Linux image setup currently runs package provisioning and downloaded agent installers inside a host-side chroot. The files are installed into the future guest rootfs, but installer and package-maintenance code executes using the host kernel before Firecracker starts. This makes the selected provisioning sources trusted host setup dependencies.
Move Linux image provisioning into a temporary Firecracker builder VM, following the existing Lima builder approach. This would put provisioning code behind the same VM isolation boundary used for agent execution and reduce the host exposure from a compromised installer or package script.
This is a defense-in-depth improvement to the existing Linux setup architecture, not a confirmed injection vulnerability introduced by Grok support. The discussion arose while reviewing #473, which adds another downloaded installer to that setup flow. Track this independently of that PR.
Proposed approach:
- Prepare the minimal bootable rootfs and access needed to start a temporary Firecracker builder.
- Run package installation, agent installers, configured provisioning scripts, and image cleanup inside the builder VM. Define the minimal preparation that must remain on the host explicitly.
- Give the builder only the network access needed for provisioning; do not forward user credentials or expose the user's workspace by default.
- Verify provisioning completed and required binaries are runnable before publishing an image.
- Shut down the builder before publishing its disk as the golden image, preserving the existing image and metadata if the build fails.
- Bound build time and clean up the VM process, mounts, networking, temporary files, and disks on success, failure, timeout, and interruption. Account for concurrent builds.
Acceptance criteria:
- Linux package and downloaded-agent installation runs inside Firecracker rather than the host chroot.
- Existing profiles and setup options retain their documented behavior, with any compatibility changes made explicit.
- Integration coverage exercises successful builds, failed provisioning, timeout/interruption cleanup, and creation of a working instance from the resulting image.
- Setup and trust-model documentation clearly distinguish the remaining host preparation from VM-contained provisioning.
Relevant implementation: src/setup.rs (build_template, install_guest_packages) and src/lima.rs (run_builder_vm).
Linux image setup currently runs package provisioning and downloaded agent installers inside a host-side chroot. The files are installed into the future guest rootfs, but installer and package-maintenance code executes using the host kernel before Firecracker starts. This makes the selected provisioning sources trusted host setup dependencies.
Move Linux image provisioning into a temporary Firecracker builder VM, following the existing Lima builder approach. This would put provisioning code behind the same VM isolation boundary used for agent execution and reduce the host exposure from a compromised installer or package script.
This is a defense-in-depth improvement to the existing Linux setup architecture, not a confirmed injection vulnerability introduced by Grok support. The discussion arose while reviewing #473, which adds another downloaded installer to that setup flow. Track this independently of that PR.
Proposed approach:
Acceptance criteria:
Relevant implementation:
src/setup.rs(build_template,install_guest_packages) andsrc/lima.rs(run_builder_vm).