vagrant-qemu 0.4.1 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4cd40c0eae22a6a6d4f284004a86de09e0584e8887cc273e9acd4c0fa2f33e69
-  data.tar.gz: 4caaa2706bbb8f221dcc67e5164e7b38879e3cb2d709d8414fc1f0a0ed0de45b
+  metadata.gz: 00ee57a8b6cb0315b36c0084239e92ed69633698845945e6290ba289d71e2889
+  data.tar.gz: 99985f04eabced2eabae1914eacb19f053f13613a4f18d40047ac57440bd4a52
 SHA512:
-  metadata.gz: dd592ca7bf0a75c82b58db4ed8194f8a3e31b44834538ea0fe7ae7124032871422b9b4f2f6b49122964fefc0692f02d1be4a018bae2e4948f3f8aeeb9385eaaf
-  data.tar.gz: 906b02b551b9f3c5082a3967edc33c656f9b642ae0f6bbabcd8bb40b944fa0e2d67f10c5b6b34af3291516c218d0d7657c47d9cf495d1dabceb63fa5acb4ac77
+  metadata.gz: ffc285799ee3f7be527da85b03d539c6f1f6b9278bc474c00b63eef41ea937bd8d5bf17aae125d801d3e1a9404967b1df9f0fa2b3173f3db452ed0fc60a12727
+  data.tar.gz: 43601507f85d2bb8e884e24795cdbb64c4d2d03f3842c1a8feb5cefe437241cdc0bcbbc531da4036540b3e19f6aaf831f9b35cad6c91c29c32da42be5f90abb0

data/CHANGELOG.md

@@ -140,3 +140,32 @@
 * Warn when private_network is configured without `advanced_network`, when the
   network backend needs sudo, and when other unsupported network types are used
 * Add test suite: unit + acceptance + e2e (`rake spec:unit|acceptance|e2e`)
+
+# 0.5.0 (2026-07-11)
+
+* `vagrant package` is now supported: export a running QEMU VM into a
+  distributable libvirt-format box. The box disk is flattened from its qcow2
+  overlay into a standalone qcow2 with `qemu-img convert` (the live VM disk is
+  never modified). A single-disk VM produces `box.img`; a multi-disk VM
+  produces `box_1.img`..`box_N.img` plus a `disks[]` entry in `metadata.json`.
+  `metadata.json` is written with `provider: libvirt` / `format: qcow2` /
+  `virtual_size`, and a minimal default Vagrantfile declaring the box `arch` is
+  bundled. `--output`/`--include`/`--info`/`--vagrantfile` are handled by the
+  core packaging middleware. Environment-specific state — networking, MAC,
+  additional disks, DVDs/cloud-init seed ISOs, and firmware — is intentionally
+  not baked into the box.
+
+# 0.6.0 (2026-07-21)
+
+* `net_mode = :socket_vmnet` adds no-sudo private networking on macOS: the
+  [socket_vmnet](https://github.com/lima-vm/socket_vmnet) daemon holds the root
+  vmnet membership and QEMU connects to it as a normal user, so `vagrant up`
+  and the other lifecycle commands need no sudo. It reuses the advanced-network
+  dual-NIC + cloud-init path — NIC 0 user-mode (SSH + port forwarding), NIC 1
+  on socket_vmnet with the configured static IP — giving host↔VM and VM↔VM
+  connectivity. On QEMU >= 7.2 QEMU connects to the daemon directly
+  (`-netdev stream`); on older QEMU it falls back to the `socket_vmnet_client`
+  wrapper (`-netdev socket,fd=3`), chosen automatically by probing the QEMU
+  binary. New config: `socket_vmnet_socket` and `socket_vmnet_client` (default
+  to the Homebrew prefix). The static IP must fall within the daemon's subnet
+  (`--vmnet-gateway`, default `192.168.105.1/24`); see the README. (#41)

