# `Hyper.Node.FireVMM.ChrootJail`
[🔗](https://github.com/harmont-dev/hyper/blob/main/lib/hyper/node/fire_vmm/chroot_jail.ex#L1)

Places a VM's boot artifacts inside its jailer chroot and points the boot spec
at them.

firecracker runs chrooted, so the kernel (a regular file) is hardlinked/copied
in and the writable rootfs (a block device) gets a matching device node
`mknod`-ed in - both chowned to the jail uid/gid via the setuid helper. The
resolved `BootSpec.Cold` carries HOST paths; `stage/4` stages them into the
chroot and returns a copy whose kernel + rootfs paths are the in-jail
(chroot-relative) equivalents the chrooted firecracker can open.

# `stage`

```elixir
@spec stage(
  Hyper.Vm.Id.t(),
  non_neg_integer(),
  non_neg_integer(),
  Hyper.Node.FireVMM.BootSpec.Cold.t()
) ::
  {:ok, Hyper.Node.FireVMM.BootSpec.Cold.t()} | {:error, term()}
```

Stage `cold`'s host kernel + rootfs device into `vm_id`'s chroot (owned
`uid:gid`), and return `cold` with its kernel + rootfs paths rewritten to their
in-jail equivalents. Fails the boot if either artifact cannot be staged.

---

*Consult [api-reference.md](api-reference.md) for complete listing*