# kcell (docs/80 §2): kernel config fragment of the Docker VM's kernel.
# build.sh runs `make allnoconfig KCONFIG_ALLCONFIG=<this + generated lines>` on an unmodified
# upstream kernel (the same pinned longterm as tools/dvm, tools/mvm) and then checks that every line
# below made it into .config unchanged (a dependency that silently drops an option fails the build).
# What Docker does not need is not here (user 2026-10-13: "docker不要的都不要"); everything is built
# in (no modules). x86_64 only. build.sh adds CONFIG_INITRAMFS_SOURCE.
# Docker's contrib/check-config.sh is the check (build.sh runs it on the result when it finds it).

CONFIG_64BIT=y
CONFIG_EXPERT=y
CONFIG_CC_OPTIMIZE_FOR_SIZE=y
CONFIG_KERNEL_ZSTD=y
CONFIG_PRINTK=y
# times on the console lines: boot time is a goal (docs/80 §2)
CONFIG_PRINTK_TIME=y
CONFIG_BUG=y
CONFIG_MULTIUSER=y
CONFIG_SHMEM=y
CONFIG_TMPFS=y
CONFIG_TMPFS_POSIX_ACL=y
CONFIG_TMPFS_XATTR=y
CONFIG_FUTEX=y
CONFIG_EPOLL=y
CONFIG_SIGNALFD=y
CONFIG_TIMERFD=y
CONFIG_EVENTFD=y
CONFIG_AIO=y
CONFIG_IO_URING=y
CONFIG_ADVISE_SYSCALLS=y
CONFIG_MEMBARRIER=y
CONFIG_KCMP=y
CONFIG_FHANDLE=y
CONFIG_FILE_LOCKING=y
CONFIG_INOTIFY_USER=y
CONFIG_FANOTIFY=y
CONFIG_SYSVIPC=y
CONFIG_POSIX_MQUEUE=y
# System calls an EXPERT allnoconfig leaves out but programs in containers use (2026-10-14: postgres's
# initdb died with "could not enable SIGALRM timer: Function not implemented", docs/80 §16):
# timer_create (postgres, Java), rseq (glibc), core dumps, process_vm_readv, cachestat,
# userfaultfd, memfd_secret, 32-bit binaries (i386 images).
CONFIG_POSIX_TIMERS=y
CONFIG_RSEQ=y
CONFIG_ELF_CORE=y
CONFIG_COREDUMP=y
CONFIG_CROSS_MEMORY_ATTACH=y
CONFIG_CACHESTAT_SYSCALL=y
CONFIG_USERFAULTFD=y
CONFIG_SECRETMEM=y
CONFIG_IA32_EMULATION=y
# memory: transparent huge pages (databases, JVMs) and hugetlbfs (postgres huge_pages)
CONFIG_TRANSPARENT_HUGEPAGE=y
CONFIG_COMPACTION=y
CONFIG_MIGRATION=y
CONFIG_HUGETLBFS=y
CONFIG_BINFMT_ELF=y
CONFIG_BINFMT_SCRIPT=y
CONFIG_UNIX98_PTYS=y
CONFIG_PROC_FS=y
# /proc/sys: dockerd and containerd read and set sysctls (ip_forward, threads-max, ...)
CONFIG_SYSCTL=y
CONFIG_PROC_SYSCTL=y
CONFIG_SYSFS=y
CONFIG_DEVTMPFS=y
CONFIG_BLK_DEV_INITRD=y
CONFIG_INITRAMFS_COMPRESSION_NONE=y
CONFIG_NO_HZ_IDLE=y
CONFIG_HIGH_RES_TIMERS=y
CONFIG_MTRR=y
CONFIG_X86_PAT=y
CONFIG_DMI=y
CONFIG_BLOCK=y

# SMP and ACPI (docs/80 §2 "ACPI 先留着", 2026-10-14 review): more than one vCPU, bhyve's
# vmgenid (an ACPI device), the power button keel presses for a shutdown.
CONFIG_SMP=y
CONFIG_NR_CPUS=64
CONFIG_ACPI=y
CONFIG_ACPI_BUTTON=y
CONFIG_VIRT_DRIVERS=y
CONFIG_VMGENID=y
# kcell.conf from keel: bhyve's fw_cfg (-o lpc.fwcfg=qemu -f opt/keel.kcell,...), its ACPI device QEMU0002
CONFIG_FW_CFG_SYSFS=y
CONFIG_INPUT=y
CONFIG_INPUT_EVDEV=y