data/README.md

@@ -108,11 +108,13 @@ This provider exposes a few provider-specific configuration options:
   * `graceful_timeout` - Seconds to wait at each `vagrant halt` stage before escalating, default: `60`. Halt sends ACPI `system_powerdown`, waits up to this long, then sends QEMU's `quit` monitor command (a clean shutdown that flushes and closes the disk images), waits again, and finally SIGKILLs QEMU as a last resort — so halt still completes even when the guest was already halted from inside (e.g. `sudo systemctl halt`), where `system_powerdown` is a no-op
 * advanced networking (requires `advanced_network = true`)
   * `advanced_network` - Enable dual-NIC advanced networking with `private_network` support, default: `false`
-  * `net_mode` - Network backend: `:auto` (detect by platform), `:vmnet_shared`, `:vmnet_host`, `:vmnet_bridged` (macOS), `:tap` (Linux), `:socket` (QEMU `socket` netdev — multicast or point-to-point, see `socket_opts`), default: `:auto`
+  * `net_mode` - Network backend: `:auto` (detect by platform), `:vmnet_shared`, `:vmnet_host`, `:vmnet_bridged` (macOS, sudo), `:socket_vmnet` (macOS, no sudo — via the socket_vmnet daemon), `:tap` (Linux), `:socket` (QEMU `socket` netdev — multicast or point-to-point, see `socket_opts`), default: `:auto`
   * `vmnet_interface` - Physical interface for vmnet-bridged mode, default: `en0`
   * `tap_device` - TAP device name for Linux tap backend, default: `nil` (uses `tap0`)
   * `mcast_addr` - Convenience shortcut for the `:socket` backend's multicast address, default: `nil` (uses `230.0.0.1:1234`)
   * `socket_opts` - Raw options for the `:socket` netdev, emitted verbatim as `-netdev socket,id=netN,<socket_opts>`. You pick the mode: `"mcast=230.0.0.1:1234"` (multicast, N-way), `"listen=:1234"` / `"connect=127.0.0.1:1234"` (point-to-point; you decide which VM listens and which connects — the no-root, macOS-friendly path). Overrides `mcast_addr`. Default: `nil` (falls back to multicast)
+  * `socket_vmnet_socket` - Path to the socket_vmnet daemon's unix socket, used by the `:socket_vmnet` backend, default: `<homebrew-prefix>/var/run/socket_vmnet` (`HOMEBREW_PREFIX` env, else `/opt/homebrew` on Apple Silicon, `/usr/local` on Intel)
+  * `socket_vmnet_client` - Path to the `socket_vmnet_client` wrapper, used only on QEMU older than 7.2 (which lacks the native `stream` netdev), default: `<homebrew-prefix>/opt/socket_vmnet/bin/socket_vmnet_client`
 
 ### Usage
 
@@ -320,7 +322,7 @@ See the [QEMU Documentation](https://www.qemu.org/docs/master/devel/multiple-iot
 
 12. Advanced networking with private_network
 
-Pick a backend with `net_mode`: QEMU's native vmnet.framework on macOS (requires sudo), TAP on Linux, or the `socket` netdev. The `:socket` backend is a thin wrapper around QEMU's `socket` netdev — you choose the mode in `socket_opts`: `mcast=` (multicast, N-way, Linux/Windows) or `listen=`/`connect=` (point-to-point, no root, works on macOS). The plugin creates two NICs: NIC 0 (user-mode for SSH and port forwarding) and NIC 1 (platform backend for VM networking). The static IP is delivered via a cloud-init NoCloud seed ISO that the plugin builds and attaches automatically; the NICs are matched by MAC address, never by interface order.
+Pick a backend with `net_mode`: QEMU's native vmnet.framework on macOS (`:vmnet_shared`/`_host`/`_bridged`, requires sudo), `:socket_vmnet` on macOS (full host↔VM and VM↔VM **without** sudo, via the [socket_vmnet](https://github.com/lima-vm/socket_vmnet) daemon), TAP on Linux, or the `socket` netdev. The `:socket` backend is a thin wrapper around QEMU's `socket` netdev — you choose the mode in `socket_opts`: `mcast=` (multicast, N-way, Linux/Windows) or `listen=`/`connect=` (point-to-point, no root, works on macOS). The plugin creates two NICs: NIC 0 (user-mode for SSH and port forwarding) and NIC 1 (platform backend for VM networking). The static IP is delivered via a cloud-init NoCloud seed ISO that the plugin builds and attaches automatically; the NICs are matched by MAC address, never by interface order.
 
