GeezerVison

What this does

Adds generic read-only verity data volumes to CVMs. An operator builds or wraps a filesystem image, places it in the VMM's configured volumes_dir, and attaches it by name at deploy time. The guest discovers the disk, verifies it against the root measured in app-compose.json, and mounts it read-only at the requested absolute path.

How it fits together

• dstack verity --dir <path> packs a directory into a reproducible squashfs volume.
• dstack verity --fs-image <path> wraps an existing filesystem image.
• Each disk uses a generic DSTACK_VOLUME envelope in partition 1, filesystem data in partition 2, and the dm-verity superblock/hash tree in partition 3.
• The VMM resolves bare volume names under cvm.volumes_dir and attaches the raw disks read-only.
• The guest dstack-volume helper scans /sys/class/block, matches the full root, opens the disk with veritysetup using the measured root, and mounts it before the application starts.
• Attestation binds verity_root and target through app-compose.json and therefore the measured app_id.

Example:

dstack verity --dir ./models -o models.img
dstack deploy -c docker-compose.yaml \
  --volume models.img:<verity-root>:/run/models

See docs/verity-volumes.md.

Why Docker image seeding is not included

An earlier version injected pre-extracted layers directly into Docker's private overlay2 state. That couples the feature to Docker internals (imagedb, layerdb, overlay2, and repository metadata) and creates unsafe lifecycle edge cases: bind mounts disappear on reboot while Docker metadata persists, pulled images may share layers with verity-seeded images, and removing or changing a volume can leave existing images or containers with dangling layer references.

Safely reconciling that state would require ownership tracking and Docker-specific graph cleanup, while a custom containerd snapshotter would be a substantially larger and less mature integration. This PR therefore keeps the trust and lifecycle boundary simple: it only exposes verified, read-only data filesystems and does not modify Docker image state.

Validation

• cargo clippy -p dstack-volume --all-targets -- -D warnings
• cargo clippy -p dstack-cli --all-targets -- -D warnings
• cargo test -p dstack-volume -p dstack-cli -p dstack-types
• cargo test -p dstack-vmm --no-fail-fast
• End-to-end local volume build with dstack verity --dir