Build image for Rust and Node jobs (images/rust: toolchain, rustfmt, clippy, Node 24, vendored crates, offline cargo); flow-init finds the program in the job's PATH (glibc's execvpe used PID 1's own); network "loopback" in M0 eb5c4db673e5

# The OxygenFlow build image (backlog F1b): Rust with rustfmt and clippy,

# Node, and every crate the Oxygen projects use, vendored, because jobs

# have no network. Built by ./build.sh, which vendors the crates first.

FROM rust:1.97.1-slim-bookworm

RUN rustup component add rustfmt clippy \

 && apt-get update \

 && apt-get install -y --no-install-recommends ca-certificates xz-utils make git pkg-config \

 && rm -rf /var/lib/apt/lists/*

# The guest's PATH is fixed and has no /usr/local/cargo/bin, and a rustup

# proxy would need RUSTUP_HOME: link the toolchain's own binaries instead.

RUN tc=$(ls -d /usr/local/rustup/toolchains/*/ | head -1) \

 && for b in cargo rustc rustdoc cargo-fmt rustfmt cargo-clippy clippy-driver; do ln -sf "$tc/bin/$b" /usr/local/bin/$b; done

ARG NODE_VERSION

ARG NODE_SHA256

ADD https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz /tmp/node.tar.xz

RUN echo "${NODE_SHA256}  /tmp/node.tar.xz" | sha256sum -c - \

 && tar -xJf /tmp/node.tar.xz -C /usr/local --strip-components=1 --exclude='*/include' --exclude='*/share/doc' \

 && rm /tmp/node.tar.xz

# Cargo reads /.cargo/config.toml for anything under /, so /src uses the

# vendored crates; CARGO_HOME stays the default $HOME/.cargo (/tmp).

COPY vendor /opt/vendor

COPY cargo-config.toml /.cargo/config.toml

# The OxygenFlow build image

A root file system for Rust and Node jobs:

- Rust 1.97.1 with rustfmt and clippy.

- Node 24.21.0, checked against its published SHA-256.

- git, make and pkg-config.

- Every crate that oxygen, oxygenhub and oxygenflow use, vendored in `/opt/vendor`.

OxygenFlow jobs have no network (`network "isolated"`). So cargo is pointed at the vendored crates by `/.cargo/config.toml`, which cargo reads for any directory under `/`, including `/src`. `CARGO_HOME` stays at its default, `$HOME/.cargo`, which is under `/tmp` and writable. The toolchain's binaries are linked into `/usr/local/bin`, because the guest's `PATH` is fixed and nothing at run time needs rustup.

## Building and importing

```

images/rust/build.sh /path/to/oxygenflow-build.tar

scp /path/to/oxygenflow-build.tar claude@earth:/home/claude/flow/dl/

ssh claude@earth 'cd ~/flow && FLOW_HOME=~/flow bin/flow rootfs import dl/oxygenflow-build.tar'

```

`build.sh` vendors the crates of the three workspaces next to this repository with `cargo vendor --locked`, then builds the image. Docker is used only on the machine that builds it, as a way to assemble a file system: the image is exported as a plain tarball. On the runner, `flow rootfs import` makes an ext4 image pinned by BLAKE3, which Firecracker boots read-only.

Rebuild and re-import whenever a `Cargo.lock` of those projects changes, then pin the new hash in the pipelines that use the image. A crate missing from the image fails the job with cargo's "no matching package" error, not with a network error.

## Using it

```kdl

sandbox "rust" {

    runtime "microvm"

    rootfs "cas://blob/<hash printed by flow rootfs import>"

    memory-limit "8GiB"

    cpu-limit 4

    network "loopback"   // tests that serve on 127.0.0.1 need it; nothing leaves the guest

}

job "test" {

    sandbox "rust"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "24GiB"

    }

    env {

        CARGO_INCREMENTAL "0"

    }

    exec "cargo" "test" "--workspace"

}

```

Measured on Earth (4 cores, the job given all of them and 8 GiB): oxygen's `cargo fmt --check`, `clippy -D warnings` and `cargo test --workspace` from a cold build take 135 s.

The build tree goes on an `ephemeral://disk` mount. The workspace itself has only 512 MiB to spare, and a `tmpfs` would take the build tree out of the job's memory.

#!/bin/sh

# Build the OxygenFlow build image and write it as a root file system

# tarball for `flow rootfs import`. Run from any directory; the Oxygen

# projects are expected next to this repository (../oxygen, ../oxygenhub).

# Rebuild whenever a Cargo.lock of those projects changes.

set -eu

here=$(cd "$(dirname "$0")" && pwd)

dev=$(cd "$here/../../.." && pwd)

out=${1:-$here/oxygenflow-build.tar}

NODE_VERSION=24.21.0

NODE_SHA256=fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6

rm -rf "$here/vendor"

cargo vendor --locked --versioned-dirs \

    --manifest-path "$dev/oxygen/Cargo.toml" \

    --sync "$dev/oxygenhub/Cargo.toml" \

    --sync "$dev/oxygenflow/Cargo.toml" \

    "$here/vendor" >/dev/null

docker build -q -t oxygenflow-build \

    --build-arg NODE_VERSION=$NODE_VERSION --build-arg NODE_SHA256=$NODE_SHA256 "$here"

id=$(docker create oxygenflow-build)

docker export "$id" -o "$out"

docker rm "$id" >/dev/null

rm -rf "$here/vendor"

echo "$out"

# Crates come from the image, never the network (OxygenFlow jobs are isolated).

[source.crates-io]

replace-with = "vendored"

[source.vendored]

directory = "/opt/vendor"

[net]

offline = true

images/rust/vendor/

images/rust/*.tar

                    // Loopback only: the guest's `lo` comes up, and it still has

                    // no device that reaches anything outside it.

