazel/releases:openshell_sandbox_linux_x86_64",
+    }),
+    tags = ["manual"],
+    target_compatible_with = select({
+        ":darwin_aarch64": [],
+        ":linux_aarch64": [],
+        ":linux_x86_64": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
+    umoci = select({
+        ":darwin_aarch64": "@vm_runtime_darwin_aarch64//:umoci",
+        ":linux_aarch64": "@vm_runtime_linux_aarch64//:umoci",
+        ":linux_x86_64": "@vm_runtime_linux_x86_64//:umoci",
+    }),
+    visibility = ["//visibility:public"],
+)

bazel/vm_runtime.bzl

@@ -0,0 +1,46 @@
+"""Rules for staging the embedded openshell-driver-vm runtime."""
+
+_ZSTD_TOOLCHAIN = "@bazel_lib//lib:zstd_toolchain_type"
+
+def _vm_runtime_bundle_impl(ctx):
+    output = ctx.actions.declare_directory(ctx.label.name)
+    zstd = ctx.toolchains[_ZSTD_TOOLCHAIN].zstdinfo.binary
+
+    resources = [
+        (ctx.file.libkrun, ctx.attr.libkrun_name),
+        (ctx.file.libkrunfw, ctx.attr.libkrunfw_name),
+        (ctx.file.gvproxy, "gvproxy"),
+        (ctx.executable.supervisor, "openshell-sandbox"),
+        (ctx.file.umoci, "umoci"),
+    ]
+    commands = ["mkdir -p '{}'".format(output.path)]
+    for source, name in resources:
+        commands.append("'{}' -q -f '{}' -o '{}/{}.zst'".format(
+            zstd.path,
+            source.path,
+            output.path,
+            name,
+        ))
+
+    ctx.actions.run_shell(
+        command = "set -euo pipefail\n{}".format("\n".join(commands)),
+        inputs = [source for source, _ in resources],
+        outputs = [output],
+        tools = [zstd],
+    )
+
+    return [DefaultInfo(files = depset([output]))]
+
+vm_runtime_bundle = rule(
+    implementation = _vm_runtime_bundle_impl,
+    attrs = {
+        "gvproxy": attr.label(allow_single_file = True, mandatory = True),
+        "libkrun": attr.label(allow_single_file = True, mandatory = True),
+        "libkrun_name": attr.string(mandatory = True),
+        "libkrunfw": attr.label(allow_single_file = True, mandatory = True),
+        "libkrunfw_name": attr.string(mandatory = True),
+        "supervisor": attr.label(executable = True, cfg = "target", mandatory = True),
+        "umoci": attr.label(allow_single_file = True, mandatory = True),
+    },
+    toolchains = [_ZSTD_TOOLCHAIN],
+)

crates/openshell-driver-vm/BUILD.bazel

@@ -0,0 +1,74 @@
+load("@crates//:defs.bzl", "aliases", "all_crate_deps")
+load("@rules_rs//rs:rust_binary.bzl", "rust_binary")
+load("@rules_rs//rs:rust_library.bzl", "rust_library")
+load("@rules_rs//rs:rust_test.bzl", "rust_test")
+load("@rules_rust//rust:defs.bzl", "rustfmt_test")
+load("@workspace_version//:version.bzl", "WORKSPACE_VERSION")
+
+VM_RUNTIME = "//bazel/vm-runtime:runtime"
+
+VM_RUNTIME_ENV = {
+    "OUT_DIR": "$(execpath //bazel/vm-runtime:runtime)",
+}
+
+rust_library(
+    name = "openshell-driver-vm",
+    srcs = glob(
+        ["src/**/*.rs"],
+        exclude = ["src/main.rs"],
+    ),
+    aliases = aliases(),
+    compile_data = [
+        "scripts/openshell-vm-sandbox-init.sh",
+        VM_RUNTIME,
+    ],
+    crate_features = ["telemetry"],
+    rustc_env = VM_RUNTIME_ENV,
+    version = WORKSPACE_VERSION,
+    visibility = ["//visibility:public"],
+    deps = all_crate_deps(normal = True),
+)
+
+rust_binary(
+    name = "openshell-driver-vm_bin",
+    srcs = ["src/main.rs"],
+    aliases = aliases(),
+    binary_name = "openshell-driver-vm",
+    version = WORKSPACE_VERSION,
+    visibility = ["//visibility:public"],
+    deps = all_crate_deps(normal = True) + [":openshell-driver-vm"],
+)
+
+rust_test(
+    name = "openshell-driver-vm_lib_test",
+    compile_data = [
+        "scripts/openshell-vm-sandbox-init.sh",
+        VM_RUNTIME,
+    ],
+    crate = ":openshell-driver-vm",
+    crate_features = ["telemetry"],
+    rustc_env = VM_RUNTIME_ENV,
+    deps = all_crate_deps(normal_dev = True),
+)
+
+rust_test(
+    name = "openshell-driver-vm_bin_test",
+    srcs = ["src/main.rs"],
+    aliases = aliases(),
+    version = WORKSPACE_VERSION,
+    deps = all_crate_deps(
+        normal = True,
+        normal_dev = True,
+    ) + [":openshell-driver-vm"],
+)
+
+rustfmt_test(
+    name = "rustfmt_test",
+    targets = [
+        ":openshell-driver-vm",
+        ":openshell-driver-vm_bin",
+        ":openshell-driver-vm_bin_test",
+        ":openshell-driver-vm_lib_test",
+    ],
+    visibility = ["//crates:__pkg__"],
+)

crates/openshell-vfio/BUILD.bazel

@@ -9,6 +9,7 @@ rust_library(
     srcs = glob(["src/**/*.rs"]),
     aliases = aliases(),
     target_compatible_with = ["@platforms//os:linux"],
+    visibility = ["//visibility:public"],
     deps = all_crate_deps(normal = True),
 )