zygotectl

Overview ¶

Command zygotectl builds, pushes, pulls and inspects zygote artifacts.

zygotectl build -zygote bin/refzygote -args "--heap-mb 32" -seal-to fleet-pub.json -out out/ref
zygotectl build -zygote bin/refzygote -skip-images -out out/bare   runs it to READY, no criu, no key
zygotectl build -hyperlight-snapshot snap/ -hyperlight-helper /usr/local/bin/hyperlight-helper -seal-to fleet-pub.json -out out/hl
zygotectl push  -dir out/ref -ref http://127.0.0.1:5000/zygotes/ref:v1
zygotectl pull  -ref http://127.0.0.1:5000/zygotes/ref@sha256:... -out /tmp/ref
zygotectl inspect -dir out/ref

The digest build and push print is the grant's template_digest. The images a build takes are sealed to the fleet's public wrap key (fleet-pub.json, from grant-issuer keygen -alg A256GCM). The author holds nothing that opens them. Only homes, which hold the fleet's seal key, do.

push logs in to a registry that asks with what docker login stored for it. pull never logs in, as a home never does.