vmsan 0.1.0 → 0.1.1

package/dist/_chunks/doctor.mjs

@@ -3,7 +3,7 @@ import { l as handleCommandError } from "./errors.mjs";
 import { r as getOutputMode, t as createCommandLogger } from "./logger.mjs";
 import { basename, join } from "node:path";
 import { execSync } from "node:child_process";
-import { accessSync, constants, existsSync, readdirSync, statfsSync } from "node:fs";
+import { accessSync, constants, existsSync, readFileSync, readdirSync, statfsSync } from "node:fs";
 import { consola } from "consola";
 import { defineCommand } from "citty";
 function checkKvm() {
@@ -82,6 +82,67 @@ function checkDefaultInterface() {
 		};
 	}
 }
+function checkTunDevice() {
+	try {
+		accessSync("/dev/net/tun", constants.R_OK | constants.W_OK);
+		return {
+			category: "System",
+			name: "TUN device",
+			status: "pass",
+			detail: "/dev/net/tun"
+		};
+	} catch {
+		return {
+			category: "System",
+			name: "TUN device",
+			status: "fail",
+			detail: "/dev/net/tun not accessible",
+			fix: "Load the tun kernel module: sudo modprobe tun"
+		};
+	}
+}
+function checkJailerFilesystem(jailerBaseDir) {
+	try {
+		const mounts = readFileSync("/proc/mounts", "utf-8");
+		let bestMatch = "";
+		let bestOptions = "";
+		for (const line of mounts.split("\n")) {
+			const parts = line.split(" ");
+			if (parts.length < 4) continue;
+			const mountpoint = parts[1];
+			if ((jailerBaseDir === mountpoint || jailerBaseDir.startsWith(mountpoint.endsWith("/") ? mountpoint : `${mountpoint}/`)) && mountpoint.length > bestMatch.length) {
+				bestMatch = mountpoint;
+				bestOptions = parts[3];
+			}
+		}
+		if (!bestMatch) return {
+			category: "System",
+			name: "Jailer filesystem",
+			status: "pass",
+			detail: "Check skipped"
+		};
+		if (bestOptions.split(",").includes("nodev")) return {
+			category: "System",
+			name: "Jailer filesystem",
+			status: "fail",
+			detail: `${bestMatch} mounted with nodev`,
+			fix: `The jailer needs device nodes to work. Remount without nodev: sudo mount -o remount,dev ${bestMatch}`
+		};
+		return {
+			category: "System",
+			name: "Jailer filesystem",
+			status: "pass",
+			detail: bestMatch
+		};
+	} catch {
+		return {
+			category: "System",
+			name: "Jailer filesystem",
+			status: "pass",
+			detail: "Check skipped"
+		};
+	}
+}
 function checkFirecracker(binDir) {
 	const fcPath = join(binDir, "firecracker");
 	if (!existsSync(fcPath)) return {
@@ -193,8 +254,10 @@ function runDoctorChecks(paths) {
 	const p = paths ?? vmsanPaths();
 	return [
 		checkKvm(),
+		checkTunDevice(),
 		checkDiskSpace(p.baseDir),
 		checkDefaultInterface(),
+		checkJailerFilesystem(p.jailerBaseDir),
 		checkFirecracker(p.binDir),
 		checkJailer(p.binDir),
 		checkAgent(p.agentBin),

package/dist/_chunks/errors.mjs

@@ -154,12 +154,28 @@ var FirecrackerApiError = class extends VmsanError {
 		};
 	}
 };
-const firecrackerApiError = (method, path, httpStatus, body) => new FirecrackerApiError("ERR_FIRECRACKER_API", {
-	method,
-	path,
-	httpStatus,
-	message: `${method} ${path} failed (${httpStatus}): ${body}`
-});
+const firecrackerApiError = (method, path, httpStatus, body) => {
+	const opts = {
+		method,
+		path,
+		httpStatus,
+		message: `${method} ${path} failed (${httpStatus}): ${body}`
+	};
+	if (body.includes("/dev/net/tun") && body.includes("Permission denied")) {
+		opts.why = "Firecracker cannot open /dev/net/tun inside the jailer chroot. This usually means the filesystem where the vmsan data directory resides is mounted with the 'nodev' option.";
+		opts.fix = [
+			"Run 'vmsan doctor' to check for nodev and other issues.",
+			"",
+			"If the filesystem is mounted with 'nodev', remount without it:",
+			"  sudo mount -o remount,dev <mountpoint>",
+			"",
+			"Or move vmsan to a different filesystem:",
+			"  export VMSAN_DIR=/var/lib/vmsan",
+			"  curl -fsSL https://vmsan.dev/install | bash"
+		].join("\n");
+	}
+	return new FirecrackerApiError("ERR_FIRECRACKER_API", opts);
+};
 var NetworkError = class extends VmsanError {
 	constructor(code, options) {
 		super(code, options);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vmsan",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Firecracker microVM sandbox toolkit",
   "homepage": "https://github.com/angelorc/vmsan",
   "bugs": "https://github.com/angelorc/vmsan/issues",