# Boot: the EFI stub through keel's UEFI firmware first (D1); PVH (D3: bhyve's direct boot, like
# hyp/mvm.c) is built in already.
CONFIG_EFI=y
CONFIG_EFI_STUB=y
CONFIG_EFI_PARTITION=y
CONFIG_PARTITION_ADVANCED=y
CONFIG_HYPERVISOR_GUEST=y
CONFIG_PVH=y
CONFIG_PCI=y
CONFIG_PCI_MSI=y
CONFIG_CMDLINE_BOOL=y
CONFIG_CMDLINE="console=ttyS0,115200 loglevel=4 panic=10"
# CONFIG_CMDLINE_OVERRIDE is not set

# Devices: virtio (disks, NICs, entropy from bhyve's virtio-rnd), COM1, the CMOS clock.
CONFIG_VIRTIO_MENU=y
CONFIG_VIRTIO_PCI=y
# bhyve's virtio devices are legacy (transitional) ones
CONFIG_VIRTIO_PCI_LEGACY=y
CONFIG_BLK_DEV=y
CONFIG_VIRTIO_BLK=y
CONFIG_NETDEVICES=y
CONFIG_NET_CORE=y
CONFIG_VIRTIO_NET=y
CONFIG_HW_RANDOM=y
CONFIG_HW_RANDOM_VIRTIO=y
CONFIG_TTY=y
CONFIG_SERIAL_8250=y
CONFIG_SERIAL_8250_CONSOLE=y
CONFIG_RTC_CLASS=y
CONFIG_RTC_DRV_CMOS=y
# the RTC's time for kcell-clock and hwclock (docs/80 §17: the clock after a restore)
CONFIG_RTC_INTF_SYSFS=y
CONFIG_RTC_INTF_DEV=y
# The ACPI PM timer: the reference the TSC is calibrated against. allnoconfig turns EXPERT on,
# which made it optional and off: "tsc: No reference (HPET/PMTIMER) available", the TSC marked
# unstable, every clock read on the HPET (a VM exit each; docs/80 §17)
CONFIG_X86_PM_TIMER=y

# File systems: ext4 for /var/lib/docker (a zvol, docs/80 §4), overlayfs (overlay2), virtiofs for
# the host's datasets (keelfs, docs/80 §18; FUSE also for containers that bring their own), the
# NFSv3 client (was the datasets' way before keelfs; kept for Docker's NFS volumes), the SMB client, FAT for
# kcell.conf on the ESP.
CONFIG_EXT4_FS=y
CONFIG_EXT4_FS_POSIX_ACL=y
CONFIG_EXT4_FS_SECURITY=y
CONFIG_OVERLAY_FS=y
CONFIG_FUSE_FS=y
CONFIG_VIRTIO_FS=y
CONFIG_NETWORK_FILESYSTEMS=y
CONFIG_NFS_FS=y
CONFIG_NFS_V3=y
CONFIG_NFS_V3_ACL=y
# SMB client: Docker's CIFS volumes, a keelNAS share as an application's library (docs/80 §23)
CONFIG_CIFS=y
CONFIG_VFAT_FS=y
CONFIG_NLS=y
CONFIG_NLS_CODEPAGE_437=y
CONFIG_NLS_ISO8859_1=y
CONFIG_NLS_UTF8=y
CONFIG_NLS_DEFAULT="utf8"
CONFIG_KEYS=y

# Networking.
CONFIG_NET=y
CONFIG_INET=y
CONFIG_IPV6=y
CONFIG_UNIX=y
CONFIG_PACKET=y
CONFIG_IP_MULTICAST=y
CONFIG_IP_ADVANCED_ROUTER=y
CONFIG_IP_MULTIPLE_TABLES=y
CONFIG_IPV6_MULTIPLE_TABLES=y
CONFIG_VETH=y
CONFIG_BRIDGE=y
CONFIG_BRIDGE_VLAN_FILTERING=y
CONFIG_VLAN_8021Q=y
CONFIG_MACVLAN=y
CONFIG_IPVLAN=y
CONFIG_VXLAN=y
CONFIG_DUMMY=y
CONFIG_TUN=y
CONFIG_NET_SCHED=y
CONFIG_NET_CLS_CGROUP=y
CONFIG_CGROUP_NET_PRIO=y

