Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

runtime adapter: run cold sandboxes end to end on KVM, MSHV and WHP

Open
  • Is something wrong?
#822 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
linux, rust
Domain
infrastructure, testing

Research direction

Start with the adapter plan in #813, tests/runtime-adapter/src/layered.rs, and the existing VM scenarios in tests/vm_layered.rs and tests/vm_restart.rs; read #805 for the execution work needed inside a VM. Trace how the host currently launches and how the guest attaches shares, then map the scoped launch, transport, network, and consumer-contract scenarios to their tests. Done means the listed acceptance scenarios pass on KVM, MSHV, and WHP in CI.

Written by the indexing model from the issue text.

Description

Parent: #816. Builds on #813's adapter plan. Sub-issue: #805.

Goal. The in-repo test adapter runs real cold sandboxes on KVM, MSHV and WHP, through public APIs and its own transport: a checked launch, mappings, network policy, executions, stop and teardown. #624 then counts it as the second adapter.

Today (dev c5a0dd7):

  • runtime-adapter-host launches through supervisor::launch with a plan from SandboxPlan::new (tests/runtime-adapter/src/layered.rs). It doesn't bind its images or hand OpenVMM checked files (PreparedLaunch).
  • Its VMs assemble all four format and upper combinations outside PID 1 and probe them (tests/vm_layered.rs), and reattach after a restart (tests/vm_restart.rs), in CI on every backend.
  • It plans with SandboxPlan::new, not the adapter plan that #813 added.
  • It runs executions only in-process (#784). #805 lists what keeps them out of a VM: no execution cgroup, not in the assembled root, and no host command.
  • It attaches no network.

Scope:

  1. Plan and handoff: the host plans with SandboxPlan::adapter (#813), binds its images with a DistroBinding, and launches through PreparedLaunch. Its guest chooses the workload identities and attaches its shares.
  2. Executions in a VM: #805.
  3. Launch order through its transport: policy installed, boot, authenticated Ready, mapping tables in order, then Start. A failed start is torn down.
  4. Network: the typed policy, installed before boot. On one representative configuration it enforces deny, allow, proxy-only and host loopback.
  5. Scenarios: its share of #535's consumer-contract suite: C2's concurrency and pooled frame credit, C3's root and non-root profiles, C4's mappings and network, C5's replacement between the check and OpenVMM's open, and C6 and C7 on real VMs.

Not in scope: NVX's adapter; changes to the libraries. As #535 sets out, most faults run on one representative configuration rather than the full matrix.

Acceptance:

  • On KVM, MSHV and WHP, in CI: launch, several executions at once, output beyond 1 MiB, mapping tables, stop and teardown, in all four format and upper combinations.
  • Network deny, allow, proxy-only and host loopback on one representative configuration.
  • It uses documented public APIs only, with default features off and its own lockfile.
  • The scenarios above pass, and #805 is done.

Carries over: #622's scope 8 (A4 PR 8).

Dominant language
Python
Stars
408
Forks
28
Avg merge
16h 20m
Merged PRs (30d)
355

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from microsoft/nvx

All issues in microsoft/nvx

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.