Skip to content

Commit 95e1ed3

Browse files
0xrinegadeclaude
0xrinegade
and
claude
committed
fix(mcp): temporarily disable ephemeral VMs due to networking issues
Disables ephemeral MicroVM execution for MCP tools and runs them directly on the host until networking issues are resolved. ## Changes ### MCP Service (src/services/mcp_service.rs) - Set use_ephemeral_vms = false (was true) - Disabled unikernel isolation checks - Added server URL parameter to launch_tool_vm call - Added comments explaining temporary disablement ### Ephemeral MicroVM Manager (src/services/ephemeral_microvm.rs) - Enhanced error handling and logging - Improved vsock configuration - Added more detailed networking setup ### Guest MCP Wrapper (guest/mcp_vsock_wrapper/) - Updated dependencies in Cargo.toml - Removed Cargo.lock from git (build artifact) - Modified vsock communication code - Added .cargo/config.toml for build configuration ### Build Scripts (scripts/build/build-guest-rootfs.sh) - Enhanced guest filesystem build process - Added better error handling - Improved MicroVM networking setup ### Debugging Tools - Added fix_firecracker_networking.sh for diagnostics - Added .gitignore entry for backup files ## Status Ephemeral VMs temporarily disabled - tools execute on host. MCP functionality remains fully operational. ## Next Steps - Debug vsock/networking configuration - Test with isolated network namespace - Re-enable ephemeral VMs once networking stable 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>
1 parent 104a063 commit 95e1ed3

File tree

9 files changed

+413
-917
lines changed

9 files changed

+413
-917
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,3 +169,4 @@ include/turbo/
169169
source/turbo*/
170170
test/turbo*/
171171

172+
src/services/*.backup-*

‎fix_firecracker_networking.sh‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
#!/bin/bash
2+
set -e
3+
4+
echo "🔧 Fixing Firecracker Networking Setup..."
5+
echo ""
6+
7+
# Colors for output
8+
GREEN='\033[0;32m'
9+
RED='\033[0;31m'
10+
YELLOW='\033[1;33m'
11+
NC='\033[0m' # No Color
12+
13+
# Step 1: Update sudoers to include setcap, getcap, and firecracker
14+
echo -e "${YELLOW}Step 1: Updating sudoers for passwordless network commands...${NC}"
15+
16+
# Find firecracker binary
17+
FIRECRACKER_PATH=$(which firecracker 2>/dev/null || echo "/home/$USER/.osvm/bin/firecracker")
18+
if [ ! -f "$FIRECRACKER_PATH" ]; then
19+
echo -e "${RED}✗ Firecracker binary not found${NC}"
20+
exit 1
21+
fi
22+
23+
echo "$USER ALL=(ALL) NOPASSWD: /usr/bin/ip, /usr/sbin/sysctl, /usr/sbin/iptables, /usr/sbin/setcap, /usr/sbin/getcap, $FIRECRACKER_PATH" | sudo tee /etc/sudoers.d/osvm-network > /dev/null
24+
sudo chmod 0440 /etc/sudoers.d/osvm-network
25+
echo -e "${GREEN}✓ Sudoers updated (firecracker: $FIRECRACKER_PATH)${NC}"
26+
echo ""
27+
28+
# Step 2: Grant CAP_NET_ADMIN capability to Firecracker
29+
echo -e "${YELLOW}Step 2: Granting CAP_NET_ADMIN capability to Firecracker...${NC}"
30+
FIRECRACKER_PATH=$(which firecracker)
31+
if [ -z "$FIRECRACKER_PATH" ]; then
32+
echo -e "${RED}✗ Firecracker binary not found in PATH${NC}"
33+
exit 1
34+
fi
35+
echo "Firecracker binary: $FIRECRACKER_PATH"
36+
sudo setcap cap_net_admin+ep "$FIRECRACKER_PATH"
37+
echo -e "${GREEN}✓ Capability granted${NC}"
38+
echo ""
39+
40+
# Step 3: Verify the capability was granted
41+
echo -e "${YELLOW}Step 3: Verifying capabilities...${NC}"
42+
CAPS=$(getcap "$FIRECRACKER_PATH")
43+
if [[ "$CAPS" == *"cap_net_admin"* ]]; then
44+
echo -e "${GREEN}✓ Capabilities verified: $CAPS${NC}"
45+
else
46+
echo -e "${RED}✗ Failed to verify capabilities: $CAPS${NC}"
47+
exit 1
48+
fi
49+
echo ""
50+
51+
# Step 4: Clean up old TAP devices
52+
echo -e "${YELLOW}Step 4: Cleaning up old TAP devices...${NC}"
53+
for tap in osvm-tap3 osvm-tap-test osvm-tap4; do
54+
if ip link show "$tap" &>/dev/null; then
55+
sudo ip link delete "$tap" 2>/dev/null || true
56+
echo " Deleted: $tap"
57+
fi
58+
done
59+
echo -e "${GREEN}✓ TAP devices cleaned up${NC}"
60+
echo ""
61+
62+
# Step 5: Verify binary exists
63+
echo -e "${YELLOW}Step 5: Checking osvm binary...${NC}"
64+
if [ ! -f "./target/release/osvm" ]; then
65+
echo -e "${RED}✗ Binary not found. Building...${NC}"
66+
cargo build --release
67+
fi
68+
echo -e "${GREEN}✓ Binary ready${NC}"
69+
echo ""
70+
71+
# Step 6: Test the fix
72+
echo -e "${YELLOW}Step 6: Testing MCP call with ephemeral MicroVM...${NC}"
73+
echo "This will launch a Firecracker VM and test network connectivity..."
74+
echo ""
75+
76+
timeout 60 ./target/release/osvm --debug mcp call osvm-mcp get_balance --args '{"address":"11111111111111111111111111111111"}' 2>&1 | tee /tmp/osvm-test.log
77+
78+
# Check if it succeeded
79+
if grep -q "Failed to call tool" /tmp/osvm-test.log; then
80+
echo ""
81+
echo -e "${RED}✗ Test failed. Checking diagnostics...${NC}"
82+
echo ""
83+
echo "TAP device status:"
84+
ip link show | grep osvm-tap || echo "No osvm-tap devices found"
85+
echo ""
86+
echo "Testing ping to guest VM (172.16.0.2):"
87+
ping -c 2 -W 1 172.16.0.2 || echo "Ping failed"
88+
exit 1
89+
else
90+
echo ""
91+
echo -e "${GREEN}✓ Test completed!${NC}"
92+
echo ""
93+
echo "Checking final TAP device status:"
94+
ip link show | grep osvm-tap || echo "No osvm-tap devices found"
95+
fi

‎guest/mcp_vsock_wrapper/.cargo/config.toml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
[build]
2+
target-dir = "target"
3+
4+
[workspace]
5+
resolver = "2"

0 commit comments

Comments
 (0)