You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Add aci_edge_sandboxes with an OpenVMM sandbox backend - #307
Adds aci_edge_sandboxes/, the aci_edge_sandboxes Rust crate, with AciEdgeSandbox and AsyncAciEdgeSandbox clients for NVX's state-aware sandbox
lifecycle: provision, start, exec, stop, and deprovision. The default backend
drives OpenVMM directly; no Python tooling or daemon is needed at runtime.
The package-related surfaces consistently use the new name:
crate, directory, imports, build metadata, and test helpers: aci_edge_sandboxes
CI job, action, CLI command, and fake OpenVMM binary: aci-edge-sandboxes
build, bundle, end-to-end, and required-status environment variables: ACI_EDGE_SANDBOXES_*
AciEdgeSandbox and AsyncAciEdgeSandbox remain singular client type names because
each client manages individual sandbox instances. NVX wire identifiers,
sandbox IDs, guest kernel tokens, release layout, and shared artifact-discovery
settings retain their existing names and behavior.
History
The six existing implementation commits were rewritten from their original
merge base. Their commit messages, historical file paths, code, comments, and
documentation use the new package name from its first introduction. A final
formatter-only commit wraps identifiers whose longer names crossed Rustfmt and
Ruff line-length boundaries.
Behavior
Extends the managed control agent with cancellation, host mappings, workload
accounts, feature negotiation, and fail-closed exec-cgroup containment.
Exposes synchronous and Tokio lifecycle clients, typed policies and results,
live streams, cancellation, deterministic validation, and a pluggable
backend.
Drives OpenVMM directly with persistent state, lifecycle locks, process
reconciliation, authenticated control sessions, filesystem mappings, and
supported IPv4 egress policies.
Provides an in-memory MockBackend and the aci-edge-sandboxes-fake-openvmm test double.
Wires hosted Linux and Windows crate checks, real-hypervisor lifecycle tests,
release gating, and required-status aggregation into CI.
Review feedback addressed
Containment verification parses a unique valid population field, reports
read/parse/settlement failures, and refuses cgroup reuse without positive
emptiness verification.
Side-effect-free backend validation hooks reuse the same OpenVMM argument,
working-directory, timeout, and egress-policy checks as the real operations.
Mock input is interruptible on Windows, Unix, and async paths; echo workers
are closed and joined before terminal outcomes, and input errors remain
observable.
Launch recovery persists child identity before runtime registration and
bounds cancellation waits by the control timeout.
Windows fixtures compare canonical mapped guest paths, including aliased
temporary-directory spellings.
Artifact pin warning
aci_edge_sandboxes/artifacts.json still pins v0.1.0-dev.89c192e79f0d, which predates the guest features introduced here.
Until a release containing these changes is available, use ACI_EDGE_SANDBOXES_BUNDLE_DIR with a current local release directory or point NVX_ARTIFACTS_DIR at current artifacts.
Pedro Henrique Penna (ppenna)
changed the title
Add the nvx-rs crate with an OpenVMM sandbox backend
Add aci_sandbox with an OpenVMM sandbox backend
Oct 2, 2026
Reject guest subnets using reserved host addresses
aci_sandbox/src/openvmm/config.rs:359
guest_network accepts the subnet address, broadcast address, and the first usable address. The portable profile derives that first usable address as its gateway, so a value such as 10.0.0.1/24 passes validation but assigns the guest the gateway's address and breaks networking. Validate the host portion as well, reserving host values 0, 1, and the all-ones value.
Preserve state and report VM cleanup failures
aci_sandbox/tests/openvmm_e2e.rs:54
Cleanup failures are discarded even though OpenVMM is detached from the test process. If stop cannot terminate the VM, deprovision also fails, then the Python harness removes its temporary state root and loses the PID/capability needed to retry; this can orphan a VM on a self-hosted runner. Preserve the state directory and surface cleanup failures (without double-panicking) whenever stop/deprovision does not complete.
PR #307 is ready for review and CI is green on head c1d68ade.
CI run 36964708806, attempt 1, completed successfully: 22 applicable CI jobs passed. This includes Linux/Windows crate gates, OpenVMM unit/vmm tests, real KVM/MSHV/WHP microVM and crate lifecycle tests, all platform benchmarks, the performance regression gate, and the required status check. The license/CLA check passed too. Only development-release publication and performance-history persistence were skipped, as intended for PR runs.
The initial Windows test-fixture path-alias failure was reproduced and fixed in the signed commit above without changing production mapping behavior or weakening assertions. The corrected Windows job and the full replacement run both pass. Local worktrees are clean and the OpenVMM submodule remains unchanged.