 For VM-to-VM networking on macOS without sudo, use `:socket` with a `listen`/`connect` pair — you decide which VM listens and which connects:
 
@@ -366,6 +368,38 @@ Vagrant.configure("2") do |config|
 end
 ```
 
+Full networking on macOS **without sudo** with `:socket_vmnet` (host↔VM and VM↔VM, static IP):
+
+```ruby
+Vagrant.configure("2") do |config|
+  config.vm.box = "perk/ubuntu-2204-arm64"  # an aarch64 cloud-init box
+  config.vm.network "private_network", ip: "192.168.105.10"
+
+  config.vm.provider "qemu" do |qe|
+    qe.advanced_network = true
+    qe.net_mode = :socket_vmnet
+    # qe.socket_vmnet_socket = "/opt/homebrew/var/run/socket_vmnet"  # default (Homebrew prefix)
+  end
+end
+```
+
+Set up the daemon once (root, one-time), then run `vagrant up` as your normal user:
+
+```sh
+brew install socket_vmnet
+# Reserve a static-IP range so cloud-init IPs don't collide with the DHCP pool:
+sudo brew services start socket_vmnet   # or run it with explicit flags, e.g.:
+# sudo socket_vmnet --vmnet-gateway=192.168.105.1 --vmnet-dhcp-end=192.168.105.100 \
+#     /opt/homebrew/var/run/socket_vmnet
+```
+
+The `private_network` IP must sit inside the daemon's subnet (`--vmnet-gateway`, default
+`192.168.105.1/24`) and, to avoid a DHCP clash, above `--vmnet-dhcp-end`. Unlike the native vmnet
+backends, `:socket_vmnet` cannot tell the daemon which subnet to use — the daemon's launch flags are
+authoritative, so align the IP to them. On QEMU ≥ 7.2 the plugin connects to the daemon directly
+(`-netdev stream`); on older QEMU it automatically falls back to the `socket_vmnet_client` wrapper
+(configurable via `qe.socket_vmnet_client`).
+
 Notes:
 * The guest image must include cloud-init, otherwise the static IP is silently not applied
 * On macOS, vmnet requires root: run `sudo vagrant up` (and the other lifecycle commands such as `halt`/`reload`/`destroy`), because the plugin launches QEMU as a child of the Vagrant process and does not elevate it on its own. The plugin warns when vmnet is selected and Vagrant is not running as root.
@@ -374,7 +408,7 @@ Notes:
   sudo chown -R "$(id -un)":staff ~/.vagrant.d/boxes/<box> .vagrant
   ```
   Pre-adding boxes as your normal user (`vagrant box add <box>`) before the first `sudo vagrant up` also avoids the box ending up root-owned.
-* To avoid root (and this side effect) entirely on macOS, use [`socket_vmnet`](https://github.com/lima-vm/socket_vmnet) — a small root helper daemon you install once, which QEMU then connects to as a normal user (the approach Lima/Colima/minikube take). The `com.apple.developer.networking.vmnet` entitlement could also bypass root in principle, but it is a *restricted* Apple entitlement that requires an Apple-provisioned signing certificate and cannot be ad-hoc / self-signed onto Homebrew's QEMU, so it is not a practical option for individual users.
+* To avoid root (and this side effect) entirely on macOS, use `net_mode = :socket_vmnet` (see the example above): the [`socket_vmnet`](https://github.com/lima-vm/socket_vmnet) daemon holds the root vmnet membership and QEMU connects to it as a normal user (the approach Lima/Colima/minikube take), so `vagrant up` and the other lifecycle commands need no sudo. The `com.apple.developer.networking.vmnet` entitlement could also bypass root in principle, but it is a *restricted* Apple entitlement that requires an Apple-provisioned signing certificate and cannot be ad-hoc / self-signed onto Homebrew's QEMU, so it is not a practical option for individual users.
 * Without `advanced_network = true`, the `private_network` configuration is ignored with a warning
 * When only one NIC is needed (no `private_network`), no cloud-init seed is attached, avoiding compatibility issues
 * Combining `advanced_network` with `config.vm.cloud_init` is supported: the plugin merges your user-data and the generated network-config into a single NoCloud seed
@@ -387,7 +421,8 @@ Platform support:
 
 | Platform | Backend (`net_mode`) | Host ↔ VM | VM ↔ VM | Root? | External dependency |
 |----------|---------|:---------:|:-------:|:-----:|:-------------------:|
-| macOS    | `:vmnet_shared`/`_host`/`_bridged` | Yes | Yes | sudo (or socket_vmnet) | None (QEMU >= 7.0) |
+| macOS    | `:vmnet_shared`/`_host`/`_bridged` | Yes | Yes | sudo | None (QEMU >= 7.0) |
+| macOS    | `:socket_vmnet` | Yes | Yes | No | socket_vmnet daemon (`brew install socket_vmnet`) |
 | macOS    | `:socket` (`listen`/`connect`) | No (use port forwarding) | Yes (2 VMs) | No | None |
 | Linux    | `:tap` + bridge | Yes | Yes | sudo | Pre-created tap device + bridge (`ip` command) |
 | Linux    | `:socket` (`mcast`) | No (use port forwarding) | Yes | No | None |

