Repository navigation
NVX Phase 2: Policy Support and Image Selection - #1538
Huzaifa Danish (huzaifa-d) wants to merge 3 commits into
Conversation
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
There was a problem hiding this comment.
🔵 Needs a closer look
Filesystem and network enforcement across the native runtime boundary requires final human review backed by completed Windows Hypervisor Platform validation.
No open issues 🎉
What changed in this PR
This PR extends Phase 1 NVX support with experimental Rust SDK execution, caller-selected images, and filesystem and network policies for Windows x64 MicroVMs.
Changes:
- Adds typed experimental execution and required image selection through the development contract.
- Maps supported policies to the signed NVX runtime, with capability checks before container creation.
- Expands functional tests, schedules daily validation, hardens bundle staging, and updates SDK documentation.
| File | Description |
|---|---|
| tests/configs/microvm_timeout.json | Adds explicit workload image. |
| tests/configs/microvm_timeout_linux.json | Adds explicit workload image. |
| tests/configs/microvm_stdlib.json | Adds explicit workload image. |
| tests/configs/microvm_stdlib_linux.json | Adds explicit workload image. |
| tests/configs/microvm_network.json | Adds explicit workload image. |
| tests/configs/microvm_network_linux.json | Adds explicit workload image. |
| tests/configs/microvm_multiline.json | Adds explicit workload image. |
| tests/configs/microvm_multiline_linux.json | Adds explicit workload image. |
| tests/configs/microvm_large_output.json | Adds explicit workload image. |
| tests/configs/microvm_large_output_linux.json | Adds explicit workload image. |
| tests/configs/microvm_hello.json | Adds explicit workload image. |
| tests/configs/microvm_hello_linux.json | Adds explicit workload image. |
| tests/configs/microvm_exit_code.json | Adds explicit workload image. |
| tests/configs/microvm_exit_code_linux.json | Adds explicit workload image. |
| tests/configs/microvm_error.json | Adds explicit workload image. |
| tests/configs/microvm_error_linux.json | Adds explicit workload image. |
| src/mxc-sdk/tests/nvx_e2e/network.rs | Tests network restrictions and proxy traffic. |
| src/mxc-sdk/tests/nvx_e2e.rs | Tests image validation, authorization, and filesystem policies. |
| src/mxc-sdk/tests/nvx_bundle_integrity.rs | Covers extraction under linked temporary roots. |
| src/mxc-sdk/tests/mxc_contract/version_boundaries/containment.rs | Includes image selection in contract-boundary tests. |
| src/mxc-sdk/tests/mxc_contract/v1_1_0_alpha/fixtures/one_shot/valid/microvm-image.json | Adds valid image-selection fixture. |
| src/mxc-sdk/tests/mxc_contract/v1_1_0_alpha/fixtures/one_shot/invalid/microvm-whitespace-image.json | Covers whitespace-only image rejection. |
| src/mxc-sdk/tests/mxc_contract/v1_1_0_alpha/fixtures/one_shot/invalid/microvm-null-image.json | Covers null image rejection. |
| src/mxc-sdk/tests/mxc_contract/v1_1_0_alpha/fixtures/one_shot/invalid/microvm-missing-image.json | Covers missing image configuration. |
| src/mxc-sdk/tests/mxc_contract/v1_1_0_alpha/fixtures/one_shot/invalid/microvm-image-without-containment.json | Covers mismatched containment and image configuration. |
| src/mxc-sdk/tests/mxc_contract/v1_1_0_alpha/fixtures/one_shot/invalid/microvm-empty-config.json | Covers empty MicroVM configuration. |
| src/mxc-sdk/tests/mxc_contract/v1_1_0_alpha/fixtures/one_shot/invalid/microvm-blank-image.json | Covers empty image rejection. |
| src/mxc-sdk/src/policy/exact/v1_0.rs | Prevents MicroVM emission through the published contract. |
| src/mxc-sdk/src/policy/exact/mod.rs | Routes MicroVM authoring through the development builder. |
| src/mxc-sdk/src/policy/exact/dev_microvm.rs | Builds typed MicroVM requests and policies. |
| src/mxc-sdk/src/policy.rs | Adds the image-bearing MicroVM variant. |
| src/mxc-sdk/src/lib.rs | Exposes experimental typed execution. |
| src/mxc-sdk/src/core/mxc_engine/mod.rs | Shares execution dispatch with typed requests. |
| src/mxc-sdk/src/core/mxc_engine/dispatch.rs | Enforces experimental authorization before spawning. |
| src/mxc-sdk/src/core/mxc_contract/dev/schema.rs | Requires image configuration for MicroVM containment. |
| src/mxc-sdk/src/core/mxc_contract/dev/request.rs | Validates containment and image pairing. |
