Repository navigation
Retire pre-v0.9 Unix network paths - #1424
Closed
Gudge (MGudgin) wants to merge 4 commits into
Closed
Gudge (MGudgin) wants to merge 4 commits into
Gudge (MGudgin) wants to merge 4 commits into
Conversation
This PR removes obsolete contract and runtime compatibility markers now that executable requests start at 0.9.0-alpha. Published schema artifacts stay immutable while unsupported policy guides are removed. Details * Remove constant default-environment and strict-network provenance. * Prune unused wire fields and obsolete policy documentation. * Preserve exact-contract validation and supported request semantics. Tests * cargo fmt --all -- --check and cargo test --workspace --quiet: passed. * cargo check --workspace --all-targets --all-features --quiet: passed. * cargo clippy --workspace --all-targets --all-features --quiet -- -D warnings: passed. * Linux Bubblewrap runner: 30 passed; schema history: 9 passed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7570a662-a429-46d2-aa24-47fae6655cc4 Generated-with: gpt-6-sol
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
This was referenced Oct 6, 2026
This PR removes unreachable old-version network paths in WSLc, ProcessContainer, Windows Sandbox, Hyperlight, NanVix, and AppContainer. Unsupported direct requests still fail before provisioning. Details * Retire host-filter processes and the obsolete firewall manager. * Derive network capabilities and audit records from directional policy. * Avoid redundant Hyperlight validation on normal execution. Tests * cargo fmt --all -- --check and cargo test --workspace --quiet: passed. * cargo check --workspace --all-targets --all-features --quiet: passed. * cargo clippy --workspace --all-targets --all-features --quiet -- -D warnings: passed. * Feature suite: 3442 passed, 3 ignored; Linux SDK check passed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7570a662-a429-46d2-aa24-47fae6655cc4 Generated-with: gpt-6-sol
This PR removes unreachable LXC host-list and proxy routing and lowers directional CIDRs through typed rules. Reused containers check for stale proxy pins inside the container before launching workloads. Details * Reject unsupported network policy before container creation. * Remove old host routing while retaining in-container pin cleanup. * Document the supported directional-only LXC posture. Tests * cargo fmt --all -- --check and cargo test --workspace --quiet: passed. * cargo check --workspace --all-targets --all-features --quiet: passed. * cargo clippy --workspace --all-targets --all-features --quiet -- -D warnings: passed. * LXC units: 284 passed on Windows, 303 passed on Linux. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7570a662-a429-46d2-aa24-47fae6655cc4 Generated-with: gpt-6-sol
This PR removes old-version network fallback paths from Seatbelt and Bubblewrap. Supported requests use directional policy, and Bubblewrap retains private-namespace proxy-only egress parity. Details * Remove legacy branch selection and retired host-list routing. * Preserve direct-request fail-closed validation before provisioning. * Run proxy ingress parity without a guest curl dependency. Tests * cargo fmt --all -- --check and cargo test --workspace --quiet: passed. * cargo check --workspace --all-targets --all-features --quiet: passed. * cargo clippy --workspace --all-targets --all-features --quiet -- -D warnings: passed. * Seatbelt: 102; Linux Bubblewrap: 303; host suite: passed. * macOS target check: passed; runtime tests not run locally. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7570a662-a429-46d2-aa24-47fae6655cc4 Generated-with: gpt-6-sol
Gudge (MGudgin)
force-pushed
the
user/gudge/retire-network-lxc
branch
from
October 6, 2026 21:54
d4e3b63 to
dc5aef1
Compare
Gudge (MGudgin)
force-pushed
the
user/gudge/retire-network-unix
branch
from
October 6, 2026 21:54
ee02978 to
f3e7a1a
Compare
Gudge (MGudgin)
force-pushed
the
user/gudge/retire-network-lxc
branch
from
October 6, 2026 23:05
dc5aef1 to
6117179
Compare
Member
Author
|
Superseded by merged #1397, which includes the Bubblewrap and Seatbelt cleanup in this stacked PR. Closing this alternative PR. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📖 Description
This PR removes pre-v0.9 network fallback paths from Seatbelt and Bubblewrap. Supported requests use directional policy, with unsupported direct requests rejected before provisioning; Bubblewrap retains private-namespace proxy-only egress parity.
Details
🔗 References
Depends on #1423. Follow-up to the exact-contract floor in #1382 and #1383.
🔍 Validation
Tests
src/,cargo fmt --all -- --check: passed.cargo check --workspace --all-targets --all-features --quiet: passed.cargo clippy --workspace --all-targets --all-features --quiet -- -D warnings: passed.cargo test --workspace --quiet: passed.cargo test -p mxc-sdk --lib seatbelt::common --quiet: 102 passed on Windows.cargo check -p mxc-sdk --all-targets --target x86_64-apple-darwin --quiet: passed.src/,cargo check -p mxc-sdk --all-targets --quiet: passed.cargo test -p mxc-sdk --lib bubblewrap::common --quiet -- --test-threads=1: 303 passed.cargo build -p lxc -p unix_test_proxy --quiet: passed;bash ../tests/scripts/run_bwrap_directional_test.sh: nine checks passed, including proxy-only ingress parity.✅ Checklist
Cargo.lock, thedependency-feed-checkcheck passes (see docs/pull-requests.md)📋 Issue Type
GitHub Actions runs the PR validation build automatically. The ADO pipeline
(
MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHubActions build; it runs on merge to
main, and Microsoft reviewers with write access can trigger iton a PR with
/azp run. See docs/pull-requests.md.If the
dependency-feed-checkcheck fails on a new dependency, the crate must be added tothe feed before the PR can pass. See docs/pull-requests.md
for the steps.
Microsoft Reviewers: Open in CodeFlow