data/lib/vagrant-qemu/action/export.rb

@@ -0,0 +1,74 @@
+require "json"
+require "open3"
+require "pathname"
+require "log4r"
+
+module VagrantPlugins
+  module QEMU
+    module Action
+      # Produces the box's disk artifacts and metadata.json in export.temp_dir:
+      # flattens each box-disk overlay into a standalone qcow2 and describes them
+      # in a libvirt-format metadata.json. Only the VM's box disks are packaged;
+      # additional disks, DVDs and cloud-init seed ISOs are left out.
+      class Export
+        def initialize(app, env)
+          @app    = app
+          @logger = Log4r::Logger.new("vagrant_qemu::action::export")
+        end
+
+        def call(env)
+          @env = env
+
+          if env[:machine].state.id != :stopped
+            raise Vagrant::Errors::VMPowerOffToPackage
+          end
+
+          export
+          @app.call(env)
+        end
+
+        def export
+          driver   = @env[:machine].provider.driver
+          temp_dir = Pathname.new(@env["export.temp_dir"])
+          disks    = driver.box_disk_paths
+
+          if disks.empty?
+            raise Errors::BoxInvalid, name: @env[:machine].name, err: "No box disk found to package"
+          end
+
+          multi     = disks.size > 1
+          disk_meta = []
+          disks.each_with_index do |src, i|
+            name = multi ? "box_#{i + 1}.img" : "box.img"
+            @env[:ui].info(I18n.t("vagrant_qemu.packaging_disk", name: name))
+            driver.convert_box_disk(src, temp_dir.join(name))
+            disk_meta << { "path" => name }
+          end
+
+          write_metadata(temp_dir, disk_meta, multi)
+        end
+
+        # libvirt box metadata: provider must be "libvirt" (the provider's
+        # box_format) or the packaged box won't match on `box add`.
+        def write_metadata(temp_dir, disk_meta, multi)
+          metadata = {
+            "provider"     => "libvirt",
+            "format"       => "qcow2",
+            "virtual_size" => virtual_size_gb(temp_dir.join(disk_meta.first["path"])),
+          }
+          metadata["disks"] = disk_meta if multi
+          File.write(temp_dir.join("metadata.json"), JSON.pretty_generate(metadata))
+        end
+
+        def virtual_size_gb(img)
+          stdout, stderr, status = Open3.capture3("qemu-img", "info", "--output=json", img.to_s)
+          if !status.success?
+            raise Errors::ExecuteError, command: "qemu-img info", stderr: stderr, stdout: stdout
+          end
+          bytes = JSON.parse(stdout)["virtual-size"]
+          (bytes.to_f / (1024**3)).ceil
+        end
+      end
+    end
+  end
+end

data/lib/vagrant-qemu/action/package_vagrantfile.rb

@@ -0,0 +1,37 @@
+require "pathname"
+
+module VagrantPlugins
+  module QEMU
+    module Action
+      # Writes a minimal default Vagrantfile into the box declaring only the
+      # architecture, so a consumer on a different host arch doesn't default to
+      # the wrong one. Networking, MAC and host-specific machine flags are left
+      # out on purpose — they are environment-specific and come from the
+      # consuming Vagrantfile. The core Package middleware appends the SSH
+      # private-key config to this same file afterwards.
+      class PackageVagrantfile
+        def initialize(app, env)
+          @app = app
+        end
+
+        def call(env)
+          @env = env
+          create_vagrantfile
+          @app.call(env)
+        end
+
+        def create_vagrantfile
+          arch = @env[:machine].provider_config.arch
+          path = Pathname.new(@env["export.temp_dir"]).join("Vagrantfile")
+          File.write(path, <<~VF)
+            Vagrant.configure("2") do |config|
+              config.vm.provider :qemu do |qe|
+                qe.arch = "#{arch}"
+              end
+            end
+          VF
+        end
+      end
+    end
+  end
+end

data/lib/vagrant-qemu/action/start_instance.rb

@@ -42,6 +42,8 @@ module VagrantPlugins
             :tap_device => config.tap_device,
             :mcast_addr => config.mcast_addr,
             :socket_opts => config.socket_opts,
+            :socket_vmnet_socket => config.socket_vmnet_socket,
+            :socket_vmnet_client => config.socket_vmnet_client,
           }
 
