feat(process-container): discover identity-less loopback proxy support

docs/api-reference/dotnet/v1/types.md

@@ -38,6 +38,7 @@ public enum BackendCapability
     FilesystemDeniedPaths = 3,
     IngressHostLoopbackAllow = 4,
     FilesystemEnumeratePaths = 5,
+    IdentitylessLoopbackProxy = 6,
 }
 ```
 
@@ -954,6 +955,7 @@ public sealed class ProbeFacts
     public bool BaseContainerSupportsDenyPaths { get; init; }
     public bool BaseContainerSupportsEnumeratePaths { get; init; }
     public bool BaseContainerSupportsIngressHostLoopbackAllow { get; init; }
+    public bool BaseContainerSupportsIdentitylessLoopbackProxy { get; init; }
     public bool IsolationSessionAvailable { get; init; }
     public bool HyperlightAvailable { get; init; }
     public required UiCapabilitySupport UiCapabilities { get; init; }

docs/api-reference/node/v1/types.md

@@ -31,6 +31,7 @@ export type BackendCapability =
   | 'filesystemEnumeratePaths'
   | 'ingressHostLoopbackAllow'
   | 'proxyEnforcement'
+  | 'identitylessLoopbackProxy'
   | 'unknown';
 ```
 
@@ -578,6 +579,7 @@ export interface ProbeFacts {
   baseContainerSupportsDenyPaths: boolean;
   baseContainerSupportsEnumeratePaths: boolean;
   baseContainerSupportsIngressHostLoopbackAllow: boolean;
+  baseContainerSupportsIdentitylessLoopbackProxy: boolean;
   isolationSessionAvailable: boolean;
   hyperlightAvailable: boolean;
   uiCapabilities: UiCapabilitySupport;

docs/api-reference/rust/v1/types.md

@@ -31,6 +31,7 @@ pub enum BackendCapability {
   FilesystemEnumeratePaths,
   IngressHostLoopbackAllow,
   ProxyEnforcement,
+  IdentitylessLoopbackProxy,
 }
 ```
 
@@ -535,6 +536,7 @@ pub struct ProbeFacts {
   pub base_container_supports_deny_paths: bool,
   pub base_container_supports_enumerate_paths: bool,
   pub base_container_supports_ingress_host_loopback_allow: bool,
+  pub base_container_supports_identityless_loopback_proxy: bool,
   pub isolation_session_available: bool,
   pub hyperlight_available: bool,
   pub ui_capabilities: UiCapabilitySupport,

docs/backends/process-container/networking.md

@@ -116,11 +116,36 @@ PSEC rejects it alongside a proxy. Their ingress default still selects `privateN
 host-loopback setting selects both the `networkLoopback` capability and the `MXC-Loopback` peer rather than an
 identity-scoped proxy peer. The peer alone is insufficient: without the capability, the environment can be created
 but its client cannot reach the host proxy.
-The public ingress policy remains required, and host-loopback allow retains the PSEC 1.1 host requirement.
-Requests that do not allow host loopback use the
-PSEC 1.0 capability mapping; `hostLoopback: "allow"` is rejected when the PSEC 1.1 ingress contract is unavailable.
+The public ingress policy remains required. Direct-egress host-loopback allow
+requires PSEC 1.1 and the ingress support flag. For an identity-less
+`runtimeConfig.networkProxy` with explicit `hostLoopback: "allow"`, MXC also
+supports a compatibility workaround on hosts that support PSEC 1.0 but not 1.1.
+Hosts that support PSEC 1.1 or newer must still advertise the ingress support
+flag; accepting a 1.0 payload does not enable this workaround.
+Requests that do not allow host loopback use the PSEC 1.0 capability mapping.
 Requests the PSEC contract cannot preserve continue to an AppContainer tier.
 
+#### Discovering identity-less loopback proxy support
+
+Backend discovery reports `identitylessLoopbackProxy` on the ProcessContainer
+`base-container` tier when the host supports an identity-less proxy on loopback.