# Netfilter: the iptables of Docker's networks in both flavours (nft and legacy; the userland
# decides), connmark for the policy routing of published ports (docs/80 §6), IPVS for swarm's
# service balancing.
CONFIG_NETFILTER=y
CONFIG_NETFILTER_ADVANCED=y
CONFIG_BRIDGE_NETFILTER=y
CONFIG_NF_CONNTRACK=y
CONFIG_NF_CONNTRACK_MARK=y
CONFIG_NF_CONNTRACK_FTP=y
CONFIG_NF_CONNTRACK_TFTP=y
CONFIG_NF_NAT=y
CONFIG_NF_NAT_FTP=y
CONFIG_NF_NAT_TFTP=y
CONFIG_NF_TABLES=y
CONFIG_NF_TABLES_INET=y
CONFIG_NF_TABLES_IPV4=y
CONFIG_NF_TABLES_IPV6=y
CONFIG_NFT_CT=y
CONFIG_NFT_NAT=y
CONFIG_NFT_MASQ=y
CONFIG_NFT_REDIR=y
CONFIG_NFT_COMPAT=y
CONFIG_NFT_FIB_IPV4=y
CONFIG_NFT_FIB_IPV6=y
CONFIG_NETFILTER_XTABLES=y
CONFIG_NETFILTER_XT_MARK=y
CONFIG_NETFILTER_XT_CONNMARK=y
CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y
CONFIG_NETFILTER_XT_TARGET_REDIRECT=y
CONFIG_NETFILTER_XT_TARGET_CHECKSUM=y
CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
CONFIG_NETFILTER_XT_MATCH_COMMENT=y
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
CONFIG_NETFILTER_XT_MATCH_IPVS=y
CONFIG_NETFILTER_XT_MATCH_PHYSDEV=y
CONFIG_NETFILTER_XTABLES_LEGACY=y
CONFIG_IP_NF_IPTABLES=y
CONFIG_IP_NF_IPTABLES_LEGACY=y
CONFIG_IP_NF_FILTER=y
CONFIG_IP_NF_MANGLE=y
CONFIG_IP_NF_NAT=y
CONFIG_IP_NF_TARGET_MASQUERADE=y
CONFIG_IP_NF_TARGET_REDIRECT=y
CONFIG_IP_NF_RAW=y
CONFIG_IP6_NF_IPTABLES=y
CONFIG_IP6_NF_IPTABLES_LEGACY=y
CONFIG_IP6_NF_FILTER=y
CONFIG_IP6_NF_MANGLE=y
CONFIG_IP6_NF_NAT=y
CONFIG_IP6_NF_TARGET_MASQUERADE=y
CONFIG_IP6_NF_RAW=y
CONFIG_IP_VS=y
CONFIG_IP_VS_NFCT=y
CONFIG_IP_VS_PROTO_TCP=y
CONFIG_IP_VS_PROTO_UDP=y
CONFIG_IP_VS_RR=y

# Containers: namespaces, cgroup v2 with every controller Docker uses, seccomp, BPF (cgroup v2
# device control).
CONFIG_NAMESPACES=y
CONFIG_UTS_NS=y
CONFIG_IPC_NS=y
CONFIG_USER_NS=y
CONFIG_PID_NS=y
CONFIG_NET_NS=y
CONFIG_CGROUPS=y
CONFIG_MEMCG=y
CONFIG_BLK_CGROUP=y
CONFIG_BLK_DEV_THROTTLING=y
CONFIG_CGROUP_SCHED=y
CONFIG_FAIR_GROUP_SCHED=y
CONFIG_CFS_BANDWIDTH=y
CONFIG_CGROUP_PIDS=y
CONFIG_CGROUP_FREEZER=y
CONFIG_CPUSETS=y
CONFIG_CGROUP_DEVICE=y
CONFIG_CGROUP_CPUACCT=y
CONFIG_CGROUP_BPF=y
CONFIG_BPF=y
CONFIG_BPF_SYSCALL=y
CONFIG_SECCOMP=y
CONFIG_SECCOMP_FILTER=y

# Intel iGPU SR-IOV VF (docs/80 §20, docs/64): xe in VF mode for /dev/dri/renderD128 (Jellyfin's
# QSV/VA-API). A module, in the system dataset (/lib/modules), loaded by kcell-setup only when an
# Intel display-class PCI device is there; every other kcell never loads it. No display (a VF has
# none), no i915, no firmware: a VF loads no GuC/HuC (xe_uc_fw.c: the PF did that, the VF asks
# the GuC for the version). PM: runtime PM core, as the dvm (without it xe reads no GuC answer);
# PCI_MMCONFIG: bhyve's ECAM, the extended config space.
CONFIG_MODULES=y
# CONFIG_MODULE_SIG is not set
CONFIG_DRM=m
CONFIG_DRM_XE=m
# CONFIG_DRM_XE_DISPLAY is not set
CONFIG_DRM_XE_FORCE_PROBE=""
CONFIG_PM=y
CONFIG_PCI_MMCONFIG=y
CONFIG_X86_PLATFORM_DEVICES=y

# Not wanted (docs/80 §2): no ftrace/kprobes (Docker does not need them); modules only for xe (above).
# CONFIG_FTRACE is not set
# CONFIG_KPROBES is not set
