NanVix: Preserve block-default networking with blockedHosts by huzaifa-d · Pull Request #1071 · microsoft/mxc

Huzaifa Danish (huzaifa-d) · 2026-08-31T18:32:08Z

📖 Description

Prevent legacy network host lists from silently changing or bypassing the selected network.defaultPolicy across shared validation, backend lowering, and SDK-generated requests.

Enforce the valid legacy defaultPolicy/host-list matrix in shared wxc_common validation while keeping policy models as raw data.
Make NanVix and Hyperlight lower the same validated legacy semantics, retaining backend-specific rejection when a microVM filter cannot represent both lists.
Make Node and Rust SDK builders emit a block default whenever an allowlist narrows outbound access; reject blocklist-only policies unless outbound is otherwise allowed. The C# SDK inherits the corrected Rust builder behavior through mxc_ffi.
Migrate affected Bubblewrap and LXC fixtures to equivalent valid shapes and update the LXC CIDR harness to assert its new default-DROP posture.
Keep Seatbelt backend tests on shared-valid inputs so they continue exercising backend representability, and correct their remediation guidance.
Correct Seatbelt, Bubblewrap, and cross-SDK documentation to distinguish shared validity, SDK construction, and backend representability.

🔗 References

Resolves #787

🔍 Validation

node scripts/versioning/validate-configs.js
npm test and npm run typecheck from sdk/node
cargo fmt --all -- --check
cargo test -p wxc_common
cargo test -p mxc_engine policy
cargo test -p mxc-sdk --test sdk_helpers
cargo test -p seatbelt_common --lib
cargo check -p seatbelt_common --tests --target aarch64-apple-darwin
cargo clippy -p seatbelt_common --tests --target aarch64-apple-darwin -- -D warnings
cargo test -p nanvix_runner
cargo test -p hyperlight_common --features hyperlight
cargo clippy -p wxc_common -p nanvix_runner --all-targets -- -D warnings
cargo clippy -p hyperlight_common --all-targets --features hyperlight -- -D warnings
cargo clippy -p mxc_engine -p mxc-sdk --all-targets -- -D warnings

✅ Checklist

Signed the Contributor License Agreement
Linked to an issue
Updated documentation (if applicable)
Updated Copilot instructions (not applicable; this correction does not change repository build commands, architecture, or contributor conventions)
If this PR changes Cargo.lock, the dependency-feed-check check passes (not applicable; Cargo.lock is unchanged)

📋 Issue Type

Bug fix
Feature
Task

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHub
Actions build; it runs on merge to main, and Microsoft reviewers with write access can trigger it
on a PR with /azp run. See docs/pull-requests.md.

If the dependency-feed-check check fails on a new dependency, the crate must be added to
the feed before the PR can pass. See docs/pull-requests.md
for the steps.

Microsoft Reviewers: Open in CodeFlow

azure-pipelines · 2026-08-31T18:32:18Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Copilot

Copilot review overview

Review tier: Balanced
Findings: None

What changed in this PR

Fixes NanVix networking so blockedHosts cannot widen block-default policies.

Changes:

Rejects blocklists unless defaultPolicy is allow.
Makes network enablement fail-safe and adds regression tests.
Documents supported policy combinations.

File	Description
`src/backends/nanvix/runner/src/lib.rs`	Implements validation, fail-safe enablement, and tests.
`docs/nanvix-microvm/nanvix.md`	Documents the network-policy matrix.
`docs/superpowers/specs/2026-08-31-nanvix-blocked-hosts-default-policy-design.md`	Records the fix design.
`docs/superpowers/plans/2026-08-31-nanvix-blocked-hosts-default-policy.md`	Records the implementation plan.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

azure-pipelines · 2026-09-01T17:13:53Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Copilot

Copilot review overview

Review tier: Balanced
Findings: None

Copilot

Copilot review overview

Review tier: Balanced
Findings: None

azure-pipelines · 2026-09-01T20:56:09Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Jeff Whiteside (jsidewhite) · 2026-09-01T21:42:37Z

Per-host egress filtering

This is policy that applies equally to all backends. Can we unify the documentation on this in the backend-agnostic location?

Refers to: docs/nanvix-microvm/nanvix.md:164 in f900351. [](commit_id = f900351, deletion_comment = False)

Jeff Whiteside (jsidewhite)

🕐

Copilot

Copilot review overview

🟡 Changes recommended

The NanVix documentation does not clearly state that blocklists under a block default are rejected.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

Document the rejected block-default blocklist · New

Resolved since last review (1)

Align validation with the promised rejection

revoking review

Reject legacy host lists that cannot refine defaultPolicy in shared validation, keep ContainerPolicy as data, and have NanVix and Hyperlight lower validated raw fields while retaining their backend-specific combined-list limitation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot review overview

🟡 Changes recommended

Existing Seatbelt and SDK documentation still describes a configuration now rejected by shared validation.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

Update backend docs for the new shared rejection · New

Resolved since last review (1)

Document the rejected block-default blocklist

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot review overview

🟡 Changes recommended

Existing backend fixtures and public documentation contain combinations newly rejected by shared validation.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 1

Open (2)

Update backend fixtures rejected by the new matrix · New
Update backend docs for the new shared rejection

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot review overview

🟡 Changes recommended

The migrated Bubblewrap deny-precedence fixture now blocks its required control connection to 10.0.2.2.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

Allow the control endpoint under the new block default · New

Resolved since last review (2)

Update backend fixtures rejected by the new matrix
Update backend docs for the new shared rejection

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot review overview

🔵 Needs a closer look

The schema 0.8 version-specific documentation still describes legacy networking without the newly enforced validity rules.