                    Some("loopback") => Some(Network::Loopback),

                    Some("egress") => {

                        ctx.err(c.span(), "network \"egress\" is not in M0; M0 has \"isolated\" and \"loopback\"");

#[test]

fn loopback_is_in_m0_and_egress_is_not() {

    let src = |net: &str| {

        format!("schema-version 1\nsandbox \"s\" {{\n  rootfs \"cas://blob/{ROOTFS}\"\n  network \"{net}\"\n}}\njob \"a\" {{ sandbox \"s\"; exec \"true\"; }}\n")

    };

    let p = Pipeline::parse(&src("loopback")).unwrap();

    assert_eq!(p.sandboxes["s"].network, Network::Loopback);

    assert_ne!(p.hash(), Pipeline::parse(&src("isolated")).unwrap().hash(), "the network is part of the sandbox");

    assert!(problems(&src("egress")).iter().any(|(l, m)| *l == 4 && m.contains("not in M0")));

}

    /// `network "loopback"`: bring up `lo` (the guest has no other device).

    #[serde(default)]

    loopback: bool,

    }

    Ok(())

}

/// The file `program` names: itself when it holds a `/`, otherwise the first

/// executable regular file of that name in `path`'s directories.

fn resolve_program(program: &str, path: &str) -> Option<String> {

    use std::os::unix::fs::PermissionsExt;

    if program.is_empty() {

        return None;

    }

    if program.contains('/') {

        return Some(program.to_string());

    }

    path.split(':')

        .filter(|d| !d.is_empty())

        .map(|d| format!("{d}/{program}"))

        .find(|p| std::fs::metadata(p).is_ok_and(|m| m.is_file() && m.permissions().mode() & 0o111 != 0))

}

/// Set `lo` up; the kernel gives it 127.0.0.1 and ::1 itself.

fn loopback_up() -> Result<(), String> {

    let fd = unsafe { libc::socket(libc::AF_INET, libc::SOCK_DGRAM | libc::SOCK_CLOEXEC, 0) };

    if fd < 0 {

        return Err(format!("socket for lo: {}", std::io::Error::last_os_error()));

    }

    let mut req: libc::ifreq = unsafe { std::mem::zeroed() };

    for (i, b) in b"lo".iter().enumerate() {

        req.ifr_name[i] = *b as libc::c_char;

    }

    let ok = unsafe {

        libc::ioctl(fd, libc::SIOCGIFFLAGS, &mut req) == 0 && {

            req.ifr_ifru.ifru_flags |= libc::IFF_UP as libc::c_short;

            libc::ioctl(fd, libc::SIOCSIFFLAGS, &req) == 0

        }

    };

    let err = std::io::Error::last_os_error();

    unsafe { libc::close(fd) };

    if !ok {

        return Err(format!("bring up lo: {err}"));

    if job.loopback {

        loopback_up()?;

    }

    // glibc's execvpe searches the caller's PATH, and PID 1 has none of its

    // own, so the program is found here, in the job's PATH, before forking.

    let program = cstr(&resolve_program(&job.argv[0], PATH).ok_or_else(|| format!("cannot run {:?}: not found in {PATH}", job.argv[0]))?)?;

            libc::execve(program.as_ptr(), a.as_ptr(), e.as_ptr());

    }

}

#[cfg(test)]

mod tests {

    use super::resolve_program;

    use std::os::unix::fs::PermissionsExt;

    #[test]

    fn programs_are_found_in_the_jobs_path() {

        let dir = std::env::temp_dir().join(format!("flow-init-test-{}", std::process::id()));

        let (a, b) = (dir.join("a"), dir.join("b"));

        std::fs::create_dir_all(&a).unwrap();

        std::fs::create_dir_all(&b).unwrap();

        std::fs::write(a.join("tool"), "not executable").unwrap();

        std::fs::write(b.join("tool"), "#!/bin/sh\n").unwrap();

        std::fs::set_permissions(b.join("tool"), std::fs::Permissions::from_mode(0o755)).unwrap();

        std::fs::create_dir_all(a.join("dir")).unwrap();

        let path = format!("{}::{}", a.display(), b.display());

        assert_eq!(resolve_program("tool", &path), Some(format!("{}/tool", b.display())), "skips a file that is not executable");

        assert_eq!(resolve_program("dir", &path), None, "and directories");

        assert_eq!(resolve_program("missing", &path), None);

        assert_eq!(resolve_program("./x", &path).as_deref(), Some("./x"), "a path is used as given");

        assert_eq!(resolve_program("", &path), None);

        std::fs::remove_dir_all(&dir).unwrap();

    let mut spec = guest_spec(job);

    spec["loopback"] = serde_json::Value::Bool(sandbox.network == flow_core::Network::Loopback);

    network "isolated"           // "isolated" or "loopback" in M0

   construction; `loopback` only brings up the guest's `lo`, so tests can

   serve and connect on 127.0.0.1 while nothing leaves the guest), `vcpu_count` and `mem_size_mib` from the sandbox, the

   switches root, then runs `argv` (its program found in the guest's `PATH` by

   `flow-init` itself) with exactly the job's `env` (plus