| src/mxc-sdk/src/core/mxc_contract/dev/primitives.rs | Adds validated image-reference input. |
| src/mxc-sdk/src/core/mxc_contract/dev/one_shot.rs | Defines MicroVM creation settings. |
| src/mxc-sdk/src/core/mxc_contract/dev/mod.rs | Exports new contract types. |
| src/mxc-sdk/src/core/mxc_common/sdk_input.rs | Leaves image selection absent for lifecycle input. |
| src/mxc-sdk/src/core/mxc_common/policy_identity.rs | Includes image selection in policy identity. |
| src/mxc-sdk/src/core/mxc_common/models.rs | Carries image selection in execution requests. |
| src/mxc-sdk/src/core/mxc_common/config_parser.rs | Preserves image selection during normalization. |
| src/mxc-sdk/src/core/mxc_common/config_contract_adapters/v1_0/state_aware.rs | Keeps image selection absent in existing lifecycle contracts. |
| src/mxc-sdk/src/core/mxc_common/config_contract_adapters/v1_0/one_shot.rs | Keeps image selection absent in the published contract. |
| src/mxc-sdk/src/core/mxc_common/config_contract_adapters/v0_9/state_aware.rs | Keeps image selection absent in older lifecycle contracts. |
| src/mxc-sdk/src/core/mxc_common/config_contract_adapters/v0_9/one_shot.rs | Keeps image selection absent in the older contract. |
| src/mxc-sdk/src/core/mxc_common/config_contract_adapters/dev/state_aware.rs | Leaves image selection absent for lifecycle requests. |
| src/mxc-sdk/src/core/mxc_common/config_contract_adapters/dev/one_shot.rs | Transfers image selection into shared request data. |
| src/mxc-sdk/src/core/mxc_common/config_contract_adapters/dev/one_shot_tests/experimental.rs | Updates MicroVM adapter test input. |
| src/mxc-sdk/src/core/mxc_common/common_request_ir.rs | Carries optional image selection between layers. |
| src/mxc-sdk/src/backends/nvx/runtime.rs | Adds capability queries and provision validation. |
| src/mxc-sdk/src/backends/nvx/runner.rs | Validates and provisions selected images and policies. |
| src/mxc-sdk/src/backends/nvx/policy.rs | Maps policies and checks runtime capabilities. |
| src/mxc-sdk/src/backends/nvx/abi.rs | Defines native policy and capability messages. |
| src/mxc-sdk/README.md | Documents experimental execution and supported policies. |
| src/mxc-sdk/build/build_nvx_bundled.rs | Rejects linked bundle sources and destinations. |
| sdk/node/src/generated/v1_1_0_alpha/wire.ts | Adds generated image-selection types. |
| schemas/dev/mxc-config.schema.1.1.0-alpha.json | Adds generated MicroVM image constraints. |
| docs/schema.md | Documents required image selection and network support. |
| docs/development/guides/authoring-a-new-feature.md | Explains experimental development-contract authoring. |
| docs/development/build-and-test/ci-validation-infrastructure.md | Describes daily NVX validation and prerequisites. |
| docs/api-reference/rust/v1/types.md | Documents the MicroVM containment variant. |
| docs/api-reference/rust/v1/README.md | Introduces experimental MicroVM execution. |
| docs/api-reference/rust/v1/api.md | Documents the experimental launch signature. |
| .github/workflows/microvm-e2e.yml | Adds daily runs and NVX library tests. |
| .github/workflows/Build.Windows.Job.yml | Includes the NVX bundle in Windows artifacts. |
Review effort: Balanced
microsoft-github-policy-service
Bot
added
the
Needs-Author-Feedback
There was a problem hiding this comment.
🔵 Needs a closer look
Signed NVX policy and Bubblewrap containment changes require human review and host-dependent Windows WHP/PSEC and Linux runtime validation that could not be performed in this source-only review.
No open issues 🎉
Review effort: Balanced
5474b31 to
4c5d844
Compare
Gudge (MGudgin)
left a comment
Gudge (MGudgin)
left a comment
There was a problem hiding this comment.
Summary
Requesting changes for finding 1: the new image-reference schema regex has quadratic rejection cost on unbounded invalid input, blocking synchronous JavaScript schema validation. There are also four Medium findings concerning CI guards, filesystem/network enforcement coverage, and the development policy reference. The coverage findings are missing regression protection, not demonstrated native containment failures.
All five findings were rechecked against base 1cc2dbd05e56cc18e882af87567047676299db4b and head 4c5d844ee6bee3d0991142e67a1a5fd1fc3c7f79. The local and GitHub diffs match apart from abbreviated index hashes. Four findings are inline; finding 5 is below because its fix belongs in an unchanged file.
