hysn-firecracker-python 1.0.5__tar.gz → 1.0.7__tar.gz

{hysn_firecracker_python-1.0.5/hysn_firecracker_python.egg-info → hysn_firecracker_python-1.0.7}/PKG-INFO

@@ -1,8 +1,8 @@
 Metadata-Version: 2.4
 Name: hysn-firecracker-python
-Version: 1.0.5
+Version: 1.0.7
 Summary: A Python client library to interact with Firecracker microVMs
-Author: Muhammad Yuga Nugraha
+Author: PDSO Platform
 License: MIT License
         
         Copyright (c) 2024 Practical DevSecOps

{hysn_firecracker_python-1.0.5 → hysn_firecracker_python-1.0.7}/debian/control

@@ -1,7 +1,7 @@
 Source: firecracker-python
 Section: python
 Priority: optional
-Maintainer: Muhammad Yuga Nugraha <myugan59@gmail.com>
+Maintainer: PDSO Platform
 Standards-Version: 4.6.2
 Build-Depends: debhelper (>= 11), dh-python, python3-all, python3-setuptools, curl, jq
 

{hysn_firecracker_python-1.0.5 → hysn_firecracker_python-1.0.7}/debian/copyright

@@ -1,10 +1,10 @@
 Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
 Upstream-Name: firecracker-python
-Upstream-Contact: Muhammad Yuga Nugraha <myugan59@gmail.com>
+Upstream-Contact: PDSO Platform
 Source: https://github.com/myugan/firecracker-python
 
 Files: *
-Copyright: 2025 Muhammad Yuga Nugraha <myugan59@gmail.com>
+Copyright: 2025 PDSO Platform
 License: MIT
 
 License: MIT

{hysn_firecracker_python-1.0.5 → hysn_firecracker_python-1.0.7}/examples/Dockerfile

@@ -1,5 +1,5 @@
 FROM ubuntu:24.04
-LABEL maintainer="Muhammad Yuga Nugraha"
+LABEL maintainer="PDSO Platform"
 
 COPY id_rsa.pub /root/.ssh/authorized_keys
 COPY init /usr/local/bin/init

{hysn_firecracker_python-1.0.5 → hysn_firecracker_python-1.0.7}/firecracker/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.5'
-__version_tuple__ = version_tuple = (1, 0, 5)
+__version__ = version = '1.0.7'
+__version_tuple__ = version_tuple = (1, 0, 7)
 
-__commit_id__ = commit_id = 'g01bf110fc'
+__commit_id__ = commit_id = 'g3fc03cf51'

{hysn_firecracker_python-1.0.5 → hysn_firecracker_python-1.0.7}/firecracker/microvm.py

@@ -1541,6 +1541,8 @@ class MicroVM:
         container_name = image.split("/")[-1].replace(":", "-")
         tar_file = f"{self._config.data_path}/rootfs_{container_name}.tar"
 
+        container = None
+        merged_dir = None
         try:
             if not image:
                 raise VMMError(f"Failed to download Docker image {image}")
@@ -1549,6 +1551,21 @@ class MicroVM:
                 self._logger.debug(f"Creating container: {container_name}")
 
             container = self._docker.containers.create(image, name=container_name)
+
+            # container.export() makes the daemon mount the container's overlay
+            # rootfs (overlay2/<id>/merged), and container.remove() does not
+            # unmount it. The orphaned mount pins the image layers, so a later
+            # `docker image prune` reclaims 0B and disk fills up over repeated
+            # builds. Capture the merged path now (populated at create time) so
+            # we can unmount it explicitly in the finally block below.
+            try:
+                graph = self._docker.api.inspect_container(
+                    container.id
+                ).get("GraphDriver", {})
+                merged_dir = graph.get("Data", {}).get("MergedDir")
+            except Exception:
+                merged_dir = None
+
             export_data = container.export()
 
             if self._config.verbose:
@@ -1558,8 +1575,6 @@ class MicroVM:
                 for chunk in export_data:
                     f.write(chunk)
 
-            container.remove(force=True)
-
             if self._config.verbose:
                 self._logger.debug(f"Successfully exported container to {tar_file}")
 
