@multiplayer-app/sandbox 7.0.2 → 7.0.3

package/README.md

@@ -205,6 +205,79 @@ sandbox worker, or otherwise restarts/starts the Compose sandbox service;
 `VM_IMAGES_REFRESH=true` makes that worker replace its cached QEMU/Firecracker
 images from MinIO before advertising its engines.
 
+## Publishing your own AWS Lambda MicroVM images
+
+Unlike the ops commands above, this works from a plain `npm install
+@multiplayer-app/sandbox` — no monorepo checkout needed. It builds the guest
+agent for each stack (`node`/`python`/`static`) and zips it entirely in memory
+(see `src/microvm-guest-agents.ts`), then registers or updates it as an AWS
+Lambda MicroVM image in **your own AWS account**, using whatever credentials
+are already active (`AWS_PROFILE`, static env vars, an assumed role, ...).
+
+```sh
+# Discover a base OS image ARN to build on top of
+npx @multiplayer-app/sandbox images microvm-list-base --region us-east-1
+
+# Build and register/update sandbox-node, sandbox-python, sandbox-static
+npx @multiplayer-app/sandbox images microvm-create \
+  --region us-east-1 \
+  --bucket my-artifacts-bucket \
+  --base-image-arn arn:aws:lambda:us-east-1:aws:microvm-image:al2023-1 \
+  --build-role-arn arn:aws:iam::123456789012:role/microvm-image-build
+```
+
+`--build-role-arn` is an IAM role the build assumes to read the uploaded code
+artifact from `--bucket` — trust policy allowing `lambda.amazonaws.com` to
+assume it, permissions limited to `s3:GetObject` on that bucket. It's a
+one-time setup step this command doesn't automate; see the "MicroVM base image
+build role" section below for the exact `aws iam` commands.
+
+The first run creates each image; every later run updates it in place — AWS
+records that as a new numbered version under the same stable ARN, so nothing
+else needs to change when you publish a new version. The command prints a
+ready-to-paste `MICROVM_STACK_IMAGE_ARNS` line for your worker's environment
+once every image finishes building.
+
+Lambda MicroVMs is ARM/Graviton-only today, so there's no architecture flag —
+run `--help` on either command for the rest of the options (`--stack`,
+`--min-memory-mib`, `--image-name-prefix`).
+
+### MicroVM base image build role
+
+One-time, per AWS account:
+
+```sh
+aws iam create-role --profile my-profile \
+  --role-name microvm-image-build \
+  --assume-role-policy-document '{
+    "Version": "2012-10-17",
+    "Statement": [{
+      "Effect": "Allow",
+      "Principal": { "Service": "lambda.amazonaws.com" },
+      "Action": ["sts:AssumeRole", "sts:TagSession"]
+    }]
+  }'
+
+aws iam put-role-policy --profile my-profile \
+  --role-name microvm-image-build \
+  --policy-name microvm-build-permissions \
+  --policy-document '{
+    "Version": "2012-10-17",
+    "Statement": [
+      {
+        "Effect": "Allow",
+        "Action": "s3:GetObject",
+        "Resource": "arn:aws:s3:::my-artifacts-bucket/microvm-images/*"
+      },
+      {
+        "Effect": "Allow",
+        "Action": ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"],
+        "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda-microvms/sandbox-*:*"
+      }
+    ]
+  }'
+```
+
 If the build already succeeded and only the upload needs retrying, run:
 
 ```sh

package/dist/cli.js

@@ -28,7 +28,7 @@ var import_config5 = require("dotenv/config");
 var import_commander = require("commander");
 
 // package.json
-var version = "7.0.2";
+var version = "7.0.3";
 
 // src/config.ts
 var import_os2 = __toESM(require("os"));
@@ -130,8 +130,8 @@ function s3Key(prefix, arch, stack, file) {
   return [prefix, arch, stack, file].filter(Boolean).join("/");
 }
 async function makeS3Client(endpoint) {
-  const { S3Client } = await import("@aws-sdk/client-s3");
-  return new S3Client({
+  const { S3Client: S3Client2 } = await import("@aws-sdk/client-s3");
+  return new S3Client2({
     ...endpoint ? {
       endpoint,
       forcePathStyle: true,
