vxn: fix terminal mode hang and enable interactive container support

The containerd shim's Create RPC hung indefinitely because go-runc
captures the OCI runtime's stdout via a pipe, and cmd.Wait() blocks
until all holders of the pipe's write end close it. The background
monitor subshell inherited this pipe fd and held it open, preventing
the shim from ever proceeding to ReceiveMaster() or calling Start.

Fix by closing inherited stdout/stderr in the terminal-mode monitor
with exec >/dev/null before entering the domain poll loop. Non-terminal
mode is unaffected because the shim configures IO via FIFO dup2, where
cmd.Wait() only waits for process exit.

Additional changes for terminal mode support:
- vxn-sendtty: set PTY to raw mode (cfmakeraw) before sending fd
- vxn-oci-runtime: wait up to 5s for xenconsoled PTY, capture sendtty
  return code, write persistent debug file to /root/vxn-tty-debug,
  log every runtime invocation, remove stale debug logging
- vxn-init.sh: add [vxn] diagnostic markers for terminal visibility,
  suppress kernel console messages early in interactive mode
- vcontainer-preinit.sh: suppress kernel messages in quiet mode

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>

4 files changed, 67 insertions, 17 deletions

diff --git a/recipes-containers/vcontainer/files/vcontainer-preinit.sh b/recipes-containers/vcontainer/files/vcontainer-preinit.sh
index 7d4e7072..7c0fa590 100644
--- a/recipes-containers/vcontainer/files/vcontainer-preinit.sh
+++ b/recipes-containers/vcontainer/files/vcontainer-preinit.sh
@@ -35,6 +35,10 @@ log() {
     [ "$QUIET" = "0" ] && echo "$@"
 }
 
+# Suppress kernel console messages in interactive mode so they don't
+# pollute the terminal (loop device messages bypass loglevel=0)
+[ "$QUIET" = "1" ] && { dmesg -n 1 2>/dev/null || true; }
+
 log "=== vcontainer preinit (squashfs) ==="
 
 # Wait for block devices to appear
diff --git a/recipes-containers/vcontainer/files/vxn-init.sh b/recipes-containers/vcontainer/files/vxn-init.sh
index 4b9b630a..c22fa8ea 100755
--- a/recipes-containers/vcontainer/files/vxn-init.sh
+++ b/recipes-containers/vcontainer/files/vxn-init.sh
@@ -343,9 +343,10 @@ exec_in_container() {
     if [ "$RUNTIME_INTERACTIVE" = "1" ]; then
         # Interactive mode: connect stdin/stdout directly
         export TERM=linux
-        printf '\r\033[K'
+        dmesg -n 1 2>/dev/null || true
+        echo "[vxn] chroot: $rootfs $cmd" > /dev/console 2>/dev/null
         if [ "$use_sh" = "true" ]; then
-            chroot "$rootfs" /bin/sh -c "cd '$workdir' 2>/dev/null; $cmd"
+            chroot "$rootfs" /bin/sh -c "cd '$workdir' 2>/dev/null; exec $cmd"
         else
             chroot "$rootfs" $cmd
         fi
@@ -630,6 +631,13 @@ mount_base_filesystems
 # Check for quiet boot mode
 check_quiet_boot
 
+# Interactive mode: suppress kernel console messages early (before mounts
+# that trigger loop device messages) and emit markers visible through PTY
+if [ "$QUIET_BOOT" = "1" ]; then
+    dmesg -n 1 2>/dev/null || true
+    echo "[vxn] init" > /dev/console 2>/dev/null
+fi
+
 log "=== vxn Init ==="
 log "Version: $VCONTAINER_VERSION"
 
@@ -720,6 +728,7 @@ else
     fi
 
     # Execute in container rootfs
+    [ "$QUIET_BOOT" = "1" ] && echo "[vxn] exec: $EXEC_CMD" > /dev/console 2>/dev/null
     exec_in_container "$CONTAINER_ROOT" "$EXEC_CMD"
 fi
 
diff --git a/recipes-containers/vcontainer/files/vxn-oci-runtime b/recipes-containers/vcontainer/files/vxn-oci-runtime
index 6158cddd..57144aea 100644
--- a/recipes-containers/vcontainer/files/vxn-oci-runtime
+++ b/recipes-containers/vcontainer/files/vxn-oci-runtime
@@ -169,14 +169,6 @@ cmd_create() {
     [ -f "$bundle/config.json" ] || die "create: $bundle/config.json not found"
 
     log "CREATE: id=$container_id bundle=$bundle console_socket=$console_socket"
-    # Debug: log what the shim gives us
-    log "  DEBUG: fd0=$(readlink /proc/$$/fd/0 2>/dev/null) fd1=$(readlink /proc/$$/fd/1 2>/dev/null) fd2=$(readlink /proc/$$/fd/2 2>/dev/null)"
-    log "  DEBUG: bundle dir: $(ls -F $bundle/ 2>/dev/null | tr '\n' ' ')"
-    local _taskdir
-    _taskdir=$(dirname "$bundle")
-    log "  DEBUG: task dir ($bundle): $(ls -F $bundle/ 2>/dev/null | tr '\n' ' ')"
-    log "  DEBUG: parent dir ($_taskdir): $(ls -F $_taskdir/ 2>/dev/null | tr '\n' ' ')"
-    log "  DEBUG: all pipes: $(find /run -type p 2>/dev/null | tr '\n' ' ')"
 
     detect_arch
 
@@ -283,10 +275,17 @@ XENEOF
 
     log "  Domain $domname created (paused)"
 
