Allow vm security.shared

[MggMuggins]

This is a preparatory change for attaching virtual-machine and container type volumes to instances.

security.shared will be required for in order to attach virtual-machine volumes to other VMs.

Also a few bits I noticed in the docs.

[github-actions]

Heads up @mionaalex - the "Documentation" label was applied to this issue.

[tomponline]

security.shared will be required for in order to attach virtual-machine volumes to other instances.

Hrm, im not sure why that is needed, because that security.shared setting is designed to allow concurrently mounting custom block volumes on multiple running instances, but for the feature you're working on we will require that the instance's whose root volume you're attaching to a different instance wont be running.

[tomponline]

This is a preparatory change for attaching virtual-machine and container type volumes to instances.

Also interesting that you mention container volumes here, im not opposed to this at all, but this might introduce additional complexities wrt to idmapping, so might be a "phase 2" feature, as the primary driver for the feature you're working on is to add support for attaching VM root volumes to another VM for recovery/export/import.

[MggMuggins]

attaching VM root volumes to another VM for recovery/export/import

I totally s/VM/instance/ when I read the roadmap item; my bad. This will be reflected in the spec.

security.shared only guards creation of multiple disk devices referring to the same volume (it's only checked during config validation or when updating storage volumes), basically --yes-i-really-mean-it for creating the devices.

As we found while I was working on cluster member limits, making decisions based on the running state of instances is prone to races.

We should require security.shared: true to attach a VM's root volume to another instance since we have no way of guarding against corruption by checking the running state.

We can put this on hold until I've put together a spec.

[tomponline]

Lets close this for now.