@@ -189,7 +189,7 @@ async function pullImages(opts, destDir) {
   return downloaded;
 }
 async function pushImages(opts, srcDir) {
-  const { PutObjectCommand } = await import("@aws-sdk/client-s3");
+  const { PutObjectCommand: PutObjectCommand2 } = await import("@aws-sdk/client-s3");
   const { bucket, prefix } = parseS3Uri(opts.location);
   const client = await makeS3Client(opts.endpoint);
   const uploaded = [];
@@ -205,7 +205,7 @@ async function pushImages(opts, srcDir) {
       }
       const key = s3Key(prefix, opts.arch, stack, file);
       await client.send(
-        new PutObjectCommand({
+        new PutObjectCommand2({
           Bucket: bucket,
           Key: key,
           Body: import_fs.default.readFileSync(src)
@@ -4210,6 +4210,423 @@ async function startSandboxHealthServer(options) {
   return server;
 }
 
+// src/microvm-images.ts
+var import_archiver = require("archiver");
+var import_client_lambda_microvms2 = require("@aws-sdk/client-lambda-microvms");
+var import_client_s3 = require("@aws-sdk/client-s3");
+
+// src/microvm-guest-agents.ts
+var MICROVM_BASE_IMAGE_STACKS = ["node", "python", "static"];
+function isMicrovmBaseImageStack(stack) {
+  return MICROVM_BASE_IMAGE_STACKS.includes(stack);
+}
+var NODE_APP = `const http = require('http')
+const fs = require('fs')
+const { execSync, spawn } = require('child_process')
+
+const HOOK_PREFIX = '/aws/lambda-microvms/runtime/v1/'
+let session = null // set by the /run hook (payload from the worker executor)
+
+// Release deployment: pull the presigned artifact, unzip, then hand :8080 over
+// to the app (it must answer the lifecycle hooks itself from that point on).
+async function startApp(url) {
+  try {
+    const res = await fetch(url)
+    if (!res.ok) throw new Error(\`artifact download failed: HTTP \${res.status}\`)
+    fs.writeFileSync('/tmp/app.zip', Buffer.from(await res.arrayBuffer()))
+    execSync('unzip -o -q /tmp/app.zip -d /workspace')
+    server.close(() => {
+      console.log('starting release app (node app.js)')
+      const child = spawn('node', ['app.js'], { cwd: '/workspace', stdio: 'inherit' })
+      child.on('exit', (code) => process.exit(code ?? 1))
+    })
+  } catch (error) {
+    console.error('release deploy failed, agent keeps serving:', error)
+  }
+}
+
+const server = http.createServer((req, res) => {
+  if (req.url.startsWith(HOOK_PREFIX) && req.method === 'POST') {
+    const hook = req.url.slice(HOOK_PREFIX.length)
+    const chunks = []
+    req.on('data', (c) => chunks.push(c))
+    req.on('end', () => {
+      const body = Buffer.concat(chunks).toString()
+      if (hook === 'run' && body) {
+        try {
+          const parsed = JSON.parse(body)
+          session = parsed.runHookPayload ? JSON.parse(parsed.runHookPayload) : null
+          session = { ...session, microvmId: parsed.microvmId }
+          for (const [key, value] of Object.entries(session?.env ?? {})) {
+            if (typeof value === 'string') process.env[key] = value
+          }
+        } catch { /* payload is optional */ }
+      }
+      // Runtime env may contain a presigned release URL or other secrets; never log the body.
+      console.log(\`lifecycle hook: \${hook}\`)
+      res.writeHead(200, { 'Content-Type': 'application/json' })
+      res.end('{}')
+      if (hook === 'run' && process.env.APP_URL) {
+        setImmediate(() => startApp(process.env.APP_URL))
+      }
+    })
+    return
+  }
+
+  res.writeHead(200, { 'Content-Type': 'application/json' })
+  res.end(JSON.stringify({ status: 'ok', path: req.url, session }))
+})
+
+server.listen(8080, () => {
+  console.log('vm agent listening on 8080')
+  // Fargate/Docker: no lifecycle hook caller, so APP_URL (if set) drives startup directly.
+  if (process.env.APP_URL) setImmediate(() => startApp(process.env.APP_URL))
+})
+`;
+var NODE_DOCKERFILE = `FROM node:24-alpine
+WORKDIR /app
+COPY app.js .
