hyperlight: integrate host-proxied networking via NetworkPolicy#315
Conversation
Signed-off-by: danbugs <danilochiarlone@gmail.com>
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Integrates host-proxied networking from hyperlight-unikraft into the MXC hyperlight backend by mapping MXC's NetworkPolicy fields onto pyhl's NetworkPolicy enum, replacing the previous unconditional rejection of network rules.
Changes:
- Add
network_policy_from_requesttranslation and threadNetworkPolicythroughensure_runtime/Runtime::new/pyhl::install. - Track active network hosts for runtime-reuse cache invalidation; remove
ERR_NETWORK_POLICYand update preflight tests. - Add
hyperlight_networking.jsonconfig and a corresponding e2e test case asserting an HTTP 200 via allowlist.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| test_configs/hyperlight_networking.json | New config exercising allowedHosts with an HTTP GET. |
| src/wxc_e2e_tests/tests/e2e_windows.rs | Adds a hyperlight e2e case for the new networking config. |
| src/wxc_common/src/hyperlight_runner.rs | Translates network policy, plumbs it through install/runtime, updates cache key, and rewrites unit tests. |
…nd normalize host order Signed-off-by: danbugs <danilochiarlone@gmail.com>
| /// Filesystem mounts and network policies ARE supported. | ||
| fn validate_policies(request: &CodexRequest) -> Result<(), PyhlError> { | ||
| if !request.policy.allowed_hosts.is_empty() | ||
| || !request.policy.blocked_hosts.is_empty() |
There was a problem hiding this comment.
This check should still be there because now
Allow + Blocked_host = Allow All
There was a problem hiding this comment.
Added BlockList support upstream in hyperlight-dev/hyperlight-unikraft#25. blocked_hosts now maps to NetworkPolicy::BlockList–deny the listed hosts, allow everything else. Also added validation that rejects configs with both allowedHosts and blockedHosts set (mutually exclusive). See commits 46da46a and fa390df.
| @@ -0,0 +1,10 @@ | |||
| { | |||
| "process": { | |||
| "commandLine": "import urllib.request; r = urllib.request.urlopen('http://example.com/'); print(r.status)", | |||
There was a problem hiding this comment.
Suggestion : Should add another test with a different url to test the blocking with allowedHosts.
There was a problem hiding this comment.
Added hyperlight_networking_blocked.json–it tries to reach httpbin.org when only example.com is in allowedHosts and expects the request to be blocked. Corresponding e2e test case added. See commit cdedd5d.
Signed-off-by: danbugs <danilochiarlone@gmail.com>
Signed-off-by: danbugs <danilochiarlone@gmail.com>
Summary
NetworkPolicyenum:Block→ disabled,allowedHosts→ per-host allowlist,Allow→ allow-allhyperlight_networking.jsontest config and e2e test case (HTTP GET to example.com with allowlist)5f424bb(includes socket2 dependency for networking)Microsoft Reviewers: Open in CodeFlow