weft-microvm-init

pod-init-build packs a pod-mode initramfs cpio.gz containing /init (weft-init), /bin/crun, and optionally /bin/cfs-client + /bin/weft-microvm-agent.

weft-init is the PID-1 binary that boots inside an openweft micro-VM.

Package bundler turns a pod.Container into an OCI runtime bundle on disk — the directory + config.json the OCI runtime (runc/crun) consumes.

Package cubefs mounts a CubeFS volume inside the guest by driving the CubeFS FUSE client (cfs-client) — CubeFS being the platform's RWX share backend (a CNCF distributed POSIX + S3 filesystem, since it replaced the SFTP server).

firewall_linux.go is the kernel-touching reconciler that converges a nftables table named "weft-fw" to a [pod.Firewall] desired state.

Package pod defines the in-VM PodSpec — what the guest init is told to run.

Package runtime is the abstraction over the OCI runtime binary (crun, runc, youki) that weft-init exec's to create containers.

Package crun implements runtime.Runtime by exec'ing the `crun` binary.

Package supervisor owns the two PID-1 responsibilities of weft-init: (1) reaping every orphaned child the kernel reparents to us, and (2) supervising the user-declared containers — start, watch, restart per policy, stop cleanly.

Package transport opens the guest↔host channel weft-init uses to stream pod status, container events, log chunks, and to receive control requests (stop, exec, restart) from weft-agent on the hypervisor host.