feat(sandbox/vm): add DAX support to the vfs

Cargo.toml

@@ -121,7 +121,7 @@ num-derive = "0.4"
 num-traits = "0.2"
 nu-ansi-term = "0.50"
 oauth2 = "5.0.0"
-octocrab = "0.51"
+octocrab = "0.53"
 opentelemetry = "0.32"
 opentelemetry-appender-tracing = "0.32"
 opentelemetry-otlp = { version = "0.32", features = ["grpc-tonic", "zstd-tonic", "logs", "metrics"] }
@@ -198,17 +198,17 @@ tower = { version = "0.5", features = ["timeout", "util"] }
 tower-http = { version = "0.6", features = ["add-extension", "compression-zstd", "decompression-zstd", "map-request-body", "map-response-body", "set-header", "timeout", "util"] }
 tracing = "0.1.44"
 tracing-opentelemetry = "0.33"
-tracing-subscriber = { version = "0.3.22", features = ["env-filter", "json"] }
-tracing-tree = "0.4.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
+tracing-tree = "0.4"
 turso = "0.6.0"
 unicode-segmentation = "1"
 unicode-width = "0.2"
 uuid = { version = "1", features = ["v7"] }
 v8 = { git = "https://github.com/tangramdotdev/rusty_v8" }
 virtiofsd = "1"
-vhost = "0.13"
-vhost-user-backend = "0.17"
-vm-memory = { version = "0.16", features = ["backend-atomic", "backend-mmap"] }
+vhost = "0.16"
+vhost-user-backend = "0.22"
+vm-memory = { version = "0.17", features = ["backend-atomic", "backend-mmap"] }
 waitpid-any = "0.3"
 webbrowser = "1"
 winnow = "1"
@@ -225,3 +225,6 @@ ignored = [
   "octocrab",
   "webbrowser",
 ]
+
+[patch.crates-io]
+virtiofsd = { git = "https://github.com/tangramdotdev/virtiofsd", branch = "feat/dax" }

package.json

@@ -26,10 +26,10 @@
 	},
 	"dependencies": {
 		"@types/bun": "^1.3.14",
-		"@typescript/native-preview": "^7.0.0-dev.20260602.1",
+		"@typescript/native-preview": "^7.0.0-dev.20260608.1",
 		"esbuild": "^0.28.0",
-		"oxfmt": "^0.53.0",
-		"oxlint": "^1.68.0",
+		"oxfmt": "^0.54.0",
+		"oxlint": "^1.69.0",
 		"typescript": "^6.0.3"
 	}
 }

packages/cli/src/sandbox/vm/run.rs

@@ -10,12 +10,18 @@ pub struct Args {
 	#[arg(long)]
 	pub artifacts_path: PathBuf,
 
+	#[arg(long)]
+	pub cloud_hypervisor_path: Option<PathBuf>,
+
 	#[arg(long, hide = true, value_name = "DIR")]
 	pub create_snapshot: Option<PathBuf>,
 
 	#[arg(long)]
 	pub cpu: Option<u64>,
 
+	#[arg(long, hide = true)]
+	pub dax: Option<u64>,
+
 	#[arg(action = clap::ArgAction::Append, long = "dns", num_args = 1)]
 	pub dns: Vec<Ipv4Addr>,
 
@@ -87,8 +93,10 @@ impl Cli {
 	pub fn command_sandbox_vm_run(args: Args) -> tg::Result<std::process::ExitCode> {
 		let arg = tangram_sandbox::vm::run::Arg {
 			artifacts_path: args.artifacts_path,
+			cloud_hypervisor_path: args.cloud_hypervisor_path,
 			create_snapshot: args.create_snapshot,
 			cpu: args.cpu,
+			dax: args.dax,
 			dns: args.dns,
 			firewall: args.firewall,
 			guest_ip: args.guest_ip,

packages/cli/tests/run/sandboxed_mount_cat.nu

@@ -0,0 +1,30 @@
+use ../../test.nu *
+
+if $nu.os-info.name != 'linux' {
+	return
+}
+
+let server = spawn --busybox
+
+let mount = mktemp -d | str trim
+"hello from the mount\n" | save -f ($mount | path join "file")
+
+let path = artifact {
+	tangram.ts: '
+		import busybox from "busybox";
+
+		export default async function (mount) {
+			const host = tg.host.current;
+			tg.assert(typeof host === "string");
+			return await tg.run({
+				args: ["-c", "cat /target/file"],
+				env: tg.build(busybox),
+				executable: "sh",
+				host,
+			}).sandbox().mount({ source: mount, target: "/target" });
+		}
+	',
+}
+
+let output = tg run $path --arg-string $mount | str trim
+assert equal $output "hello from the mount"

packages/cli/tests/run/sandboxed_mount_cat_dax.nu

@@ -0,0 +1,44 @@
+use ../../test.nu *
+
+if $nu.os-info.name != 'linux' {
+	return
+}
+
+if (($env.TANGRAM_TEST_VM? | default "") | str length) == 0 {
+	return
+}
+
+for dax in [true false] {
+	let server = spawn --busybox --config {
+		sandbox: {
+			isolation: {
+				vm: {
+					dax: $dax,
+				},
+			},
+		},
+	}
+
+	let mount = mktemp -d | str trim
+	"hello from the mount\n" | save -f ($mount | path join "file")
+
+	let path = artifact {
+		tangram.ts: '
+			import busybox from "busybox";
+
+			export default async function (mount) {
+				const host = tg.host.current;
+				tg.assert(typeof host === "string");
+				return await tg.run({
+					args: ["-c", "cat /target/file"],
+					env: tg.build(busybox),
+					executable: "sh",
+					host,
+				}).sandbox().mount({ source: mount, target: "/target" });
+			}
+		',
+	}
+
+	let output = tg run $path --arg-string $mount | str trim
+	assert equal $output "hello from the mount"
+}

packages/sandbox/src/lib.rs

@@ -137,6 +137,8 @@ pub struct SeatbeltIsolation {}
 
 #[derive(Clone, Debug, Eq, PartialEq, serde::Deserialize, serde::Serialize)]
 pub struct VmIsolation {
+	pub cloud_hypervisor_path: Option<PathBuf>,
+	pub dax: Option<u64>,
 	pub kernel_path: PathBuf,
 	pub max_cpu: u64,
 	pub max_memory: u64,

packages/sandbox/src/vm.rs

@@ -9,7 +9,7 @@ pub(crate) mod network;
 pub mod image;
 pub mod init;
 pub mod run;
-pub mod virtiofsd;
+pub mod virtiofs;
 
 #[derive(Clone, Debug)]
 pub struct Network {

packages/sandbox/src/vm/init.rs

@@ -76,13 +76,43 @@ pub fn run() -> tg::Result<ExitCode> {
 	wait_for_virtiofs()
 		.map_err(|source| tg::error!(!source, "error waiting for virtiofs tags to connect"))?;
 	tracing::trace!("virtiofs tags ready");
+
+	signal_ready();
+	let mut resume = [0u8; 1];
+	loop {
+		let n = unsafe { libc::read(libc::STDIN_FILENO, resume.as_mut_ptr().cast(), resume.len()) };
+		if n >= 0 {
+			break;
+		}
+		let error = std::io::Error::last_os_error();
+		if error.raw_os_error() != Some(libc::EINTR) {
+			return Err(tg::error!(!error, "failed to read the resume signal"));
+		}
+	}
+	tracing::trace!("resumed");
 	online_cpus();
 
-	mount_virtiofs(SANDBOX_FS_TAG, HOST_MOUNT_POINT)?;
+	mount_virtiofs(SANDBOX_FS_TAG, HOST_MOUNT_POINT, None)?;
 	tracing::trace!("mounted {HOST_MOUNT_POINT}");
-	mount_virtiofs(ARTIFACTS_FS_TAG, ARTIFACTS_MOUNT_POINT)?;
+	let artifacts_options = if dax_from_cmdline() {
+		Some("dax")
+	} else {
+		None
+	};
+	mount_virtiofs(ARTIFACTS_FS_TAG, ARTIFACTS_MOUNT_POINT, artifacts_options)?;
 	tracing::trace!("mounted {ARTIFACTS_MOUNT_POINT}");
 
+	let mut stat: libc::stat = unsafe { std::mem::zeroed() };
+	let path = c"/mnt/host/opt/tangram/artifacts";
+	if unsafe { libc::stat(path.as_ptr(), &raw mut stat) } == 0 {
+		let major = libc::major(stat.st_dev);
+		let minor = libc::minor(stat.st_dev);
+		let bdi = format!("/sys/class/bdi/{major}:{minor}/read_ahead_kb");
+		if let Err(error) = std::fs::write(&bdi, "1024") {
+			tracing::warn!(%error, path = %bdi, "failed to raise the artifacts readahead");
+		}
+	}
+
 	let bytes = std::fs::read(HOST_INIT_CONFIG_PATH)
 		.map_err(|error| tg::error!(!error, "failed to read the init config"))?;
 	tracing::trace!("read {} bytes from {HOST_INIT_CONFIG_PATH}", bytes.len());
@@ -156,21 +186,39 @@ pub fn run() -> tg::Result<ExitCode> {
 	}
 }
 
-fn mount_virtiofs(tag: &str, target: &str) -> tg::Result<()> {
+fn dax_from_cmdline() -> bool {
+	let Ok(cmdline) = std::fs::read_to_string("/proc/cmdline") else {
+		return false;
+	};
+	cmdline
+		.split_whitespace()
+		.any(|token| token == "tangram.dax=1")
+}
+
+fn mount_virtiofs(tag: &str, target: &str, options: Option<&str>) -> tg::Result<()> {
 	std::fs::create_dir_all(target)
 		.map_err(|error| tg::error!(!error, %target, "failed to create the virtiofs target"))?;
 	let source = CString::new(tag)
 		.map_err(|error| tg::error!(!error, "failed to encode the virtiofs tag"))?;
 	let target_c = CString::new(target)
 		.map_err(|error| tg::error!(!error, "failed to encode the virtiofs target"))?;
 	let fstype = CString::new("virtiofs").unwrap();
+	let data = options
+		.map(|options| {
+			CString::new(options)
+				.map_err(|error| tg::error!(!error, "failed to encode the virtiofs options"))
+		})
+		.transpose()?;
+	let data_ptr = data
+		.as_ref()
+		.map_or(std::ptr::null(), |data| data.as_ptr().cast());
 	let result = unsafe {
 		libc::mount(
 			source.as_ptr(),
 			target_c.as_ptr(),
 			fstype.as_ptr(),
 			0,
-			std::ptr::null(),
+			data_ptr,
 		)
 	};
 	if result != 0 {
@@ -505,8 +553,6 @@ fn wait_for_virtiofs() -> tg::Result<()> {
 		return Ok(());
 	}
 
-	signal_ready();
-
 	let mut buf = [0u8; 8192];
 	while !pending.is_empty() {
 		let n = unsafe { libc::recv(socket, buf.as_mut_ptr().cast(), buf.len(), 0) };