guest: delete the old layered init and the managed agent's sandbox mode (SL7.8b)

.github/actions/check-quality/action.yml

@@ -43,9 +43,6 @@ runs:
           guest/common/init guest/alpine/nvx-container-enter \
           guest/alpine/nvx-container-launch \
           guest/common/nvx-hostmount guest/common/nvx-identity-probe \
-          guest/common/nvx-init-agent \
-          guest/common/nvx-container-enter-azurelinux \
-          guest/common/nvx-container-launch-azurelinux \
           guest/common/nvx-sandbox-smoke guest/common/nvx-snapshot \
           guest/common/nvx-virtio-restore-probe \
           scripts/setup/setup-linux.sh
@@ -59,9 +56,6 @@ runs:
           guest/common/init guest/alpine/nvx-container-enter \
           guest/alpine/nvx-container-launch \
           guest/common/nvx-hostmount guest/common/nvx-identity-probe \
-          guest/common/nvx-init-agent \
-          guest/common/nvx-container-enter-azurelinux \
-          guest/common/nvx-container-launch-azurelinux \
           guest/common/nvx-sandbox-smoke guest/common/nvx-snapshot \
           guest/common/nvx-virtio-restore-probe \
           scripts/setup/setup-linux.sh

doc/acceptance-case-matrix.md

@@ -482,8 +482,8 @@ this matrix. The README's own code is no doctest.
 | `nvx-rs/src/guest/activation/state.rs - guest::activation::state::Activation (line 56)` | kept |  |
 | `nvx-rs/src/guest/cgroup.rs - guest::cgroup (line 36)` | kept | Its module leaves with the exec engine (#1087), whose PR retires it |
 | `nvx-rs/src/guest/entry.rs - guest::entry (line 90)` | kept | Its module leaves with the exec engine (#1087), whose PR retires it |
-| `nvx-rs/src/guest/exec.rs - guest::exec (line 80)` | kept | Its module leaves with the exec engine (#1087), whose PR retires it |
-| `nvx-rs/src/guest/exec.rs - guest::exec::Execution::adopt (line 620)` | kept | Its module leaves with the exec engine (#1087), whose PR retires it |
+| `nvx-rs/src/guest/exec.rs - guest::exec (line 79)` | kept | Its module leaves with the exec engine (#1087), whose PR retires it |
+| `nvx-rs/src/guest/exec.rs - guest::exec::Execution::adopt (line 619)` | kept | Its module leaves with the exec engine (#1087), whose PR retires it |
 | `nvx-rs/src/guest/gpt.rs - guest::gpt (line 18)` | kept | The guest's space becomes private (#1127), whose PR moves it to the space's unit tests |
 | `nvx-rs/src/guest/mappings/mapper.rs - guest::mappings::mapper (line 107)` | kept | The guest's space becomes private (#1127), whose PR moves it to the space's unit tests |
 | `nvx-rs/src/guest/mappings/table.rs - guest::mappings::table::MappingTable (line 47)` | kept |  |

doc/guests/azurelinux-guest.md

@@ -16,8 +16,6 @@ The Azure Linux initramfs is a workload guest, not a sandbox control
 environment. Alpine remains the default guest of `run` and the only control
 environment of `sandbox`:
 
-- the initramfs omits the sandbox init agent, so the common `/init` refuses
-  sandbox mode;
 - the microVM test harness rejects the sandbox-control scenarios for Azure
   Linux; and
 - `build-distro-layer` accepts only Ubuntu, so there is no Azure Linux

doc/guests/ubuntu-guest.md

@@ -147,16 +147,11 @@ proof.
 The layer runs under the Alpine control initramfs as the sandbox's read-only
 `distro` layer over a writable scratch disk, which is formatted separately
 with `mkfs.ext4`; see the
-[experimental sandbox](../run.md#experimental-single-workload-sandbox). For a
-one-shot workload, the Alpine
-[container entry helper](../../guest/alpine/nvx-container-enter) injects its
-musl loader, `setpriv`, and libraries into `/.nvx-agent`, so glibc Ubuntu
-binaries run while the trusted agent stays musl-based. A managed sandbox's
-init, nvx-init, a static binary, runs each execution itself, as a plain
-process in the VM's root, without them. A one-shot workload gets private
-mount, PID, and UTS namespaces, a managed sandbox's executions share
-nvx-init's, and every workload shares the guest's network namespace. It runs
-as a fixed non-root identity, by default `65534:65534`, the Ubuntu `nobody`
+[experimental sandbox](../run.md#experimental-single-workload-sandbox). The
+sandbox's init, nvx-init, a static binary, runs each execution itself, as a
+plain process in the VM's root. Its executions share nvx-init's mount, PID,
+and UTS namespaces, and the guest's network namespace. A workload runs as a
+fixed non-root identity, by default `65534:65534`, the Ubuntu `nobody`
 account whose home the builder creates, with no supplementary groups, no
 capabilities, and `no_new_privs`.
 

