Research whether the Firecracker vsock device is needed

Observation

At commit df5909c, src/vm.rs::build_config unconditionally adds a vsock device to every Firecracker VM. Instance helpers derive its CID and host socket path, and lifecycle cleanup removes the socket. A repository search found configuration, cleanup, documentation, and tests, but no coop runtime consumer of this transport. Workspace transfers, agent sessions, and the credential proxy use SSH.

This suggests the device may expose unnecessary guest-accessible VMM functionality. This is a source-inspection finding, not a demonstrated vulnerability; external consumers or undocumented dependencies have not been ruled out.

Research scope

• Confirm whether any supported workflow, guest service, integration fixture, or external integration depends on the Firecracker vsock device.
• Determine whether the device can be omitted by default, removed entirely, or made explicit opt-in for an identified use case.
• Check behavior for existing persisted VM configurations and across start, restart, restore, reprovision, and destroy.
• Keep the scope specific to Firecracker. Lima may use vsock internally for its own guest agent and must be assessed independently.

Expected outcome

Document the consumer inventory and recommend retaining, removing, or gating the device with concrete reasons. If removal is proposed, validate the full Linux lifecycle, workspace transfers, agent launches, and proxy operation without it. Update affected configuration tests and docs, and state any compatibility impact. Do not claim an exploit or quantified security improvement without evidence.

Start with src/vm.rs::build_config and trace the vsock CID, host socket path, cleanup, configuration, documentation, and tests. Audit supported workflows and integrations across start, restart, restore, reprovision, and destroy, while assessing Lima separately. Done means a documented consumer inventory, a retain/remove/opt-in recommendation, and lifecycle validation with compatibility impacts recorded.