@@ -1569,6 +1584,23 @@ class MicroVM:
             raise VMMError(f"Docker error: {e}")
         except Exception as e:
             raise VMMError(f"Unexpected error: {e}")
+        finally:
+            # Remove the container, then ensure its overlay rootfs is unmounted
+            # so the image layers can actually be pruned/reclaimed afterwards.
+            if container is not None:
+                try:
+                    container.remove(force=True)
+                except Exception as e:
+                    if self._config.verbose:
+                        self._logger.debug(
+                            f"Failed to remove container {container_name}: {e}"
+                        )
+            if merged_dir and os.path.ismount(merged_dir):
+                # Plain unmount first; lazy unmount if briefly busy after teardown.
+                if run(f"umount {merged_dir}").returncode != 0:
+                    run(f"umount -l {merged_dir}")
+                if self._config.verbose:
+                    self._logger.debug(f"Unmounted leaked overlay: {merged_dir}")
 
     def _build_rootfs(self, image: str, file: str, size: str, fs_format: str = "ext4"):
         """Create a filesystem image from a tar file.

{hysn_firecracker_python-1.0.5 → hysn_firecracker_python-1.0.7}/firecracker/network.py

@@ -497,6 +497,18 @@ class NetworkManager:
                     has_correct_dnat = False
 
                     for e in expr:
+                        # Current form: `fib daddr type local` (no host-IP match).
+                        if (
+                            "match" in e
+                            and e["match"]["op"] == "=="
+                            and "fib" in e["match"].get("left", {})
+                            and "daddr"
+                            in e["match"]["left"]["fib"].get("flags", [])
+                            and e["match"]["right"] == "local"
+                        ):
+                            has_daddr_match = True
+
+                        # Legacy form: exact `ip daddr <host_ip>` payload match.
                         if (
                             "match" in e
                             and e["match"]["op"] == "=="
@@ -684,6 +696,71 @@ class NetworkManager:
                 )
             return False
 
+    def _build_prerouting_rule(
+        self,
+        id: str,
+        family: str,
+        host_port: int,
+        dest_ip: str,
+        dest_port: int,
+        protocol: str = "tcp",
+    ):
+        """Build the PREROUTING DNAT rule for a port forward.
+
+        The destination-address match uses ``fib daddr type local`` instead of a
+        single detected host IP. This matches any address the host owns, on every
+        provider, with zero host-IP detection -- fixing the ``ip daddr 0.0.0.0``
+        bug where a failed/empty public-IP lookup produced a rule that never fired.
+
+        Args:
+            id (str): Machine ID, used in the rule comment.
+            family (str): nftables family ("ip" or "ip6").
+            host_port (int): Host port to forward.
+            dest_ip (str): IP address to forward to.
+            dest_port (int): Port to forward to.
+            protocol (str): Protocol to forward (default: "tcp").
+
+        Returns:
+            dict: An nftables ``add`` rule object for the PREROUTING chain.
+        """
+        return {
+            "add": {
+                "rule": {
+                    "family": family,
+                    "table": "nat",
+                    "chain": "PREROUTING",
+                    "comment": f"machine_id={id} host_port={host_port} vm_port={dest_port}",
+                    "expr": [
+                        {
+                            "match": {
+                                "op": "==",
+                                "left": {
+                                    "fib": {
+                                        "result": "type",
+                                        "flags": ["daddr"],
+                                    }
+                                },
+                                "right": "local",
+                            }
+                        },
+                        {
+                            "match": {
+                                "op": "==",
+                                "left": {
+                                    "payload": {
+                                        "protocol": protocol,
+                                        "field": "dport",
+                                    }
+                                },
+                                "right": host_port,
+                            }
+                        },
+                        {"dnat": {"addr": dest_ip, "port": dest_port}},
+                    ],
+                }
+            }
+        }
+
     def add_port_forward(
         self,
         id: str,
@@ -695,8 +772,13 @@ class NetworkManager:
     ):
         """Port forward a port to a new IP and port.
 
+        The PREROUTING rule matches ``fib daddr type local`` (any address the host
+        owns), so ``host_ip`` is used only to detect the IP family (IPv4 vs IPv6);
+        its value no longer appears in the rule match. This avoids the
+        ``ip daddr 0.0.0.0`` bug on hosts where public-IP detection fails.
+
         Args:
-            host_ip (str): IP address to forward from.
+            host_ip (str): IP address used only to detect IPv4/IPv6 family.
             host_port (int): Port to forward.
             dest_ip (str): IP address to forward to.
             dest_port (int): Port to forward to.
@@ -767,45 +849,11 @@ class NetworkManager:
                 }
             )
 
