socketforward: add UDS forwarding

[akerouanton]

Summary

Adds UDS socket forwarding: vminitd relays connections from inside the container to the corresponding host-side socket, enabling UDS sockets to be bind-mounted across the VM boundary.

Container-side sockets are declared as OCI mounts with type=uds:

• source: path of the target UNIX socket on the host
• destination: path where the socket should appear inside the container

The shim rewrites each uds mount to an ordinary bind mount before passing the spec to runc. The bind mount source is a VM-internal listener socket at /run/socketfwd/{forward_id}.sock; vminitd creates that socket via the Bind RPC before container creation so runc can complete the bind mount.

When a container process connects to the forwarded socket, vminitd notifies the shim via the Accept streaming RPC. The shim resolves the forward_id to a host-side path from its own configuration (never trusting a path from the VM), dials the host socket, opens a vsock stream, and relays data bidirectionally.

The forward_id is derived from SHA256(container_id + ":" + destination) so that the same socket mount on two containers within the same VM gets a distinct identifier.

[Copilot]

Pull request overview

This PR introduces a new “socketforward” subsystem to relay UNIX domain socket connections across the VM boundary via vsock streams, coordinated between the host shim and a vminitd-side ttrpc service.

Changes:

• Add a new SocketForward ttrpc service (Connect + server-streaming Listen) and VM-side forwarding implementation.
• Add shim-side OCI-annotation parsing, bind-mount wiring, and runtime forwarding loops for both directions.
• Plumb socket-forward configuration into vminitd via plugin properties and add documentation.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
plugins/vminit/socketforward/plugin.go	Registers the VM-side socketforward ttrpc plugin and wires it to shutdown/task/streaming dependencies.
plugins/types.go	Adds a new plugin property key for passing socket-forward configuration into vminitd.
internal/vminit/task/service.go	Exposes container init PID lookup used for mount-namespace dialing.
internal/vminit/socketforward/socketforward.go	Implements VM-side socket forwarding service, listeners, and relaying over vsock streams.
internal/shim/task/socketforward.go	Implements shim-side annotation parsing, init arg generation, and host-side forwarding loops.
internal/shim/task/service.go	Integrates socket forwarding lifecycle into container creation/shutdown logic.
cmd/vminitd/socket_forward.go	Adds -socket-forward flag parsing and entry types for vminitd.
cmd/vminitd/main.go	Plumbs socket-forward entries into plugin properties and registers the new vminit plugin.
docs/socket-forwarding.md	Documents how to configure and use socket forwarding.
api/proto/nerdbox/services/socketforward/v1/socketforward.proto	Defines the SocketForward service and ConnectRequest message.
api/services/socketforward/v1/*	Adds generated protobuf + ttrpc code and package docs for the new API.
api/next.txtpb	Updates API descriptor snapshot to include the new socketforward service.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 5 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 9 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This section references host-to-container socket forwarding via a Connect RPC, but the socketforward service/proto in this PR only defines Bind + Accept (and the shim/VM implementation shown is container-to-host). Update this doc to match the implemented RPCs/patterns, or add the missing Connect RPC implementation if that’s the intended design.

Suggested change

	This is the most common pattern. Container stdio and host-to-container
	socket forwarding (`Connect` RPC) both use it.
	This is the most common pattern. Container stdio uses it.