Feature: implement swtpm in runc#4855

Draft

everzakov wants to merge 29 commits into

opencontainers:mainfrom

everzakov:vtpm-clean

Commits on Aug 16, 2025

TEMP: specs: Extend specs with vTPM support

stefanberger
authored and
everzakov
committed
Add vTPM support for Linux

stefanberger
authored and
everzakov
committed
vtpm: Run swtpm with an AppArmor profile

stefanberger
authored and
everzakov
committed
use ApplyProfile instead ApplyProfileThread
everzakov
committed
vtpm: Run swtpm with an SELinux label

stefanberger
authored and
everzakov
committed
vtpm: Add test cases

stefanberger
authored and
everzakov
committed
vtpm: Get the supported capabilities of swtpm and swtpm_setup

stefanberger
authored and
everzakov
committed
vtpm: Pass startup-clear as part of flags to avoid kernel logging

stefanberger
authored and
everzakov
committed
vtpm: Add support for encrypted vTPM state

stefanberger
authored and
everzakov
committed
maskedPaths: Add /sys/devices/virtual/tpm

stefanberger
authored and
everzakov
committed
vtpm: Put vTPMs into container's cgroup

stefanberger
authored and
everzakov
committed
add tpm implementation
everzakov
committed
fix: use WriteCgroupProc func to apply swtpm pid to container's cgroup
everzakov
committed
set correct apparmor profile
everzakov
committed
fix: apparmor rule to tmp state file
everzakov
committed
fix: run vtpm tests in a docker container
everzakov
committed
cleancode: remove unused code
everzakov
committed
tests: add integration test v1
everzakov
committed
cleancode: simplify functions
everzakov
committed
vtpm: use generated device host path
everzakov
committed
vtpms: add vtpm names check
everzakov
committed
vtpm: add config to ignore vtpms errors
everzakov
committed
vtpms: use generated name to pass in user-namespaced container
everzakov
committed
vtpms: return the call of swtpm_setup and more info about errors.
everzakov
committed
vtpms: fix flaky tests
everzakov
committed
vtpms: go.mod update runtime-spec
everzakov
committed
tests: unbind test vtpms devices major minor
everzakov
committed
vtpms: pass run as to swtpm_cuse and fix chown race condition
everzakov
committed
tests: reduce time to wait tpm device and disable integration test with swtpm_cuse issue
everzakov
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature: implement swtpm in runc#4855

Feature: implement swtpm in runc#4855
everzakov wants to merge 29 commits into
opencontainers:mainfrom
everzakov:vtpm-clean

Commits on Aug 16, 2025

TEMP: specs: Extend specs with vTPM support

Add vTPM support for Linux

vtpm: Run swtpm with an AppArmor profile

use ApplyProfile instead ApplyProfileThread

vtpm: Run swtpm with an SELinux label

vtpm: Add test cases

vtpm: Get the supported capabilities of swtpm and swtpm_setup

vtpm: Pass startup-clear as part of flags to avoid kernel logging

vtpm: Add support for encrypted vTPM state

maskedPaths: Add /sys/devices/virtual/tpm

vtpm: Put vTPMs into container's cgroup

add tpm implementation

fix: use WriteCgroupProc func to apply swtpm pid to container's cgroup

set correct apparmor profile

fix: apparmor rule to tmp state file

fix: run vtpm tests in a docker container

cleancode: remove unused code

tests: add integration test v1

cleancode: simplify functions

vtpm: use generated device host path

vtpms: add vtpm names check

vtpm: add config to ignore vtpms errors

vtpms: use generated name to pass in user-namespaced container

vtpms: return the call of swtpm_setup and more info about errors.

vtpms: fix flaky tests

vtpms: go.mod update runtime-spec

tests: unbind test vtpms devices major minor

vtpms: pass run as to swtpm_cuse and fix chown race condition

tests: reduce time to wait tpm device and disable integration test with swtpm_cuse issue