Add --guestfwd arg to boco boot

.containerignore

@@ -1,10 +0,0 @@
-# Build context: deny everything, then allow only what the Containerfile needs.
-# Keeps the linux submodule (and example/, .gitea/, README, etc.) out of the build.
-*
-!Cargo.toml
-!Cargo.lock
-!src/
-!src/**
-!init/
-!init/**
-!kernel/config

Containerfile

@@ -1,65 +0,0 @@
-# boco runner: compiles boco (static musl) AND the shared boco kernel (vmlinuz)
-# with the slim config checked into the boco repo, then serves as the runtime
-# image for `boco build` / `boco boot` under podman.
-#
-# Runtime requirements (boco shells out to nested rootless podman):
-#   --device /dev/kvm      KVM accel for the VMs (entrypoint chmods it)
-#   --device /dev/net/tun  only if nested container runs need pasta networking
-#   volume at /home/boco/.local/share/boco   persistent registry (images+kernel)
-#   NO --privileged: the container's own userns (single mapping) is what makes
-#   nested `podman unshare` work; ignore_chown_errors handles unmapped uids.
-#
-# Kernel source: pinned tarball linux-7.2 (= 8d3ae59288f1e7d58d76558a6ee96d533bc5019f,
-# verified == refs/tags/v7.2{} via git ls-remote), sha256-checked.
-
-FROM alpine:edge AS build
-RUN apk add --no-cache rust cargo git
-WORKDIR /src
-COPY . .
-# alpine's rust targets x86_64-alpine-linux-musl natively (static, no glibc dep)
-RUN cargo build --release -p boco -p boco-init \
- && strip target/release/boco target/release/boco-init
-
-FROM alpine:3.22 AS kernel
-# g++ for host tools, libelf for objtool, openssl for extract-cert
-RUN apk add --no-cache make gcc g++ musl-dev perl flex bison bc \
-      elfutils-dev openssl-dev findutils tar xz zstd curl linux-headers diffutils
-WORKDIR /kbuild
-# Pinned upstream tarball: linux-7.2.tar.xz, sha256
-# f9fef3d14c0df53819026f4be74459835c2a0b0dcbf5b5bbd9ea19f0829402b3.
-# (Equivalent to the upstream shallow pin 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
-# = refs/tags/v7.2{} — verified via `git ls-remote`; the tarball avoids
-# a multi-GB shallow clone through flaky slirp NAT.)
-RUN curl -fsSLo /tmp/linux-7.2.tar.xz https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.xz \
- && echo "f9fef3d14c0df53819026f4be74459835c2a0b0dcbf5b5bbd9ea19f0829402b3  /tmp/linux-7.2.tar.xz" | sha256sum -c - \
- && tar -xJf /tmp/linux-7.2.tar.xz \
- && mv linux-7.2 linux
-# Install the slim kernel config checked into the boco repo; olddefconfig
-# normalizes it against this tree and fails nothing silently afterwards.
-COPY kernel/config /kbuild/linux/.config
-RUN make -C linux olddefconfig HOSTCC=gcc CC=gcc \
- && grep -qE '^(# )?CONFIG_MODULES' linux/.config
-RUN make -C linux -j"$(nproc)" bzImage HOSTCC=gcc CC=gcc \
- && cp linux/arch/x86/boot/bzImage /vmlinuz \
- && ls -lh /vmlinuz
-
-FROM alpine:3.22
-RUN apk add --no-cache \
-      qemu-system-x86_64 qemu-img virtiofsd \
-      podman fuse3 openssh-client ca-certificates iptables ip6tables \
-      e2fsprogs cpio passt \
- && adduser -D -s /bin/sh boco \
- && echo boco:100000:65536 > /etc/subuid \
- && echo boco:100000:65536 > /etc/subgid \
- && mkdir -p /etc/containers \
- && printf '[storage]\ndriver = "vfs"\nrunroot = "/run/containers/storage"\ngraphroot = "/var/lib/containers/storage"\n[storage.options]\nignore_chown_errors = "true"\n' > /etc/containers/storage.conf \
- && printf '#!/bin/sh\n[ -e /dev/kvm ] && chmod 666 /dev/kvm\nexec /usr/local/bin/boco "$@"\n' > /usr/local/bin/entrypoint.sh \
- && chmod 755 /usr/local/bin/entrypoint.sh
-COPY --from=build /src/target/release/boco /usr/local/bin/boco
-COPY --from=build /src/target/release/boco-init /home/boco/.local/share/boco/boco-init
-COPY --from=kernel /vmlinuz /home/boco/.local/share/boco/vmlinuz
-RUN chmod 755 /usr/local/bin/boco /home/boco/.local/share/boco/boco-init /home/boco/.local/share/boco/vmlinuz
-ENV XDG_DATA_HOME=/home/boco/.local/share
-WORKDIR /data
-ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
-CMD ["image", "list"]

