Skip to content

Disable strict hostname enforcement only on microsandbox create #896

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SaladDay merged 1 commit into from
Oct 27, 2026
Merged

Disable strict hostname enforcement only on microsandbox create #896

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion services/core/tools/microsandbox-provider/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ The checkpoint root is a separate adapter-owned directory, mode 0700, with a pri

## Create and bootstrap

Create names the VM from a hash of the installation and allocation reference plus the compute generation; a name never serves another incarnation. It creates the VM with the saved CPUs and memory as both initial and maximum, a managed root disk of `root_disk_mib`, the explicitly resolved workspace directory mounted at `/environment`, user 1000:1000, working directory `/` and the node's network policy ([`bootstrap.go`](bootstrap.go)). The resource checks run before bootstrap. Creation and restore retain the SDK's strict hostname policy enforcement; the adapter does not disable it.
Create names the VM from a hash of the installation and allocation reference plus the compute generation; a name never serves another incarnation. It creates the VM with the saved CPUs and memory as both initial and maximum, a managed root disk of `root_disk_mib`, the explicitly resolved workspace directory mounted at `/environment`, user 1000:1000, working directory `/` and the node's network policy ([`bootstrap.go`](bootstrap.go)). The resource checks run before bootstrap. Creation disables the SDK's strict hostname policy enforcement, so domain allows match by the guest's DNS answer and the TLS server name without TLS interception; restore accepts only the policy rules and cannot set it.

Workspace, staging and outputs share the `/environment` filesystem, which keeps the Runtime's cross-device and link checks intact; the layered root filesystem can report different device IDs for a directory and its upper-layer files, so it holds no workspace data. The filesystem provider owns the directory; sandbox removal never deletes it. The binding and resource rules belong to [Workspace filesystem protocol](../../../../docs/workspace-provider.md#attachment). The [Runtime bootstrap](../../../../docs/runtime-bootstrap.md) owns the Runtime directory layout.

Expand Down
4 changes: 4 additions & 0 deletions services/core/tools/microsandbox-provider/bootstrap.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,10 @@ func (b backend) create(ctx context.Context) (wire.Response, error) {
if e != nil {
return wire.Response{}, e
}
// Strict hostname enforcement accepts a domain allow over TLS only with TLS
// interception, so the domain allows of a not-public egress would never pass
// HTTPS. Restore cannot set it (the SDK takes only the policy there).
network.DisableStrict = true
live, e := sdk.CreateSandbox(ctx, c.Name,
// Every compatible node holds the pinned image; nothing is ever pulled.
sdk.WithImage(b.q.Config.Image), sdk.WithPullPolicy(sdk.PullPolicyNever), sdk.WithMemory(b.q.Config.MemoryMiB), sdk.WithCPUs(b.q.Config.CPUs),
Expand Down
6 changes: 1 addition & 5 deletions services/core/tools/microsandbox-provider/network.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,10 +46,6 @@ const resolveTimeout = 5 * time.Second
// and rebind protection already refuse private ones
// 7. public addresses, when Public
//
// Strict hostname enforcement is off: it accepts a domain allow over TLS only
// with TLS interception, so the domain allows of rule 6 would never pass HTTPS.
// They match by the guest's DNS answer and the TLS server name instead.
//
// Core and PrivateDomains names are resolved together under one deadline. A
// PrivateDomains name that does not resolve gets no address rule and is
// reported to report.
Expand Down Expand Up @@ -99,7 +95,7 @@ func egressNetwork(ctx context.Context, coreURL string, egress sandbox.Egress, r
slices.Sort(private)
private = slices.Compact(private)

n := &sdk.NetworkConfig{DefaultEgress: sdk.PolicyActionDeny, DefaultIngress: sdk.PolicyActionDeny, DisableStrict: true}
n := &sdk.NetworkConfig{DefaultEgress: sdk.PolicyActionDeny, DefaultIngress: sdk.PolicyActionDeny}
allow := func(destination, protocol, port string) {
n.Rules = append(n.Rules, sdk.PolicyRule{Action: sdk.PolicyActionAllow, Direction: sdk.PolicyDirectionEgress, Destination: destination, Protocol: sdk.PolicyProtocol(protocol), Port: port})
}
Expand Down
2 changes: 1 addition & 1 deletion services/core/tools/microsandbox-provider/network_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ func rules(t *testing.T, egress sandbox.Egress, dns map[string][]string) (string
if err != nil {
t.Fatal(err)
}
if n.DefaultEgress != "deny" || n.DefaultIngress != "deny" || !n.DisableStrict || n.DNS != nil {
if n.DefaultEgress != "deny" || n.DefaultIngress != "deny" || n.DisableStrict || n.DNS != nil {
t.Fatalf("defaults or DNS options changed: %+v", n)
}
var lines []string
Expand Down
Loading