+RUN mkdir -p /workspace
+EXPOSE 8080
+CMD ["node", "app.js"]
+`;
+var PYTHON_APP = `import json
+import os
+import threading
+import urllib.request
+import zipfile
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+HOOK_PREFIX = "/aws/lambda-microvms/runtime/v1/"
+session = None  # set by the /run hook (payload from the worker executor)
+
+
+def start_app(url):
+    """Release deployment: pull the presigned artifact, unzip, then replace this
+    process with the app on :8080 (it must answer lifecycle hooks itself)."""
+    try:
+        urllib.request.urlretrieve(url, "/tmp/app.zip")
+        with zipfile.ZipFile("/tmp/app.zip") as zf:
+            zf.extractall("/workspace")
+        print("starting release app (python app.py)", flush=True)
+        os.chdir("/workspace")
+        os.execvp("python", ["python", "app.py"])
+    except Exception as error:  # noqa: BLE001 \u2014 agent keeps serving on failure
+        print(f"release deploy failed, agent keeps serving: {error}", flush=True)
+
+
+class Handler(BaseHTTPRequestHandler):
+    def _send(self, body):
+        data = body.encode()
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(data)))
+        self.end_headers()
+        self.wfile.write(data)
+
+    def do_POST(self):
+        global session
+        if self.path.startswith(HOOK_PREFIX):
+            hook = self.path[len(HOOK_PREFIX):]
+            length = int(self.headers.get("Content-Length") or 0)
+            body = self.rfile.read(length).decode() if length else ""
+            if hook == "run" and body:
+                try:
+                    parsed = json.loads(body)
+                    payload = parsed.get("runHookPayload")
+                    session = json.loads(payload) if payload else {}
+                    session["microvmId"] = parsed.get("microvmId")
+                    os.environ.update({
+                        key: value for key, value in session.get("env", {}).items()
+                        if isinstance(value, str)
+                    })
+                except (ValueError, TypeError):
+                    pass  # payload is optional
+            # Runtime env may contain a presigned release URL or other secrets.
+            print(f"lifecycle hook: {hook}")
+            self._send("{}")
+            if hook == "run" and os.environ.get("APP_URL"):
+                threading.Timer(0.1, start_app, args=[os.environ["APP_URL"]]).start()
+            return
+        self._send(json.dumps({"status": "ok", "path": self.path, "session": session}))
+
+    def do_GET(self):
+        self._send(json.dumps({"status": "ok", "path": self.path, "session": session}))
+
+    def log_message(self, fmt, *args):
+        pass
+
+
+if __name__ == "__main__":
+    print("vm agent listening on 8080")
+    # Fargate/Docker: no lifecycle hook caller, so APP_URL (if set) drives startup directly.
+    if os.environ.get("APP_URL"):
+        threading.Timer(0.1, start_app, args=[os.environ["APP_URL"]]).start()
+    ThreadingHTTPServer(("", 8080), Handler).serve_forever()
+`;
+var PYTHON_DOCKERFILE = `FROM python:3.12-alpine
+WORKDIR /app
+COPY app.py .
+RUN mkdir -p /workspace
+EXPOSE 8080
+CMD ["python", "app.py"]
+`;
+var STATIC_APP = `const http = require('http')
+const fs = require('fs')
+const path = require('path')
+const { execSync } = require('child_process')
+
+const HOOK_PREFIX = '/aws/lambda-microvms/runtime/v1/'
+const STATIC_ROOT = '/workspace'
+let session = null // set by the /run hook (payload from the worker executor)
+let serving = false // true once a release has been unzipped into STATIC_ROOT
+
+const CONTENT_TYPES = {
+  '.html': 'text/html; charset=utf-8',
+  '.htm': 'text/html; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.js': 'text/javascript; charset=utf-8',
+  '.mjs': 'text/javascript; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.svg': 'image/svg+xml',
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.gif': 'image/gif',
+  '.ico': 'image/x-icon',
+  '.txt': 'text/plain; charset=utf-8',
+  '.wasm': 'application/wasm',
+}
+
+// Release deployment: pull the presigned artifact, unzip it into STATIC_ROOT, and
+// switch the request handler into "serve static files" mode. No process is spawned \u2014
+// unlike the node/python base images, there is no entrypoint to run.