           # Pick up SSH port that may have been corrected by HandleForwardedPortCollisions

data/lib/vagrant-qemu/action.rb

@@ -9,8 +9,21 @@ module VagrantPlugins
       include Vagrant::Action::Builtin
 
       def self.action_package
-        lambda do |env|
-          raise Errors::NotSupportedError
+        Vagrant::Action::Builder.new.tap do |b|
+          b.use ConfigValidate
+          b.use Call, IsState, :not_created do |env, b2|
+            if env[:result]
+              b2.use MessageNotCreated
+              next
+            end
+
+            b2.use Vagrant::Action::General::PackageSetupFolders
+            b2.use Vagrant::Action::General::PackageSetupFiles
+            b2.use StopInstance
+            b2.use Vagrant::Action::General::Package
+            b2.use Export
+            b2.use PackageVagrantfile
+          end
         end
       end
 
@@ -173,6 +186,8 @@ module VagrantPlugins
       autoload :Import, action_root.join("import")
       autoload :StartInstance, action_root.join("start_instance")
       autoload :StopInstance, action_root.join("stop_instance")
+      autoload :Export, action_root.join("export")
+      autoload :PackageVagrantfile, action_root.join("package_vagrantfile")
       autoload :Destroy, action_root.join("destroy")
       autoload :CloudInitNetwork, action_root.join("cloud_init_network")
       autoload :TimedProvision, action_root.join("timed_provision") # some plugins now expect this action to exist

data/lib/vagrant-qemu/config.rb

@@ -29,7 +29,7 @@ module VagrantPlugins
       attr_accessor :graceful_timeout  # seconds to wait for guest shutdown before force kill
       # Advanced networking options
       attr_accessor :advanced_network   # bool, opt-in for dual-NIC setup
-      attr_accessor :net_mode           # :auto, :vmnet_shared, :vmnet_host, :vmnet_bridged, :tap, :socket
+      attr_accessor :net_mode           # :auto, :vmnet_shared, :vmnet_host, :vmnet_bridged, :tap, :socket, :socket_vmnet
       attr_accessor :vmnet_interface    # physical interface for vmnet-bridged (e.g. "en0")
       attr_accessor :tap_device         # tap device name for Linux tap backend
       attr_accessor :mcast_addr         # convenience shortcut for the :socket backend's multicast address
@@ -39,6 +39,10 @@ module VagrantPlugins
       # The mode (multicast vs point-to-point listen/connect) and any roles are
       # entirely the user's choice. Overrides mcast_addr when set.
       attr_accessor :socket_opts
+      # socket_vmnet backend (macOS): the daemon's unix socket, and the client
+      # wrapper used only on QEMU without the native `stream` netdev.
+      attr_accessor :socket_vmnet_socket
+      attr_accessor :socket_vmnet_client
 
       def initialize
         @ssh_host = UNSET_VALUE
@@ -71,6 +75,8 @@ module VagrantPlugins
         @tap_device = UNSET_VALUE
         @mcast_addr = UNSET_VALUE
         @socket_opts = UNSET_VALUE
+        @socket_vmnet_socket = UNSET_VALUE
+        @socket_vmnet_client = UNSET_VALUE
       end
 
       #-------------------------------------------------------------------
@@ -123,6 +129,8 @@ module VagrantPlugins
         @tap_device = nil if @tap_device == UNSET_VALUE
         @mcast_addr = nil if @mcast_addr == UNSET_VALUE
         @socket_opts = nil if @socket_opts == UNSET_VALUE
+        @socket_vmnet_socket = "#{homebrew_prefix}/var/run/socket_vmnet" if @socket_vmnet_socket == UNSET_VALUE
+        @socket_vmnet_client = "#{homebrew_prefix}/opt/socket_vmnet/bin/socket_vmnet_client" if @socket_vmnet_client == UNSET_VALUE
 
         # TODO better error msg
         @ssh_port = Integer(@ssh_port)
@@ -152,6 +160,14 @@ module VagrantPlugins
         end
       end
 
