Support vAccel/vsock Integration for Cloud Hypervisor

[Nachiket-Roy]

Current Behavior

vAccel (vsock) support is only wired up and validated for Firecracker and QEMU.
pkg/unikontainers/hypervisors/cloud_hypervisor.go already implements the Cloud Hypervisor VMM, but the vAccel/vsock config validation function (isValidVSockAddress) only accepts "firecracker" and "qemu" as valid hypervisor values when vAccelType == "vsock". Requesting Cloud Hypervisor with vAccel enabled is currently rejected/unsupported.

Why Cloud Hypervisor Fits the Existing Pattern

Cloud Hypervisor implements vsock the same way Firecracker does "mapping guest vsock traffic to a host-side Unix domain socket". This means it can follow the same integration approach already used for Firecracker, without needing a new transport mechanism.

What I've Done

I've implemented and locally tested a Cloud Hypervisor vsock validation path mirroring Firecracker's approach. Verification steps and result below.

Step 1: Install Cloud Hypervisor

Ensure the latest cloud-hypervisor static binary is installed on the host and configured with the necessary capabilities:

wget https://github.com/cloud-hypervisor/cloud-hypervisor/releases/download/v52.0/cloud-hypervisor-static
chmod +x cloud-hypervisor-static
sudo setcap cap_net_admin+ep ./cloud-hypervisor-static
sudo mv cloud-hypervisor-static /usr/local/bin/cloud-hypervisor

Step 2: Set Up Host-Side vAccel RPC Agent & Bridge

1. Start the vAccel RPC agent on the host listening on TCP port 65500:

   export LD_LIBRARY_PATH=/path/to/vaccel/usr/lib/x86_64-linux-gnu
   export VACCEL_PLUGINS=/path/to/vaccel/usr/lib/x86_64-linux-gnu/libvaccel-noop.so
   export VACCEL_LOG_LEVEL=4
   vaccel-rpc-agent -a tcp://127.0.0.1:65500

2. Start socat to bridge the host Unix socket file to the TCP port:

   socat UNIX-LISTEN:/tmp/vaccel.sock_2049,fork,mode=777 TCP4:127.0.0.1:65500

Step 3: Run the Test Container

Run the container using ctr, specifying cloud-hypervisor as the hypervisor and the Unix socket address for vAccel:

sudo ctr run --rm --runtime io.containerd.urunc.v2 \
  --annotation com.urunc.unikernel.hypervisor="cloud-hypervisor" \
  --annotation com.urunc.unikernel.vAccel="vsock" \
  --annotation com.urunc.unikernel.RPCAddress="unix:///tmp/vaccel.sock_2049" \
  harbor.nbfc.io/nubificus/ubuntu-vaccel-urunc-qemu:x86_64 \
  vaccel-test-ch \
  /usr/bin/classify /usr/share/vaccel/images/example.jpg 1

Step 4: Result — Confirmed Working

The execution successfully offloaded the classification task to the host agent over vsock, producing the observed output:

2026.07.04-10:55:49.42 - <info> vAccel 0.7.1-51-499fc2f7
2026.07.04-10:55:49.43 - <info> Registered plugin rpc 0.2.1-10-3d4d748c
Initialized session with id: 1
classification tags: This is a dummy classification tag!
classification imagename: This is a dummy imgname!

Ask

I'd like the maintainer to confirm this is the right direction (matching Firecracker's validation pattern) before I open a PR.