+The Windows request probe also reports
+`probes.baseContainerSupportsIdentitylessLoopbackProxy`, including when called
+without a request. Support is available on PSEC 1.0-only hosts and on hosts with
+PSEC 1.1 or newer that advertise ingress support. A host that reports
+`baseContainerSupportsIngressHostLoopbackAllow` also supports an identity-less
+loopback proxy. PSEC 1.1 or newer without ingress support does not qualify,
+even if it also accepts PSEC 1.0 payloads. Version-query failures omit the
+capability, set the probe fact to `false`, and add a warning.
+
+This does not grant general `ingressHostLoopbackAllow` support or report that the
+current request uses an identity-less proxy. The request must set
+`runtimeConfig.networkProxy`, omit `processContainer.network.allowedProxyPeer`,
+and explicitly allow host loopback, while retaining the Model 2 network policy.
+Other requested features still require their own host support.
+Use the request-aware probe for the complete policy. Neither probe launches the
+workload or checks proxy reachability.
+
 **Unresolved ingress limitation:** on Windows build 26691.1002, this proxy mapping permits unprivileged connections
 to the configured proxy and blocks direct loopback bypasses, but host-to-container listener connections still time
 out. The same listener succeeds under a non-proxy PSEC ingress policy. The proxy mapping is therefore not yet a

docs/examples.md

@@ -135,9 +135,11 @@ the development/testing configuration is:
 
 This identity-less host-loopback deployment restricts client egress to the
 configured proxy address and port, but does not verify which process owns that
-endpoint. It requires native PSEC 1.1 ingress/host-loopback support; unsupported
-hosts reject the request. For production ProcessContainer deployments, identify
-a packaged proxy through `processContainer.network.allowedProxyPeer` instead; see
+endpoint. It supports PSEC 1.0-only hosts and hosts with PSEC 1.1 or newer that
+advertise ingress support. PSEC 1.1 or newer without that flag rejects the
+request, even if the host also accepts PSEC 1.0 payloads. For production
+ProcessContainer deployments, identify a packaged proxy through
+`processContainer.network.allowedProxyPeer` instead; see
 [proxy deployment choices](backends/process-container/networking.md#proxy-deployment-choices).
 Bubblewrap and Seatbelt also support a caller-managed loopback proxy, but
 their supported ingress policies differ. See their backend guides.

sdk/dotnet/Microsoft.Mxc.Sdk.AotSmokeTest/Program.cs

@@ -337,7 +337,8 @@ static void CheckRoundTrip<T>(T value, Func<T, bool> check, string name)
     "bfsCompiledIn": false,
     "baseContainerSupportsDenyPaths": true,
     "baseContainerSupportsEnumeratePaths": false,
-    "baseContainerSupportsIngressHostLoopbackAllow": true,
+    "baseContainerSupportsIngressHostLoopbackAllow": false,
+    "baseContainerSupportsIdentitylessLoopbackProxy": true,
     "isolationSessionAvailable": true,
     "hyperlightAvailable": false,
     "uiCapabilities": {
@@ -359,6 +360,14 @@ static void CheckRoundTrip<T>(T value, Func<T, bool> check, string name)
 Check(probe.Tier == IsolationTier.AppContainerDacl, "probe tier parsed");
 Check(probe.NeedsDaclAugmentation == true, "probe dacl augmentation parsed");
 Check(probe.Probes.BaseContainerApiPresent, "probe facts parsed");
+Check(probe.Probes.BaseContainerSupportsIdentitylessLoopbackProxy, "identity-less loopback proxy parsed");
 Check(probe.Probes.UiCapabilities.CanBlockClipboardRead, "probe ui capabilities parsed");
+var nativeProbe = MxcJson.Deserialize<NativeProbeOutput>(probeJson, MxcJson.ProbeOptions)!;
+CheckRoundTrip(nativeProbe.Probes!,
+    x => x.BaseContainerSupportsIdentitylessLoopbackProxy, "identity-less loopback proxy facts");
