Recipes lack a top-level matrix of supported kernel versions

[hty993]

Looking at the recipes/ ecosystem (16 entries), each has its own README.md and build.sh. The ROADMAP.md references kernel vmlinux-6.1.141 in the M2 example. The packaging/k8s/ README presumably has its own assumed kernel.

Nowhere in the repo top-level docs (README.md, DESIGN.md, CHANGELOG.md) did I find a "supported kernel versions" matrix. Forkd is fundamentally a Firecracker user, and Firecracker is kernel-sensitive (the snapshot format depends on KVM ABI versions; some kernel CVEs explicitly broke Firecracker compatibility).

A small table would help:

## Supported kernel matrix

| Kernel | Status | Notes |
|---|---|---|
| 6.1.x  | tested | Recommended baseline |
| 6.6.x  | tested | LTS, preferred for production |
| 6.8.x  | partial | Snapshot restore broken on 6.8.0–6.8.4, fixed in 6.8.5 |
| 6.11.x | untested | |

The recipe builds are silent about which kernel each parent was warmed against, which makes the question "will this snapshot still restore on my host kernel?" answerable only by trying.

Severity: Low — but a footgun for anyone trying to deploy in a heterogeneous fleet.

[WaylandYang]

Thanks @hty993 — real gap, fixed in #245.

One clarification that's worth making explicit, because it changes the shape of the answer: there are two kernels, and only the host is your variable.

• Guest kernel — forkd ships and pins vmlinux-6.1.141 (Firecracker's CI image). Every snapshot is taken and restored against this same guest kernel, so it's identical on every host. The guest kernel is never the reason a snapshot won't restore elsewhere — which is the core of your "will this restore on my host kernel?" question. The recipes aren't silent about their guest kernel so much as they all share the one forkd installs.
• Host kernel — this is where the version sensitivity you're describing actually lives. forkd needs ≥5.7 for live BRANCH (UFFDIO_WRITEPROTECT on memfd; forkd doctor probes it) and any KVM-capable kernel for basic fork / Diff BRANCH. Tested on 6.14; the packaging/k8s/ example targets 6.14 too (you guessed it has an assumed kernel — it does, and it's documented).

On the specific table you proposed: I left out the per-version rows (6.6.x, 6.8.x — restore broken on 6.8.0–6.8.4, 6.11.x) because I couldn't source those claims in this repo or attribute them to an upstream FC issue, and a kernel matrix is exactly the kind of doc a fleet operator trusts for a go/no-go call — so I'd rather point at Firecracker's own kernel-support policy for the authoritative host-kernel ABI matrix than ship a copy that could be wrong or drift. If you have the FC issue/CVE behind the 6.8.0–6.8.4 restore breakage, link it and I'll fold it in — that'd be a genuinely useful addition.

(Minor: ROADMAP.md doesn't actually reference a kernel version, and it's 17 recipes, not 16 — but the underlying point stands and the matrix needed to exist.)