[Pedro Henrique Penna (ppenna)]

Leaving code only. This PR changes only code that this effort removes from NVX: the Alpine one-shot container helpers (guest/alpine/nvx-container-launch and guest/alpine/nvx-container-enter), and so guest/alpine, with the edits that remove references to them. Nothing that stays changes, and no later PR uses what it changes, so the size limits for kept code don't apply.

Part of #1123 (SL7.8c, "the Alpine one-shot container helpers are gone"). Parent #1087, umbrella #1076.

Stacked on #1534 (SL7.8b).

What and why

#1534 (SL7.8b) deletes the old layered init, nvx-init-agent, which was the only caller of the Alpine one-shot container helpers: nvx-container-launch ran a workload's container through nvx-container-enter, which staged Alpine's musl loader and setpriv in the container's root. With #1534, the shell /init hands every layered root to /sbin/nvx-init, and a managed blockless boot to nvx-managed-agent with its own root, so nothing runs them any more.

This PR deletes both, and so guest/alpine, which held nothing else, with every inventory that names them or the directory:

• Build: build.py no longer installs them in the Alpine initramfs (its _install_guest_files keeps installing /etc/nvx-bashrc for the guests without sandbox control, as before), nor lists guest/alpine among the Alpine guest's customization files.
• Source inventory: the Alpine guest's source directories are guest/common alone, as Azure Linux's are: AlpineBuildConstants loses GUEST_DIRECTORY, and SOURCE-MANIFEST.json's Alpine guest_sources, which release.py checks against those constants, drops guest/alpine. release.py's source-tree check no longer requires the entry helper.
• CI: the Alpine artifacts' cache key (build-guest-artifacts) no longer hashes guest/alpine/**, and check-quality's ShellCheck and shfmt lists no longer name the helpers.
• Docs: the setup guide's copies of those lists, and the project structure, which no longer describes guest/alpine nor, since guest: delete the old layered init and the managed agent's sandbox mode (SL7.8b) #1534 deletes the init agent, an agent among guest/common's scripts.

Nothing else used them. On #1534's head, 00341544, I searched the tree, outside openvmm/ and build outputs, for the helpers' names, guest/alpine, AlpineBuildConstants.GUEST_DIRECTORY, /.nvx-agent, and prose about container launch or entry scripts:

• guest image builds: only the files above name them; docker/Dockerfile and .dockerignore don't;
• runtime: nothing runs them. The shell /init names neither; no host code or scenario passes either as nvx_exec=, the initramfs program that /init would run; and no code in nvx-rs names them;
• microVM scenarios and benchmarks: microvm_tests.py, its scripts and the benchmark harness don't name them;
• CI: only the two actions above; ci.py selects jobs by the guest/ prefix, so the deleted directory needs no rule of its own;
• docs: only the setup guide and the project structure; the case matrix lists no test of them.

Left on purpose:

• scripts/nvx_tools/kernel_features.py still names nvx-container-launch, and nvx-init-agent, among the consumers of a kernel feature: nvx-rs slimming 4.2.4: the exec engine, the process modules and the old layered init are gone #1123's follow-up K1 edits that file once, after SL6.11b, since any edit changes the kernel cache key.
• The /.nvx-agent mapping-target reservation (protocol::share, the mapper's Reserved::container_root, the host's checks, and doc/run.md and doc/usage.md): the entry helper staged its tools there, and nothing does now, but dropping the reservation changes the targets that NVX accepts, which isn't leaving code.
• guest/common/nvx-sandbox-smoke's limits check, which no scenario or test runs, still explains its process count by the deleted launcher's unshare parent and the init agent.
• The Alpine package list: setpriv and unshare still serve init, nvx-identity-probe and nvx-snapshot.
• test_package_rejects_tampered_source_metadata_without_replacing_output keeps ["guest/common", "guest/alpine"] as a tampered Alpine guest_sources, which the release check still refuses.

Size

Measured as #1076 defines them, against #1534's head:

	Core lines	Counted files
Estimate (#1123)	none recorded	none recorded
Measured	6	5

• Core lines (6): in build.py, the condition of the nvx-bashrc install (if not descriptor.sandbox_control:) and the customization files' return; in build_constants.py, AlpineBuildConstants.GUEST_SOURCE_DIRECTORIES; the Alpine cache key's line in build-guest-artifacts; and the two guest/common/init \ lines of check-quality's lists. The rest are deletions.
• Counted files (5): scripts/nvx_tools/build.py, build_constants.py and release.py, .github/actions/build-guest-artifacts/action.yml and .github/actions/check-quality/action.yml. The two deleted helpers, SOURCE-MANIFEST.json, the docs and the test don't count.

Old tests of the area

• Retired: CI's ShellCheck and shfmt of the two helpers, in check-quality.
• Rewritten: none. No test exercised the helpers.
• Kept: everything else; the two tests below change only to stop naming what left.

Test changes

python scripts/check_test_changes.py --base 00341544 (#1534's head) lists 6 changes to existing tests, hence tests-modified:

• scripts/test_nvx_tools.py's _write_release_fixture, the manifest that the release tests package, drops guest/alpine from the Alpine guest_sources, as the real manifest does, which release.py requires.
• CiConfigurationTests.test_ci_change_classification_selects_suites_by_input drops its case of guest/alpine/nvx-container-enter, a deleted file. Its guest/common/init case still checks that a guest input selects the microVM tests and the benchmarks, by the same guest/ rule.
• .github/actions/check-quality/action.yml: 4 changed lines of CI test wiring, the ShellCheck and shfmt lists, which no longer name the helpers.

