Add debug logging for nitro enclaves #504
Merged
+141
−61
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The debug enclave argument will direct the enclave to print kernel+initramfs debug logs in addition to application output. Rather than submitting the nitro start flags within the API, use the setting of debug to enable the enclave's debug start flag. Signed-off-by: Tyler Fanelli <tfanelli@redhat.com>
Signed-off-by: Tyler Fanelli <tfanelli@redhat.com>
We currently don't support user input via stdin. As such there's no need to redirect stdin to the output vsock. Signed-off-by: Tyler Fanelli <tfanelli@redhat.com>
The enclave's output proxy requires a signal from the enclave notifying it to stop listening for output and terminate the connection. Close the output vsock within the enclave to send this signal. Signed-off-by: Tyler Fanelli <tfanelli@redhat.com>
Rather than rebooting, exit the init process. This will likely cause a kernel panic and result in a "reboot" (according to the kernel, but likely a termination by the nitro hypervisor). Signed-off-by: Tyler Fanelli <tfanelli@redhat.com>
tylerfanelli
requested review from
MatiasVara,
jakecorrenti,
mtjhrc and
slp
as code owners
Signed-off-by: Tyler Fanelli <tfanelli@redhat.com>
Signed-off-by: Tyler Fanelli <tfanelli@redhat.com>
jakecorrenti
reviewed
Jan 8, 2026
Member
jakecorrenti
left a comment
jakecorrenti
left a comment
There was a problem hiding this comment.
Just one slight improvement that I think would improve overall readability
jakecorrenti
approved these changes
Jan 9, 2026
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR enables nitro enclave guest kernel and initramfs debug logs via
krun_set_log_level(KRUN_LOG_LEVEL_DEBUG). For those looking to try for themselves, a--debugflag was added to the nitro example. Enabling this flag will enable debug output from the enclave.