Repository navigation
Support individual-file filesystem mappings #282
Description
Allow callers to expose a single existing host file to an NVX workload, without exposing its parent directory.
| Example | Expected behaviour |
|---|---|
Grant read-only access to C:\config\settings.json |
The workload can read that file but cannot modify it. |
Grant read-write access to C:\results\output.txt |
The workload can read and update that file. |
| Other files exist beside the granted file | They remain inaccessible unless separately granted. |
Do not replace a file grant with a broader directory grant. Keep denied-path restrictions enforced.
Verify reads, allowed writes, blocked writes and sibling-file isolation with real workloads.
MXC schema requirement: filesystem.readonlyPaths and filesystem.readwritePaths describe path grants; the current NVX export interface requires a directory root.
Metadata
Metadata
Assignees
Labels
No labels
Activity
microVM: model aggregate child kinds and exposed files explicitly
openvmm: pin single-file aggregate virtio-fs children
doc: index the OpenVMM commits that the file-children pin adds
aci_edge_sandboxes: export mapped files without their directories
run, sandbox: share single host files at their targets
test-microvm: share single files through the aggregate virtio-fs device
ci: share single files in the concurrent sandbox shares smoke test
microVM: require the file flag for a file child of an aggregate
openvmm: pin single-file aggregate virtio-fs children
doc: index the OpenVMM commits that the file-children pin adds
aci_edge_sandboxes: export mapped files without their directories
run, sandbox: share single host files at their targets
test-microvm: share single files through the aggregate virtio-fs device
ci: share single files in the concurrent sandbox shares smoke test
openvmm: pin single-file aggregate virtio-fs children
doc: index the OpenVMM commits that the file-children pin adds
aci_edge_sandboxes: export mapped files without their directories
run, sandbox: share single host files at their targets
test-microvm: share single files through the aggregate virtio-fs device
ci: share single files in the concurrent sandbox shares smoke test
microVM: export single host files as aggregate virtio-fs children