Fix 2-second systemd notify stalls in cloud-hypervisor

[rzhikharevich]

This is a fix for #474. See the code comment for explanation and caveats.

Relevant parts of:

• systemd: sd-daemon.c:630
• cloud-hypervisor

[yorickvP]

I think reader.read(-1) should also work, it reads until EOF

[astro]

@RaitoBezarius Please help review.

[rzhikharevich]

Unfortunately, there is no EOF because cloud-hypervisor doesn't seem to propagate the socket half-close to the host socket, so read(-1) doesn't work.

[rzhikharevich]

read(-1) hangs until systemd decides to kill the unit because of the activation timeout:

roman@nixform ~/D/S/microvm.nix (cloud-hv-notify-proxy-fix) [1]> pgrep -af notify-proxy
322387 /nix/store/pzdalg368npikvpq4ncz2saxnz19v53k-python3-3.13.12/bin/python3.13 /nix/store/lqm440b0y5alm3nb6fj044y7hr5aykxs-vsock-notify-proxy/bin/vsock-notify-proxy
roman@nixform ~/D/S/microvm.nix (cloud-hv-notify-proxy-fix)> sudo strace -p 322387
strace: Process 322387 attached
epoll_wait(5

[rzhikharevich]

By the way, should I use vmHostPackages or pkgs here? I see that some other runners use the former but cloud-hypervisor.nix doesn't seem to.

[SuperSandro2000]

Suggested change

	VSOCK_NOTIFY_PATH=${vsockPath}_8888 ${vsockNotifyProxy}/bin/vsock-notify-proxy &
	${lib.getExe vsockNotifyProxy} ${vsockPath}_8888 &

[SuperSandro2000]

Suggested change

	path = os.environ["VSOCK_NOTIFY_PATH"]
	server = await asyncio.start_unix_server(handle, path=path)
	server = await asyncio.start_unix_server(handle, path=sys.argv[0])

We can make this kinda dirty here, as we control all invocations and this fails loudly when no arg is there, os.environ does IIRC return empty string.

[SuperSandro2000]

Suggested change

	# TODO(rzhikharevich): Ideally, cloud-hypervisor should propagate the half-close, then the
	# TODO: Ideally, cloud-hypervisor should propagate the half-close, then the

[Copilot]

Pull request overview

This PR addresses slow microvm boot times when running cloud-hypervisor under systemd with microvm.vsock.cid enabled, by replacing the previous socat-based notify forwarding (which introduced a 2s stall per notification) with a purpose-built proxy that immediately closes the vsock-stream connection after a single read.

Changes:

• Add a Python-based vsock-notify-proxy that forwards guest notify messages from the cloud-hypervisor vsock socket to the host NOTIFY_SOCKET.
• Replace the socat -T2 forwarding logic in preStart with the new proxy to avoid repeated systemd stalls.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

After calling writer.close(), it’s generally best to await writer.wait_closed() (or equivalent) to ensure the transport is actually closed and file descriptors are released promptly. This helps avoid accumulating open connections under load and prevents noisy ResourceWarnings in some Python/asyncio versions.

Suggested change

	writer.close()
	writer.close()
	await writer.wait_closed()

[astro]

The 1st example in the Python asyncio documentation does this, too.

[RaitoBezarius]

@RaitoBezarius Please help review.

I'm sorry, I don't review anything that involves GenAI in a project on my free time.

[SuperSandro2000]

@rzhikharevich can you please incorporate the feedback?