machine: add vfkit timesync device for Apple VMs by vyasgun · Pull Request #28527 · containers/podman

vyasgun · 2026-04-16T15:17:20Z

Checklist

Ensure you have completed the following checklist for your pull request to be reviewed:

Certify you wrote the patch or otherwise have the right to pass it on as an open-source patch by signing all
commits. (git commit -s). (If needed, use git commit -s --amend). The author email must match
the sign-off email address. See CONTRIBUTING.md
for more information.
Referenced issues using Fixes: #00000 in commit message (if applicable)
Tests have been added/updated (or no tests are needed)
Documentation has been updated (or no documentation changes are needed)
All commits pass make validatepr (format/lint checks)
Release note entered in the section below (or None if no user-facing changes)

Does this PR introduce a user-facing change?

Related PR: containers/podman-machine-os#175

None

Fixes: containers#28345 Signed-off-by: Gunjan Vyas <vyasgun20@gmail.com>

TomSweeneyRedHat · 2026-04-17T20:12:19Z

@vyasgun thanks for the PR! Our CI is barking as there's no test to go along with the change. Would that be possible to add?

Otherwise, LGTM

danishprakash · 2026-04-20T07:45:48Z

 	}
 	vm.Devices = append(vm.Devices, mounts...)

+	timesync, err := vfConfig.TimeSyncNew(1234)


Please consider using a named constant for the port

mheon · 2026-04-20T19:17:15Z

I dunno if testing for this one is particularly reasonable - hard to validate proper date/time stuff in my experience. I'm going to add No New Tests.

l0rd · 2026-04-21T13:00:22Z

@vyasgun machine e2e tests are failing on macOS with libkrun. You can try to reproduce the problem locally using make localmachine (see the doc).

Honny1 · 2026-04-29T17:42:09Z

I started with the takeover of the podman-machine-os PR. And I think it would be good to add this for QEMU, to benefit from this on linux.

@vyasgun, can you do updates, or can I take over this PR too? I think it would be good to finish this to get this into Podman 6.1.

vyasgun · 2026-05-04T12:39:00Z

@l0rd I suspect the e2e failures on CI are from an older krunkit (need v1.2.0+ or so). I can’t see which version CI uses from the CI logs. Locally everything passes:

Ran 73 of 80 Specs in 792.949 seconds
SUCCESS! -- 73 Passed | 0 Failed | 0 Pending | 7 Skipped

I updated contrib/cirrus/mac_env.sh to print krunkit --version. Those prints don’t show up in the HTML log though - where can I look for them?

vyasgun · 2026-05-04T12:40:38Z

@Honny1 I have updated this PR with the suggested changes

l0rd · 2026-05-04T12:48:10Z

@vyasgun CI is failing at code validation, and the machine tests aren't executed. To avoid that, you can use make validatepr before pushing.

… version Signed-off-by: Gunjan Vyas <vyasgun20@gmail.com>

mheon · 2026-05-05T18:51:20Z

I think the failures are flakes? Restarted the bunch.

l0rd · 2026-05-06T08:58:50Z

@vyasgun your suspect was correct: the krunkit version installed in the VMs that run the CI is 1.1.1 (last line of this file). I know that linux/windows images are defined here but I am not sure about macOS ones. @Luap99 @ashley-cui @timcoding1988 should know. I am afraid we won't be able to merge this PR before updating the VM image.

Luap99 · 2026-05-06T10:36:48Z

The macos worker pool uses brew to install the runtime deps
https://github.com/containers/automation/blob/7081019797582cb07158f1e2249bd224cfb10090/mac_pw_pool/setup.sh#L86-L109

IF the update is not in brew we will not consume it

Luap99 · 2026-05-06T10:39:59Z

Overall this looks like something we need some basic tests? The fact that this passes with the machine-os change seems concerning, we need some way to confirm the socket is actually active and can be used to talk to the host hypertvisor otherwise how do we ever catch regressions in qemu/kruntkit/vfkit or our own code around this...

Install qemu-guest-agent and configure it to listen on vsock port 1234 (matching the constant in containers/podman). The service is gated by a DMI sys_vendor check (ExecCondition) so it only runs on Podman machine providers that expose the vsock channel: vfkit (Apple Inc.), libkrun (Libkrun), and qemu (QEMU). A custom SELinux module allows virt_qemu_ga_t to use vsock sockets. Related PR: containers/podman#28527 Replace: containers#175 Signed-off-by: Jan Rodák <hony.com@seznam.cz>

Honny1

Should we also wire an explicit qemu-ga vsock unix socket (e.g. <name>-qemu-ga.sock) in addition to --timesync? That would give us a concrete host endpoint to test and debug, and helps prevent regressions around guest-agent connectivity.

Honny1 · 2026-05-06T11:54:43Z

-const applehvMACAddress = "5a:94:ef:e4:0c:ee"
+const (
+	applehvMACAddress = "5a:94:ef:e4:0c:ee"
+	timeSyncVsockPort = 1234


I think this should be shared in pkg/machine/define.