init/src/main.rs

@@ -353,6 +353,9 @@ fn exec_command(argv: &[String], user: Option<UserSpec>) -> ! {
     let c_prog = cstrings[0].clone();
     let c_refs: Vec<&CString> = cstrings.iter().collect();
 
+    // If UserSpec is 0:0, don't fork.
+    let user = user.filter(|u| !u.uid.is_root() || u.gid != Gid::from_raw(0));
+
     match user {
         None => {
             // No privilege drop: exec directly, PID 1 becomes the command.
@@ -362,6 +365,7 @@ fn exec_command(argv: &[String], user: Option<UserSpec>) -> ! {
             std::process::exit(1);
         }
         Some(user) => {
+            warn(&format!("dropping privileges to {}:{}", user.uid, user.gid));
             // Drop privileges in a child so PID 1 (root) can poweroff afterwards.
             match unsafe { fork() } {
                 Ok(ForkResult::Child) => {

scripts/setup.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -ex
+
+cd "$(dirname "$0")/.."
+
+mkdir -p "$HOME/.local/share/boco"
+cargo build --release --target x86_64-unknown-linux-musl -p boco-init
+
+target_dir="${CARGO_TARGET_DIR:-target}"
+cp "$target_dir/x86_64-unknown-linux-musl/release/boco-init" "$HOME/.local/share/boco/"
+

src/qemu.rs

@@ -24,6 +24,10 @@ pub struct BootCmd {
     #[clap(long)]
     forward: Vec<PortForward>,
 
+    /// Pass a `guestfwd=...` argument to qemu `-nic` argument.
+    #[clap(long)]
+    guestfwd: Vec<String>,
+
     /// Override the command to exec in the VM (base64-encoded on the kernel
     /// cmdline as `boco.cmd=<b64>`). Overrides the CMD inferred at build time.
     #[clap(long)]
@@ -35,6 +39,9 @@ pub struct BootCmd {
     /// relative to the image's WORKINGDIR. Can be repeated.
     #[clap(long)]
     mount: Vec<String>,
+
+    /// Extra arguments to qemu
+    extra: Vec<String>,
 }
 
 /// Invoke `qemu` to boot a boco image. See [`BootCmd`] for options
@@ -46,8 +53,10 @@ pub(crate) fn boot(
         name,
         memory,
         forward,
+        guestfwd,
         cmd,
         mount,
+        extra,
     }: BootCmd,
 ) -> Result<()> {
     let reg_dir = registry_dir(&name)?;
@@ -149,6 +158,9 @@ pub(crate) fn boot(
     for forward in &forward {
         _ = write!(&mut network, ",hostfwd={forward}");
     }
+    for guestfwd in &guestfwd {
+        _ = write!(&mut network, ",guestfwd={guestfwd}");
+    }
 
     let mut command = Command::new("qemu-system-x86_64");
 
@@ -165,7 +177,8 @@ pub(crate) fn boot(
         .args(["-no-reboot"])
         .args(["-append", &cmdline])
         .args(["-nographic"])
-        .args(["-nic", &network]);
+        .args(["-nic", &network])
+        .args(&extra);
 
     println!("{command:?}");