Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

runtime adapter: run cold sandboxes end to end on KVM, MSHV and WHP

Aperta
  • Qualcosa non va?
#822 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
linux, rust
Ambito
infrastructure, testing

Direzione di ricerca

Start with the adapter plan in #813, tests/runtime-adapter/src/layered.rs, and the existing VM scenarios in tests/vm_layered.rs and tests/vm_restart.rs; read #805 for the execution work needed inside a VM. Trace how the host currently launches and how the guest attaches shares, then map the scoped launch, transport, network, and consumer-contract scenarios to their tests. Done means the listed acceptance scenarios pass on KVM, MSHV, and WHP in CI.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Parent: #816. Builds on #813's adapter plan. Sub-issue: #805.

Goal. The in-repo test adapter runs real cold sandboxes on KVM, MSHV and WHP, through public APIs and its own transport: a checked launch, mappings, network policy, executions, stop and teardown. #624 then counts it as the second adapter.

Today (dev c5a0dd7):

  • runtime-adapter-host launches through supervisor::launch with a plan from SandboxPlan::new (tests/runtime-adapter/src/layered.rs). It doesn't bind its images or hand OpenVMM checked files (PreparedLaunch).
  • Its VMs assemble all four format and upper combinations outside PID 1 and probe them (tests/vm_layered.rs), and reattach after a restart (tests/vm_restart.rs), in CI on every backend.
  • It plans with SandboxPlan::new, not the adapter plan that #813 added.
  • It runs executions only in-process (#784). #805 lists what keeps them out of a VM: no execution cgroup, not in the assembled root, and no host command.
  • It attaches no network.

Scope:

  1. Plan and handoff: the host plans with SandboxPlan::adapter (#813), binds its images with a DistroBinding, and launches through PreparedLaunch. Its guest chooses the workload identities and attaches its shares.
  2. Executions in a VM: #805.
  3. Launch order through its transport: policy installed, boot, authenticated Ready, mapping tables in order, then Start. A failed start is torn down.
  4. Network: the typed policy, installed before boot. On one representative configuration it enforces deny, allow, proxy-only and host loopback.
  5. Scenarios: its share of #535's consumer-contract suite: C2's concurrency and pooled frame credit, C3's root and non-root profiles, C4's mappings and network, C5's replacement between the check and OpenVMM's open, and C6 and C7 on real VMs.

Not in scope: NVX's adapter; changes to the libraries. As #535 sets out, most faults run on one representative configuration rather than the full matrix.

Acceptance:

  • On KVM, MSHV and WHP, in CI: launch, several executions at once, output beyond 1 MiB, mapping tables, stop and teardown, in all four format and upper combinations.
  • Network deny, allow, proxy-only and host loopback on one representative configuration.
  • It uses documented public APIs only, with default features off and its own lockfile.
  • The scenarios above pass, and #805 is done.

Carries over: #622's scope 8 (A4 PR 8).

Lingua principale
Python
Stelle
408
Fork
28
Merge medio
16h 20m
PR unite (30g)
355

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di microsoft/nvx

Tutte le issue di microsoft/nvx

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.