+var discovery = MxcPlatform.ParseAvailableBackends(
+    """[{"backend":"processcontainer","tier":"base-container","capabilities":["identitylessLoopbackProxy"]}]""");
+Check(discovery.Single().Capabilities.SequenceEqual([BackendCapability.IdentitylessLoopbackProxy]),
+    "identity-less loopback proxy discovery");
 
 Console.WriteLine("AOT smoke test passed: all JSON paths are reflection-free.");

sdk/dotnet/Microsoft.Mxc.Sdk.Tests/V1/MxcContainerTests.cs

@@ -30,6 +30,7 @@ public class MxcContainerTests
             "baseContainerSupportsDenyPaths": true,
             "baseContainerSupportsEnumeratePaths": false,
             "baseContainerSupportsIngressHostLoopbackAllow": true,
+            "baseContainerSupportsIdentitylessLoopbackProxy": true,
             "isolationSessionAvailable": true,
             "hyperlightAvailable": false,
             "uiCapabilities": {
@@ -272,6 +273,41 @@ public void ProbeParser_RejectsMissingRequiredProbeBoolean()
             json["probes"]!.AsObject().Remove("bfscfgPresent"));
     }
 
+    [Theory]
+    [InlineData(false, false)]
+    [InlineData(true, false)]
+    [InlineData(true, true)]
+    public void ProbeParser_PreservesIdentitylessLoopbackProxy(bool supported, bool ingressSupported)
+    {
+        var json = CreateCompleteProbeJson();
+        json["tier"] = "base-container";
+        json["needsDaclAugmentation"] = false;
+        json["probes"]!["baseContainerSupportsIngressHostLoopbackAllow"] = ingressSupported;
+        json["probes"]!["baseContainerSupportsIdentitylessLoopbackProxy"] = supported;
+
+        var output = MxcContainer.ParseProbeOutput(json.ToJsonString());
+
+        Assert.Equal(supported, output.Probes.BaseContainerSupportsIdentitylessLoopbackProxy);
+        Assert.Equal(ingressSupported, output.Probes.BaseContainerSupportsIngressHostLoopbackAllow);
+    }
+
+    [Fact]
+    public void ProbeParser_RejectsMissingIdentitylessLoopbackProxy()
+    {
+        AssertProbeJsonRejected(json =>
+            json["probes"]!.AsObject().Remove("baseContainerSupportsIdentitylessLoopbackProxy"));
+    }
+
+    [Theory]
+    [InlineData("null")]
+    [InlineData("\"true\"")]
+    [InlineData("1")]
+    public void ProbeParser_RejectsInvalidIdentitylessLoopbackProxy(string value)
+    {
+        AssertProbeJsonRejected(json =>
+            json["probes"]!["baseContainerSupportsIdentitylessLoopbackProxy"] = JsonNode.Parse(value));
+    }
+
     [Fact]
     public void ProbeParser_RejectsMissingRequiredUiBoolean()
     {
@@ -456,6 +492,7 @@ public void Discovery_MapsEveryNativeIsolationTier(
     [InlineData("filesystemEnumeratePaths", BackendCapability.FilesystemEnumeratePaths)]
     [InlineData("ingressHostLoopbackAllow", BackendCapability.IngressHostLoopbackAllow)]
     [InlineData("proxyEnforcement", BackendCapability.ProxyEnforcement)]
+    [InlineData("identitylessLoopbackProxy", BackendCapability.IdentitylessLoopbackProxy)]
     public void Discovery_MapsEveryNativeCapability(
         string wireName,
         BackendCapability expected)
@@ -472,6 +509,7 @@ public void BackendCapability_PreservesReleasedNumericValues()
         Assert.Equal(3, (int)BackendCapability.FilesystemDeniedPaths);
         Assert.Equal(4, (int)BackendCapability.IngressHostLoopbackAllow);
         Assert.Equal(5, (int)BackendCapability.FilesystemEnumeratePaths);
+        Assert.Equal(6, (int)BackendCapability.IdentitylessLoopbackProxy);
     }
 
     [Theory]

sdk/dotnet/Microsoft.Mxc.Sdk/MxcJsonSerialization.cs

@@ -82,6 +82,7 @@ public CamelCaseJsonStringEnumConverter()
 [JsonSerializable(typeof(NativeAvailableBackend[]))]
 [JsonSerializable(typeof(NativePlatformSupport))]
 [JsonSerializable(typeof(NativeProbeOutput))]
