introduce requirements.nesting for images

doc/api-extensions.md

@@ -2400,3 +2400,7 @@ This adds `balanced` as a new value for `limits.cpu.nodes`.
 When set to `balanced`, Incus will attempt to select the least busy NUMA
 node at startup time for the instance, trying to keep the load spread
 across NUMA nodes on the system.
+
+## `image_restriction_nesting`
+
+This extension adds a new image restriction, `requirements.nesting` which when `true` indicates that an image cannot be run without nesting.

doc/image-handling.md

@@ -58,5 +58,6 @@ Key                                         | Type      | Default      | Descrip
 :--                                         | :---      | :------      | :----------
 `requirements.cdrom_agent`                  | bool      | -            | If set to `true`, indicates that the VM requires an `agent:config` disk be added.
 `requirements.cgroup`                       | string    | -            | If set to `v1`, indicates that the image requires the host to run cgroup v1.
+`requirements.nesting`                      | bool      | -            | If set to `true`, indicates that the image cannot work without nesting enabled.
 `requirements.privileged`                   | bool      | -            | If set to `false`, indicates that the image cannot work as a privileged container.
 `requirements.secureboot`                   | bool      | -            | If set to `false`, indicates that the image cannot boot under secure boot.

internal/server/instance/drivers/driver_lxc.go

@@ -2626,6 +2626,21 @@ func (d *lxc) onStart(_ map[string]string) error {
 	return nil
 }
 
+// validateStartup checks any constraints that would prevent start up from succeeding under normal circumstances.
+func (d *lxc) validateStartup(stateful bool, statusCode api.StatusCode) error {
+	err := d.common.validateStartup(stateful, statusCode)
+	if err != nil {
+		return err
+	}
+
+	// Ensure nesting is turned on for images that require nesting.
+	if util.IsTrue(d.localConfig["image.requirements.nesting"]) && util.IsFalseOrEmpty(d.expandedConfig["security.nesting"]) {
+		return fmt.Errorf("The image used by this instance requires nesting. Please set security.nesting=true on the instance")
+	}
+
+	return nil
+}
+
 // Stop functions.
 func (d *lxc) Stop(stateful bool) error {
 	d.logger.Debug("Stop started", logger.Ctx{"stateful": stateful})

internal/version/api.go

@@ -404,6 +404,7 @@ var APIExtensions = []string{
 	"oidc_claim",
 	"device_usb_serial",
 	"numa_cpu_balanced",
+	"image_restriction_nesting",
 }
 
 // APIExtensionsCount returns the number of available API extensions.