package grpc

Get desktop application:
View/edit binary Protocol Buffers messages

• rpc AdoptContainer (AdoptContainerRequest, AdoptContainerResponse)

  sandbox.proto:39

  Resume mode: rename an orphan container to the new containerd-assigned ID so the running process is adopted instead of duplicated.

  message AdoptContainerRequest

  sandbox.proto:141

  • string old_id = 1

  • string new_id = 2

  message AdoptContainerResponse

  sandbox.proto:146

  (message has no fields)

• rpc Check (CheckRequest, google.protobuf.Empty)

  sandbox.proto:31

  vm

  message CheckRequest

  sandbox.proto:57

  • string service = 1

• rpc CheckInjectSocket (CheckInjectSocketRequest, CheckInjectSocketResponse)

  sandbox.proto:54

  WarmFork: verify all readiness sockets are open and workloads speak the expected protocol version. The guest agent probes each target: connects, reads CAPABILITIES, then closes the connection. Each workload receives EOF and loops back to accept(), ready for the real injection after restore.

  message CheckInjectSocketRequest

  sandbox.proto:186

  WarmFork: pre-snapshot readiness socket probe. Targets to probe. For single-container mode this has exactly one entry.

  • repeated InjectTarget targets = 1

  message CheckInjectSocketResponse

  sandbox.proto:190

  • repeated TargetCheckResult results = 1

    Per-target results, in the same order as CheckInjectSocketRequest.targets.

• rpc ExecVMProcess (ExecVMProcessRequest, ExecVMProcessResponse)

  sandbox.proto:32

  message ExecVMProcessRequest

  sandbox.proto:61

  • string command = 1

  • bytes stdin = 2

  message ExecVMProcessResponse

  sandbox.proto:66

  • string out = 1

• rpc GetEvents (google.protobuf.Empty, containerd.services.events.ttrpc.v1.Envelope)

  sandbox.proto:34

• rpc InjectTask (InjectTaskRequest, InjectTaskResponse)

  sandbox.proto:48

  WarmFork: deliver task parameters to all ready-waiting workload processes via the two-phase PREPARE/READY/COMMIT/STARTED protocol. The guest agent enters each container's mount namespace (via setns) before connecting to its readiness socket.

  message InjectTaskRequest

  sandbox.proto:252

  WarmFork: task parameters delivered to all ready-waiting workload processes. The guest agent implements the two-phase PREPARE/READY/COMMIT/STARTED protocol.

  • repeated ContainerTask tasks = 1

    One entry per workload target.

  • uint32 prepare_timeout_ms = 2

    Phase-1 timeout in milliseconds (waiting for all READY replies).

  • uint32 commit_timeout_ms = 3

    Phase-2 timeout in milliseconds (waiting for all STARTED replies after COMMIT).

  message InjectTaskResponse

  sandbox.proto:261

  • repeated ContainerInjectResult results = 1

    Per-target results, in the same order as InjectTaskRequest.tasks.

• rpc ReseedEntropy (ReseedEntropyRequest, google.protobuf.Empty)

  sandbox.proto:43

  Snapshot restore: inject fresh host-generated entropy into the guest to prevent duplicate random state across VMs restored from the same snapshot.

  message ReseedEntropyRequest

  sandbox.proto:149

  • bytes seed = 1

• rpc SetupSandbox (SetupSandboxRequest, google.protobuf.Empty)

  sandbox.proto:35

  message SetupSandboxRequest

  sandbox.proto:135

  • optional google.protobuf.Any config = 1

  • repeated Interface interfaces = 2

  • repeated Route routes = 3

• rpc SyncClock (SyncClockPacket, SyncClockPacket)

  sandbox.proto:33

  message SyncClockPacket

  sandbox.proto:76

  SyncClockPacket is the data struct for time syncing ttrpc call SyncClock is a two step ttrpc call, the first call with a zero delta, is to determine the time offset between host and guest, client will calculate the offset and set it to Delta, call SyncClock again, process inside the vm will set the guest time to add the Delta to the current time the ClientSendTime/ClientArriveTime/ServerSendTime/ServerArriveTime are all in nanosecond.