+[JsonSerializable(typeof(NativeProbeFacts))]
 [JsonSerializable(typeof(ExecutionMetadata))]
 [JsonSerializable(typeof(CaptureDenialsResult))]
 [JsonSerializable(typeof(CaptureDenialsError))]

sdk/dotnet/Microsoft.Mxc.Sdk/V1/MxcContainer.cs

@@ -177,6 +177,8 @@ internal static ProbeOutput ParseProbeOutput(string json)
                     probes.BaseContainerSupportsEnumeratePaths,
                 BaseContainerSupportsIngressHostLoopbackAllow =
                     probes.BaseContainerSupportsIngressHostLoopbackAllow,
+                BaseContainerSupportsIdentitylessLoopbackProxy =
+                    probes.BaseContainerSupportsIdentitylessLoopbackProxy,
                 IsolationSessionAvailable = probes.IsolationSessionAvailable,
                 HyperlightAvailable = probes.HyperlightAvailable,
                 UiCapabilities = new UiCapabilitySupport

sdk/dotnet/Microsoft.Mxc.Sdk/V1/MxcPlatform.cs

@@ -118,6 +118,7 @@ internal static BackendCapability ParseBackendCapability(string value) =>
             "filesystemEnumeratePaths" => BackendCapability.FilesystemEnumeratePaths,
             "ingressHostLoopbackAllow" => BackendCapability.IngressHostLoopbackAllow,
             "proxyEnforcement" => BackendCapability.ProxyEnforcement,
+            "identitylessLoopbackProxy" => BackendCapability.IdentitylessLoopbackProxy,
             _ => BackendCapability.Unknown,
         };
 

sdk/dotnet/Microsoft.Mxc.Sdk/V1/PlatformDiscovery.cs

@@ -78,6 +78,12 @@ public enum BackendCapability
     /// Native filesystem enumeration-only access at the reported tier.
     /// </summary>
     FilesystemEnumeratePaths = 5,
+
+    /// <summary>
+    /// Identity-less proxy support on loopback.
+    /// Requires explicit host-loopback allow; not general ingress support.
+    /// </summary>
+    IdentitylessLoopbackProxy = 6,
 }
 
 /// <summary>One host-available backend and its probed capabilities.</summary>
@@ -146,6 +152,8 @@ public sealed class ProbeFacts
     public bool BaseContainerSupportsDenyPaths { get; init; }
     public bool BaseContainerSupportsEnumeratePaths { get; init; }
     public bool BaseContainerSupportsIngressHostLoopbackAllow { get; init; }
+    /// <summary>Identity-less proxy support on loopback; requires explicit host-loopback allow.</summary>
+    public bool BaseContainerSupportsIdentitylessLoopbackProxy { get; init; }
     public bool IsolationSessionAvailable { get; init; }
     public bool HyperlightAvailable { get; init; }
     public required UiCapabilitySupport UiCapabilities { get; init; }
@@ -279,6 +287,10 @@ internal sealed class NativeProbeFacts
     [JsonPropertyName("baseContainerSupportsIngressHostLoopbackAllow")]
     public bool BaseContainerSupportsIngressHostLoopbackAllow { get; init; }
 
+    [JsonRequired]
+    [JsonPropertyName("baseContainerSupportsIdentitylessLoopbackProxy")]
+    public bool BaseContainerSupportsIdentitylessLoopbackProxy { get; init; }
+
     [JsonRequired]
     [JsonPropertyName("isolationSessionAvailable")]
     public bool IsolationSessionAvailable { get; init; }

sdk/node/src/v1/platform.ts

@@ -26,6 +26,7 @@ const discoveryBackends: readonly ContainmentBackend[] = [
 const discoveryCapabilities: readonly BackendCapability[] = [
   'captureDenials', 'filesystemDeniedPaths', 'filesystemEnumeratePaths',
   'ingressHostLoopbackAllow', 'proxyEnforcement',
+  'identitylessLoopbackProxy',
 ];
 const discoveryTiers: readonly IsolationTier[] = [
   'base-container', 'appcontainer-bfs', 'appcontainer-dacl',

sdk/node/src/v1/probe.ts

@@ -31,6 +31,7 @@ const probeFactBooleanFields: readonly (keyof ProbeFacts)[] = [
   'baseContainerSupportsDenyPaths',
   'baseContainerSupportsEnumeratePaths',
   'baseContainerSupportsIngressHostLoopbackAllow',
