Skip to content

feat(sdk)!: typed VmId replaces raw String for process builders#5

Open
PeronGH wants to merge 1 commit intomasterfrom
fix/validate-vm-id
Open

feat(sdk)!: typed VmId replaces raw String for process builders#5
PeronGH wants to merge 1 commit intomasterfrom
fix/validate-vm-id

Conversation

@PeronGH
Copy link
Copy Markdown

@PeronGH PeronGH commented Apr 24, 2026

Summary

Firecracker's --id flag is validated against utils::validators::validate_instance_id (byte length 1..=64, chars matching c == '-' || c.is_alphanumeric()). Passing a bad id makes the child process panic at startup — callers previously had no way to catch that ahead of time and had to roll their own sanitizer.

This PR promotes that rule into the SDK as a typed VmId, so callers either validate upfront or get a Firecracker-compatible identifier by construction.

  • New fc_sdk::VmId in fc-sdk/src/vm_id.rs with two constructors:
    • VmId::new(s) -> Result<VmId, VmIdError> — strict, error variants mirror upstream's ValidatorError (InvalidChar { c, position }, InvalidLen { length, min, max }) so messages line up with what a user would see from the Firecracker binary itself.
    • VmId::from_sanitized(s) -> VmId — infallible projection. Non-(alphanumeric-or-hyphen) chars become -, result truncated to 64 bytes at a char boundary, empty result falls back to "vm". Deterministic.
  • Builders take VmId (breaking): FirecrackerProcessBuilder::id, JailerProcessBuilder::new, and the bundled BundledRuntimeOptions::jailer_builder all consume a pre-validated VmId.
  • fc-cli surfaces VmIdError through invalid_input so the user's CLI input is validated and reported cleanly.
  • Workspace version 0.2.3 → 0.3.0 for the API break.

Test plan

  • cargo test -p fc-sdk — 16 unit tests (all vm_id scenarios incl. multi-byte UTF-8 truncation) + 7 doc-tests pass.
  • cargo test --workspace — all member crates green.
  • cargo clippy --workspace --all-targets -- -D warnings — clean.
  • cargo fmt --check — clean.
  • End-to-end boot from the downstream consumer (arcbox-agent): real inst_<uuid>-style identifier with an underscore passed to .id(VmId::from_sanitized(...)) produces a live firecracker process (--id inst-<uuid>), no InvalidChar panic, API reports Running.

Firecracker's --id flag panics on any character outside
`c == '-' || c.is_alphanumeric()` or byte length outside 1..=64,
per utils::validators::validate_instance_id. Callers previously
had to sanitize on their own, and a bad id turned into a child
process abort rather than a recoverable error.

Add a VmId newtype that encodes that exact rule at the SDK
boundary. Two constructors: `new` (strict, Result<_, VmIdError>)
and `from_sanitized` (infallible projection, always valid).

FirecrackerProcessBuilder::id, JailerProcessBuilder::new, and
the bundled runtime's jailer_builder now take VmId. fc-cli
surfaces VmIdError to the user via invalid_input. Workspace
version bumped to 0.3.0 to reflect the breaking change.
Copilot AI review requested due to automatic review settings April 24, 2026 07:53
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR introduces a typed VmId into fc-sdk to enforce Firecracker’s --id validation rules in the SDK, preventing child-process panics from invalid identifiers and making ID handling explicit across builders and the CLI.

Changes:

  • Added fc_sdk::VmId + VmIdError with strict validation (new) and deterministic sanitization (from_sanitized).
  • Updated process builders (Firecracker/Jailer) and bundled runtime options to take VmId instead of String (breaking API change).
  • Updated fc-cli to validate --id input and surface validation errors cleanly.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
src/runtime/bundled.rs Updates bundled jailer builder API to require VmId and adjusts tests accordingly.
fc-sdk/src/vm_id.rs Adds the new VmId type, error model, sanitization/validation logic, and unit tests.
fc-sdk/src/process.rs Switches builder APIs/fields from String IDs to VmId and updates docs/tests.
fc-sdk/src/lib.rs Exposes the new vm_id module and re-exports VmId/VmIdError.
fc-sdk/src/error.rs Adds InvalidVmId variant and From<VmIdError> conversion for ergonomic ? usage.
fc-cli/src/main.rs Validates CLI-provided IDs via VmId::new and returns InvalidInput errors on failure.
Cargo.toml Bumps workspace version to 0.3.0 to reflect the breaking API change.
Cargo.lock Updates workspace crate versions to 0.3.0.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread fc-sdk/src/vm_id.rs
Comment on lines +101 to +113
let sanitized: String = input
.as_ref()
.chars()
.map(|c| if is_valid_char(c) { c } else { '-' })
.collect();

let truncated = truncate_to_bytes(&sanitized, MAX_LEN);
let final_id = if truncated.is_empty() {
SANITIZE_FALLBACK.to_owned()
} else {
truncated.to_owned()
};

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants