Can´t run Apache Iggy (with IO_uring) in msb

[victorolinasc]

Hello! Awesome project! Thanks a lot for all your work!

Issue

I am trying to run apache/iggy:0.8.0 using msb run --conf iggy-sandbox.yaml --replace --name iggy and it fails. Logs:

❯ msb logs --source system iggy
INFO microsandbox_runtime::vm: sandbox starting sandbox=iggy
INFO microsandbox_runtime::relay: agent relay listening on /home/myuser/.microsandbox/run/sandboxes/fed1abbfaa7d7647d2445e7e/agent.sock
INFO microsandbox_runtime::vm: entering VM sandbox=iggy
INFO microsandbox_runtime::vm: host placement acknowledged before guest execution pinned_vcpus=0 inherited_vcpus=4 memory=Inherited
[    0.391714] genirq: Flags mismatch irq 8. 00200000 (rtc0) vs. 00200080 (virtio3)
[    0.391936] rtc_cmos rtc_cmos: probe with driver rtc_cmos failed with error -16
agentd: init failed: exec session error: guest user not found: iggy
INFO msb_krun_vmm: Vmm is stopping.
--- sandbox stopped ---

Context

I can run other images wihtout problem (I have kvm enabled and everything else).

Iggy uses IO_uring and its container configuration is a bit scary. Here is the example from their compose.yaml:

services:
  iggy-server:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: iggy-server
    restart: unless-stopped
    cap_add:
      - SYS_NICE
    security_opt:
      - seccomp:unconfined
    ulimits:
      memlock:
        soft: -1
        hard: -1
    networks:
      - iggy
    ports:
      - 3000:3000
      - 8080:8080
      - 8090:8090
      - 8092:8092
    volumes:
      - iggy-server:/local_data

volumes:
  iggy-server:
    driver: local

networks:
  iggy:
    name: iggy-network

So, I would like to avoid disabling seccomp and everything on my host and use a guest kernel for that. Also the cappabilities hook for adding SYS_NICE and the unbounded limits I would also like to do on a guest kernel instead of mine.

Does this make sense? There are other such similar services that need these kind of kenerl APIs (TigerBeetle for one) and it would be nice to have it working on msb. It seems like a great example of the isolation and could even become an example in the repo/docs.

Thanks in advance!