Open source
What runs inside your virtual machines, and what reads the images you hand us, is open for anyone to read, build and reuse under the Apache License 2.0.
virtainer-guest-agent
The Virtainer Guest Agent (VGA): a single static binary that speaks the QEMU Guest Agent protocol over vsock. Address reporting, filesystem freeze for consistent snapshots, onlining of hot-added CPUs and memory, and an interactive shell, with no network access needed inside the guest.
Rust · Apache-2.0 · Source on GitHub
cloud-image-inspector
Read-only inspection of cloud disk images without booting or mounting them: qcow2 and raw, GPT and MBR, ext4, XFS and btrfs, and the apk, dpkg, pacman and RPM package databases. It reports the operating system and the facts that decide how first-boot configuration has to be written. No dependencies beyond the Rust standard library.
Rust · Apache-2.0 · Source on GitHub
Reporting a security issue
Each repository accepts private vulnerability reports through GitHub: open the repository'sSecurity tab and choose Report a vulnerability. Please do not open a public issue for a security problem.