  • int64 ClientSendTime = 1

  • int64 ClientArriveTime = 2

  • int64 ServerSendTime = 3

  • int64 ServerArriveTime = 4

  • int64 Delta = 5

• rpc UpdateInterfaces (UpdateInterfacesRequest, google.protobuf.Empty)

  sandbox.proto:27

  networking

  message UpdateInterfacesRequest

  sandbox.proto:127

  • repeated Interface interfaces = 1

• rpc UpdateRoutes (UpdateRoutesRequest, google.protobuf.Empty)

  sandbox.proto:28

  message UpdateRoutesRequest

  sandbox.proto:131

  • repeated Route routes = 1

Per-target result of InjectTask.

Used in: InjectTaskResponse

• string container_id = 1

• InjectStatus status = 2

• InjectPhase phase = 3

  Which phase this result belongs to; use this, not enum ordinal.

• string message = 4

Per-container task parameters for injection.

Used in: InjectTaskRequest

• string container_id = 1

  Used for mount-namespace entry.

• string socket_path = 2

  Absolute path of the readiness socket inside the container's mount namespace.

• string task_id = 3

  Non-empty; same value for all targets in one restore.

• map<string, string> env_overrides = 4

  Per-target effective env overrides (pod-level merged with per-container).

• string context = 5

  Per-target effective context.

Used in: Interface

• IPFamily family = 1

• string address = 2

• string mask = 3

Used in: IPAddress, Route

• v4 = 0

• v6 = 1

Which protocol phase the result belongs to, so the host can choose the correct action (rollback vs. VM stop) without relying on enum ordinals.

Used in: ContainerInjectResult

• INJECT_PHASE_PREPARE = 0

  Failure before COMMIT was sent (connect / setns / PREPARE exchange).

• INJECT_PHASE_COMMIT = 1

  Failure after COMMIT was sent (COMMIT exchange / STARTED wait).

Used in: ContainerInjectResult

• INJECT_STARTED = 0

  Workload sent STARTED; restore committed.

• INJECT_REJECT = 1

  Workload sent REJECT during PREPARE (always PHASE_PREPARE).

• INJECT_CONNECT_FAILED = 2

  Could not connect to readiness socket.

• INJECT_NAMESPACE_ERROR = 3

  setns into container's mount namespace failed.

• INJECT_PROTOCOL_ERROR = 4

  Unexpected message or parse failure.

• INJECT_TIMEOUT_PREPARE = 5

  READY never received within prepare_timeout_ms (always PHASE_PREPARE).

• INJECT_TIMEOUT_COMMIT = 6

  STARTED never received within commit_timeout_ms (always PHASE_COMMIT).

• INJECT_TARGET_NOT_FOUND = 7

  container_id not found in guest agent.

• INJECT_INTERNAL_ERROR = 8

  Any other guest-side error.

One workload container target to probe or inject.

Used in: CheckInjectSocketRequest

• string container_id = 1

  CRI container ID; guest agent uses this to enter the container's mount namespace.

• string socket_path = 2

  Absolute path of the readiness socket inside the container's mount namespace. Defaults to /run/warmfork-readiness.sock when empty.

Used in: SetupSandboxRequest, UpdateInterfacesRequest

• string device = 1

• string name = 2

• repeated IPAddress IPAddresses = 3

• uint64 mtu = 4

• string hwAddr = 5

• string type = 6

  Type defines the type of interface described by this structure. The expected values are the one that are defined by the netlink library, regarding each type of link. Here is a non exhaustive list: "veth", "macvtap", "vlan", "macvlan", "tap", ...

• uint32 raw_flags = 7

Used in: SetupSandboxRequest, UpdateRoutesRequest

• string dest = 1

• string gateway = 2

• string device = 3

• string source = 4

• uint32 scope = 5

• IPFamily family = 6

• uint32 flags = 7

Per-target result of CheckInjectSocket.

Used in: CheckInjectSocketResponse

• string container_id = 1

• TargetCheckStatus status = 2

• string message = 3

  Human-readable detail on non-OK status.

Used in: TargetCheckResult

• TARGET_CHECK_OK = 0

• TARGET_NOT_FOUND = 1

  container_id unknown to guest agent.

• NAMESPACE_ERROR = 2

  setns into container's mount namespace failed.

• CONNECT_FAILED = 3

  unix connect() to socket_path failed.

• PROTOCOL_ERROR = 4

  CAPABILITIES missing, wrong version, or malformed.