Review effort: Balanced
Findings: None

Resolved since last review (1)

Allow the control endpoint under the new block default

Previously missed (1)

In code that hasn't changed since last review

Update the version-specific 0.8 legacy networking docs

docs/schema.md:87

The new matrix also governs legacy fields accepted by schema 0.8, but docs/sandbox-policy/0.8.0/policy.md:55-65 still describes allowOutbound as unconditionally allowing egress and lists allowedHosts/blockedHosts without the newly required combinations. A reader of that version-specific contract can therefore author a policy that shared validation now rejects. Please mirror this matrix (or link to it and update the field descriptions) in the 0.8 policy page as part of this behavior change.

Copilot

Copilot review overview

🟢 Approval recommended

The implementation consistently preserves default-policy semantics across validation, backend lowering, SDK construction, tests, and documentation.

Review effort: Balanced
Findings: None

Jeff Whiteside (jsidewhite) · 2026-09-18T19:11:53Z

+            throw new Error(
+                "blockedHosts requires allowedHosts when network.defaultPolicy='block'",
+            );
+        }


I'm unclear on why this is needed at SDK layer, but changes otherwise look good!

Jeff Whiteside (jsidewhite)

Copilot AI balanced review requested due to automatic review settings August 31, 2026 18:32

Copilot started reviewing on behalf of Huzaifa Danish (huzaifa-d) August 31, 2026 18:33 View session

Copilot AI reviewed Aug 31, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 1, 2026 17:12

Copilot started reviewing on behalf of Huzaifa Danish (huzaifa-d) September 1, 2026 17:12 View session

Huzaifa Danish (huzaifa-d) marked this pull request as ready for review September 1, 2026 17:13

Huzaifa Danish (huzaifa-d) requested a review from a team as a code owner September 1, 2026 17:13

Copilot AI reviewed Sep 1, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 1, 2026 17:13

Copilot started reviewing on behalf of Huzaifa Danish (huzaifa-d) September 1, 2026 17:14 View session

Copilot AI reviewed Sep 1, 2026

View reviewed changes

Branden Bonaby (bbonaby) previously approved these changes Sep 1, 2026

View reviewed changes

Comment thread src/backends/nanvix/runner/src/lib.rs Outdated

Darren Hoehna (dhoehna) previously approved these changes Sep 1, 2026

View reviewed changes

Huzaifa Danish (huzaifa-d) closed this Sep 1, 2026

Huzaifa Danish (huzaifa-d) reopened this Sep 1, 2026

Jeff Whiteside (jsidewhite) reviewed Sep 1, 2026

View reviewed changes

Comment thread docs/nanvix-microvm/nanvix.md Outdated

Jeff Whiteside (jsidewhite) reviewed Sep 1, 2026

View reviewed changes

Comment thread src/backends/nanvix/runner/src/lib.rs Outdated

Jeff Whiteside (jsidewhite) previously requested changes Sep 1, 2026

View reviewed changes

microsoft-github-policy-service Bot assigned Huzaifa Danish (huzaifa-d) Sep 1, 2026

microsoft-github-policy-service Bot added the Needs-Author-Feedback Issue needs attention from issue or PR author label Sep 1, 2026

Copilot AI review requested due to automatic review settings September 17, 2026 20:33

Huzaifa Danish (huzaifa-d) dismissed stale reviews from Darren Hoehna (dhoehna) and Branden Bonaby (bbonaby) via 35f2a31 September 17, 2026 20:33

Huzaifa Danish (huzaifa-d) requested a review from a team September 17, 2026 20:33

microsoft-github-policy-service Bot added Needs-Attention Issue needs attention from Microsoft and removed Needs-Author-Feedback Issue needs attention from issue or PR author labels Sep 17, 2026

Copilot AI review requested due to automatic review settings September 17, 2026 21:45

Copilot started reviewing on behalf of Huzaifa Danish (huzaifa-d) September 17, 2026 21:45 View session

Copilot AI reviewed Sep 17, 2026

View reviewed changes

Comment thread docs/nanvix-microvm/nanvix.md Outdated

Copilot finished work on behalf of Huzaifa Danish (huzaifa-d) September 17, 2026 21:48

Jeff Whiteside (jsidewhite) reviewed Sep 17, 2026

View reviewed changes

Comment thread src/core/wxc_common/src/models.rs Outdated

Jeff Whiteside (jsidewhite) reviewed Sep 17, 2026

View reviewed changes

Comment thread docs/schema.md Outdated

Huzaifa Danish (huzaifa-d) force-pushed the user/modanish/fix-issue-787 branch from d10e8d0 to 4748b14 Compare September 18, 2026 02:19

Copilot AI review requested due to automatic review settings September 18, 2026 02:19

Copilot started reviewing on behalf of Huzaifa Danish (huzaifa-d) September 18, 2026 02:19 View session