[LXC] State-aware lifecycle management#633
Open
dhoehna wants to merge 2 commits into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds state-aware lifecycle support for the Linux LXC backend by implementing StatefulSandboxBackend in lxc_common, wiring dispatch from lxc-exec, and exposing the new backend key/prefix in both Rust parsing/dispatch and the TypeScript SDK state-aware types/helpers.
Changes:
- Register
lxcas a state-aware backend prefix/key in the Rust dispatcher/config parser (with new unit tests). - Add
LxcStateAwareRunnerimplementingprovision/start/exec/stop/deprovisionfor LXC containers (best-effort iptables cleanup on teardown). - Extend the SDK state-aware type system + prefix map to support
lxc, including per-phase config/metadata typings.
Reviewed changes
Copilot reviewed 8 out of 9 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/core/wxc_common/src/state_aware_dispatch.rs | Adds lxc sandboxId prefix routing + a unit test. |
| src/core/wxc_common/src/config_parser.rs | Accepts experimental.lxc as a known experimental backend key and adjusts key matching for containment: "lxc" (with test). |
| src/core/lxc/src/main.rs | Switches to load_mxc_request and routes state-aware requests to LxcStateAwareRunner. |
| src/core/lxc/Cargo.toml | Adds serde_json dependency for error envelope printing. |
| src/Cargo.lock | Lockfile update reflecting the new serde_json dependency. |
| src/backends/lxc/common/src/state_aware.rs | New LXC state-aware lifecycle implementation. |
| src/backends/lxc/common/src/lib.rs | Exposes the new state_aware module. |
| sdk/src/state-aware-types.ts | Adds lxc to state-aware backend union and defines LXC per-phase config + metadata types. |
| sdk/src/state-aware-helper.ts | Adds lxc prefix mapping and hoists containerId as a cross-cutting field. |
…) (AB#62953349) Provision/start/exec/stop/deprovision for the LXC backend, modeled on IsolationSessionRunner; reuses lxc CLI wrappers and one-shot lxc-attach PTY streaming. Registers the lxc wire key in Rust dispatch/parser and SDK state-aware routing. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3b78bec0-e139-4cfd-9c10-092ef986d4f4
ded0b0d to
fabdfd0
Compare
… + narrow LXC start network type Restrict is_valid_container_name to the same character set and length bound (<=20 chars, alphanumeric/-/_) that NetworkIptablesManager::new uses to derive the per-container iptables chain name. This makes the container-name -> chain-name mapping an identity on valid names, so distinct names (e.g. 'a.b' vs 'ab', or names differing only past the 20th char) can no longer collide onto the same firewall chain and cross-tear-down each other's rules. Narrow LxcStartConfig.network to Omit<NetworkConfig, 'proxy'> so the SDK rejects network.proxy at compile time, matching the Rust runner which rejects it at start (apply_network_policy). Adds Rust + TypeScript tests for both. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linked work item: AB#62953349 — [LXC] State-aware lifecycle management
Summary
Implements the existing
StatefulSandboxBackendtrait for the LXC backend, modeled onIsolationSessionRunner.state_awaremodule in the LXC common crate;provision/start/exec/stop/deprovisionfully wired to the LXC CLI wrappers.execreuses thelxc-attachPTY streaming path; the returnedExecHandlewaiter yields the captured exit code.deprovisionperforms best-effort iptables cleanup.BACKEND_KEY = "lxc"in the Rust dispatcher/parser and the SDK prefix map (+ SDK state-aware types).Validation
cargo fmt --all -- --check;cargo clippy --target x86_64-unknown-linux-gnu -p lxc_common -D warnings— cleancargo test -p wxc_common— 397 passed;cargo test -p mxc-sdk— 32 passedcargo check --target x86_64-unknown-linux-gnu -p lxc_common --tests— passCoupling
Adds an SDK state-aware backend key and touches the shared dispatcher/parser, so merge-time reconciliation with the schema PR (AB#62830582) is expected.
Microsoft Reviewers: Open in CodeFlow