-        # Add PREROUTING rule
+        # Add PREROUTING rule (fib daddr type local -- no host-IP detection)
         rules["nftables"].append(
-            {
-                "add": {
-                    "rule": {
-                        "family": family,
-                        "table": "nat",
-                        "chain": "PREROUTING",
-                        "comment": f"machine_id={id} host_port={host_port} vm_port={dest_port}",
-                        "expr": [
-                            {
-                                "match": {
-                                    "op": "==",
-                                    "left": {
-                                        "payload": {
-                                            "protocol": family,
-                                            "field": "daddr",
-                                        }
-                                    },
-                                    "right": host_ip,
-                                }
-                            },
-                            {
-                                "match": {
-                                    "op": "==",
-                                    "left": {
-                                        "payload": {
-                                            "protocol": protocol,
-                                            "field": "dport",
-                                        }
-                                    },
-                                    "right": host_port,
-                                }
-                            },
-                            {"dnat": {"addr": dest_ip, "port": dest_port}},
-                        ],
-                    }
-                }
-            }
+            self._build_prerouting_rule(
+                id, family, host_port, dest_ip, dest_port, protocol
+            )
         )
 
         # Only add POSTROUTING rule if it doesn't already exist

{hysn_firecracker_python-1.0.5 → hysn_firecracker_python-1.0.7}/firecracker/utils.py

@@ -2,6 +2,7 @@ import os
 import random
 import string
 import signal
+import ipaddress
 import requests
 import subprocess
 import socket
@@ -185,8 +186,20 @@ def get_public_ip(timeout: int = 5):
 
     for url in URLS:
         try:
-            return _try_get_ip_from_url(url, timeout)
+            ip = _try_get_ip_from_url(url, timeout)
         except requests.RequestException:
             continue
 
+        # Reject empty/garbage and unspecified (0.0.0.0 / ::) responses so a bad
+        # service can never silently produce a dead "daddr 0.0.0.0" forward rule.
+        try:
+            ip_obj = ipaddress.ip_address(ip)
+        except ValueError:
+            continue
+
+        if ip_obj.is_unspecified:
+            continue
+
+        return str(ip_obj)
+
     raise RuntimeError("Failed to get public IP")

{hysn_firecracker_python-1.0.5 → hysn_firecracker_python-1.0.7/hysn_firecracker_python.egg-info}/PKG-INFO

@@ -1,8 +1,8 @@
 Metadata-Version: 2.4
 Name: hysn-firecracker-python
-Version: 1.0.5
+Version: 1.0.7
 Summary: A Python client library to interact with Firecracker microVMs
-Author: Muhammad Yuga Nugraha
+Author: PDSO Platform
 License: MIT License
         
         Copyright (c) 2024 Practical DevSecOps

{hysn_firecracker_python-1.0.5 → hysn_firecracker_python-1.0.7}/pyproject.toml

@@ -7,7 +7,7 @@ name = "hysn-firecracker-python"
 dynamic = ["version"]
 description = "A Python client library to interact with Firecracker microVMs"
 authors = [
-    {name = "Muhammad Yuga Nugraha"}
+    {name = "PDSO Platform"}
 ]
 requires-python = ">=3.9"
 dependencies = [

{hysn_firecracker_python-1.0.5 → hysn_firecracker_python-1.0.7}/setup.py

@@ -4,7 +4,7 @@ from setuptools import setup
 setup(
     name="hysn-firecracker-python",
     description="A Python client library to interact with Firecracker microVMs",
-    author="Muhammad Yuga Nugraha",
+    author="PDSO Platform",
     packages=find_packages(),
     install_requires=[
         "requests==2.32.3",

{hysn_firecracker_python-1.0.5 → hysn_firecracker_python-1.0.7}/tests/test_port_forward.py