+async function deployRelease(url) {
+  const res = await fetch(url)
+  if (!res.ok) throw new Error(\`artifact download failed: HTTP \${res.status}\`)
+  fs.mkdirSync(STATIC_ROOT, { recursive: true })
+  fs.writeFileSync('/tmp/site.zip', Buffer.from(await res.arrayBuffer()))
+  execSync(\`unzip -o -q /tmp/site.zip -d \${STATIC_ROOT}\`)
+  fs.rmSync('/tmp/site.zip', { force: true })
+  serving = true
+  console.log('serving static release from', STATIC_ROOT)
+}
+
+function serveStatic(req, res) {
+  const urlPath = decodeURIComponent(req.url.split('?')[0])
+  let filePath = path.join(STATIC_ROOT, path.normalize(urlPath).replace(/^(\\.\\.[/\\\\])+/, ''))
+  if (urlPath.endsWith('/') || urlPath === '') filePath = path.join(filePath, 'index.html')
+
+  fs.readFile(filePath, (err, data) => {
+    if (err) {
+      // SPA-style fallback: unknown paths without a file extension serve index.html
+      if (!path.extname(filePath)) {
+        return fs.readFile(path.join(STATIC_ROOT, 'index.html'), (err2, index) => {
+          if (err2) return send404(res)
+          res.writeHead(200, { 'Content-Type': CONTENT_TYPES['.html'] })
+          res.end(index)
+        })
+      }
+      return send404(res)
+    }
+    const ext = path.extname(filePath).toLowerCase()
+    res.writeHead(200, { 'Content-Type': CONTENT_TYPES[ext] ?? 'application/octet-stream' })
+    res.end(data)
+  })
+}
+
+function send404(res) {
+  res.writeHead(404, { 'Content-Type': 'text/plain' })
+  res.end('not found')
+}
+
+const server = http.createServer((req, res) => {
+  if (req.url.startsWith(HOOK_PREFIX) && req.method === 'POST') {
+    const hook = req.url.slice(HOOK_PREFIX.length)
+    const chunks = []
+    req.on('data', (c) => chunks.push(c))
+    req.on('end', () => {
+      const body = Buffer.concat(chunks).toString()
+      if (hook === 'run' && body) {
+        try {
+          const parsed = JSON.parse(body)
+          session = parsed.runHookPayload ? JSON.parse(parsed.runHookPayload) : null
+          session = { ...session, microvmId: parsed.microvmId }
+          for (const [key, value] of Object.entries(session?.env ?? {})) {
+            if (typeof value === 'string') process.env[key] = value
+          }
+        } catch { /* payload is optional */ }
+      }
+      // Runtime env may contain a presigned release URL or other secrets; never log the body.
+      console.log(\`lifecycle hook: \${hook}\`)
+      res.writeHead(200, { 'Content-Type': 'application/json' })
+      res.end('{}')
+      if (hook === 'run' && process.env.APP_URL) {
+        deployRelease(process.env.APP_URL).catch((error) => console.error('release deploy failed:', error))
+      }
+    })
+    return
+  }
+
+  if (serving) return serveStatic(req, res)
+
+  res.writeHead(200, { 'Content-Type': 'application/json' })
+  res.end(JSON.stringify({ status: 'ok', path: req.url, session }))
+})
+
+server.listen(8080, () => {
+  console.log('vm agent listening on 8080')
+  // Fargate/Docker: no lifecycle hook caller, so APP_URL (if set) drives startup directly.
+  if (process.env.APP_URL) deployRelease(process.env.APP_URL).catch((error) => console.error('release deploy failed:', error))
+})
+`;
+var STATIC_DOCKERFILE = `FROM node:24-alpine
+RUN apk add --no-cache unzip
+WORKDIR /app
+COPY app.js .
