LXC state-aware e2e script covers one scenario where WSLC covers nine

[dhoehna]

tests/scripts/run_lxc_state_aware_test.sh is 176 lines and exercises a single provision/start/stop/deprovision scenario. tests/scripts/run_wslc_state_aware_tests.ps1 is 1,117 lines across 9 scenario groups. Raised by Soham Das (@SohamDas2021) in review of PR #849.

Not all of the gap is real work:

• The two daemon-oriented WSLC groups (daemon idle teardown and daemon recovery) do not apply. LXC is daemonless, so there is no idle daemon to tear down and nothing to recover.
• Whether the bridged-proxy group applies to LXC is unverified — it needs a decision before it is worth writing.

The remainder is genuine coverage the LXC script does not have: repeated lifecycle cycles, teardown when the container is already gone, concurrent lifecycle calls against one name, and firewall-policy enforcement end to end.

Separately, the script's environment guard is weaker than it looks. It checks for root, for lxc-create on PATH, and for the built binary, then exits 77 (skip). None of those establishes a functional LXC runtime, so the script can proceed on a host where the runtime cannot actually start a container, and a real failure there is not distinguishable from a broken environment.

Filed rather than fixed in PR #849: that PR is already 33 files and +6192/-566, and its unmerged predecessor #633 failed at 87 comments and 42 commits with the same growth shape.

[github-actions]

Triage summary

Labels applied: OS-Linux, Area-Test-Executor

Assigned: @SohamDas2021 (Linux/LXC owner) and @theelliotm (test infrastructure owner) — this issue spans both areas.

Maintainers: Comment /investigate to check whether this issue or bug is valid against the most current code. Copilot will also produce a report with the changes that will be needed. For a small, unambiguous documentation or test fix, it may also create one draft PR.

Generated by 🏷️ Issue Triage for #882 · sonnet46 · 18.7 AIC · ⌖ 5.29 AIC · ⊞ 7.4K · ◷

[dhoehna]

Sharpening this from a suppressed review comment on state_aware.rs:978 (review 4940329283), which makes the gap more specific than "more scenarios":

The new lifecycle script starts without any network policy, so it never exercises this PR's security-critical state-aware path: pre-start FORWARD installation, post-start INPUT installation, ingress-failure rollback, or authoritative teardown. The existing LXC network scripts cover only the one-shot runner.

That is the priority ordering for this issue. The four firewall-mode paths above are where the unit tests are weakest — they verify command construction, so they cannot detect an integration failure against real LXC namespaces and iptables — and they are also where every fail-open found in review has landed (#877, #878, #859).

So: a firewall-mode state-aware e2e that asserts both directions are filtered and that stop/deprovision actually remove the host rules is worth more than raising the raw scenario count toward WSLC parity.

[dhoehna]

Consolidated into #903 -- [LXC] Test coverage gaps: untestable fail-closed branch and thin state-aware e2e.

The backlog now carries one issue per area instead of one per finding. This report is reproduced there in full and unedited; nothing here is dropped. Track and fix it at #903.