Repository navigation
tests: give the runtime adapter's executions their network's settings - #882
Open
Enrique Saurez (esaurez) wants to merge 3 commits into
Conversation
The root configuration gains an optional listeners field, after the workload identity, which says whether the guest's listeners are published. Executions, and the account check of a workload identity, enter the root with that publication, so that while listeners are published the entry refuses CAP_NET_BIND_SERVICE and CAP_NET_RAW at stage 0. A layered launch names the publication of its network as OpenVMM publishes listeners: with ingress or host-loopback access allowed, and none without a network. The host gives an execution's start the URL of a proxy-only network's proxy in the proxy variables of its environment, with layered::with_proxy, from the plan that LaunchRecord::read_plan reads back from the store. The network device, its addresses, and the announcer of the guest's listeners stay with NVX's /init. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a7c15634-094a-4a66-af59-25a58e732f4b
The host program's exec reads the plan that the launch recorded, and gives each execution the URL of the proxy of the VM's network, if any, in its environment with layered::with_proxy, after its --env entries, unless they name the proxy variables themselves. The VM scenarios can now give their VM a network, which the launch reads from a file that the scenario writes. In a proxy-only network, the executions find the proxy's URL in their environment, and root may hold CAP_NET_BIND_SERVICE and CAP_NET_RAW. A network with ingress allowed publishes the guest's listeners, so the guest refuses both at stage 0. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a7c15634-094a-4a66-af59-25a58e732f4b
This was referenced Oct 24, 2026
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Proxy injection can invalidate a later start after earlier executions have already been sent, so the augmented batch needs validation before submission.
1 open issue
What changed in this PR
This PR connects the runtime adapter’s execution settings to its sandbox network policy, advancing #822’s end-to-end sandbox support.
Changes:
- Adds listener-publication configuration and passes it into guest capability checks.
- Supplies proxy environment variables from the recorded launch plan while preserving caller overrides.
- Adds configuration, host, guest, and VM coverage with updated documentation.
| File | Description |
|---|---|
| tests/runtime-adapter/tests/vm_layered.rs | Adds proxy and published-listener VM scenarios. |
| tests/runtime-adapter/tests/layered_launch.rs | Tests publication, proxy injection, and plan readback. |
| tests/runtime-adapter/tests/guest_session.rs | Tests publication-dependent capability admission. |
| tests/runtime-adapter/src/worker/executions.rs | Carries sandbox publication into execution entry. |
| tests/runtime-adapter/src/worker.rs | Applies configured publication to entry and account checks. |
| tests/runtime-adapter/src/root.rs | Defines and validates the optional listeners field. |
| tests/runtime-adapter/src/lib.rs | Documents execution network settings. |
| tests/runtime-adapter/src/layered.rs | Derives publication, injects proxies, and reads recorded plans. |
| tests/runtime-adapter/src/bin/runtime-adapter-host.rs | Integrates network settings into launch and execution commands. |
| tests/runtime-adapter/README.md | Documents configuration, behavior, and test coverage. |
Review effort: Balanced
The proxy's variables lengthen an execution's start, so a start that the framing carried when exec parsed its command line may no longer fit once exec gives it the proxy of the VM's network. exec found out only as it sent that start, after it had sent the starts before it, and then failed without collecting their outcomes. exec now gives every start the proxy's variables, and checks each as it checked them without the proxy, before it attaches; it runs none of the executions if one no longer fits. A start takes its key once exec has attached, and a key's encoding has the same size whatever its value. On Linux, whose command lines carry a start as long as the framing allows, the proxy-only VM scenario checks that exec refuses such a batch before it attaches, that none of its executions ran, and that the VM still runs the next command's executions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: a7c15634-094a-4a66-af59-25a58e732f4b
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #866; this PR retargets when its parent merges.
Chain: #863 → #867 → #869 → #865 → #864 → #872 → #875 → #878 → #862 → #868 → #870 → #866 → #882 (this PR) → #883.
Part of #822: PR 10 of 11, the guest's settings.
What changed
listeners(root::Listeners:publishedorunpublished), which says whether the sandbox's listeners are published. It is the 17th field, afterworkload-uidandworkload-gid; no other field moves, and the version stays 1. Without it, the listeners are published, asnvx::guest::entry's default has them, which refuses the most to the executions.worker::executions::Sandbox::new(identity, publication), with the publication that the configuration names; the hostname stays the entry's default. Executions, and the check of the account of the sandbox's workload identity, enter the root with that publication (worker::Entrance::publication). While the listeners are published, the entry refusesCAP_NET_BIND_SERVICEandCAP_NET_RAWat stage 0, with which a workload could forge the announcements of its listeners.LayeredLaunch::with_networkputs the network on the plan, with the listeners published when ingress or host-loopback access is allowed, and unpublished otherwise, or without a network.SandboxPlan::proxy_url) in the proxy variables of its environment,layered::PROXY_VARIABLES(http_proxy,https_proxy,HTTP_PROXY, andHTTPS_PROXY), after its own entries, withlayered::with_proxy; a start that names any of them keeps its own proxy settings. The host program'sexecreads the plan that the launch recorded, withLaunchRecord::read_plan. Before it attaches,execchecks that the framing still carries each start with the proxy's variables, and runs none of the executions if one no longer fits./init.Tests
src/root.rs: the field's encoding, last, its decoding, and the configurations that the guest refuses for it.tests/guest_session.rs, guest-only:an_execution_enters_the_root_with_the_publication_of_listeners_that_its_configuration_names, without the field, and with each publication: the refusals at stage 0 while listeners are published, the capabilities that the entry still allows, and the account check of a workload identity, which enters with the configuration's publication.tests/layered_launch.rs, host-only: the publication that a launch names for each element of a policy;an_execution_finds_the_url_of_its_network_s_proxy_in_its_environment, for each scheme and with a start that names its own proxy; andthe_record_of_a_launch_gives_back_its_plan.tests/vm_layered.rs, on a real hypervisor:executions_take_the_settings_of_a_proxy_only_network, which on Linux also hasexecrefuse, before it attaches, a batch with a start that the framing carries alone but not with the proxy's URL, none of whose executions runs; andpublished_listeners_refuse_binding_and_raw_sockets.Validation
tests/runtime-adapter:cargo fmt --all --check; the protocol-only and host-only configurations'cargo clippy --locked --all-targets [--features host] -- -D warnings,cargo build --locked,cargo test --locked, andcargo +1.89 check --locked --all-targets.tests/runtime-adapter: the same, plus the guest-only configuration (--features guest --target x86_64-unknown-linux-musl): clippy, build, tests, and the MSRV check; the guest-only library andguest_sessiontests as root; and a stress run ofguest_session, 10 times as root and 10 times as a user, and of the library's tests, 3 times as root.vm_layered(43 scenarios),vm_restart(3), andvm_steps(3) on WHP (local) and MSHV (Linux x86_64, as root).python scripts/check_markdown_links.py.dev, KVM included; a stacked PR runs no NVX CI.