+RUN mkdir -p /workspace
+EXPOSE 8080
+CMD ["node", "app.js"]
+`;
+function guestAgentFiles(stack) {
+  switch (stack) {
+    case "node":
+      return { "app.js": NODE_APP, Dockerfile: NODE_DOCKERFILE };
+    case "python":
+      return { "app.py": PYTHON_APP, Dockerfile: PYTHON_DOCKERFILE };
+    case "static":
+      return { "app.js": STATIC_APP, Dockerfile: STATIC_DOCKERFILE };
+  }
+}
+
+// src/microvm-images.ts
+var HOOKS = {
+  port: 8080,
+  microvmHooks: { run: "ENABLED", resume: "ENABLED", suspend: "ENABLED", terminate: "ENABLED" },
+  microvmImageHooks: { ready: "ENABLED" }
+};
+async function zipFiles(files) {
+  const archive = new import_archiver.ZipArchive({ zlib: { level: 9 } });
+  const chunks = [];
+  const collected = new Promise((resolve, reject) => {
+    archive.on("data", (chunk) => chunks.push(chunk));
+    archive.on("error", reject);
+    archive.on("end", () => resolve(Buffer.concat(chunks)));
+  });
+  for (const [name, content] of Object.entries(files)) {
+    archive.append(content, { name });
+  }
+  await archive.finalize();
+  return collected;
+}
+async function listAllManagedImages(client) {
+  const images2 = [];
+  let nextToken;
+  do {
+    const page = await client.send(new import_client_lambda_microvms2.ListManagedMicrovmImagesCommand({ nextToken }));
+    images2.push(...page.items ?? []);
+    nextToken = page.nextToken;
+  } while (nextToken);
+  return images2;
+}
+async function listBaseMicrovmImages(options) {
+  const client = new import_client_lambda_microvms2.LambdaMicrovmsClient({ region: options.region });
+  const images2 = await listAllManagedImages(client);
+  return images2.map((image) => image.imageArn).filter((arn) => Boolean(arn));
+}
+async function imageExists(client, imageIdentifier) {
+  try {
+    await client.send(new import_client_lambda_microvms2.GetMicrovmImageCommand({ imageIdentifier }));
+    return true;
+  } catch (error) {
+    if (error instanceof Error && error.name === "ResourceNotFoundException") return false;
+    throw error;
+  }
+}
+async function waitForVersion(client, imageIdentifier, imageVersion, pollIntervalMs, pollTimeoutMs) {
+  const deadline = Date.now() + pollTimeoutMs;
+  for (; ; ) {
+    const version2 = await client.send(
+      new import_client_lambda_microvms2.GetMicrovmImageVersionCommand({ imageIdentifier, imageVersion })
+    );
+    if (version2.state === "SUCCESSFUL") return;
+    if (version2.state === "FAILED") {
+      throw new Error(`${imageIdentifier} version ${imageVersion} failed to build`);
+    }
+    if (Date.now() > deadline) {
+      throw new Error(
+        `timed out waiting for ${imageIdentifier} version ${imageVersion} (still ${version2.state})`
+      );
+    }
+    await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+  }
+}
+async function createMicrovmImages(options) {
+  const {
+    region,
+    bucket,
+    baseImageArn,
+    buildRoleArn,
+    stacks = [...MICROVM_BASE_IMAGE_STACKS],
+    minMemoryMib = 1024,
+    imageNamePrefix = "sandbox",
+    pollIntervalMs = 5e3,
+    pollTimeoutMs = 6e5,
+    onProgress = () => {
+    }
+  } = options;
+  for (const stack of stacks) {
+    if (!isMicrovmBaseImageStack(stack)) {
+      throw new Error(
+        `unsupported stack "${stack}" \u2014 must be one of: ${MICROVM_BASE_IMAGE_STACKS.join(", ")}`
+      );
+    }
+  }
+  const accountId = buildRoleArn.split(":")[4];
+  if (!accountId) throw new Error(`could not parse account ID from buildRoleArn: ${buildRoleArn}`);
+  const cpuArchitecture = "ARM_64";
+  const s3 = new import_client_s3.S3Client({ region });
+  const lambdaMicrovms = new import_client_lambda_microvms2.LambdaMicrovmsClient({ region });
+  const stackArns = {};
+  for (const stack of stacks) {
+    const files = guestAgentFiles(stack);
+    const zip = await zipFiles(files);
+    const key = `microvm-images/${stack}/app.zip`;
+    onProgress(`[${stack}] uploading ${zip.byteLength}-byte artifact -> s3://${bucket}/${key}`);
+    await s3.send(new import_client_s3.PutObjectCommand({ Bucket: bucket, Key: key, Body: zip }));
+    const imageName = `${imageNamePrefix}-${stack}`;
+    const imageArn = `arn:aws:lambda:${region}:${accountId}:microvm-image:${imageName}`;
