[LXC] State-aware sandbox lifecycle - #849

Open

Darren Hoehna (dhoehna) wants to merge 155 commits into

microsoft:mainfrom

dhoehna:user/dahoehna/lxc-lifecycle-current

Commits on Jul 13, 2026

[LXC] Implement StatefulSandboxBackend for LXC (state-aware lifecycle) (AB#62953349)

Darren Hoehna (dhoehna)
and
Copilot
committed
fabdfd0
[LXC] Address PR #633 review: collision-free container names + narrow LXC start network type

Darren Hoehna (dhoehna)
and
Copilot
committed
0853f9c

Commits on Jul 15, 2026

Add LXC state-aware provision sample config (tests/configs/lxc_state_aware_provision.json)

Darren Hoehna (dhoehna)
and
Copilot
committed
9764b1a
Merge microsoft/mxc main (47a172c) into lxc-state-aware-lifecycle

Darren Hoehna (dhoehna)
and
Copilot
committed
af38cc1
ci: re-trigger PR build (empty commit)

Darren Hoehna (dhoehna)
and
Copilot
committed
5a138bc

Commits on Jul 16, 2026

Address PR #633 review: LXC state-aware lifecycle fixes

Darren Hoehna (dhoehna)
and
Copilot
committed
f84cf2b

Commits on Jul 17, 2026

Merge upstream/main (d271ac4) into lxc-state-aware-lifecycle

Darren Hoehna (dhoehna)
and
Copilot
committed
dd29002

Commits on Jul 20, 2026

Merge remote-tracking branch 'upstream/main' into user/dahoehna/lxc-state-aware-lifecycle
Darren Hoehna (dhoehna)
committed
91ebaf7

Commits on Jul 27, 2026

Merge upstream/main into user/dahoehna/lxc-state-aware-lifecycle

Darren Hoehna (dhoehna)
and
Copilot
committed
7ad03df

Commits on Jul 30, 2026

[LXC] Address PR #633 review: egress direction, fail-open start, SDK surface

Darren Hoehna (dhoehna)
and
Copilot
committed
287b918
[LXC] Share state-aware telemetry orchestration between the wxc and lxc executors

Darren Hoehna (dhoehna)
and
Copilot
committed
95a197d
[LXC] Add the missing state-aware lifecycle test and run it from the suite

Darren Hoehna (dhoehna)
and
Copilot
committed
783c197
[LXC] Do not treat the default network policy as an explicit restriction

Darren Hoehna (dhoehna)
and
Copilot
committed
c453787
Merge upstream/main into lxc-state-aware-lifecycle

Darren Hoehna (dhoehna)
and
Copilot
committed
c9001a3
Remove accidentally committed SDK build output and node_modules

Darren Hoehna (dhoehna)
and
Copilot
committed
d287e49
Restore LF line endings in wxc/src/main.rs

Darren Hoehna (dhoehna)
and
Copilot
committed
a39e1cc

Commits on Aug 4, 2026

Merge remote-tracking branch 'upstream/main' into user/dahoehna/lxc-state-aware-lifecycle
Darren Hoehna (dhoehna)
committed
15daa8f
LXC: clear only MXC-added bind mounts, not baseline entries

Darren Hoehna (dhoehna)
and
Copilot
committed
1832e43
LXC: make firewall chain name collision-free via a name hash

Darren Hoehna (dhoehna)
and
Copilot
committed
cdb8344
LXC: remove FORWARD hook on teardown regardless of veth discovery

Darren Hoehna (dhoehna)
and
Copilot
committed
5c03c13
LXC: install the firewall before the container starts (fail closed)

Darren Hoehna (dhoehna)
and
Copilot
committed
d8be903
LXC: route exec error envelope to stderr so it can't corrupt the stream

Darren Hoehna (dhoehna)
and
Copilot
committed
44929f0
LXC test script: make cleanup idempotent so it runs once per run

Darren Hoehna (dhoehna)
and
Copilot
committed
d699f9e
docs(sdk): add LXC to the state-aware backend list, note streaming-exec gap

