[Bubblewrap/LXC/WSLC] Update roadmap doc

[Soham Das (SohamDas2021)]

📖 Description

Update roadmap doc with the state of the work-items. Align LXC/Bwrap N2 inbound control with GA networking spec.

🔗 References

🔍 Validation

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see docs/pull-requests.md)

📋 Issue Type

• Bug fix
• Feature
• Task

---

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHub
Actions build; it runs on merge to main, and Microsoft reviewers with write access can trigger it
on a PR with /azp run. See docs/pull-requests.md.

If the dependency-feed-check check fails on a new dependency, the crate must be added to
the feed before the PR can pass. See docs/pull-requests.md
for the steps.

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Updates the Linux/WSL roadmap to reflect backend progress and align inbound networking plans with the GA specification.

Changes:

• Updates filesystem-policy work-item statuses.
• Revises LXC/Bubblewrap inbound-control plans.
• Clarifies WSLC limitations and dependencies.

Comments suppressed due to low confidence (3)

docs/linux-wsl-roadmap-june-2026.md:164

• This repeats an ingress rule set that is broader than the GA contract: NEW ACCEPT in the private namespace permits direct connections over the veth, not just host-loopback traffic, while -i lo is only sandbox-internal loopback. The N1 routed-proxy design needs to define a host-side listener bound to 127.0.0.1/::1 and an INPUT rule scoped to that forwarding path rather than accepting every new connection.

| 14 | **(N2) Inbound control (`hostLoopback`)** | 🟡 Actionable | Already in place: `--unshare-net` inherently blocks inbound (no route). New work (proxy mode): GA requires ingress enforced via an iptables **INPUT** chain in the sandbox's **own network namespace** (`docs/sandbox-policy/v2/networking.md` L148/L212/L289/L295), scoped per-sandbox (D6). This **depends on N1** moving proxy mode off the shared host netns onto `--unshare-net` + a routed proxy (slirp4netns/veth, elevation required). Once Bwrap has a private netns, ingress runs there via the shared `NetworkIptablesManager` — `-i lo` ACCEPT, `ESTABLISHED,RELATED` ACCEPT, `NEW` ACCEPT/DROP keyed on `ingress.hostLoopback`/`allowLocalNetwork`, terminal DROP — same as LXC. A host-side INPUT chain on the shared netns is **not** the GA target: it can't be attributed to a single sandbox. | M |

docs/linux-wsl-roadmap-june-2026.md:232

• This describes the old behavior as current, but WSLC already calls validate_denied_path_overlap() before loading the SDK (wsl_container_runner.rs:892-905), and a wiring test verifies rejection before container startup. Update both this row and its example so the roadmap does not list completed mitigation as actionable.

| 5 | **`deniedPaths` overlap validation** | 🟡 Actionable | Today a `deniedPaths` entry that is a child of a mounted (`readwritePaths`/`readonlyPaths`) path is silently ignored, leaving it accessible through the parent mount. Planned: reject such configs at parse time (since the WSLC SDK cannot enforce the deny). Non-overlapping denied paths are already implicitly enforced (unmounted = invisible). This is a workaround; *masking* a denied subtree under a mounted parent needs an SDK exclusion primitive (see [WSLC SDK dep #4](#wslc-sdk-dependencies)). | S |

docs/linux-wsl-roadmap-june-2026.md:471

• This dependency summary reintroduces the same obsolete claim as filesystem item #5. The current runner already rejects nested denied paths before SDK load, so saying MXC silently ignores them and only plans to reject them makes the roadmap internally inconsistent and understates the current fail-closed behavior.

| 4 | **Deny-mount / path-exclusion primitive** | Filesystem #5 (`deniedPaths` enforcement) | LXC and Bubblewrap mask a `deniedPaths` entry that sits under a mounted parent by overlaying it (`/dev/null` or `tmpfs`). The WSLC SDK exposes only a flat volume-mount surface with no overlay/exclusion primitive, so a denied subtree under a mounted parent cannot be masked. Today MXC silently ignores such a denied path, leaving it accessible through the parent mount; the planned near-term mitigation is to reject these configs at parse time (Filesystem #5), but real enforcement needs an SDK exclusion primitive. (Note: this is the *basic subtree-deny* gap — spec-exact D5 "visible + ACCESS_DENIED" remains non-actionable on every Linux backend regardless, see Filesystem #12.) |

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

docs/linux-wsl-roadmap-june-2026.md:144

• The same unresolved lexical-path case prevents calling Bubblewrap D4 fully addressed. resolve_mount_order preserves the original spelling and counts ./.. as components, while the parser permits them, so emitted order can differ from the effective filesystem hierarchy. Keep this actionable until these components are folded for ordering or rejected.

| 4 | **(D4) Most-specific-path-wins** | ✅ Addressed | Longest-prefix (most-specific-path-wins) resolution via the shared `filesystem_resolve.rs` path-tree resolver in `wxc_common`, consumed by `bwrap_command.rs` instead of relying on left-to-right arg order. Done in [PR #608](https://github.com/microsoft/mxc/pull/608). | M |