doc/project-structure.md

@@ -227,10 +227,9 @@ verification of the pinned OpenVMM release.
 ### `guest/`, `ubuntu/`, and `azurelinux/`
 
 `guest/common` contains scripts shared by the Alpine, Ubuntu, and Azure Linux
-initramfs builds, plus the Azure Linux variants of the container-entry
-scripts. The ten compiled `/sbin/nvx-*` programs live under `nvx-rs/src/guest`
-and `nvx-rs/src/bin`. `init` controls early boot and then starts an
-initramfs program named by `nvx_exec=`, `nvx-init` for a layered root,
+initramfs builds. The ten compiled `/sbin/nvx-*` programs live under
+`nvx-rs/src/guest` and `nvx-rs/src/bin`. `init` controls early boot and then
+starts an initramfs program named by `nvx_exec=`, `nvx-init` for a layered root,
 `nvx-managed-agent` for a managed workload, a one-shot
 workload named by `nvx_entrypoint=`, a virtio restore probe for benchmark
 profiling, or the interactive shell. On an interactive boot, `init` prints a
@@ -240,19 +239,10 @@ the container launch and entry scripts that only the Alpine initramfs installs;
 the entry script stages Alpine's musl loader and `setpriv` inside the
 workload's root.
 
-The older sandbox scripts, `nvx-init-agent` and the container scripts, which
-`init` no longer starts, resolve fixed virtio-blk roles through sysfs, mount the
-EROFS `distro` layer as the overlay's only lower layer, under the upper that
-the host declares, an ext4 scratch disk or a tmpfs, place the workload in its
-cgroup before release, construct its mount/PID/UTS namespaces, enter its
-filesystem root after dropping capabilities, and retain the agent as the outer
-PID 1. In a managed sandbox, the agent supervises `nvx-managed-agent`, which
-enters each execution itself through the library's `nvx::guest::entry`, and
-performs the ordered unmount teardown after a stop request. The remaining
-common helpers handle shutdown, virtio-fs mounting, snapshot preparation, and
-the guest side of the time ABI. The Rust guest binaries provide shutdown,
-managed control, restore repair, device access, ingress announcements, and
-diagnostic probes.
+The remaining common helpers handle shutdown, virtio-fs mounting, snapshot
+preparation, and the guest side of the time ABI. The Rust guest binaries
+provide shutdown, managed control, restore repair, device access, ingress
+announcements, and diagnostic probes.
 
 `ubuntu/packages.lock.json` pins the complete
 supplemental `.deb` closure installed without maintainer-script execution.

doc/setup.md

@@ -219,9 +219,6 @@ shellcheck --shell=sh \
   guest/common/init guest/alpine/nvx-container-enter \
   guest/alpine/nvx-container-launch \
   guest/common/nvx-hostmount guest/common/nvx-identity-probe \
-  guest/common/nvx-init-agent \
-  guest/common/nvx-container-enter-azurelinux \
-  guest/common/nvx-container-launch-azurelinux \
   guest/common/nvx-sandbox-smoke \
   guest/common/nvx-snapshot guest/common/nvx-virtio-restore-probe \
   scripts/setup/setup-linux.sh
@@ -234,9 +231,6 @@ shfmt -d -ln posix -i 4 -ci \
   guest/common/init guest/alpine/nvx-container-enter \
   guest/alpine/nvx-container-launch \
   guest/common/nvx-hostmount guest/common/nvx-identity-probe \
-  guest/common/nvx-init-agent \
-  guest/common/nvx-container-enter-azurelinux \
-  guest/common/nvx-container-launch-azurelinux \
   guest/common/nvx-sandbox-smoke \
   guest/common/nvx-snapshot guest/common/nvx-virtio-restore-probe \
   scripts/setup/setup-linux.sh
@@ -282,9 +276,6 @@ shfmt -w -ln posix -i 4 -ci \
   guest/common/init guest/alpine/nvx-container-enter \
   guest/alpine/nvx-container-launch \
   guest/common/nvx-hostmount guest/common/nvx-identity-probe \
-  guest/common/nvx-init-agent \
-  guest/common/nvx-container-enter-azurelinux \
-  guest/common/nvx-container-launch-azurelinux \
   guest/common/nvx-sandbox-smoke \
   guest/common/nvx-snapshot guest/common/nvx-virtio-restore-probe \
   scripts/setup/setup-linux.sh

docker/Dockerfile

@@ -131,10 +131,7 @@ install -m 0755 /repo/guest/common/init /rootfs/init
 install -m 0755 /repo/guest/common/nvx-hostmount \
     /repo/guest/common/nvx-identity-probe \
     /repo/guest/common/nvx-snapshot \
-    /repo/guest/common/nvx-virtio-restore-probe \
-    /repo/guest/common/nvx-container-enter-azurelinux /rootfs/sbin/
-install -m 0755 /repo/guest/common/nvx-container-launch-azurelinux \
-    /rootfs/sbin/nvx-container-launch
+    /repo/guest/common/nvx-virtio-restore-probe /rootfs/sbin/
 python3 <<'PY'
 import shutil
 import sys