super/box
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(netvm): add waypipe support and cgroup/netns wrapping for chromebox

Browse Source
This commit is contained in:
Antigravity Agent
2026-10-05 13:41:05 -04:00
parent 4b92277686
commit ab7d1215e0
3 changed files with 51 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/netvm-chrome.sh
+11 -5
View File
@@ -8,10 +8,11 @@
set -euo pipefail
NETVM_BIN="$(cd "$(dirname "$0")" && pwd)"
. "$NETVM_BIN/netvm-names.sh"
HEADLESS=0; CDP_OVERRIDE=""; NO_CDP=0; PROFILE=""; URL=""
usage() { echo "usage: netvm-chrome.sh [--headless] [--cdp-port N|--no-cdp] <profile> [url]"; }
WAYPIPE=0; HEADLESS=0; CDP_OVERRIDE=""; NO_CDP=0; PROFILE=""; URL=""
usage() { echo "usage: netvm-chrome.sh [--waypipe] [--headless] [--cdp-port N|--no-cdp] <profile> [url]"; }
while [ $# -gt 0 ]; do
case "$1" in
--waypipe) WAYPIPE=1; shift;;
--headless) HEADLESS=1; shift;;
--cdp-port) CDP_OVERRIDE="$2"; shift 2;;
--cdp-port=*) CDP_OVERRIDE="${1#*=}"; shift;;
@@ -44,9 +45,14 @@ if [ "$NO_CDP" = 1 ]; then CDP=""; elif [ -n "$CDP_OVERRIDE" ]; then CDP="$CDP_O
sudo -n "$NETVM_BIN/netvm-node-up.sh" "$NODE" | tail -1
LAUNCH_ARGS=(launch "$PROFILE")
[ "$HEADLESS" = 1 ] && LAUNCH_ARGS+=(--no-sandbox --headless)
LAUNCH_ARGS=(launch "$PROFILE" --no-sandbox)
[ "$HEADLESS" = 1 ] && LAUNCH_ARGS+=(--headless)
[ -n "$CDP" ] && LAUNCH_ARGS+=(--cdp-port "$CDP")
[ -n "$URL" ] && LAUNCH_ARGS+=("$URL")
[ -n "$CDP" ] && echo "cdp: http://$PEER_IP:$CDP/json/list (local) | ssh -L $CDP:$PEER_IP:$CDP <user>@<tail-ip> (remote)"
exec sudo -n "$NETVM_BIN/netvm-enter.sh" "$NODE" "$(id -u)" "$(id -g)" "$HOME" -- "$CHROME_BOX" "${LAUNCH_ARGS[@]}"
if [ "$WAYPIPE" = 1 ]; then
exec waypipe --compress=lz4 run -- sudo -n "$NETVM_BIN/netvm-enter.sh" "$NODE" "$(id -u)" "$(id -g)" "$HOME" -- "$CHROME_BOX" "${LAUNCH_ARGS[@]}"
else
exec sudo -n "$NETVM_BIN/netvm-enter.sh" "$NODE" "$(id -u)" "$(id -g)" "$HOME" -- "$CHROME_BOX" "${LAUNCH_ARGS[@]}"
fi
bin/netvm-enter.sh
+11 -2
View File
@@ -10,6 +10,15 @@ netvm_names "$1"; TUID="$2"; TGID="$3"; THOME="$4"; shift 4
[ "${1:-}" = "--" ]; shift
RESOLV=/etc/netvm/resolv-warp.conf
[ -f "$RESOLV" ] || echo "nameserver 1.1.1.1" > "$RESOLV"
ip netns exec "$NETNS" env \
EXEC_CMD=(ip netns exec "$NETNS" env \
NETVM_RESOLV="$RESOLV" NETVM_UID="$TUID" NETVM_GID="$TGID" NETVM_HOME="$THOME" \
unshare --mount "$SCRIPT_DIR/netvm-enter-inner.sh" "$@"
unshare --mount "$SCRIPT_DIR/netvm-enter-inner.sh" "$@")
if command -v systemd-run >/dev/null 2>&1; then
UNIT_NAME="netvm-${NODE}-$RANDOM"
exec systemd-run --scope -p MemoryMax=2G -p CPUQuota=200% --unit="$UNIT_NAME" "${EXEC_CMD[@]}"
else
exec "${EXEC_CMD[@]}"
fi
bin/netvm-node-up.sh
+29 -1
View File
@@ -6,8 +6,15 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
. "$SCRIPT_DIR/netvm-names.sh"
netvm_names "${1:?usage: netvm-node-up.sh <node>}"
CONF="/etc/netvm/${NODE}.conf"
STAGE_CONF="/tmp/netvm-stage-${NODE}.conf"
if [ ! -f "$CONF" ] && [ -f "$STAGE_CONF" ]; then
mkdir -p /etc/netvm 2>/dev/null || true
install -m 600 -o root -g root "$STAGE_CONF" "$CONF"
rm -f "$STAGE_CONF"
fi
[ -f "$CONF" ] || { echo "missing $CONF (human: netvm-new-identity.sh $NODE)"; exit 1; }
chmod 600 "$CONF"
# let the operator user stat (not read) identities: 711 dir, 600 files
chmod 711 /etc/netvm 2>/dev/null || true
nsexec() { ip netns exec "$NETNS" "$@"; }
@@ -100,4 +107,25 @@ else
fi
EGRESS=$(nsexec curl -sk --max-time 15 'https://1.1.1.1/cdn-cgi/trace' 2>/dev/null | grep -oP '^ip=\K.*' || true)
fi
echo "node=$NODE netns=$NETNS ifaces=$WG/$VETH egress=${EGRESS:-unknown}"
if [ -z "$EGRESS" ]; then
echo "ERROR: Egress check failed for node '$NODE' (warp interface down or unroutable). Aborting." >&2
EMAIL_ALERT="/home/super/Projects/email-alert/email-alert"
if [ -x "$EMAIL_ALERT" ]; then
"$EMAIL_ALERT" send --priority high --subject "NetVM Alert: Node '$NODE' Egress Failed" "WireGuard WARP tunnel for node '$NODE' failed egress verification. Execution aborted to protect IP isolation." || true
fi
exit 1
fi
REAL_USER="${SUDO_USER:-$USER}"
REAL_HOME=$(eval echo "~$REAL_USER")
AUDIT_DIR="$REAL_HOME/.local/share/chrome-box"
mkdir -p "$AUDIT_DIR" 2>/dev/null || true
chown "$REAL_USER:" "$AUDIT_DIR" 2>/dev/null || true
TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
python3 -c "import json; print(json.dumps({'timestamp': '$TIMESTAMP', 'event': 'node_up', 'node': '$NODE', 'netns': '$NETNS', 'veth_ip': '$PEER_IP', 'cdp_port': $CDP_PORT, 'egress_ip': '$EGRESS', 'user': '$REAL_USER'}))" >> "$AUDIT_DIR/audit.jsonl" 2>/dev/null || true
chown "$REAL_USER:" "$AUDIT_DIR/audit.jsonl" 2>/dev/null || true
echo "node=$NODE netns=$NETNS ifaces=$WG/$VETH egress=$EGRESS"