+  'baseContainerSupportsIdentitylessLoopbackProxy',
   'isolationSessionAvailable',
   'hyperlightAvailable',
 ];

sdk/node/src/v1/types.ts

@@ -711,6 +711,7 @@ export type BackendCapability =
   | 'filesystemEnumeratePaths'
   | 'ingressHostLoopbackAllow'
   | 'proxyEnforcement'
+  | 'identitylessLoopbackProxy'
   | 'unknown';
 
 /** One host-available backend and its native capabilities. */
@@ -784,6 +785,8 @@ export interface ProbeFacts {
   baseContainerSupportsDenyPaths: boolean;
   baseContainerSupportsEnumeratePaths: boolean;
   baseContainerSupportsIngressHostLoopbackAllow: boolean;
+  /** Identity-less proxy support on loopback; requires explicit host-loopback allow. */
+  baseContainerSupportsIdentitylessLoopbackProxy: boolean;
   /** True when this executor includes IsolationSession and the host can activate it. */
   isolationSessionAvailable: boolean;
   /** True when this executor includes Hyperlight and its host runtime is available. */

sdk/node/tests/unit/platform.test.ts

@@ -71,6 +71,19 @@ describe('native backend discovery', () => {
     }]);
   });
 
+  it('reports identity-less loopback proxy support without general ingress support', () => {
+    assert.deepStrictEqual(parseAvailableBackends(JSON.stringify([{
+      backend: 'processcontainer',
+      tier: 'base-container',
+      capabilities: ['identitylessLoopbackProxy'],
+    }])), [{
+      backend: 'processcontainer',
+      tier: 'base-container',
+      capabilities: ['identitylessLoopbackProxy'],
+      warnings: [],
+    }]);
+  });
+
   it('rejects malformed discovery results instead of returning no backends', () => {
     for (const payload of [
       null, {}, [null], [[]], [{}], [{ backend: 1 }],

sdk/node/tests/unit/probe.test.ts

@@ -30,6 +30,7 @@ const completeProbe = {
     baseContainerSupportsDenyPaths: false,
     baseContainerSupportsEnumeratePaths: false,
     baseContainerSupportsIngressHostLoopbackAllow: false,
+    baseContainerSupportsIdentitylessLoopbackProxy: false,
     isolationSessionAvailable: false,
     hyperlightAvailable: false,
     uiCapabilities: {
@@ -192,6 +193,35 @@ describe('probe', () => {
     assert.equal(output.needsDaclAugmentation, true);
   });
 
+  it('preserves identity-less proxy support with or without general ingress', () => {
+    for (const [supported, ingressSupported] of [[false, false], [true, false], [true, true]]) {
+      const output = runProbeOutput({
+        ...completeProbe,
+        tier: 'base-container',
+        needsDaclAugmentation: false,
+        probes: {
+          ...completeProbe.probes,
+          baseContainerSupportsIdentitylessLoopbackProxy: supported,
+          baseContainerSupportsIngressHostLoopbackAllow: ingressSupported,
+        },
+      });
+      assert.equal(output.probes.baseContainerSupportsIdentitylessLoopbackProxy, supported);
+      assert.equal(output.probes.baseContainerSupportsIngressHostLoopbackAllow, ingressSupported);
+    }
+  });
+
+  it('rejects missing or invalid identity-less loopback proxy facts', () => {
+    for (const value of [undefined, null, 'true', 1]) {
+      assertProbeOutputRejected({
+        ...completeProbe,
+        probes: {
+          ...completeProbe.probes,
+          baseContainerSupportsIdentitylessLoopbackProxy: value,
+        },
+      });
+    }
+  });
+
   it('rejects an unknown envelope field', () => {
     const payload = cloneCompleteProbe();
     payload.unknownEnvelopeField = true;

src/ffi/mxc_ffi/tests/ffi.rs

@@ -78,6 +78,7 @@ fn extern_discovery_returns_owned_json() {
                     | "filesystemEnumeratePaths"
                     | "ingressHostLoopbackAllow"
                     | "proxyEnforcement"
+                    | "identitylessLoopbackProxy"
             )
         ));
     }