Skip to content

Retire pre-v0.9 compatibility scaffolding #1421

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Gudge (MGudgin) wants to merge 1 commit into from
Closed

Retire pre-v0.9 compatibility scaffolding #1421

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -334,7 +334,6 @@ Repository contributors can browse the [development documentation](docs/developm
| [tests/scripts/README.md](tests/scripts/README.md) | Local and CI backend test suites |
| [Host preparation](docs/backends/process-container/host-prep.md) | Windows host preparation (`wxc-host-prep.exe`) |
| [Diagnostics](docs/development/guides/diagnostics.md) | Diagnostic logging and ETW |
| [Containment configuration 0.7.0](docs/containment-configuration/0.7.0/policy.md) | Containment configuration 0.7.0 specification |
| [Adding ProcessContainer OS features](docs/development/guides/process-container-adding-os-features.md) | Windows AppContainer / BaseContainer developer guide |
| [docs/backends/lxc/lxc-backend.md](docs/backends/lxc/lxc-backend.md) | LXC backend (Linux) |
| [docs/backends/bwrap/bubblewrap-backend.md](docs/backends/bwrap/bubblewrap-backend.md) | Bubblewrap backend (Linux) |
Expand Down
8 changes: 4 additions & 4 deletions docs/api-reference/dotnet/v1/types.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -785,7 +785,7 @@ public enum NetworkAction

## `Microsoft.Mxc.Sdk.V1.NetworkEgressPolicy`

Schema-0.8 outbound network policy.
Supported directional outbound network policy.

```csharp
public sealed class NetworkEgressPolicy
Expand All @@ -801,7 +801,7 @@ public sealed class NetworkEgressPolicy

## `Microsoft.Mxc.Sdk.V1.NetworkIngressPolicy`

Schema-0.8 inbound and host-loopback network policy.
Supported directional inbound and host-loopback network policy.

```csharp
public sealed class NetworkIngressPolicy
Expand Down Expand Up @@ -893,7 +893,7 @@ public sealed class NetworkRulePolicy

## `Microsoft.Mxc.Sdk.V1.NetworkRuntimeConfig`

Schema-0.8 runtime network values.
Supported runtime network values.

```csharp
public sealed class NetworkRuntimeConfig
Expand Down Expand Up @@ -1209,7 +1209,7 @@ Schema versions supported by this SDK release.
```csharp
public static class SchemaVersions
{
public const string Minimum = "0.6.0-alpha";
public const string Minimum = "0.9.0-alpha";
public const string MaximumSupported = "1.1.0-alpha";
public const string LatestStable = "1.0.0";
}
Expand Down
8 changes: 4 additions & 4 deletions docs/backends/process-container/examples/0.8.0-schema.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,12 @@

> **Audience:** MXC consumers and developers

> Historical design reference: schema 0.8 is retired. For supported requests,
> Schema 0.8 is retired. For supported requests,
> use [current ProcessContainer networking guidance](../networking.md).

See the shared [0.7-to-0.8 network schema comparison](../../../containment-configuration/0.8.0/networking/schema-updates.md)
for egress, ingress, and proxy endpoint changes. This page covers the
ProcessContainer-specific proxy peer.
For the supported egress, ingress, and proxy endpoint fields, see
[directional networking](../../../schema.md#directional-networking-supported-contracts).
The example below covers the ProcessContainer-specific proxy peer.

## Contained proxy

Expand Down
7 changes: 3 additions & 4 deletions docs/backends/process-container/networking.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,9 @@ Supported exact contracts from `0.9.0-alpha` use the shared `network.egress`
and `network.ingress` policy plus `runtimeConfig.networkProxy` and
`processContainer.network.allowedProxyPeer` configuration.

Implementation companion to the parent
[MXC Network Configuration, GA design](../../containment-configuration/0.8.0/networking/networking.md)
doc. The parent owns the shared policy schema, connectivity models, and GA goal.
This doc covers only how the Windows ProcessContainer backend enforces them.
For the shared policy shape and defaults, see
[directional networking](../../schema.md#directional-networking-supported-contracts).
This guide covers how the Windows ProcessContainer backend enforces them.

## 1. What this backend targets at GA

Expand Down
13 changes: 8 additions & 5 deletions docs/backends/process-container/os-version-support.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ document are Windows 11**, and the minimum considered here is Windows 11 23H2.

For the enforcement mechanisms themselves see the
[UI policy schema](./UIPolicy_Schema.md) and the
[containment configuration spec](../../containment-configuration/0.7.0/policy.md).
[supported configuration schema](../../schema.md).

## Windows 11 releases

Expand Down Expand Up @@ -125,7 +125,9 @@ Notes:

## Network policy

The release matrix describes the legacy schema 0.6/0.7 implementation.
The following release matrix documents the retired schema 0.6/0.7
implementation, not support for executable requests. For current directional
policy and tier behavior, see [ProcessContainer networking](networking.md).

| Aspect | 23H2 | 24H2 | 25H2 | 25H2+ |
|--------|:--:|:--:|:--:|:--:|
Expand All @@ -143,9 +145,10 @@ Notes:
the forward-looking proxy architecture; support for the model-2 BaseContainer
contract should replace this fallback in a separate change.

Schema 0.8 support is selected by runtime contract rather than Windows release:
Supported directional network policy (schema 0.9+) depends on the available
backend enforcement tier rather than the declared version:

| Schema 0.8 capability | PSEC | AppContainer fallback |
| Directional capability | PSEC | AppContainer fallback |
|---|:---:|:---:|
| Directional defaults represented by capabilities | ✅ | ✅ when the capability mapping preserves the request |
| Explicit egress IP/CIDR/port/protocol rules | ✅ WFP | ❌ |
Expand All @@ -155,7 +158,7 @@ Schema 0.8 support is selected by runtime contract rather than Windows release:
PSEC owns the WFP policy lifetime through workload completion. The
AppContainer fallback rejects
`egress.default: "deny"` with `ingress.default: "allow"` because
`privateNetworkClientServer` is bidirectional and no schema 0.8 WFP filter is
`privateNetworkClientServer` is bidirectional and no per-container WFP filter is
available there to block private-network egress.

## UI restrictions
Expand Down
4 changes: 2 additions & 2 deletions docs/backends/seatbelt/seatbelt-backend.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,8 +183,8 @@ Anything it hasn't declared is rejected up front.
### Fields (supported schema 0.9+)

This is the cross-backend directional shape accepted by the registered exact
contracts. The original [0.8 networking design](../../containment-configuration/0.8.0/networking/networking.md)
is historical; schema 0.8 is no longer accepted.
contracts. Schema 0.8 is no longer accepted; see the
[supported network fields](../../schema.md#directional-networking-supported-contracts).

> **Omitting `network` entirely denies all IP networking.** Every field below
> defaults to `deny`, so a config with no `network` block behaves exactly like
Expand Down
Loading
Loading