Darren Hoehna (dhoehna)
and
Copilot
committed
cd34a4f
LXC: enforce an explicit default network policy (item 6)

Darren Hoehna (dhoehna)
and
Copilot
committed
e3e657a
LXC: add chain-name collision-freedom spec tests

Darren Hoehna (dhoehna)
and
Copilot
committed
9c055f2
LXC: fix three evidence-reviewer findings from e3e657a

Darren Hoehna (dhoehna)
and
Copilot
committed
6d712e3
Fix chain-name collision from 32-bit hash truncation (PR 633 review)

Darren Hoehna (dhoehna)
and
Copilot
committed
cb62636
docs: correct the 36^11 modulus value in a comment

Darren Hoehna (dhoehna)
and
Copilot
committed
adf8e03
Correct the chain-hash work-factor claim

authored and
Darren Hoehna
committed
dbac069

Commits on Aug 5, 2026

Correct MAX_CONTAINER_NAME_LEN comment: chain names are not collision-free

Darren Hoehna (dhoehna)
and
Copilot
committed
bf78432

Commits on Aug 6, 2026

Address review feedback on the state-aware lifecycle

authored and
Darren Hoehna
committed
204bff4
Correct four defects an independent review found in the previous commit

Darren Hoehna (dhoehna)
and
Copilot
committed
d7e3bc9

Commits on Aug 7, 2026

Commits on Aug 12, 2026

Merge upstream/main into the state-aware lifecycle branch

Darren Hoehna (dhoehna)
and
Copilot
committed
51c26e4
Drop the IsolationSessionUserConfig import the merge should not have kept

Darren Hoehna (dhoehna)
and
Copilot
committed
2658d07

Commits on Aug 13, 2026

Commits on Aug 14, 2026

Commits on Aug 15, 2026

Merge remote-tracking branch 'upstream/main' into user/dahoehna/lxc-lifecycle-current
Darren Hoehna (dhoehna)
committed
a551ce2

Commits on Aug 16, 2026

[LXC] Enforce the network mode rule at start instead of in the SDK types

Darren Hoehna (dhoehna)
and
Copilot
committed
7d3e2e0
[LXC] Cover the network presence bit end to end on a real container

Darren Hoehna (dhoehna)
and
Copilot
committed
c4a87aa
[LXC] Pin filesystem_specified with a case that can actually fail

Darren Hoehna (dhoehna)
and
Copilot
committed
1470f15

Commits on Aug 17, 2026

[LXC] Ask liblxc for the interface list instead of parsing the config

authored and
Darren Hoehna
committed
8fecff7
[LXC] Assert the default-deny hook is applied, not just reported

authored and
Darren Hoehna
committed
579d486
[LXC] Drop the lxc.include refusal from the contract

authored and
Darren Hoehna
committed
de90b20
[LXC] Require the physdev hook the bridged veth actually uses

Darren Hoehna (dhoehna)
and
Copilot
committed
79ab7ab
[LXC] Drop the stale lxc.include refusal from the repo guidance

Darren Hoehna (dhoehna)
and
Copilot
committed
bdd8214
[LXC] Pin the netdev type named "empty" against the absence signal

Darren Hoehna (dhoehna)
and
Copilot
committed
b02e731
[LXC] Follow the sole interface's index instead of requiring lxc.net.0

Darren Hoehna (dhoehna)
and
Copilot
committed
825334a
[LXC] Refuse a network config that moved while it was being read

Darren Hoehna (dhoehna)
and
Copilot
committed
1fbc2a9
[LXC] Recheck the located index, not just the interface summary

Darren Hoehna (dhoehna)
and
Copilot
committed
e140496
[LXC] Enforce the network policy without depending on the interface index

Darren Hoehna (dhoehna)
and
Copilot
committed
d6984f1
[LXC] Close three teardown gaps an independent review found

Darren Hoehna (dhoehna)
and
Copilot
committed
56fccba
[LXC] Ask the container which name its interface has, and re-read before flushing

