code: func getByHostname(c context.Context, hostname string) (*instances.Instance, error) {
  	if vmtoken.Has(c) && vmtoken.Hostname(c) != hostname {
  		return nil, status.Errorf(codes.PermissionDenied, "unauthorized user")
  	}
  	var vms []*model.VM
  	// Hostnames are globally unique, so there should be at most one match.
  	q := datastore.NewQuery(model.VMKind).Eq("hostname", hostname).Limit(1)
  	switch err := datastore.GetAll(c, q, &vms); {
  	case err != nil:
  		return nil, errors.Annotate(err, "failed to fetch VM").Err()
  	case len(vms) == 0:
  		if vmtoken.Has(c) {
  			return nil, status.Errorf(codes.PermissionDenied, "unauthorized user")
  		}
  		return nil, status.Errorf(codes.NotFound, "no VM found with hostname %q", hostname)
  	default:
  		inst := toInstance(vms[0])
  		if vmtoken.Has(c) && !vmtoken.Matches(c, inst.Hostname, inst.Zone, inst.Project) {
  			return nil, status.Errorf(codes.PermissionDenied, "unauthorized user")
  		}
  		return inst, nil
  	}
  }
docs: // getByHostname returns the *instances.Instance matching the given hostname.
  // May be called by VMs.