cocoon vm inspect reports the API socket, the vsock path, the netns and the taps, but not where the guest console is. For a direct-boot (OCI) image Cloud Hypervisor allocates a PTY per boot (/dev/pts/N), which cocoon itself resolves through the CH API (vm.info → config.console.file) for vm console; for a UEFI cloud image the serial console sits on <run_dir>/cloudhypervisor/<id>/console.sock.
An external consumer (eru's cocoon engine, which drives cocoon over SSH as a non-root login through a sudo wrapper) cannot make that same query: api.sock is created mode 0700 by the VMM, so only the owner can open it. Please add the resolved console path — the PTY or the socket, whichever this boot uses — to the vm inspect JSON (for example console_path), refreshed on every start/restore. That lets a supervisor record where to read a VM's console without reaching into the API socket.
cocoon vm inspectreports the API socket, the vsock path, the netns and the taps, but not where the guest console is. For a direct-boot (OCI) image Cloud Hypervisor allocates a PTY per boot (/dev/pts/N), which cocoon itself resolves through the CH API (vm.info→config.console.file) forvm console; for a UEFI cloud image the serial console sits on<run_dir>/cloudhypervisor/<id>/console.sock.An external consumer (eru's cocoon engine, which drives cocoon over SSH as a non-root login through a sudo wrapper) cannot make that same query:
api.sockis created mode 0700 by the VMM, so only the owner can open it. Please add the resolved console path — the PTY or the socket, whichever this boot uses — to thevm inspectJSON (for exampleconsole_path), refreshed on every start/restore. That lets a supervisor record where to read a VM's console without reaching into the API socket.