-    # Get domid and read Xen console PTY from xenstore
+    # Get domid and read Xen console PTY from xenstore.
+    # xenconsoled may not have created the PTY yet — wait for it.
     local domid pty_path
     domid=$(xl domid "$domname" 2>/dev/null) || die "create: failed to get domid for $domname"
-    pty_path=$(xenstore-read "/local/domain/$domid/console/tty" 2>/dev/null) || true
+    pty_path=""
+    local _try
+    for _try in 1 2 3 4 5 6 7 8 9 10; do
+        pty_path=$(xenstore-read "/local/domain/$domid/console/tty" 2>/dev/null) || true
+        [ -n "$pty_path" ] && break
+        sleep 0.5
+    done
     log "  domid=$domid pty=$pty_path"
 
     if [ -n "$pty_path" ]; then
@@ -294,14 +293,32 @@ XENEOF
     fi
 
     # Terminal mode: send PTY fd to shim via console-socket (SCM_RIGHTS)
+    local sendtty_rc="-"
     if [ -n "$console_socket" ] && [ -n "$pty_path" ]; then
         if command -v vxn-sendtty >/dev/null 2>&1; then
-            vxn-sendtty "$console_socket" "$pty_path" \
-                || log "  WARNING: vxn-sendtty failed (socket=$console_socket pty=$pty_path)"
-            log "  Sent PTY fd to console-socket"
+            vxn-sendtty "$console_socket" "$pty_path"
+            sendtty_rc=$?
+            [ "$sendtty_rc" -ne 0 ] && log "  WARNING: vxn-sendtty failed (rc=$sendtty_rc)"
+            log "  Sent PTY fd to console-socket (rc=$sendtty_rc)"
         else
+            sendtty_rc="missing"
             log "  WARNING: vxn-sendtty not found, cannot send PTY to shim"
         fi
+    elif [ -n "$console_socket" ] && [ -z "$pty_path" ]; then
+        sendtty_rc="no-pty"
+        log "  WARNING: no PTY path from xenstore, cannot send to shim"
+    fi
+
+    # Write terminal debug to persistent storage (survives reboot)
+    if [ -n "$console_socket" ]; then
+        cat > /root/vxn-tty-debug 2>/dev/null <<DBGEOF
+domid=$domid
+pty=$pty_path
+console_socket=$console_socket
+sendtty_rc=$sendtty_rc
+terminal=$terminal
+domname=$domname
+DBGEOF
     fi
 
     # Persistent log dir — survives container deletion by shim
@@ -349,8 +366,12 @@ XENEOF
                 done < "$_logdir/console.log"
             fi
         else
-            # Terminal mode: shim owns PTY — just wait for domain death
-            while xl list "$_dn" >/dev/null 2>&1; do sleep 2; done
+            # Terminal mode: shim owns PTY — just wait for domain death.
+            # Close inherited stdout/stderr: go-runc captures runtime stdout
+            # via a pipe and cmd.Wait() blocks until EOF. If we hold the
+            # pipe's write end open, Create never returns to the shim.
+            exec >/dev/null 2>/dev/null
+            while xl list "$_dn" >/dev/null 2>&1; do sleep 0.5; done
         fi
     ) &
     local monitor_pid=$!
@@ -627,6 +648,9 @@ done
 command="${1:-}"
 shift || true
 
+# Log every invocation for debugging (before command dispatch)
+log "INVOKE: cmd=$command args=$* root=$RUNTIME_ROOT"
+
 case "$command" in
     create)  cmd_create "$@" ;;
     start)   cmd_start "$@" ;;
diff --git a/recipes-containers/vcontainer/files/vxn-sendtty.c b/recipes-containers/vcontainer/files/vxn-sendtty.c
index a253b129..b1257100 100644
--- a/recipes-containers/vcontainer/files/vxn-sendtty.c
+++ b/recipes-containers/vcontainer/files/vxn-sendtty.c
@@ -19,6 +19,7 @@
 #include <string.h>
 #include <unistd.h>
 #include <fcntl.h>
+#include <termios.h>
 #include <sys/socket.h>
 #include <sys/un.h>
 
@@ -44,6 +45,18 @@ int main(int argc, char *argv[])
                 return 1;
         }
 
+        /* Set PTY to raw mode for direct terminal I/O.
+         * Without this, the PTY slave's line discipline (echo, canonical mode)
+         * buffers input and echoes characters, preventing the shim from
+         * bridging the terminal correctly. */
+        {
+                struct termios tio;
+                if (tcgetattr(pty_fd, &tio) == 0) {
+                        cfmakeraw(&tio);
+                        tcsetattr(pty_fd, TCSANOW, &tio);
+                }
+        }
+
         sock_fd = socket(AF_UNIX, SOCK_STREAM, 0);
         if (sock_fd < 0) {
                 perror("socket");