Cargo.toml

[workspace]
resolver = "2"
members = [
    "vk-core",
    "vk-driver",
    "vk-agent",
    "vk-fs",
    "vk-registry",
    "vk-runnerctl",
    "vk-selfupdate",
    "bench",
]
# third_party/libkrun is upstream libkrun's own cargo workspace, vendored and locally
# patched (see third_party/libkrun/VENDOR.md). vk-driver will depend on its `libkrun`
# crate by path; excluding it here keeps the two workspaces from merging.
#
# third_party/imago is a single vendored leaf crate (see third_party/imago/VENDOR.md), a
# dependency of third_party/libkrun's block device — excluded for the same reason.
exclude = ["third_party/libkrun", "third_party/imago", "third_party/ipstack"]

[workspace.package]
version = "0.79.1"
edition = "2024"
authors = [
    "Vincent Vanackere <vincent.vanackere@gmail.com>",
    "Vincent Vanackere <vvanackere@wallix.com>",
    "WALLIX",
]
license = "Apache-2.0"

# Fast local builds: keep file:line backtraces for workspace crates, but omit the
# variable/type debuginfo that slows code generation and linking. Dependencies need no
# debuginfo in the normal edit loop. Opt into the full-debug profile when debugging.
[profile.dev]
debug = "line-tables-only"

[profile.dev.package."*"]
debug = false

# `inherits` also carries the inherited profile's per-package overrides, so the dev
# profile's `debug = false` for dependencies has to be undone explicitly here —
# otherwise no dependency frame resolves in the one profile meant for debugging.
[profile.debugging]
inherits = "dev"
debug = true

[profile.debugging.package."*"]
debug = true

# Reproducible release builds: strip inside the toolchain (not the host strip).
# Path-independence comes from --remap-path-prefix / -ffile-prefix-map applied at
# build time (see build.sh), since trim-paths is not yet stabilized in this toolchain.
#
# lto + a single codegen unit trade compile time for smaller, faster binaries
# (cross-crate inlining + dead-code elimination); both also make the output more
# deterministic, which the reproducible-build guarantee wants anyway.
[profile.release]
strip = true
lto = "thin"
codegen-units = 1