Validation

local_gates.py --files (from dev) selects test-changes, markdown-links, test-layout, quality-code, nvx-cli (validate-nvx) and openvmm-ci on both systems; no Rust changes. I ran them from this branch's action definitions, on bd1ead5e, but openvmm-ci, which checks the unchanged openvmm pin and is left to CI.

Windows, this workstation:

Check	Result
python scripts/nvx.py verify	passed
ruff check scripts .github/specula, ruff format --check ..., compileall, pyright --pythonplatform Linux, --pythonplatform Windows	passed, 0 errors
validate-nvx's unittest list, test_adversarial.py, test_hosts.py and nvx.py's --help commands	passed: 1803 tests, 73 skipped; test_adversarial.py (11 skipped) and test_hosts.py pass
release.verify_source_tree() on this tree, and the real SOURCE-MANIFEST.json's Alpine section against the build pin that release.py checks	passed
check_test_layout.py, check_markdown_links.py, SL5.2's check_matrix.py <worktree> 99d2022085f	passed
check_test_changes.py --base 00341544	6 changes, explained above

Linux, nvx-kvm-test (Azure Linux 3, kernel 6.6, KVM, virtual machine), in a worktree of this branch with its own target directory, every signal at its default disposition:

Check	Result
python3 scripts/nvx.py build-initramfs --guest alpine	built, SHA-256 a2e82b0b…. Its /sbin holds no nvx-container-*, and keeps nvx-init, nvx-managed-agent, nvx-snapshot and the other helpers; none of its 154 provenance inputs is under guest/alpine
python3 scripts/nvx.py build-initramfs --guest ubuntu	built, SHA-256 52ae53c7…, byte for byte the image that #1534's head builds, with /etc/nvx-bashrc
release.verify_source_tree()	passed
check-quality's ShellCheck and shfmt commands, with its pinned images and the new lists	passed
validate-nvx's unittest list, test_adversarial.py, test_hosts.py	passed: 1803 tests, 38 skipped, which runs the shell tests that Windows skips; 84; 4
MicroVM scenarios, with the Alpine image above and the kernel, Ubuntu distro layer and OpenVMM of run 43185976865, each checked by SHA-256, and NVX_AUTO_DOWNLOAD=0	passed: Alpine (1 vCPU) guest-boot, lifecycle, managed-lifecycle and console-snapshot; the public managed-exec-config, sandbox-lifecycle and snapshot-core, which boot layered roots (nvx_sandbox=1 nvx_mode=managed, nvx_layer=distro,...) through nvx-init in the new Alpine image

Not run, left to CI: openvmm-ci; build-guest --guest all and verify-guest-determinism; the other backends and scenarios. #1534 ran the full set on KVM, MSHV and WHP with images that still held the helpers, which nothing ran.

[github-actions]

This pull request changes existing tests

It modifies or removes 6 existing test asset(s), listed below. Review each with care: a change to a test can hide a regression that the test caught. See doc/contribute.md#changes-to-existing-tests.

Test code

Change	What	Before	After
modified helper	def _write_release_fixture in scripts/test_nvx_tools.py	scripts/test_nvx_tools.py:676	scripts/test_nvx_tools.py:676
modified test	def CiConfigurationTests.test_ci_change_classification_selects_suites_by_input in scripts/test_nvx_tools.py	scripts/test_nvx_tools.py:7443	scripts/test_nvx_tools.py:7442

CI test wiring

Change	What	Before	After
modified line	guest/common/init guest/alpine/nvx-container-enter \	.github/actions/check-quality/action.yml:43	.github/actions/check-quality/action.yml:43
modified line	guest/alpine/nvx-container-launch \	.github/actions/check-quality/action.yml:44	.github/actions/check-quality/action.yml:43
modified line	guest/common/init guest/alpine/nvx-container-enter \	.github/actions/check-quality/action.yml:56	.github/actions/check-quality/action.yml:55
modified line	guest/alpine/nvx-container-launch \	.github/actions/check-quality/action.yml:57	.github/actions/check-quality/action.yml:55

Relocated unchanged: 0; added: 0. Compared the merge base 8ae0617b1ebd with bf2c816e63c2.

[Copilot]

🟢 Approval recommended

No active review issues remain for the removal of the unused Alpine container helpers and their associated references.

No open issues 🎉

What changed in this PR

Removes the unused Alpine one-shot container helpers after #1534 removed their only caller, completing SL7.8c of the NVX slimming workstream. The changes remove the helpers and their inventory references while preserving retained guest behavior.

Changes:

• Deletes both Alpine container helpers and their build installation steps.
• Updates source inventories, release checks, cache inputs, and shell-check lists.
• Aligns test fixtures and documentation with the removed files.

File	Description
SOURCE-MANIFEST.json	Removes guest/alpine from Alpine source inputs.
scripts/​test_nvx_tools.py	Updates the release fixture and removes a deleted-file classification case.
scripts/​nvx_tools/​release.py	Stops requiring the deleted entry helper.
scripts/​nvx_tools/​build.py	Removes helper installation and customization inputs; preserves bashrc installation.
scripts/​nvx_tools/​build_constants.py	Removes the Alpine-specific guest directory constant and source entry.
guest/​alpine/​nvx-container-launch	Deletes the unused container launcher.
guest/​alpine/​nvx-container-enter	Deletes the unused container entry helper.
doc/​setup.md	Removes deleted helpers from lint and formatting commands.
doc/​project-structure.md	Removes obsolete directory and helper descriptions.
.github/​actions/​check-quality/​action.yml	Removes deleted helpers from ShellCheck and shfmt lists.
.github/​actions/​build-guest-artifacts/​action.yml	Removes guest/alpine/** from Alpine cache inputs.

_{Review effort: Balanced}