Darren Hoehna (dhoehna)
and
Copilot
committed
ae24c28
[LXC] Cover every start-phase policy field with a roadmap E2E case

Darren Hoehna (dhoehna)
and
Copilot
committed
7c452f4

Commits on Aug 18, 2026

Commits on Aug 19, 2026

Drop enforcementMode from LxcNetworkConfig and fix two stale doc comments

Darren Hoehna (dhoehna)
and
Copilot
committed
f9c9352
Enable bridge netfilter on the SDK integration Linux lanes

Darren Hoehna (dhoehna)
and
Copilot
committed
cfff8cd
Wire experimental.lxc into the generated config schema

Darren Hoehna (dhoehna)
and
Copilot
committed
0ef10b6
Merge upstream/main into lxc-experimental-wire

Darren Hoehna (dhoehna)
and
Copilot
committed
669c80e

Commits on Aug 20, 2026

Trim LXC runner comments to one-sentence reasons

Darren Hoehna (dhoehna)
and
Copilot
committed
b5d5cd6
Install the LXC egress firewall before the container starts

Darren Hoehna (dhoehna)
and
Copilot
committed
712ece5
Restore CRLF line endings in lxc_runner.rs

Darren Hoehna (dhoehna)
and
Copilot
committed
e43e48b
Merge remote-tracking branch 'upstream/main' into user/dahoehna/lxc-lifecycle-current

Darren Hoehna (dhoehna)
and
Copilot
committed
e2419a6
[LXC] Halt a reused container when a post-start step fails

Darren Hoehna (dhoehna)
and
Copilot
committed
e9db1c6
[LXC] Restore the Linux gate on run_watchdog

Darren Hoehna (dhoehna)
and
Copilot
committed
a492906
[LXC] Correct what the pty drain comment claims about the abandoned thread

Darren Hoehna (dhoehna)
and
Copilot
committed
0289a92

Commits on Aug 21, 2026

Merge main into the LXC state-aware lifecycle branch

Darren Hoehna (dhoehna)
and
Copilot
committed
78907be
Merge main into the LXC state-aware lifecycle branch

Darren Hoehna (dhoehna)
and
Copilot
committed
82e42a7
[LXC] Keep the sandbox ID when deprovision fails in the network test

Darren Hoehna (dhoehna)
and
Copilot
committed
c74967c
[LXC] Move requires_firewall out of the shared policy model

Darren Hoehna (dhoehna)
and
Copilot
committed
6387371
Merge main into the LXC state-aware lifecycle branch
Darren Hoehna (dhoehna)
committed
5ea1bc8

Commits on Aug 25, 2026

Merge upstream/main into the state-aware LXC branch

Darren Hoehna (dhoehna)
and
Copilot
committed
1e99ca1
Align the state-aware matrix with main's enforcement split

Darren Hoehna (dhoehna)
and
Copilot
committed
40dbde7
Restore LF line endings in two LXC network files
Darren Hoehna (dhoehna)
committed
3c2bb9d
Reject a foreign `experimental.lxc` section instead of dropping it

Darren Hoehna (dhoehna)
and
Copilot
committed
18ff7be
Abort the network matrix when a sandbox fails to deprovision

Darren Hoehna (dhoehna)
and
Copilot
committed
9321b87
Correct the `LxcNetworkConfig` note on when enforcement happens

Darren Hoehna (dhoehna)
and
Copilot
committed
abfc110
Enforce the network policy LXC's state-aware SDK accepts

Darren Hoehna (dhoehna)
and
Copilot
committed
476840e
Describe state-aware schema defaults as per-backend

Darren Hoehna (dhoehna)
and
Copilot
committed
d0d059f

Commits on Aug 26, 2026

Merge remote-tracking branch 'upstream/main' into user/dahoehna/lxc-lifecycle-current
Darren Hoehna (dhoehna)
committed
85cdbc1

Commits on Aug 28, 2026

[LXC] Gate state-aware on schema 0.8.0 and report observable sandbox state

Darren Hoehna (dhoehna)
and
Copilot
committed
2e73408
Report a missing LXC runtime as backend_unavailable

