Added lxc bubblewrap wslc roadmap#533
Open
SohamDas2021 wants to merge 11 commits into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new roadmap document under docs/ describing prioritized follow-up work for MXC’s Linux-side containment backends (LXC, Bubblewrap, WSLC), including cross-cutting themes and external dependencies.
Changes:
- Introduces
docs/linux-wsl-roadmap-june-2026.mdwith per-backend priority lists, effort sizing, and dependency notes. - Captures cross-backend themes (state-aware lifecycle,
allowLocalNetwork, proxy enforcement, cgroups v2, diagnostics, CI gating). - Documents external blockers/infra constraints based on recent runner probes.
|
|
||
| | # | Item | Description | Effort | | ||
| |---|---|---|---| | ||
| | 1 | **Schema overstates network enforcement** | Schema claims Bwrap enforces `allowedHosts` / `blockedHosts` directly, but reality is cooperative-only (env-var hints to clients). Update wording or close the gap. `schemas/dev/mxc-config.schema.0.7.0-dev.json:149-154`. | M | |
| | 2 | **Apply `allowLocalNetwork`** | Field exists in schema; backend never applies it to its network namespace. | M | | ||
| | 3 | **Add backend-specific `BubblewrapConfig`** | Bwrap currently consumes only shared fields; no surface for seccomp profile, custom binds, or `bwrap`-native knobs. | M | | ||
|
|
||
| > **More context for item #3.** Confirmed by schema inspection: every other backend has a per-backend config block (`lxc:` at `schemas/dev/mxc-config.schema.0.7.0-dev.json:271`, `wslc:` at line 318, plus dedicated blocks for `seatbelt`, `windows_sandbox`, `isolation_session`) — Bwrap has **none**. Users can only set what's in the shared `process` / `filesystem` / `network` / `ui` sections, so every `bwrap`-native knob is unreachable: `seccompProfile` (item #7), cgroups v2 caps (item #8), `customBinds` / `tmpfsMounts` / `symlinks` for mount fixups, `dropCaps` / `keepCaps`, individual `unshare-*` toggles, `dieWithParent`, `newSession`, `argv0` / `chdir` overrides. **This is table-stakes infrastructure for items #7, #8, and #9** — seccomp needs `bubblewrap.seccompProfile`, cgroups needs `bubblewrap.resources.*`, and the promote-to-stable work (#9) gates on having a stable shape for this block. Despite its placement under "Schema honesty," practically it should land **early** in the Bwrap order. Same shape as the `LxcConfig` expansion (LXC item #7): schema entry, `RawBubblewrap` in `config_parser.rs`, validated `BubblewrapConfig` in `models.rs`, plumbing through `bwrap_command.rs`, SDK type, docs — ~10-15 file PR. |
Comment on lines
+40
to
+43
| | # | Item | Description | Effort | | ||
| |---|---|---|---| | ||
| | 4 | **Apply `network.proxy`** | Schema advertises proxy support but LXC backend doesn't inject `HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY` env vars or set up iptables redirect for raw sockets. | M | | ||
| | 5 | **Apply `allowLocalNetwork`** | Inbound `bind()`/`listen()` policy is silently dropped; add iptables `INPUT` rules on the container's veth. | M | |
|
|
||
| | 8 | **nftables backend** | Docs claim nftables support but only iptables is implemented; add nftables path and let the user select per-host. `network_iptables.rs:98-115` + `docs/lxc-support/lxc-backend.md:91-103`. | M | | ||
|
|
||
| > **Disposition for item #8.** As of June 2026 there is no concrete user-driven ask for nftables. The four documentation hits all use "iptables/nftables" generically as a Linux netfilter category, not as a commitment. **Default action: do not build the nftables code path — instead, update the docs (`docs/lxc-support/lxc-backend.md` lines 11, 93, 163 and `docs/macos-support/seatbelt-backend.md` line 336) to say "iptables" only. Effort drops from M to S.** Promote this item back to the full nftables implementation only if a real user ask surfaces — e.g. an Azure Linux / RHEL 9+ partner reporting the `iptables-nft` shim breaking, or a deployment with thousands of `allowedHosts` rules where iptables' O(n) traversal is measurably hurting them. |
|
|
||
| | # | Item | Description | Effort | | ||
| |---|---|---|---| | ||
| | 10 | **Structured denied-resource diagnostics** | Process Container surfaces structured denial reasons (PR #6d5a0da); LXC returns opaque "execution failed" strings — wire equivalent telemetry. | M | |
|
|
||
| ## Notes | ||
|
|
||
| - **Issue tracking**: as of June 2026 the public repo has 5 open issues, all Windows process-container. None of the above are filed yet. |
SohamDas2021
force-pushed
the
user/sodas/lxc-bubblewrap-wslc-roadmap
branch
2 times, most recently
from
33a095b to
1433d12
Compare
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
SohamDas2021
force-pushed
the
user/sodas/lxc-bubblewrap-wslc-roadmap
branch
from
030d751 to
808b8dd
Compare
|
Who is the S, M, and L efforts for? PMs, Devs, someone else? What will they use this value for? I feel that this column should be removed unless you are 1000% confident of the effort. |
Contributor
Author
These denote dev efforts, a legend is included at the top of the file. These are ballpark estimates; we have filed ADO tasks with accurate estimates for these. S — small, hours to a day (single-file fix, doc update) |
dhoehna
approved these changes
Jul 1, 2026
bbonaby
approved these changes
Jul 1, 2026
| "deny": [{ "to": [{ "cidr": "10.0.0.0/8" }] }] | ||
| }, | ||
| "ingress": { "hostLoopback": "deny" }, | ||
| "proxy": { "http": "127.0.0.1:8080" } |
Collaborator
There was a problem hiding this comment.
note: it's slightly changed since it looked like this. The proxy part was taken out of the network section itself and into a runtimeConfig section. I'm in the process of spinning up a PR for to add my spec's as .md files. Basically will just be a full port of the docx file to .md. I can update this the same time I have the PR up
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📖 Description
🔗 References
🔍 Validation
✅ Checklist
📋 Issue Type
GitHub Actions runs the PR validation build automatically. The ADO pipeline
(
MXC-PR-Build) is the official build pipeline that signs the binaries; itruns on merge to
mainand nightly, and Microsoft reviewers can trigger iton a PR with
/azp run. See docs/pull-requests.md.Microsoft Reviewers: Open in CodeFlow