Cargo.toml

# nixvm — a userland Linux kernel + VM-style sandbox.
#
# One crate. Internal structure (abi / vcpu / kernel / fs / loader / image /
# sandbox) lives as modules, and heavy or platform-specific dependencies are
# feature-gated rather than split into separate crates. `unsafe` is confined to
# four documented sites: `vcpu::hvf` (Hypervisor.framework FFI), `vcpu::kvm`
# (/dev/kvm ioctl FFI), `vcpu::region` (page-aligned guest-RAM allocation), and
# `fs::passthrough` (*at(2) FFI). See ROADMAP.md for the plan.

[package]
name = "nixvm"
version = "0.0.0"
edition = "2024"
rust-version = "1.89"
license = "Apache-2.0 OR MIT"
repository = "https://github.com/KarpelesLab/nixvm"
authors = ["Mark Karpeles <magicaltux@gmail.com>"]
description = "A portable VM-style sandbox that runs a real Linux userland by emulating Linux syscalls directly (no guest kernel, no device emulation)."

# `cdylib` is what `wasm-pack`/wasm-bindgen needs to emit a loadable .wasm for
# the browser demo (src/wasm.rs); `rlib` keeps normal `cargo build`/`cargo test`
# and the `nixvm` bin working exactly as before.
[lib]
crate-type = ["cdylib", "rlib"]

# The binary. Kept out of a default library build via `required-features` so the
# embeddable library never has to pull CLI deps.
[[bin]]
name = "nixvm"
path = "src/bin/nixvm.rs"
required-features = ["cli"]

[features]
default = ["cli"]
# CLI-only deps (clap, tracing-subscriber, …) get added here in a later phase.
cli = []
# Hardware virtualization backends. Both are compiled by target cfg, not these
# features — they link no extra crates (hand-rolled FFI) and `vcpu::select`
# probes them at runtime, falling back to the interpreter when unavailable
# (HVF: unentitled binary; KVM: no /dev/kvm). Features kept as reserved
# placeholders.
hvf = []    # Hypervisor.framework, macOS/arm64
kvm = []    # KVM, Linux/x86-64 (x86-64 guests); arm64 KVM is Phase 10
# Software CPU interpreter — the no-acceleration fallback (Phase 10).
interp = []
# Real on-disk filesystem images (ext2/3/4) via our `fstool` crate, for the
# read-only guest root. Off by default so the core stays dependency-free and
# wasm-buildable; only mounting a real image needs it.
fstool = ["dep:fstool"]
# In-process gzip decompression of a `.tar.gz` root image, via the `compcol`
# compression collection (the same one `fstool` uses). Lets the browser demo
# decompress the Alpine minirootfs itself instead of relying on the browser's
# `DecompressionStream` — so it works in any wasm-capable browser and keeps the
# decompression path in Rust. Pure computation; builds for wasm32.
targz = ["dep:compcol"]
# Browser demo entry point (src/wasm.rs): exposes an interactive `Terminal` and
# `run_elf` via wasm-bindgen. Pulls in wasm-bindgen + console_error_panic_hook,
# `targz` to unpack a `.tar.gz` root image in-process, and `fstool` to repack it
# into an in-memory squashfs (read-only lower of a copy-on-write overlay).
wasm = ["dep:wasm-bindgen", "dep:console_error_panic_hook", "targz", "fstool"]
# HTTP(S) fetching of guest root images (src/image.rs). Off by default so the
# core stays dependency-free and wasm-buildable; sha256 verification is
# hand-rolled in image.rs so it needs no extra dep either way.
fetch = ["dep:ureq"]

[dependencies]
# The core builds fully offline with no third-party deps. `fstool` is the first
# optional dependency, gated behind its feature; per-phase additions arrive
# gated by the features above (object, kvm-ioctls, sha2, a fetch stack, …).
# `gzip` lets us repack an Alpine .tar.gz minirootfs into an ext4 root image.
fstool = { version = "0.4.20", optional = true, default-features = false, features = [
    "gzip",
] }
# Blocking HTTP(S) client for downloading guest root images, gated behind the
# `fetch` feature (see src/image.rs). Not linked into the default build.
ureq = { version = "2", optional = true }
# Compression collection (gzip decoder), gated behind `targz`. `std` + `gzip`
# only — a pure-Rust inflate that builds for wasm32. Same crate `fstool` uses.
compcol = { version = "0.6", optional = true, default-features = false, features = [
    "std",
    "gzip",
] }

[target.'cfg(target_arch = "wasm32")'.dependencies]
# Only pulled in on wasm32, and only linked when the `wasm` feature is on
# (both deps are `optional = true` so the `wasm` feature can gate them).
wasm-bindgen = { version = "0.2", optional = true }
console_error_panic_hook = { version = "0.1", optional = true }

[lints.rust]
unsafe_op_in_unsafe_fn = "deny"
missing_debug_implementations = "warn"

[lints.clippy]
all = { level = "warn", priority = -1 }
pedantic = { level = "warn", priority = -1 }
missing_errors_doc = "allow"
missing_panics_doc = "allow"
module_name_repetitions = "allow"
# Docs are dense with spec acronyms (PT_LOAD, ELF, RWX, EL0, SVC, TPIDR …);
# don't force backticks around every one.
doc_markdown = "allow"
# ABI field names mirror the Linux/kernel spec deliberately (st_mode, e_phoff …).
similar_names = "allow"
# Syscall/ABI code intentionally does register-width casts (guest u64 registers
# <-> i32 args, `-errno`, truncation to the guest word). These lints fight that.
cast_possible_truncation = "allow"
cast_sign_loss = "allow"
cast_possible_wrap = "allow"
# Instruction decode legitimately tests fixed opcode fields as `x & mask == n`.
verbose_bit_mask = "allow"
# Binary opcode literals (0b000101 …) read best without digit separators.
unreadable_literal = "allow"

[profile.release]
lto = "thin"
codegen-units = 1
panic = "abort"