+    const commonFields = {
+      baseImageArn,
+      buildRoleArn,
+      codeArtifact: { uri: `s3://${bucket}/${key}` },
+      cpuConfigurations: [{ architecture: cpuArchitecture }],
+      resources: [{ minimumMemoryInMiB: minMemoryMib }],
+      description: `sandbox v${version}`,
+      hooks: HOOKS
+    };
+    const exists = await imageExists(lambdaMicrovms, imageArn);
+    onProgress(`[${stack}] ${exists ? "updating" : "creating"} MicroVM image ${imageName}...`);
+    const result = exists ? await lambdaMicrovms.send(
+      new import_client_lambda_microvms2.UpdateMicrovmImageCommand({ imageIdentifier: imageArn, ...commonFields })
+    ) : await lambdaMicrovms.send(
+      new import_client_lambda_microvms2.CreateMicrovmImageCommand({ name: imageName, tags: { stack }, ...commonFields })
+    );
+    onProgress(`[${stack}] waiting for version ${result.imageVersion} to build...`);
+    await waitForVersion(
+      lambdaMicrovms,
+      imageArn,
+      result.imageVersion,
+      pollIntervalMs,
+      pollTimeoutMs
+    );
+    const finalArn = result.imageArn ?? imageArn;
+    onProgress(`[${stack}] ready: ${finalArn} (version ${result.imageVersion})`);
+    stackArns[stack] = finalArn;
+  }
+  return { stackArns };
+}
+
 // src/cli.ts
 process.on("unhandledRejection", (reason) => {
   src_default.error({ err: reason }, "unhandled rejection \u2014 sandbox worker continues running");
@@ -4316,6 +4733,53 @@ images.command("push").description("upload locally built per-stack base images (
     for (const uri of uploaded) console.log(`pushed ${uri}`);
   }
 );
+images.command("microvm-list-base").description("list AWS-managed base OS images available in your account/region (candidates for --base-image-arn)").requiredOption("--region <region>", "AWS region", process.env.AWS_REGION).action(async (opts) => {
+  const arns = await listBaseMicrovmImages({ region: opts.region });
+  console.log(`AWS-managed base images in ${opts.region}:`);
+  for (const arn of arns) console.log(`  ${arn}`);
+});
+images.command("microvm-create").description(
+  "build this package's guest-agent base images (node/python/static) and register/update them as AWS Lambda MicroVM images in your own AWS account (uses ambient AWS credentials \u2014 AWS_PROFILE, env vars, an assumed role, ...)"
+).requiredOption("--region <region>", "AWS region", process.env.AWS_REGION).requiredOption(
+  "--bucket <bucket>",
+  "S3 bucket the built code artifact is uploaded to (must already exist)",
+  process.env.S3_BUCKET_ARTIFACTS
+).requiredOption(
+  "--base-image-arn <arn>",
+  'AWS-managed base OS image ARN \u2014 see "sandbox images microvm-list-base"',
+  process.env.MICROVM_BASE_IMAGE_ARN
+).requiredOption(
+  "--build-role-arn <arn>",
+  "IAM role ARN the build assumes to read the artifact from --bucket (needs s3:GetObject)",
+  process.env.MICROVM_BUILD_ROLE_ARN
+).option(
+  "--stack <stack...>",
+  `stacks to build/register (default: ${MICROVM_BASE_IMAGE_STACKS.join(" ")})`
+).option("--min-memory-mib <mib>", "minimum guest memory, MiB", "1024").option("--image-name-prefix <prefix>", 'MicroVM image name prefix, "<prefix>-<stack>"', "sandbox").action(
+  async (opts) => {
+    for (const stack of opts.stack ?? []) {
+      if (!isMicrovmBaseImageStack(stack)) {
+        throw new Error(
+          `unsupported stack "${stack}" \u2014 must be one of: ${MICROVM_BASE_IMAGE_STACKS.join(", ")}`
+        );
+      }
+    }
+    const { stackArns } = await createMicrovmImages({
+      region: opts.region,
+      bucket: opts.bucket,
+      baseImageArn: opts.baseImageArn,
+      buildRoleArn: opts.buildRoleArn,
+      stacks: opts.stack?.filter(isMicrovmBaseImageStack),
+      minMemoryMib: Number(opts.minMemoryMib),
+      imageNamePrefix: opts.imageNamePrefix,
+      onProgress: (message) => console.log(message)
+    });
+    console.log("\nSet this in your worker environment:");
+    console.log(
+      `MICROVM_STACK_IMAGE_ARNS=${Object.entries(stackArns).map(([stack, arn]) => `${stack}:${arn}`).join(",")}`
+    );
+  }
+);
 program.parseAsync().catch((error) => {
   console.error(`Error: ${error.message}`);
   process.exit(1);