+      # Homebrew install prefix: env override, else the per-arch default
+      # (Apple Silicon vs Intel). Defaults to the host arch (socket_vmnet paths
+      # are host-side); default_qemu_dir passes the guest arch to keep its
+      # firmware-dir behavior.
+      def homebrew_prefix(arch = host_arch)
+        ENV["HOMEBREW_PREFIX"] || (arch == "aarch64" ? "/opt/homebrew" : "/usr/local")
+      end
+
       # QEMU data dir (firmware images). Only actually consumed for aarch64
       # firmware, but resolved generically: explicit env override, then the
       # Homebrew prefix, then a per-platform default.
@@ -161,7 +177,7 @@ module VagrantPlugins
 
         case RbConfig::CONFIG["host_os"]
         when /darwin/
-          arch == "aarch64" ? "/opt/homebrew/share/qemu" : "/usr/local/share/qemu"
+          "#{homebrew_prefix(arch)}/share/qemu"
         else
           "/usr/share/qemu"
         end

data/lib/vagrant-qemu/driver.rb

@@ -114,6 +114,7 @@ module VagrantPlugins
           cmd += %W(-m #{options[:memory]}) if !options[:memory].nil?
 
           # network
+          launch_prefix = []
           if !options[:net_device].nil?
             private_networks = options[:private_networks] || []
             use_advanced = options[:advanced_network] && !private_networks.empty?
@@ -139,8 +140,12 @@ module VagrantPlugins
               # (the static-IP cloud-init seed is built and attached by the
               # CloudInitNetwork action, not here)
               backend = Network.backend_for(options[:net_mode])
+              backend.preflight!(options, qemu_binary)
               cmd += %W(-device #{options[:net_device]},netdev=net1,mac=#{mac1})
               cmd += backend.build_netdev_args("net1", options)
+              # launch_prefix is applied under the same gate as build_netdev_args
+              # (empty for every backend except socket_vmnet's wrapper route).
+              launch_prefix = backend.launch_prefix(options)
             else
               # Single NIC: user-mode only (original behavior, no cloud-init)
               cmd += %W(-device #{options[:net_device]},netdev=net0)
@@ -206,6 +211,10 @@ module VagrantPlugins
           # user-defined
           cmd += options[:extra_qemu_args]
 
+          # socket_vmnet wrapper route: launch qemu under socket_vmnet_client
+          # (empty prefix otherwise -> zero difference from the current path).
+          cmd = launch_prefix + cmd
+
           opts = {:detach => options[:no_daemonize]}
           execute(*cmd, **opts)
         end
@@ -474,6 +483,25 @@ module VagrantPlugins
       def disk_dir
           @data_dir.join(@vm_id)
       end
+
+      # Ordered paths of the box's disk overlays, reconstructed by index to
+      # match start/import (glob only counts; names rebuild by index so a
+      # two-digit suffix can't sort ahead of a single digit).
+      def box_disk_paths
+        id_dir = disk_dir
+        count = id_dir.glob("linked-box*.img").count
+        (0...count).map do |i|
+          suffix = i > 0 ? "-#{i}" : ""
+          id_dir.join("linked-box#{suffix}.img")
+        end
+      end
+
+      # Flatten a box disk overlay into a standalone qcow2 at dst. convert reads
+      # the whole backing chain and writes a fresh file, so the source overlay
+      # (the live VM disk) is never modified.
+      def convert_box_disk(src, dst)
+        execute("qemu-img", "convert", "-O", "qcow2", src.to_s, dst.to_s)
+      end
     end
   end
 end

data/lib/vagrant-qemu/errors.rb

@@ -38,6 +38,18 @@ module VagrantPlugins
       class DestroyError < VagrantQEMUError
         error_key(:destroy_error)
       end
+
+      class SocketVmnetNotMacos < VagrantQEMUError
+        error_key(:socket_vmnet_not_macos)
+      end
+
+      class SocketVmnetSocketNotFound < VagrantQEMUError
+        error_key(:socket_vmnet_socket_not_found)
+      end
+
+      class SocketVmnetClientNotFound < VagrantQEMUError
+        error_key(:socket_vmnet_client_not_found)
+      end
     end
   end
 end

