Method create_sandbox

crates/openshell-driver-vm/src/driver.rs:514–626

(&self, sandbox: &Sandbox)

    // gRPC API surface; boxing here would diverge from every other handler.
    #[allow(clippy::result_large_err)]
    pub async fn create_sandbox(&self, sandbox: &Sandbox) -> Result<CreateSandboxResponse, Status> {
        info!(
            sandbox_id = %sandbox.id,
            sandbox_name = %sandbox.name,
            "vm driver: create_sandbox received"
        );
        validate_vm_sandbox(sandbox, self.config.gpu_enabled)?;

        let state_dir = sandbox_state_dir(&self.config.state_dir, &sandbox.id)?;
        let image_ref = self.resolved_sandbox_image(sandbox).ok_or_else(|| {
            Status::failed_precondition(
                "vm sandboxes require template.image or a configured default sandbox image",
            )
        })?;
        info!(
            sandbox_id = %sandbox.id,
            image_ref = %image_ref,
            state_dir = %state_dir.display(),
            "vm driver: resolved image ref, preparing disks"
        );

        let snapshot = sandbox_snapshot(sandbox, provisioning_condition(), false);
        {
            let mut registry = self.registry.lock().await;
            if registry.contains_key(&sandbox.id) {
                return Err(Status::already_exists("sandbox already exists"));
            }
            registry.insert(
                sandbox.id.clone(),
                SandboxRecord {
                    snapshot: snapshot.clone(),
                    state_dir: state_dir.clone(),
                    process: None,
                    provisioning_task: None,
                    gpu_bdf: None,
                    qemu_network_allocated: false,
                    deleting: false,
                },
            );
        }

        let tls_paths = match self.config.tls_paths() {
            Ok(paths) => paths,
            Err(err) => {
                let mut registry = self.registry.lock().await;
                registry.remove(&sandbox.id);
                return Err(Status::failed_precondition(err));
            }
        };

        if let Err(err) = create_private_dir_all(&state_dir).await {
            let mut registry = self.registry.lock().await;
            registry.remove(&sandbox.id);
            return Err(Status::internal(format!("create state dir failed: {err}")));
        }

        if let Err(err) = self.ensure_extension_state_dirs(&state_dir).await {
            let mut registry = self.registry.lock().await;