Install qemu-guest-agent and configure it to listen on vsock port 1234 (matching the constant in containers/podman). The service is gated by a DMI sys_vendor check (ExecCondition) so it only runs on Podman machine providers that expose the vsock channel: vfkit (Apple Inc.), libkrun (Libkrun), and qemu (QEMU). A custom SELinux module allows virt_qemu_ga_t to use vsock sockets. Related PR: containers/podman#28527 Replace: containers#175 Signed-off-by: Jan Rodák <hony.com@seznam.cz>

Honny1 · 2026-05-06T12:24:42Z

Anyway, I tested that with an image from containers/podman-machine-os#238. And the time is correctly synchronized.

Install qemu-guest-agent and configure it to listen on vsock port 1234 (matching the constant in containers/podman). The service is gated by a DMI sys_vendor check (ExecCondition) so it only runs on Podman machine providers that expose the vsock channel: vfkit (Apple Inc.), libkrun (Libkrun), and qemu (QEMU). A custom SELinux module allows virt_qemu_ga_t to use vsock sockets. Related PR: containers/podman#28527 Replace: containers#175 Signed-off-by: Jan Rodák <hony.com@seznam.cz>

cfergeau · 2026-05-06T13:26:20Z

The macos worker pool uses brew to install the runtime deps https://github.com/containers/automation/blob/7081019797582cb07158f1e2249bd224cfb10090/mac_pw_pool/setup.sh#L86-L109

IF the update is not in brew we will not consume it

Looks like the brew "repo" for krunkit changed, slp/krunkit is not up to date, but https://github.com/slp/homebrew-krun (aka slp/krun) has 1.2.1.

cfergeau · 2026-05-06T13:27:18Z

The macos worker pool uses brew to install the runtime deps https://github.com/containers/automation/blob/7081019797582cb07158f1e2249bd224cfb10090/mac_pw_pool/setup.sh#L86-L109
IF the update is not in brew we will not consume it

Looks like the brew "repo" for krunkit changed, slp/krunkit is not up to date, but https://github.com/slp/homebrew-krun (aka slp/krun) has 1.2.1.

And cfergeau/crc should no longer be needed (and is no longer updated), vfkit is in the main homebrew repo.

Install qemu-guest-agent and configure it to listen on vsock port 1234 (matching the constant in containers/podman). The service is gated by a DMI sys_vendor check (ExecCondition) so it only runs on Podman machine providers that expose the vsock channel: vfkit (Apple Inc.), libkrun (Libkrun), and qemu (QEMU). A custom SELinux module allows virt_qemu_ga_t to use vsock sockets. Related PR: containers/podman#28527 Replace: containers#175 Signed-off-by: Jan Rodák <hony.com@seznam.cz>

github-actions Bot added the machine label Apr 16, 2026

machine: add vfkit timesync device for Apple VMs

8a97ed3

Fixes: containers#28345 Signed-off-by: Gunjan Vyas <vyasgun20@gmail.com>

vyasgun force-pushed the pr/krunkit-timesync branch from 8726ab7 to 8a97ed3 Compare April 16, 2026 15:32

danishprakash reviewed Apr 20, 2026

View reviewed changes

mheon added the No New Tests Allow PR to proceed without adding regression tests label Apr 20, 2026

Honny1 mentioned this pull request May 5, 2026

Add qemu-guest-agent over vsock for time sync and host-guest features containers/podman-machine-os#238

Open

use constant for timesync port and update mac_env.sh to print krunkit…

4e3b715

… version Signed-off-by: Gunjan Vyas <vyasgun20@gmail.com>

vyasgun force-pushed the pr/krunkit-timesync branch from dd54fd3 to 4e3b715 Compare May 5, 2026 17:17

Honny1 reviewed May 6, 2026

View reviewed changes

Conversation

vyasgun commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Does this PR introduce a user-facing change?

Uh oh!

TomSweeneyRedHat commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

danishprakash Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

mheon commented Apr 20, 2026

Uh oh!

l0rd commented Apr 21, 2026

Uh oh!

Honny1 commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vyasgun commented May 4, 2026

Uh oh!

vyasgun commented May 4, 2026

Uh oh!

l0rd commented May 4, 2026

Uh oh!

mheon commented May 5, 2026

Uh oh!

l0rd commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Luap99 commented May 6, 2026

Uh oh!

Luap99 commented May 6, 2026

Uh oh!

Honny1 left a comment

Choose a reason for hiding this comment

Uh oh!

Honny1 May 6, 2026

Choose a reason for hiding this comment

Uh oh!

Honny1 commented May 6, 2026

Uh oh!

cfergeau commented May 6, 2026

Uh oh!

cfergeau commented May 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

vyasgun commented Apr 16, 2026 •

edited

Loading

TomSweeneyRedHat commented Apr 17, 2026 •

edited

Loading

Honny1 commented Apr 29, 2026 •

edited

Loading

l0rd commented May 6, 2026 •

edited

Loading