data/lib/vagrant-qemu/network/base.rb

@@ -15,6 +15,23 @@ module VagrantPlugins
         def requires_sudo?
           false
         end
+
+        # Tokens to prepend to the QEMU launch command (a wrapper program).
+        # Empty by default; only socket_vmnet's wrapper route is non-empty.
+        # The driver applies this under the same gate as build_netdev_args.
+        # @param options [Hash] provider config options
+        # @return [Array<String>]
+        def launch_prefix(options)
+          []
+        end
+
+        # Validate preconditions and resolve any backend-specific options
+        # before the command is built. No-op by default; the driver calls it
+        # under the same gate as build_netdev_args.
+        # @param options [Hash] provider config options (may be mutated)
+        # @param qemu_binary [String] the resolved qemu-system-* binary
+        def preflight!(options, qemu_binary)
+        end
       end
     end
   end

data/lib/vagrant-qemu/network/socket_vmnet.rb

@@ -0,0 +1,60 @@
+require_relative "base"
+require_relative "../errors"
+
+module VagrantPlugins
+  module QEMU
+    module Network
+      # socket_vmnet backend (macOS) -- connects the private NIC to a
+      # socket_vmnet daemon so QEMU runs without sudo (the daemon holds the
+      # root vmnet.framework membership).
+      #
+      # Two routes, chosen by whether the QEMU binary has the native `stream`
+      # netdev (options[:use_stream], set by the driver from a probe):
+      #   stream (QEMU >= 7.2): QEMU connects to the daemon's unix socket
+      #     directly -- a pure netdev backend, no launch wrapper.
+      #   wrapper (older QEMU): QEMU is launched under `socket_vmnet_client
+      #     <sock>`, which hands the connection in on fd 3.
+      #
+      # build_netdev_args and launch_prefix are driven by the same use_stream
+      # so they never disagree.
+      class SocketVmnet < Base
+        # Resolve the route and fail fast on missing preconditions. Sets
+        # options[:use_stream]: true when the qemu binary has the native
+        # `stream` netdev, false when it definitively lacks it, and true when
+        # the probe couldn't determine (rare) -- stream needs no extra dependency.
+        def preflight!(options, qemu_binary)
+          raise Errors::SocketVmnetNotMacos unless RbConfig::CONFIG["host_os"] =~ /darwin/
+
+          options[:use_stream] = Network.qemu_supports_stream?(qemu_binary) != false
+
+          socket = options[:socket_vmnet_socket]
+          unless socket && File.exist?(socket)
+            raise Errors::SocketVmnetSocketNotFound, socket: socket
+          end
+
+          return if options[:use_stream]
+
+          client = options[:socket_vmnet_client]
+          unless client && (::Vagrant::Util::Which.which(client) || File.executable?(client))
+            raise Errors::SocketVmnetClientNotFound, client: client
+          end
+        end
+
+        def build_netdev_args(id, options)
+          if options[:use_stream]
+            sock = options[:socket_vmnet_socket]
+            %W(-netdev stream,id=#{id},server=off,addr.type=unix,addr.path=#{sock})
+          else
+            %W(-netdev socket,id=#{id},fd=3)
+          end
+        end
+
+        def launch_prefix(options)
+          return [] if options[:use_stream]
+
+          %W(#{options[:socket_vmnet_client]} #{options[:socket_vmnet_socket]})
+        end
+      end
+    end
+  end
+end

data/lib/vagrant-qemu/network.rb

@@ -2,6 +2,7 @@ require_relative "network/base"
 require_relative "network/vmnet"
 require_relative "network/tap"
 require_relative "network/socket"
+require_relative "network/socket_vmnet"
 
 module VagrantPlugins
   module QEMU
@@ -9,7 +10,7 @@ module VagrantPlugins
       # Select the appropriate network backend based on net_mode and platform.
       #
       # @param net_mode [Symbol] :auto, :vmnet_shared, :vmnet_host,
-      #   :vmnet_bridged, :tap, :socket
+      #   :vmnet_bridged, :tap, :socket, :socket_vmnet
       # @return [Base] a network backend instance
       def self.backend_for(net_mode)
         case net_mode
@@ -19,6 +20,8 @@ module VagrantPlugins
           Tap.new
         when :socket
           Socket.new
+        when :socket_vmnet
+          SocketVmnet.new
         when :auto
           auto_detect
         else
@@ -39,6 +42,34 @@ module VagrantPlugins
         end
       end
 
