[shiju-nv]

Summary

Resolve VM requirements against the selected backend's capabilities and allow CPU-only QEMU launches with external kernels. Keep PCI/GPU assignment separate, reject unsupported host/kernel/transport inputs before compute starts, and preserve the assigned GPU through before-launch hooks.

Related Issue

Closes #5372

Prerequisite: #5376, which fixes #5373. This branch includes that patch so the new direct-kernel path has the required guest bootstrap setup. Merge the fd-link fix first.

Changes

• Honor explicit backend requirements and check features against each backend's support.
• Build CPU-only QEMU commands with vsock and no VFIO device; retain existing GPU sizing and devices.
• Preflight Linux x86_64 host support, external kernel headers and transport/device prerequisites.
• Reject before-launch hooks that clear or replace a GPU assignment.
• Share kernel preflight across workload and image-preparation launcher entry; keep preparation on its libkrun bootstrap backend.
• Document supported combinations and add regression coverage.

Release Notes

Testing

All 282 VM crate library tests passed on macOS, along with scoped all-targets Clippy and formatting. Three targeted mutations restored the old CPU/GPU restrictions or disabled the GPU-hook guard; each matching regression failed as expected. Tests cover CPU-only kernel selection and QEMU arguments, explicit conflicts, invalid kernel headers, both launcher modes, unsupported hosts and post-hook GPU assignment.

Fern docs and navigation checks passed with three warnings in unchanged gateway MDX, remote redirect access and theme contrast. The prerequisite fd patch passed its seven-case Linux namespace regression and fresh Firecracker/libkrun Ready/exec integration checks. Actual CPU-only QEMU Ready on Linux x86_64/KVM has not been tested on this Mac.

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[github-actions]

Label test:e2e applied for 45971ad. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[elezar]

Maybe a naive question: Should this be handled at a driver level, or should this be exposed as a driver capability for a gateway to check?

[shiju-nv]

I think driver-side validation is the right place for this PR’s fix. If we want earlier gateway checks, we could add a driver preflight API as a follow-up. The driver needs to incorporate requirements from operator-installed extensions before it can resolve the backend and validate the final launch plan.