iceBear67
c7afb86ebc
Security & correctness fixes following the audit in REPORT.md.
- setup-hypervisor.sh: fix broken error handling — use curl -fsSL,
check failures properly, return valid exit codes, and fetch
/releases/latest (arch-aware) instead of the possibly-draft .[0]
- entrypoint.sh: quote "$@" and build --net conditionally so empty
NET_INTERFACE/NET_MAC don't yield "tap=,mac="
- image-updater: replace tight 3s retry loop with capped exponential
backoff + periodic pull instead of hammering the registry
- sshd: set PermitRootLogin prohibit-password explicitly (key-only root)
- vm.Dockerfile: copy only host private keys at mode 600 instead of
the whole secret/* glob (drops .gitkeep/.pub from /etc/ssh)
- Makefile: stop generating redundant _pub key files
- build-image.sh: detect failure via alpine-make-vm-image's real exit
status rather than grepping stdout for "ERROR"
- remove orphaned etc/alloy/config.alloy (service not installed)
- README: correct data.raw path
- add REPORT.md audit notes (H1/H2 accepted as out-of-scope)
1000 B
1000 B
bearnet
This repository contains necessarities to build a VM image and corresponding hypervisor image using Dockerfiles.
Edit corresponding files in image/overlay to customize VM behaviour. Privileges are required for building VM images as some scripts are depending on /dev/nbd.
Build & Running
# cp .env.example .env
# vim .env
# VM_OPTS="--no-cache" HY_OPTS="--no-cache" make
# fallocate -l 128G ./data/data.raw
# sgdisk -o -n 1:0:0 -t 1:8300 ./data/data.raw
# losetup -Pf ./data/data.raw
# mkfs.ext4 /dev/loop0p1
# losetup -d /dev/loop0
# vim docker-compose.yml
# docker compose up
The given compose file is for reference only. It must be edited according to your situation.
Once the image is built and udhcpd is ready, VM's IP will be shown in logs.
By default, a OpenSSH server will be listening on :2222.
FAQ
udhcpc: socket(AF_PACKET,2,8): Address family not supported by protocol
Clear build cache for both images to unify kernel version.