+      # Whether the QEMU binary has the native `stream` netdev (QEMU >= 7.2),
+      # so socket_vmnet can connect to the daemon's unix socket directly
+      # instead of going through the socket_vmnet_client wrapper.
+      #
+      # Probes `<qemu> -M none -netdev help` and looks for a `stream` line on
+      # stdout. Cached per binary.
+      #
+      # Tri-state so the driver can honor the design's fallback direction:
+      #   true  -- probe ran, stream present  -> use stream
+      #   false -- probe ran, stream absent    -> use the wrapper (old QEMU)
+      #   nil   -- probe could not run (rare)  -> driver defaults to stream
+      #
+      # @param qemu_binary [String] path/name of the qemu-system-* binary
+      # @return [Boolean, nil]
+      def self.qemu_supports_stream?(qemu_binary)
+        @stream_support ||= {}
+        return @stream_support[qemu_binary] if @stream_support.key?(qemu_binary)
+
+        result =
+          begin
+            out = ::Vagrant::Util::Subprocess.execute(qemu_binary, "-M", "none", "-netdev", "help")
+            out.exit_code == 0 ? out.stdout.lines.any? { |l| l.strip == "stream" } : nil
+          rescue StandardError
+            nil
+          end
+        @stream_support[qemu_binary] = result
+      end
+
       # Generate a deterministic MAC address from vm_id and NIC index.
       # Uses 52:54:00 prefix (QEMU's OUI).
       #

data/lib/vagrant-qemu/version.rb

@@ -1,5 +1,5 @@
 module VagrantPlugins
   module QEMU
-    VERSION = '0.4.1'
+    VERSION = '0.6.0'
   end
 end

data/locales/en.yml

@@ -15,6 +15,8 @@ en:
       Stopping the instance...
     destroying: |-
       Destroying the instance...
+    packaging_disk: |-
+      Exporting box disk: %{name}
     warn_networks: |-
       Warning! The QEMU provider doesn't support any of the Vagrant
       high-level network configurations (`config.vm.network`). They
@@ -82,3 +84,24 @@ en:
 
         The machine ID has been preserved. Fix the underlying issue and
         run `vagrant destroy` again.
+      socket_vmnet_not_macos: |-
+        net_mode = :socket_vmnet is only supported on macOS (it relies on
+        the socket_vmnet daemon and vmnet.framework).
+      socket_vmnet_socket_not_found: |-
+        The socket_vmnet daemon socket was not found:
+
+          %{socket}
+
+        Install and start the daemon first, e.g.:
+          brew install socket_vmnet
+          sudo brew services start socket_vmnet
+
+        Or point qe.socket_vmnet_socket at the daemon's socket path.
+      socket_vmnet_client_not_found: |-
+        This QEMU lacks the native `stream` netdev (QEMU < 7.2), so the
+        socket_vmnet_client wrapper is required but was not found:
+
+          %{client}
+
+        Install socket_vmnet (which ships the client), upgrade QEMU to >= 7.2,
+        or point qe.socket_vmnet_client at the wrapper binary.

data/spec/e2e/helper.rb

@@ -73,6 +73,18 @@ module E2EHelper
     run_vagrant_cmd("status", "--machine-readable", cwd: cwd, timeout: 15)
   end
 
+  def vagrant_package(cwd, output:, timeout: 600)
+    run_vagrant_cmd("package", "--output", output.to_s, cwd: cwd, timeout: timeout)
+  end
+
+  def vagrant_box_add(name, path, cwd:, timeout: 120)
+    run_vagrant_cmd("box", "add", name, path.to_s, "--force", cwd: cwd, timeout: timeout)
+  end
+
+  def vagrant_box_remove(name, cwd:, timeout: 60)
+    run_vagrant_cmd("box", "remove", name, "--force", cwd: cwd, timeout: timeout)
+  end
+
   private
 
   def run_vagrant_cmd(*args, cwd:, timeout: 120)
@@ -118,7 +130,7 @@ RSpec.configure do |config|
   # e2e runs the INSTALLED plugin (see note above) — fail fast when it
   # doesn't match the source tree, instead of silently testing a stale gem.
   config.before(:suite) do
-    next unless ENV["TEST_QEMU"] || ENV["TEST_VMNET"]
+    next unless ENV["TEST_QEMU"] || ENV["TEST_VMNET"] || ENV["TEST_SOCKET_VMNET"]
 
     require "vagrant-qemu/version"
     expected = VagrantPlugins::QEMU::VERSION