introduce graceful shutdown

image/overlay/etc/nftables.nft

@@ -70,6 +70,12 @@ table inet filter {
 
 	chain forward {
 		type filter hook forward priority 0; policy accept;
+		ip daddr 10.0.0.119 tcp dport {80, 443} accept
+		ip daddr 10.0.0.119 udp dport 443 accept
+		# block LAN access from containers.
+	    ip daddr 10.0.0.0/24 drop
+		ip daddr 192.168.0.0/16 drop
+		ip daddr 172.16.0.0/12 drop
 	}
 
 	chain output {

scripts/entrypoint.sh

@@ -1,7 +1,14 @@
 #!/bin/sh
 set -euo pipefail
 
-exec /usr/bin/cloud-hypervisor \
+
+_stop() {
+  ch-remote shutdown-vmm
+}
+
+trap _stop EXIT TERM
+
+/usr/bin/cloud-hypervisor \
   --kernel /boot/vmlinuz-virt --initramfs /boot/initramfs-virt \
   --disk path=/image/vm.raw,image_type=raw \
   --disk path=/image/data.raw,direct=on,image_type=raw \

scripts/setup-hypervisor.sh

@@ -3,13 +3,18 @@
 set -u
 
 echo "fetching latest version of cloud-hypervisor"
-DOWNLOAD_URL=$(curl https://api.github.com/repos/cloud-hypervisor/cloud-hypervisor/releases | jq -r '.[0].assets.[] | select( .name == "cloud-hypervisor-static") | .browser_download_url')
+RESPONSE=$(curl https://api.github.com/repos/cloud-hypervisor/cloud-hypervisor/releases)
+HYPERVISOR_URL=$(echo $RESPONSE | jq -r '.[0].assets.[] | select( .name == "cloud-hypervisor-static") | .browser_download_url')
+CH_REMOTE_URL=$(echo $RESPONSE | jq -r '.[0].assets.[] | select( .name == "ch-remote-static") | .browser_download_url' )
+
 if [ $? -ne 0 ]; then
     echo "FAILED TO FETCH DOWNLOAD LINK OF CLOUD-HYPERVISOR-STATIC"
     exit -1
 fi
 
-curl -sLo /usr/bin/cloud-hypervisor $DOWNLOAD_URL && chmod +x /usr/bin/cloud-hypervisor && cloud-hypervisor --help
+curl -sLo /usr/bin/cloud-hypervisor "$HYPERVISOR_URL" && chmod +x /usr/bin/cloud-hypervisor && cloud-hypervisor --help >/dev/null 2>&1 
+
+curl -sLo /usr/bin/ch-remote "$CH_REMOTE_URL" && chmod +x /usr/bin/ch-remote && ch-remote --help >/dev/null 2>&1
 
 if [ $? -ne 0 ]; then
     echo "FAILED TO DOWNLOAD CLOUD-HYPERVISOR or CLOUD-HYPERVISOR IS NOT EXECUTABLE. (wrong arch?)"