runtime-rs: Port MSFT changes from msft-main in runtime-go

[Redent0r]

• Build and install runtime-rs
• Port over fork specific changes from runtime-go to runtime-rs
• Add unit test coverage for static resource management changes
• Temporarily make runtime-rs the default runtime for testing (to remove before merging)

[outdated]
CI: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1077778&view=results
bb: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1077783&view=results
image build: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1077801&view=results
test: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1077871&view=results

[Redent0r]

todo: changes we'll need to bring into runtime-rs (or verify they don't apply) from runtime-go to be on par:

• a136359
• c06b470
• 521def7
• 7ddec33
• b03db3e

[Redent0r]

we'll also need changes to the kata-ci pipeline to also vendor runtime-rs dependencies https://dev.azure.com/mariner-org/mariner/_git/CBL-Mariner-Pipelines/pullrequest/26534

[Copilot]

Pull request overview

Ports Microsoft-specific behavior from runtime-go into runtime-rs, and updates the Azure Linux node-builder packaging flow to build/install runtime-go and runtime-rs artifacts side-by-side with a selectable default.

Changes:

• Build and install runtime-go + runtime-rs shim binaries/configs side-by-side, selecting the default via USE_RUNTIME_RS.
• Add static sandbox resource management defaults (workload mem/vCPU) and a minimum pod memory enforcement knob to runtime-rs.
• Relax kata-types Cloud Hypervisor memory defaults/validation to allow “0 base” sizing flows.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tools/osbuilder/node-builder/azure-linux/package_install.sh	Installs runtime-go/runtime-rs shims and configs side-by-side; selects a default shim/config.
tools/osbuilder/node-builder/azure-linux/package_build.sh	Builds both runtime implementations and generates debug configs for both.
tools/osbuilder/node-builder/azure-linux/common.sh	Adds per-runtime config filenames/dirs and selects default config name based on USE_RUNTIME_RS.
tools/osbuilder/node-builder/azure-linux/Makefile	Sets USE_RUNTIME_RS=yes by default for Azure Linux builds.
src/runtime-rs/crates/runtimes/src/manager.rs	Adds minimum workload memory enforcement during sandbox init.
src/runtime-rs/crates/resource/src/network/network_info/network_info_from_link.rs	Filters neighbor entries, allowing static + default-gateway neighbors.
src/runtime-rs/crates/resource/src/cpu_mem/initial_size.rs	Applies static-resource defaults and exposes workload memory getter.
src/runtime-rs/config/configuration-cloud-hypervisor.toml.in	Adds new static-resource default knobs + min workload memory setting.
src/runtime-rs/Makefile	Adds/exports new config substitution variables; makes DEFVCPUS/DEFMEMSZ overridable.
src/libs/kata-types/src/config/runtime.rs	Adds runtime config fields for static defaults + min workload memory.
src/libs/kata-types/src/config/hypervisor/mod.rs	Removes validation requiring non-zero default_memory.
src/libs/kata-types/src/config/hypervisor/ch.rs	Stops force-setting CH default_memory when unset.
src/libs/kata-types/src/config/default.rs	Updates default CPU/memory constraints (e.g., allow 0 min for CH memory).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Redent0r]

This block will probably generate discussion. This commit is trying to port over kata-containers@9af9844 . After doing that, I realized that, unlike the memory, the static CPU set in the config wasn't getting past to the guest VM as expected.

It looks like runtime-rs is missing https://github.com/fidencio/kata-containers/blob/e2476f587c472d5d217df9c75cdb80193dd85994/src/runtime/pkg/oci/utils.go#L1232 and we may be able to upstream that

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

src/libs/kata-types/src/config/hypervisor/mod.rs:1045

• MemoryInfo::validate() no longer rejects default_memory == 0. Since runtime-rs’ Cloud Hypervisor conversion errors on default_memory == 0 (see src/runtime-rs/crates/hypervisor/ch-config/src/convert.rs:236-238), this means invalid configs can now pass validation and only fail later at VM creation time. If 0 is meant to be a supported “auto-size” value, consider updating the CH conversion to handle it (or gate this relaxation to non-CH hypervisors); otherwise, restoring the default_memory != 0 validation would keep failures earlier and clearer.

    /// This ensures that critical memory parameters like `memory_slots` are
    /// non-zero, and checks the validity of
    /// the memory backend file path.
    pub fn validate(&self) -> Result<()> {
        validate_path!(
            self.file_mem_backend,
            "Memory backend file {} is invalid: {}"
        )?;
        if self.memory_slots == 0 {
            return Err(std::io::Error::other(
                "Configured memory slots for guest VM are zero",
            ));

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Setting MIN_CH_MEMORY_SIZE_MB to 0 effectively disables the Cloud Hypervisor “minimum guest memory” validation (since default_memory < MIN_CH_MEMORY_SIZE_MB can never be true), allowing configs with default_memory == 0 to pass plugin validation. runtime-rs’ Cloud Hypervisor conversion rejects default_memory == 0 (MemoryConfigError::NoDefaultMemory in src/runtime-rs/crates/hypervisor/ch-config/src/convert.rs), so this can push invalid configs deeper into runtime. Consider keeping a non-zero minimum here, or ensure an earlier stage always sets default_memory to a valid value before CH conversion.

Suggested change

	pub const MIN_CH_MEMORY_SIZE_MB: u32 = 0;
	pub const MIN_CH_MEMORY_SIZE_MB: u32 = 128;

[Copilot]

CloudHypervisorConfig::adjust_config() no longer fills in a default when memory_info.default_memory == 0. Combined with the relaxed MemoryInfo::validate() and MIN_CH_MEMORY_SIZE_MB == 0, it becomes easy for CH configs to flow through with default_memory == 0 and then fail later during runtime-rs CH config conversion (MemoryConfigError::NoDefaultMemory). If 0 is intended to mean “defer memory sizing to InitialSizeManager”, consider adding an explicit comment + ensuring the sizing path always runs before any CH conversion; otherwise, restoring the defaulting here would prevent runtime failures for configs that omit default_memory.

Suggested change

	// Fill in a default if not specified, to avoid propagating an unusable 0 value.
	if ch.memory_info.default_memory == 0 {
	ch.memory_info.default_memory = MIN_CH_MEMORY_SIZE_MB;
	}

[Copilot]

This Makefile forces USE_RUNTIME_RS := yes, making runtime-rs the default for any builds that include this file. The PR description calls this out as temporary “for testing (to remove before merging)”, but it’s easy to forget and accidentally ship this as the new default. Consider removing this export before merging, or gating it behind an explicit make target / environment override so default builds remain unchanged.

Suggested change

export USE_RUNTIME_RS := yes