perf(sdk): streamline local and cloud dependencies

.github/workflows/check.yml

@@ -393,7 +393,7 @@ jobs:
           # The KVM job supplies both the host runtime and Agentd explicitly,
           # so this archive needs neither download nor embedded binary features.
           mold -run cargo nextest archive -p microsandbox --tests \
-            --no-default-features --features keyring,net \
+            --no-default-features --features keyring,local,net \
             --archive-file artifacts/rust-integration-tests.tar.zst
 
       - name: Upload nextest archive
@@ -548,15 +548,15 @@ jobs:
           $ErrorActionPreference = "Stop"
           . "$env:GITHUB_WORKSPACE\vendor\libkrunfw\scripts\msvc-env.ps1"
           Set-MsvcEnvironment -Architecture ${{ matrix.vs_arch }} -HostArchitecture ${{ matrix.vs_host_arch }}
-          cargo +stable test --no-default-features --features net -p microsandbox-runtime --lib --target ${{ matrix.rust_target }} test_bind_rootfs_backend_exposes_host_file_and_init
+          cargo +stable test --no-default-features --features net,runner -p microsandbox-runtime --lib --target ${{ matrix.rust_target }} test_bind_rootfs_backend_exposes_host_file_and_init
 
       - name: Test bind rootfs patches
         shell: pwsh
         run: |
           $ErrorActionPreference = "Stop"
           . "$env:GITHUB_WORKSPACE\vendor\libkrunfw\scripts\msvc-env.ps1"
           Set-MsvcEnvironment -Architecture ${{ matrix.vs_arch }} -HostArchitecture ${{ matrix.vs_host_arch }}
-          cargo +stable test --no-default-features --features net -p microsandbox --lib --target ${{ matrix.rust_target }} sandbox::patch::tests::bind_patch_
+          cargo +stable test --no-default-features --features local,net -p microsandbox --lib --target ${{ matrix.rust_target }} sandbox::patch::tests::bind_patch_
 
       - name: Test Windows DNS resolver
         shell: pwsh
@@ -750,6 +750,13 @@ jobs:
       - name: Clippy
         run: cargo +stable clippy --workspace --exclude microsandbox-agentd -- -D warnings
 
+      - name: Check Rust SDK feature surfaces
+        run: |
+          cargo +stable check -p microsandbox --no-default-features --features cloud,net
+          cargo +stable check -p microsandbox --no-default-features --features local,net
+          cargo +stable check -p microsandbox-runtime --no-default-features --features client,net
+          cargo +stable check -p microsandbox-network --no-default-features
+
       - name: Docs
         env:
           RUSTDOCFLAGS: "-D warnings"

Cargo.toml

@@ -83,7 +83,7 @@ microsandbox-image = { version = "=0.6.14", path = "crates/image" }
 microsandbox-metrics = { version = "=0.6.14", path = "crates/metrics" }
 microsandbox-types = { version = "=0.6.14", path = "packages/microsandbox-types/rust" }
 microsandbox-migration = { version = "=0.6.14", path = "crates/migration" }
-microsandbox-network = { version = "=0.6.14", path = "crates/network" }
+microsandbox-network = { version = "=0.6.14", path = "crates/network", default-features = false }
 microsandbox-protocol = { version = "=0.6.14", path = "crates/protocol" }
 microsandbox-runtime = { version = "=0.6.14", path = "crates/runtime", default-features = false }
 microsandbox-utils = { version = "=0.6.14", path = "crates/utils" }

crates/cli/Cargo.toml

@@ -51,14 +51,14 @@ futures.workspace = true
 indicatif.workspace = true
 ipnetwork = { workspace = true, optional = true }
 libc.workspace = true
-microsandbox.workspace = true
+microsandbox = { workspace = true, features = ["local"] }
 microsandbox-db.workspace = true
 microsandbox-filesystem.workspace = true
 microsandbox-image.workspace = true
 microsandbox-migration.workspace = true
-microsandbox-network = { workspace = true, optional = true }
+microsandbox-network = { workspace = true, features = ["engine"], optional = true }
 microsandbox-protocol.workspace = true
-microsandbox-runtime.workspace = true
+microsandbox-runtime = { workspace = true, features = ["runner"] }
 microsandbox-types.workspace = true
 microsandbox-utils.workspace = true
 rand.workspace = true