# Single source of truth for dependency versions. Members reference these with
# `<dep>.workspace = true` and only add the per-crate features they need.
[workspace.dependencies]
anyhow = "1"
# wrap_help wraps help text at the terminal width (adds only `terminal_size`; rustix is
# already in the tree) — `vk run -h` lists 60 options and soft-wrapping them mid-word is
# what makes it unreadable.
clap = { version = "4", features = ["derive", "wrap_help"] }
futures = "0"
libc = "0"
serde = { version = "1", features = ["derive"] }
serde_json = "1"
# compose-subset parsing for `vk run --compose` (maintained serde_yaml fork)
serde_yaml_ng = "0.10"
# read a `docker export` stream and transcode it into a cpio initramfs (cpio.rs)
tar = "0.4"
# pull OCI images straight from a registry (no docker daemon); rustls so the
# binary stays musl-static (no openssl). flate2 gunzips the layer tars.
#
# No tls feature: oci-client's `rustls-tls` would pin reqwest and jsonwebtoken to the
# aws-lc-rs provider, pulling the aws-lc-sys C blob alongside the ring backend russh
# already uses. We wire the backends directly instead — reqwest (rustls + ring) and
# jsonwebtoken (rust_crypto) below — so a single crypto backend is linked. oci-client
# builds its reqwest client from whatever TLS reqwest compiled, so HTTPS still works.
oci-client = { version = "0.17", default-features = false }
flate2 = "1"
# docker-hash: content hashing of a (Dockerfile, stage) for image-tag resolution
sha2 = "0.11"
regex = "1"
# native OCI bundle store (registry.rs): content-defined chunking of runner.ext4 for
# block-level dedup, each chunk zstd-compressed independently. fastcdc is pure Rust;
# zstd vendors its C (gcc/musl-dev are in the build image), so the binary stays
# musl-static.
fastcdc = "5"
zstd = "0.13"
# .ko.xz kernel-module decompression for `vk run --kernel image` (fullvm): pure Rust,
# so it needs no C liblzma and the binary stays musl-static (zstd/gz are covered by the
# crates above).
lzma-rs = "0.3"
# tokio features are member-specific; only the version is pinned here.
tokio = { version = "1" }
toml = "1"
# the `vk-registry` OCI-distribution server: a minimal v2 distribution API over hyper
# (already in the tree via oci-client). Pure Rust, so the binary stays musl-static.
hyper = { version = "1", features = ["server", "http1"] }
hyper-util = { version = "0.1", features = ["tokio"] }
http-body-util = "0.1"
# IMF-fixdate for the registry's WebDAV `Last-Modified`/`getlastmodified`; already in the tree
# via hyper.
httpdate = "1"
bytes = "1"
# direct HTTP client for the transparent-zstd blob push (oci-client can't set a
# per-request Content-Encoding). rustls so the binary stays musl-static (matches
# oci-client); already in the tree via oci-client.
#
# `rustls-no-provider` compiles rustls without a built-in crypto provider (the plain
# `rustls` feature would force aws-lc-rs); main installs the ring provider as the
# process default. json/stream are pulled in by oci-client too, kept here explicitly.
reqwest = { version = "0.13", default-features = false, features = ["rustls-no-provider", "json", "query", "stream"] }
# rustls with the ring provider only (default features would pull aws-lc-rs). Ties
# the whole reqwest/oci-client TLS stack to ring; the provider is installed in main.
rustls = { version = "0.23", default-features = false, features = ["ring", "tls12", "logging", "std"] }
# oci-client declares jsonwebtoken with no crypto backend; force the pure-Rust one
# (its `rustls-tls` path would pick aws-lc-rs). Present for feature unification only.
jsonwebtoken = { version = "10", default-features = false, features = ["rust_crypto"] }
# the `switch` subcommand: a userspace L2 gateway for microVMs. etherparse parses
# and builds ethernet/ARP/IPv4/UDP (checksums); ipstack terminates arbitrary guest
# TCP/UDP for transparent egress through the host's sockets (the gvproxy replacement).
# ipstack names the vendored fork's own pre-release version: a requirement that does not
# spell one out matches no pre-release, and the patch below would be ignored.
etherparse = "0.21"
ipstack = "1.0.2-dev"
listenfd = "1"
log = "0"
rand = "0.10"
# default-features off to use the `ring` backend (consistent with oci-client)
# rather than russh's default aws-lc-rs, while keeping `rsa` so the SSH server can
# accept clients' RSA keys. The rsa crate carries RUSTSEC-2023-0071 (Marvin, no
# fixed release); it is suppressed in .cargo/audit.toml (see that file).
russh = { version = "0.63", default-features = false, features = ["flate2", "ring", "rsa"] }
russh-sftp = "2"
# /run/vk control filesystem (`ctlfs`, vk-agent): pure-Rust FUSE, mounted by
# PID-1 root directly through the mount syscall (no fusermount, no libfuse).
fuser = { version = "0.18", default-features = false }
simplelog = "0"
thiserror = "2"
tokio-serde = { version = "0", features = ["messagepack"] }
tokio-util = { version = "0", features = ["codec"] }
tokio-vsock = "0.7"
# the messagepack codec tokio-serde uses, to assert the on-wire Status layout
rmp-serde = "1"
# musl builds use jemalloc instead of the default musl allocator (same approach as ripgrep)
jemallocator = "0.5"
# vk-registry accounts.rs: an embedded users/sessions/API-keys store, alongside the
# filesystem CAS store. Pure Rust, so the binary stays musl-static — see
# vk-registry/DESIGN.md for why not a bundled sqlite.
redb = "4"
# `vk build` live progress dashboard: a multi-line, in-place-updating overview that is
# robust across terminals and multiplexers (tmux/zellij). Pure Rust (console uses libc
# termios, no C lib), so the musl-static build is unaffected.
indicatif = "0.18"
# display width of a char, for the dashboard's own right-margin break: indicatif lays its
# lines out with the same crate (via console), so counting columns any other way would
# desync the two. Already transitive through indicatif; pure Rust, tables only.
unicode-width = "0.2"
# Use indicatif's transitive ANSI classifier in dashboard layout tests.
console = { version = "0.16", default-features = false, features = ["ansi-parsing"] }

# Our vendored fork of ipstack: the fixes a guest's flows need are still on their way
# upstream. See third_party/ipstack/VENDOR.md.
[patch.crates-io]
ipstack = { path = "third_party/ipstack" }