@@ -2,10 +2,77 @@
 
 import json
 import os
+from unittest.mock import patch
 
 import pytest
 
 from firecracker import MicroVM
+from firecracker.network import NetworkManager
+
+
+class TestPreroutingRuleBuild:
+    """Unit tests for the PREROUTING DNAT rule builder (no nftables/KVM needed).
+
+    Guards the `ip daddr 0.0.0.0` regression: the rule must match
+    `fib daddr type local`, never an exact host-IP daddr payload.
+    """
+
+    def _build(self, **kwargs):
+        with patch("firecracker.network.IPRoute"):
+            nm = NetworkManager()
+        defaults = dict(
+            id="9fngkuf7",
+            family="ip",
+            host_port=37699,
+            dest_ip="172.115.48.209",
+            dest_port=22,
+            protocol="tcp",
+        )
+        defaults.update(kwargs)
+        return nm._build_prerouting_rule(**defaults)
+
+    def test_uses_fib_daddr_type_local(self):
+        """Rule matches any local address via fib, not a single host IP."""
+        expr = self._build()["add"]["rule"]["expr"]
+        fib_matches = [
+            e
+            for e in expr
+            if "match" in e and "fib" in e["match"].get("left", {})
+        ]
+        assert len(fib_matches) == 1
+        m = fib_matches[0]["match"]
+        assert m["op"] == "=="
+        assert m["left"]["fib"]["result"] == "type"
+        assert "daddr" in m["left"]["fib"]["flags"]
+        assert m["right"] == "local"
+
+    def test_no_exact_daddr_payload_match(self):
+        """Regression: no `ip daddr <addr>` payload match remains in the rule."""
+        expr = self._build()["add"]["rule"]["expr"]
+        for e in expr:
+            left = e.get("match", {}).get("left", {})
+            if "payload" in left:
+                assert left["payload"]["field"] != "daddr"
+
+    def test_dport_and_dnat_preserved(self):
+        """dport match and dnat target unchanged."""
+        expr = self._build()["add"]["rule"]["expr"]
+        dport = next(
+            e["match"]
+            for e in expr
+            if "match" in e
+            and e["match"]["left"].get("payload", {}).get("field") == "dport"
+        )
+        assert dport["right"] == 37699
+        dnat = next(e["dnat"] for e in expr if "dnat" in e)
+        assert dnat == {"addr": "172.115.48.209", "port": 22}
+
+    def test_comment_format_unchanged(self):
+        """Comment key is unchanged -- deletion/idempotency paths depend on it."""
+        rule = self._build()["add"]["rule"]
+        assert rule["comment"] == "machine_id=9fngkuf7 host_port=37699 vm_port=22"
+        assert rule["chain"] == "PREROUTING"
+        assert rule["table"] == "nat"
 
 KERNEL_FILE = "/var/lib/firecracker/vmlinux-6.1.159"
 BASE_ROOTFS = "/var/lib/firecracker/devsecops-box.img"

{hysn_firecracker_python-1.0.5 → hysn_firecracker_python-1.0.7}/tests/test_utils.py

@@ -167,3 +167,51 @@ class TestUtilsFunctions:
 
         with pytest.raises(RuntimeError, match="VMM ID required"):
             test_func(None)
+
+
+class TestGetPublicIP:
+    """Tests for get_public_ip validation (never yield 0.0.0.0/empty)."""
+
+    def test_returns_valid_ip(self):
+        """A valid IP from the first service is returned."""
+        from unittest.mock import patch
+        from firecracker.utils import get_public_ip
+
+        with patch(
+            "firecracker.utils._try_get_ip_from_url", return_value="138.201.226.62"
+        ):
+            assert get_public_ip() == "138.201.226.62"
+
+    def test_skips_unspecified_then_returns_valid(self):
+        """0.0.0.0 from one service is skipped; next valid IP wins."""
+        from unittest.mock import patch
+        from firecracker.utils import get_public_ip
+
+        with patch(
+            "firecracker.utils._try_get_ip_from_url",
+            side_effect=["0.0.0.0", "203.0.113.5", "203.0.113.9"],
+        ):
+            assert get_public_ip() == "203.0.113.5"
+
+    def test_skips_empty_and_garbage(self):
+        """Empty/garbage responses are skipped, not returned."""
+        from unittest.mock import patch
+        from firecracker.utils import get_public_ip
+
+        with patch(
+            "firecracker.utils._try_get_ip_from_url",
+            side_effect=["", "not-an-ip", "203.0.113.7"],
+        ):
+            assert get_public_ip() == "203.0.113.7"
+
+    def test_raises_when_all_unspecified_or_invalid(self):
+        """All services returning 0.0.0.0/garbage -> RuntimeError, never 0.0.0.0."""
+        from unittest.mock import patch
+        from firecracker.utils import get_public_ip
+
+        with patch(
+            "firecracker.utils._try_get_ip_from_url",
+            side_effect=["0.0.0.0", "", "::"],
+        ):
+            with pytest.raises(RuntimeError, match="Failed to get public IP"):
+                get_public_ip()