crates/cli/lib/log_args.rs

@@ -49,7 +49,7 @@ pub fn init_tracing(log_level: Option<LogLevel>, ansi: bool) {
     if let Some(level) = log_level {
         // Silence oci_client logs — the crate logs the auth token in debug mode
         // See: https://github.com/oras-project/rust-oci-client/issues/254
-        let filter = EnvFilter::new(level.as_tracing_level().to_string())
+        let filter = EnvFilter::new(level.as_str())
             .add_directive("oci_client=info".parse::<Directive>().unwrap());
 
         tracing_subscriber::fmt()

crates/image/Cargo.toml

@@ -16,8 +16,8 @@ async-compression = { workspace = true, features = ["gzip", "tokio", "zstd"] }
 chrono.workspace = true
 futures.workspace = true
 hex.workspace = true
-libc.workspace = true
 microsandbox-utils.workspace = true
+microsandbox-types.workspace = true
 oci-client.workspace = true
 oci-spec.workspace = true
 rustls-pki-types.workspace = true
@@ -28,7 +28,6 @@ sha2.workspace = true
 tar.workspace = true
 thiserror.workspace = true
 tokio = { workspace = true, features = ["fs", "io-util", "rt", "sync"] }
-tokio-util.workspace = true
 tracing.workspace = true
 
 [target.'cfg(windows)'.dependencies]

crates/image/lib/lib.rs

@@ -17,7 +17,6 @@
 )]
 
 mod archive;
-mod auth;
 mod cache;
 mod config;
 pub(crate) mod crc32c;
@@ -45,11 +44,11 @@ pub use archive::{
     ImageArchiveFormat, ImageLoadOptions, ImageSaveConfig, ImageSaveLayer, ImageSaveRequest,
     LoadedImage, load_archive, save_archive, save_docker_archive,
 };
-pub use auth::RegistryAuth;
 pub use cache::{CachedImageMetadata, CachedLayerMetadata, FlatRootfsRef, GlobalCache};
 pub use config::ImageConfig;
 pub use digest::Digest;
 pub use error::{ImageError, ImageResult};
+pub use microsandbox_types::RegistryAuth;
 pub use oci_client::Reference;
 pub use platform::{Arch, Os, Platform};
 pub use progress::{PullProgress, PullProgressHandle, PullProgressSender, progress_channel};

crates/image/lib/registry/builder.rs

@@ -4,8 +4,9 @@ use oci_client::{
 };
 use rustls_pki_types::{CertificateDer, pem::PemObject};
 
+use microsandbox_types::RegistryAuth;
+
 use crate::{
-    auth::RegistryAuth,
     cache::GlobalCache,
     error::{ImageError, ImageResult},
     platform::Platform,
@@ -44,7 +45,12 @@ impl RegistryBuilder {
 
     /// Set authentication credentials for the registry.
     pub fn auth(mut self, auth: RegistryAuth) -> Self {
-        self.auth = (&auth).into();
+        self.auth = match auth {
+            RegistryAuth::Anonymous => oci_client::secrets::RegistryAuth::Anonymous,
+            RegistryAuth::Basic { username, password } => {
+                oci_client::secrets::RegistryAuth::Basic(username, password)
+            }
+        };
         self
     }
 

crates/metrics/Cargo.toml

@@ -15,7 +15,6 @@ path = "lib/lib.rs"
 chrono.workspace = true
 libc.workspace = true
 thiserror.workspace = true
-tracing.workspace = true
 
 [target.'cfg(target_os = "windows")'.dependencies]
 windows-sys = { version = "0.61.2", features = ["Win32_Foundation", "Win32_Security", "Win32_System_Memory", "Win32_System_Threading"] }