Verification and limits
The exact emitted regex was exercised directly in Node v26.13.0: rejecting "a.".repeat(n / 2) took approximately 287 ms at 32 KB, 1,155 ms at 64 KB, and 4,679 ms at 128 KB. This is measured regex behavior, not an inference from syntax alone.
Checks that passed on the reviewed revision, from src/:
cargo test --offline --locked -p mxc-sdk --no-default-features --test nvx_e2e: 6 passed, covering feature-disabled/fail-closed behavior; no VM execution.cargo test --offline --locked -p mxc-sdk --no-default-features --lib microvm: 6 passed in the name-filtered shared-library selection.
Live Windows x64 NVX execution against the signed bundle was not run. Bundle-integrity tests had 10 passes and two access-denied junction failures in the review sandbox; the Ajv image-reference test did not execute because ajv was unavailable. The High finding affects JavaScript schema consumers, not the Rust image validator.
Findings outside the diff
5. Medium (documentation drift) - Document the newly required image in the development policy reference.
docs/containment-policy/dev/policy.md:138-146
Attribution: newly_exposed_by_change - this file is byte-identical between base and head, but this PR adds the mandatory microvm.image requirement in docs/schema.md:11-15 and the development contract. The linked self-contained development policy reference lists microvm as a backend but has no microvm row in its supported-fields table. A caller following that reference can omit the section and receive microvm.image is required without the reference explaining the new requirement.
Fix: Add a microvm row describing the required registry-qualified image and the optional provision.memoryMib field, including its current backend rejection, and link to the NVX support matrix. This documentation gap is non-blocking by itself.
Verified pre-existing - not attributed to this PR
No unrelated pre-existing defects are included as findings or merge conditions. The unchanged development policy reference was byte-compared and is retained only for the newly introduced requirement described above.
Combine Phase 2 policy and image selection with the existing versioned Rust JSON SDK integration. Address image schema backtracking and strengthen nightly filesystem and network enforcement coverage. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Add matching TCP and any-protocol controls plus a UDP-only rule that must block the same reachable TCP services. Verify the scenario fails when protocol mapping is deliberately ignored. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Reuse runtime capabilities and native request validation without probing or provisioning a VM. Reject invalid requests and missing bundles while preserving credential redaction and cleanup. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
4c5d844 to
be42796
Compare
There was a problem hiding this comment.
🔵 Needs a closer look
The signed NVX agent’s filesystem and network containment requires Windows x64/WHP validation unavailable here, so a maintainer must confirm nightly enforcement, proxy, and cleanup results on a suitable host.
Review effort: Balanced
microsoft-github-policy-service
Bot
added
Needs-Attention
| image in `microvm.image`, such as `docker.io/library/python:3.12-alpine`. | ||
| They may also include `microvm.provision.memoryMib`, a positive integer in MiB. | ||
| Contract-valid requests remain subject to backend support; see the | ||
| [NVX support matrix](backends/nvx/nvx.md#supported-operations-and-policy). |
There was a problem hiding this comment.
Somehow this doesn't feel important enough to be the intro paragraph to schema.md
| support lifecycle operations, such as starting or stopping a container. | ||
| Recognizing an ID is not enough: MXC recognizes `microvm:` IDs so it can return | ||
| an unsupported-operation error. This does not require adding MicroVM lifecycle | ||
| support to the .NET SDK. |
There was a problem hiding this comment.
What does this have to do with pull requests?
| pub readwrite_paths: Vec<PathBuf>, | ||
| #[serde(default, skip_serializing_if = "Vec::is_empty")] | ||
| pub denied_paths: Vec<PathBuf>, | ||
| } |
There was a problem hiding this comment.
What is this? why are these engine types re-introduced in a backend?
microsoft-github-policy-service
Bot
added
the
Needs-Author-Feedback
| host_loopback: Some(access(ingress.host_loopback)), | ||
| }, | ||
| })) | ||
| } |
There was a problem hiding this comment.
What is going on with this engine code being here?
| pub(crate) windows_sandbox: Option<wire::WindowsSandbox>, | ||
| pub(crate) hyperlight: Option<wire::Hyperlight>, | ||
| pub(crate) microvm_image: Option<String>, | ||
| pub(crate) microvm_memory_mib: Option<u32>, |
There was a problem hiding this comment.
put both under a microvm member?
📖 Description
Add NVX image selection and supported filesystem, network, and proxy policy to the MicroVM backend, executor, development JSON contract, and functional validation.
🔗 References
✅ Checklist
feature-acceptedCargo.lock, thedependency-feed-checkcheck passes (see pull request builds)📋 Issue Type
Microsoft Reviewers: Open in CodeFlow