Add firecracker volume export/release commands for NFS-backed host paths

completion/flake-ctl

@@ -53,6 +53,14 @@ __flake_ctl_firecracker_network() {
     __comp_reply "help add init remove"
 }
 
+__flake_ctl_firecracker_volume() {
+    if [ "${COMP_WORDS[3]}" = "export" ] || [ "${COMP_WORDS[3]}" = "release" ];then
+        __comp_reply_unused "--path --help"
+        return 0
+    fi
+    __comp_reply "help export release"
+}
+
 __flake_ctl_show() {
     declare prev="${prev}"
     if [ "${prev}" = "--format" ];then
@@ -166,12 +174,13 @@ __flake_ctl_main() {
             firecracker_network| \
             firecracker_pull| \
             firecracker_show| \
-            firecracker_register)
+            firecracker_register| \
+            firecracker_volume)
                 __flake_ctl_complete_command "${comp}" && return 0
                 ;;
             firecracker_*)
                 command="firecracker" && __comp_reply "
-                    help network pull register remove show
+                    help network pull register remove show volume
                 " && return 0
                 ;;
             podman_*)

doc/flake-ctl-firecracker-volume-export.rst

@@ -0,0 +1,68 @@
+FLAKE-CTL-FIRECRACKER-VOLUME-EXPORT(8)
+======================================
+
+NAME
+----
+
+**flake-ctl firecracker volume export** - Export a local path through NFS for firecracker guests
+
+SYNOPSIS
+--------
+
+.. code:: bash
+
+   USAGE:
+       flake-ctl firecracker volume export --path <PATH>
+
+   OPTIONS:
+       --path <PATH>
+       --help
+
+DESCRIPTION
+-----------
+
+Export the given absolute host path through NFS for firecracker guest
+access. The command writes a flake-pilot managed entry to
+``/etc/exports`` for the private firecracker network ``172.16.0.0/24``.
+
+If the ``nfs-server`` systemd service is not running yet, it is
+started. If it is already running, the export table is reloaded so the
+new export becomes effective without waiting for a service restart.
+
+The command expects an existing directory path. As it modifies a
+system-wide NFS configuration, the required privileged operations are
+executed through **sudo** when needed.
+
+OPTIONS
+-------
+
+--path <PATH>
+
+  Absolute directory path on the host to export through NFS
+
+FILES
+-----
+
+* /etc/exports
+
+EXAMPLE
+-------
+
+.. code:: bash
+
+   $ flake-ctl firecracker volume export --path /some/local/path
+
+SEE ALSO
+--------
+
+flake-ctl-firecracker-volume-release(8), flake-ctl-firecracker-network-init(8), firecracker-pilot(8)
+
+AUTHOR
+------
+
+Marcus Schäfer
+
+COPYRIGHT
+---------
+
+(c) 2026, Marcus Schäfer

doc/flake-ctl-firecracker-volume-release.rst

@@ -0,0 +1,65 @@
+FLAKE-CTL-FIRECRACKER-VOLUME-RELEASE(8)
+=======================================
+
+NAME
+----
+
+**flake-ctl firecracker volume release** - Remove a local path from the firecracker NFS exports
+
+SYNOPSIS
+--------
+
+.. code:: bash
+
+   USAGE:
+       flake-ctl firecracker volume release --path <PATH>
+
+   OPTIONS:
+       --path <PATH>
+       --help
+
+DESCRIPTION
+-----------
+
+Remove the flake-pilot managed NFS export entry for the given absolute
+host path from ``/etc/exports`` and restart the ``nfs-server`` systemd
+service so the updated export table becomes effective.
+
+Only entries previously managed by flake-pilot for the given path are
+removed. As the command changes a system-wide NFS configuration, the
+required privileged operations are executed through **sudo** when
+needed.
+
+OPTIONS
+-------
+
+--path <PATH>
+
+  Absolute host path to remove from the flake-pilot managed NFS exports
+
+FILES
+-----
+
+* /etc/exports
+
+EXAMPLE
+-------
+
+.. code:: bash
+
+   $ flake-ctl firecracker volume release --path /some/local/path
+
+SEE ALSO
+--------
+
+flake-ctl-firecracker-volume-export(8), flake-ctl-firecracker-network-init(8), firecracker-pilot(8)
+
+AUTHOR
+------
+
+Marcus Schäfer
+
+COPYRIGHT
+---------
+
+(c) 2026, Marcus Schäfer

doc/flake-ctl.rst

@@ -58,7 +58,7 @@ is no option to select the mode:
 SEE ALSO
 --------
 
-podman-pilot(8), flake-ctl-init(8), flake-ctl-list(8), flake-ctl-podman-load(8), flake-ctl-podman-register(8), flake-ctl-podman-remove(8), flake-ctl-podman-show(8), firecracker-pilot(8), flake-ctl-firecracker-load(8), flake-ctl-firecracker-register(8), flake-ctl-firecracker-remove(8), flake-ctl-firecracker-show(8), flake-ctl-firecracker-network-init(8), flake-ctl-firecracker-network-add(8), flake-ctl-firecracker-network-remove(8)
+podman-pilot(8), flake-ctl-init(8), flake-ctl-list(8), flake-ctl-podman-load(8), flake-ctl-podman-register(8), flake-ctl-podman-remove(8), flake-ctl-podman-show(8), firecracker-pilot(8), flake-ctl-firecracker-load(8), flake-ctl-firecracker-register(8), flake-ctl-firecracker-remove(8), flake-ctl-firecracker-show(8), flake-ctl-firecracker-network-init(8), flake-ctl-firecracker-network-add(8), flake-ctl-firecracker-network-remove(8), flake-ctl-firecracker-volume-export(8), flake-ctl-firecracker-volume-release(8)
 
 AUTHOR
 ------

flake-ctl/src/cli.rs

@@ -224,6 +224,11 @@ pub enum Firecracker {
         #[clap(subcommand)]
         command: Network,
     },
+    /// Manage NFS exports for firecracker volumes
+    Volume {
+        #[clap(subcommand)]
+        command: Volume,
+    },
     /// Remove application registration or entire VM
     #[clap(group(
         ArgGroup::new("remove").required(true).args(&["vm", "app"]),
@@ -289,6 +294,22 @@ pub enum Network {
     },
 }
 
+#[derive(Subcommand)]
+pub enum Volume {
+    /// Export a local path through NFS for firecracker guests
+    Export {
+        /// An absolute path on the host to export via NFS
+        #[clap(long)]
+        path: String,
+    },
+    /// Remove an exported local path from the NFS configuration
+    Release {
+        /// An absolute path on the host to remove from the NFS exports
+        #[clap(long)]
+        path: String,
+    },
+}
+
 #[derive(Subcommand)]
 pub enum Podman {
     /// Pull container

flake-ctl/src/defaults.rs

@@ -108,6 +108,16 @@ pub const IPTABLES_TOOL:&str =
     "iptables";
 pub const IP_TOOL:&str =
     "ip";
+pub const NFS_EXPORTFS_TOOL:&str =
+    "exportfs";
+pub const NFS_EXPORTS_FILE:&str =
+    "/etc/exports";
+pub const NFS_SERVER_SERVICE:&str =
+    "nfs-server";
+pub const NFS_CLIENT_NETWORK:&str =
+    "172.16.0.0/24";
+pub const NFS_EXPORT_OPTIONS:&str =
+    "rw,sync,no_subtree_check,no_root_squash,insecure";
 // Kernel switch to turn the host into a router. Required to
 // forward the traffic of a VM from its TUN/TAP device to the
 // outgoing interface of the host