Repository navigation
feat(cli): expose --disk-size / --network / --entrypoint flags - #620
Conversation
Adds the `--disk-size <GB>` CLI flag for `boxlite run` (and any
subcommand that flattens `ResourceFlags`), wired straight into
`BoxOptions.disk_size_gb`. The field already existed end-to-end
in the runtime (`src/boxlite/src/runtime/options.rs:324` →
`src/boxlite/src/litebox/init/tasks/container_rootfs.rs::create_cow_disk`
sizes the COW overlay to `max(user_size, base_image_size)`) but was
only reachable via the REST API. CLI users had no way to grow the
writable rootfs past the base image, which is fine for one-shot
workloads but immediately ENOSPCs for anything that pulls multiple
images, runs `apt install`, builds wheels, or otherwise writes more
than a few hundred MB inside the box.
The motivating consumer is the agent-workflow dind integration
tests added in a follow-up commit — they need 5-10 GB of in-box
disk for sequential `docker pull`s, named-volume writes, and
container-lifecycle scratch. Without this flag those tests would
silently fail mid-pull and the breakage would look like a flaky
registry, not a missing size declaration.
Two new lib unit tests pin:
- `--disk-size 10` reaches `BoxOptions.disk_size_gb`
verbatim through `ResourceFlags::apply_to`
- omitting the flag leaves `disk_size_gb = None`, preserving
the documented "size to base image" default and guarding
against a refactor that injects a fallback (`unwrap_or(N)`)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Two more runtime knobs that were reachable over REST/SDK but had no CLI
flag, wired the same plumbing-only way as --disk-size:
- `--network <enabled|disabled>` + `--allow-net <HOST>` (repeatable):
builds NetworkConfig{mode, allow_net} → NetworkSpec::try_from, exactly
mirroring the REST build_box_options mapping (single source of truth,
including the disabled+allow_net rejection). `--network disabled` gives
a no-eth0 box; `--allow-net` sets an egress allowlist (implies enabled).
- `--entrypoint <EXEC>`: overrides the image entrypoint as a single-token
argv → BoxOptions.entrypoint, which container_rootfs applies as
config.entrypoint. Mirrors `docker run --entrypoint`.
Both run and create get the flags (NetworkFlags flattened in each;
entrypoint via ProcessFlags for run and a standalone arg for create).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThree new CLI flag groups are added: ChangesCLI flag additions and command wiring
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Adds three
boxlite run/createflags that the runtime and REST API already supported but the CLI never exposed.--disk-size <GB>--network <enabled|disabled>+--allow-net <HOST>(repeatable)--entrypoint <EXEC>Both
runandcreateget all three.Test plan
10 unit tests on the flag →
BoxOptionsplumbing (src/cli/src/cli.rs), each crossing the realapply_toboundary (value comes from the flag struct, not the assertion):--disk-size..._plumbed(Some(10)verbatim),..._default_unset(None)--network/--allow-net..._default_left_untouched,..._disabled,..._allow_net_implies_enabled,..._disabled_with_allow_net_is_rejected,..._invalid_mode_is_rejected--entrypoint..._override(Some(vec!["/bin/bash"])),..._default_none(None)Verification (this host):
cargo nextest run -p boxlite-cli -E 'test(network_flags) or test(entrypoint) or test(resource_flags) or test(disk_size)'— 10 passed.make clibuilds clean;make fmt:check:rust+cargo clippy -p boxlite-cli --bins --testsclean.Before, these knobs were REST/SDK-only; after,
boxlite run/createexpose them with the same validation as the REST path.Summary by CodeRabbit
Release Notes
New Features
--entrypointflag to override container entrypoint configuration.--disk-sizeflag to specify container disk allocation (in GB).--networkflag to control network mode and--allow-netflag for allowlist-based network access.Tests