Autumn LiuandClaude Sonnet 5 a12c18386d actually bind /dev/kvm into the container, and test it initializes ...

DeviceAllow= only grants cgroup permission to open a device node - it
doesn't create one, and nspawn can't mknod a device inside a user
namespace. The node needs an explicit bind from the host as well, so
both are required together.

Also add a test that actually boots qemu-system-x86_64 -enable-kvm
(no disk, killed by timeout) and checks for "Permission denied" /
"Could not access KVM" in its output, rather than just checking the
node opens - a wrong-gid or unmapped node still opens but fails the
ioctls qemu needs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dzy7tEKLCFFXD96LmR8we3

2026-09-13 20:23:36 -05:00

..

server-n0

actually bind /dev/kvm into the container, and test it initializes

2026-09-13 20:23:36 -05:00