Darren Hoehna (dhoehna)
and
Copilot
committed
90c8b63
Cover the LXC identifier and adopt-or-create contract

Darren Hoehna (dhoehna)
and
Copilot
committed
9d3f721
Block the container-to-host path when hostLoopback is denied

Darren Hoehna (dhoehna)
and
Copilot
committed
bec5bb8
Cover the timeout, phase-ordering, and provision-field contract cases

Darren Hoehna (dhoehna)
and
Copilot
committed
b3ae8ff

Commits on Aug 29, 2026

Commits on Aug 31, 2026

Format the merge-resolved call site

authored and
Darren Hoehna
committed
70c4006
Merge upstream/main into the state-aware lifecycle branch

Darren Hoehna (dhoehna)
and
Copilot
committed
c85ce37
Recognize LXC as a state-aware containment in the .NET SDK

Darren Hoehna (dhoehna)
and
Copilot
committed
bac44e6
Let LXC state-aware validation tests run on a host without LXC

Darren Hoehna (dhoehna)
and
Copilot
committed
4576b4d
Refuse a proxy under a non-firewall mode in one place instead of two

Darren Hoehna (dhoehna)
and
Copilot
committed
47d661c

Commits on Sep 1, 2026

Point the inbound tamper note at the issue that still tracks it

Darren Hoehna (dhoehna)
and
Copilot
committed
7f6edf5
Refuse a proxy under capabilities before the container exists

Darren Hoehna (dhoehna)
and
Copilot
committed
c8cf6ef
Enforce the state-aware schema floor for every LXC caller

Darren Hoehna (dhoehna)
and
Copilot
committed
46cb91c
Keep clearPolicyOnExit out of the LXC start type

Darren Hoehna (dhoehna)
and
Copilot
committed
f748778
Let a signal delete the container's return-path rules

Darren Hoehna (dhoehna)
and
Copilot
committed
805afe2
Keep filtering on a container that would not die

Darren Hoehna (dhoehna)
and
Copilot
committed
de6ae00
Let the reaper report a process it could not kill

Darren Hoehna (dhoehna)
and
Copilot
committed
899de23
Keep the inbound chain when a container will not die

Darren Hoehna (dhoehna)
and
Copilot
committed
27ab29c
Clean up the failed create by name instead of by sweep

Darren Hoehna (dhoehna)
and
Copilot
committed
a3f77ab
Restore the CRLF endings the repo declares for the guidance file

Darren Hoehna (dhoehna)
and
Copilot
committed
442639b
Merge upstream/main into the state-aware LXC branch

Darren Hoehna (dhoehna)
and
Copilot
committed
12b7193
Format the LXC runner and bindings the way rustfmt wants them

Darren Hoehna (dhoehna)
and
Copilot
committed
07e3c10
Let the version-floor test pass on a host with no LXC installed

Darren Hoehna (dhoehna)
and
Copilot
committed
86e5587
Give the failed-create control a container name the backend will accept

Darren Hoehna (dhoehna)
and
Copilot
committed
553fe21
Stop the provision-fields cleanup from failing the run it just passed

Darren Hoehna (dhoehna)
and
Copilot
committed
266765c
Refuse a mistyped destination or environment entry instead of warning

Darren Hoehna (dhoehna)
and
Copilot
committed
3db4570
Refuse network and environment settings LXC cannot enforce

Darren Hoehna (dhoehna)
and
Copilot
committed
53df405
Correct the LXC document where it still describes silent skipping

Darren Hoehna (dhoehna)
and
Copilot
committed
8c92694
Store LXC Rust sources with LF so an edit cannot rewrite the whole file

Darren Hoehna (dhoehna)
and
Copilot
committed
a24a3be

Commits on Sep 2, 2026

Refuse a proxy LXC cannot enforce on a dry run too

Darren Hoehna (dhoehna)
and
Copilot
committed
87ad5e3

Commits on Sep 3, 2026