The reason will be displayed to describe this comment to others. Learn more.
Copilot review overview
🔵 Needs a closer look
The security-sensitive guest and process-lifecycle changes require human review and real-hypervisor validation, with two unresolved findings.
Review effort: Balanced Findings: None
Previously missed (2)
In code that hasn't changed since last review
Bundled feature pins an incompatible default release
aci_sandbox/artifacts.json:3
The default source for the new bundled feature points to a release that predates the guest features required unconditionally by GuestFeatures::REQUIRED. As documented in this PR, a normal --features bundled build using this pin cannot start any sandbox and is rejected as backend_unavailable; users only get a working bundle by supplying an override. Update the pin and all asset digests to a compatible release before exposing this as the feature's default source, or disable the default download path until one exists.
Checking only whether the UID exists can skip creation for an incompatible account. resolve_workload_identity immediately requires that UID's primary GID to equal workload_gid and its home to be usable, so a non-root host user whose UID collides with a guest account that has a different GID/home cannot start any sandbox with mapped paths. Verify the existing record is compatible or normalize/create the synthetic workload identity instead of returning solely on UID existence.
Pedro Henrique Penna (ppenna)
changed the title
Add aci_sandbox with an OpenVMM sandbox backend
Add aci_edge_sandboxes with an OpenVMM sandbox backend
Oct 2, 2026
The reason will be displayed to describe this comment to others. Learn more.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Introduce the aci_edge_sandboxes crate with a validated five-operation lifecycle, synchronous and Tokio clients, mock and fake backends, artifact discovery and bundling, and a cross-platform OpenVMM backend.
Extend the managed guest control protocol with feature negotiation, cancellation, host path mappings, dynamic workload identities, and cgroup-based process containment so the backend can enforce its contract.
Wire format, lint, test, and documentation gates plus real-hypervisor lifecycle coverage into the NVX CLI and CI release requirements. Document the API, architecture, policy behavior, and project layout.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The reason will be displayed to describe this comment to others. Learn more.
Copilot review overview
🔵 Needs a closer look
Security-sensitive process supervision and containment require human review and current-head hypervisor validation, alongside the unresolved cleanup issue.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
aci_edge_sandboxes/, theaci_edge_sandboxesRust crate, withAciEdgeSandboxandAsyncAciEdgeSandboxclients for NVX's state-aware sandboxlifecycle: provision, start, exec, stop, and deprovision. The default backend
drives OpenVMM directly; no Python tooling or daemon is needed at runtime.
The package-related surfaces consistently use the new name:
aci_edge_sandboxesaci-edge-sandboxesACI_EDGE_SANDBOXES_*AciEdgeSandboxandAsyncAciEdgeSandboxremain singular client type names becauseeach client manages individual sandbox instances. NVX wire identifiers,
sandbox IDs, guest kernel tokens, release layout, and shared artifact-discovery
settings retain their existing names and behavior.
History
The six existing implementation commits were rewritten from their original
merge base. Their commit messages, historical file paths, code, comments, and
documentation use the new package name from its first introduction. A final
formatter-only commit wraps identifiers whose longer names crossed Rustfmt and
Ruff line-length boundaries.
Behavior
accounts, feature negotiation, and fail-closed exec-cgroup containment.
live streams, cancellation, deterministic validation, and a pluggable
backend.
reconciliation, authenticated control sessions, filesystem mappings, and
supported IPv4 egress policies.
MockBackendand theaci-edge-sandboxes-fake-openvmmtest double.release gating, and required-status aggregation into CI.
Review feedback addressed
read/parse/settlement failures, and refuses cgroup reuse without positive
emptiness verification.
working-directory, timeout, and egress-policy checks as the real operations.
are closed and joined before terminal outcomes, and input errors remain
observable.
bounds cancellation waits by the control timeout.
temporary-directory spellings.
Artifact pin warning
aci_edge_sandboxes/artifacts.jsonstill pinsv0.1.0-dev.89c192e79f0d, which predates the guest features introduced here.Until a release containing these changes is available, use
ACI_EDGE_SANDBOXES_BUNDLE_DIRwith a current local release directory or pointNVX_ARTIFACTS_DIRat current artifacts.Validation
Passed on the rewritten source tree:
python scripts\nvx.py verifyall-feature tests, and default-feature tests
all-target/all-feature checking
shfmt, and PowerShell syntax parsing
no stale package, job, command, or environment-variable names
The real-hypervisor lifecycle tests were not rerun locally. The ready PR will
run the KVM, MSHV, and WHP matrices for the rewritten head.