refactor(backend): read the arm64 guest kernel in-process via go-diskfs, no loopback mount

[pilat]

On linux/arm64 fleetbox boots stock cloud images by direct kernel boot: it pulls the guest image's own vmlinuz/initrd out of the raw root disk before launching the VM. That extraction used to loopback-mount the disk — losetup --partscan, udevadm settle, mount, umount, losetup --detach. It was the last shell-out left in the Linux backend after ADR-0025 removed all the networking ones, and it carried the same costs: it needed those binaries on PATH and root to run, it mutated global host state (a loop device and a kernel mount) that leaked if the holder was SIGKILL'd mid-extraction, and it papered over a udev race with sleeps.

This replaces the extraction mechanism with an in-process, pure-Go read of the raw image via go-diskfs (the surgical backend/file + partition/gpt + filesystem/ext4 set): open the disk read-only, walk the partition table, read each partition as ext4 until one yields a kernel, copy out the kernel (gunzipping a gzip Image) and initrd via an atomic temp+rename. No loopback mount, no shell-out, no global host state to leak on SIGKILL, no root needed for extraction. The direct-boot decision and the boot ABI are unchanged — same --kernel/--initramfs/--cmdline, same cached output next to the disk. The extracted kernel and initrd are byte-identical to the old loopback extraction, re-proven on the pinned debian-12 arm64 image.

The pure search/copy logic lives in a new untagged bootextract.go so it is unit-testable on the macOS dev box (the same split the package already uses for purehelpers.go); the go-diskfs wiring stays in the linux && arm64 file, so go-diskfs links into that binary alone and google/uuid is the only new external module. go-ext4fs stays the fixture writer (bumped to v1.0.2). This raises the module's minimum Go to 1.25 (go-diskfs v1.9.3 requires it).

Heads-up for reviewers: there is no CI lane for the nested arm64 path — vm-linux.yml runs the amd64 firmware path (boot_amd64.go) and does not exercise this code. It was validated locally: the seam unit tests, the byte-identical sha256 re-proof, and the make test-vm nested dogfood on M3+/macOS-26 hardware.

Checklist

• Changed the public API, package list, CLI surface, on-disk layout, or dependencies → ARCHITECTURE.md updated in this PR
• Made a new, hard-to-reverse design decision → added an ADR under docs/adr/ (next sequential number)
• Breaking change (! in the title) → the description spells out what callers must change

[coderabbitai]

Warning

Review limit reached

@pilat, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 11 minutes and 12 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 048e4eee-dd77-4527-b538-af4ff1e8524c

📥 Commits

Reviewing files that changed from the base of the PR and between e24ec47 and 8131c4a.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (8)

• ARCHITECTURE.md
• docs/adr/0015-fixture-payload-ext4.md
• docs/adr/0024-arm64-direct-kernel-boot.md
• docs/adr/0027-arm64-kernel-extraction-in-process.md
• go.mod
• internal/backend/cloudhypervisor/boot_arm64.go
• internal/backend/cloudhypervisor/bootextract.go
• internal/backend/cloudhypervisor/bootextract_test.go

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/arm64-kernel-extraction-in-process

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}