[LXC] State-aware sandbox lifecycle - #849

Open

Darren Hoehna (dhoehna) wants to merge 97 commits into

microsoft:mainfrom

dhoehna:user/dahoehna/lxc-lifecycle-current

Commits on Jul 13, 2026

[LXC] Implement StatefulSandboxBackend for LXC (state-aware lifecycle) (AB#62953349)

Darren Hoehna (dhoehna)
and
Copilot
committed
fabdfd0
[LXC] Address PR #633 review: collision-free container names + narrow LXC start network type

Darren Hoehna (dhoehna)
and
Copilot
committed
0853f9c

Commits on Jul 15, 2026

Add LXC state-aware provision sample config (tests/configs/lxc_state_aware_provision.json)

Darren Hoehna (dhoehna)
and
Copilot
committed
9764b1a
Merge microsoft/mxc main (47a172c) into lxc-state-aware-lifecycle

Darren Hoehna (dhoehna)
and
Copilot
committed
af38cc1
ci: re-trigger PR build (empty commit)

Darren Hoehna (dhoehna)
and
Copilot
committed
5a138bc

Commits on Jul 16, 2026

Address PR #633 review: LXC state-aware lifecycle fixes

Darren Hoehna (dhoehna)
and
Copilot
committed
f84cf2b

Commits on Jul 17, 2026

Merge upstream/main (d271ac4) into lxc-state-aware-lifecycle

Darren Hoehna (dhoehna)
and
Copilot
committed
dd29002

Commits on Jul 20, 2026

Merge remote-tracking branch 'upstream/main' into user/dahoehna/lxc-state-aware-lifecycle
Darren Hoehna (dhoehna)
committed
91ebaf7

Commits on Jul 27, 2026

Merge upstream/main into user/dahoehna/lxc-state-aware-lifecycle

Darren Hoehna (dhoehna)
and
Copilot
committed
7ad03df

Commits on Jul 30, 2026

[LXC] Address PR #633 review: egress direction, fail-open start, SDK surface

Darren Hoehna (dhoehna)
and
Copilot
committed
287b918
[LXC] Share state-aware telemetry orchestration between the wxc and lxc executors

Darren Hoehna (dhoehna)
and
Copilot
committed
95a197d
[LXC] Add the missing state-aware lifecycle test and run it from the suite

Darren Hoehna (dhoehna)
and
Copilot
committed
783c197
[LXC] Do not treat the default network policy as an explicit restriction

Darren Hoehna (dhoehna)
and
Copilot
committed
c453787
Merge upstream/main into lxc-state-aware-lifecycle

Darren Hoehna (dhoehna)
and
Copilot
committed
c9001a3
Remove accidentally committed SDK build output and node_modules

Darren Hoehna (dhoehna)
and
Copilot
committed
d287e49
Restore LF line endings in wxc/src/main.rs

Darren Hoehna (dhoehna)
and
Copilot
committed
a39e1cc

Commits on Aug 4, 2026

Merge remote-tracking branch 'upstream/main' into user/dahoehna/lxc-state-aware-lifecycle
Darren Hoehna (dhoehna)
committed
15daa8f
LXC: clear only MXC-added bind mounts, not baseline entries

Darren Hoehna (dhoehna)
and
Copilot
committed
1832e43
LXC: make firewall chain name collision-free via a name hash

Darren Hoehna (dhoehna)
and
Copilot
committed
cdb8344
LXC: remove FORWARD hook on teardown regardless of veth discovery

Darren Hoehna (dhoehna)
and
Copilot
committed
5c03c13
LXC: install the firewall before the container starts (fail closed)

Darren Hoehna (dhoehna)
and
Copilot
committed
d8be903
LXC: route exec error envelope to stderr so it can't corrupt the stream

Darren Hoehna (dhoehna)
and
Copilot
committed
44929f0
LXC test script: make cleanup idempotent so it runs once per run

Darren Hoehna (dhoehna)
and
Copilot
committed
d699f9e
docs(sdk): add LXC to the state-aware backend list, note streaming-exec gap

Darren Hoehna (dhoehna)
and
Copilot
committed
cd34a4f
LXC: enforce an explicit default network policy (item 6)

Darren Hoehna (dhoehna)
and
Copilot
committed
e3e657a
LXC: add chain-name collision-freedom spec tests

Darren Hoehna (dhoehna)
and
Copilot
committed
9c055f2
LXC: fix three evidence-reviewer findings from e3e657a

Darren Hoehna (dhoehna)
and
Copilot
committed
6d712e3
Fix chain-name collision from 32-bit hash truncation (PR 633 review)

Darren Hoehna (dhoehna)
and
Copilot
committed
cb62636
docs: correct the 36^11 modulus value in a comment

Darren Hoehna (dhoehna)
and
Copilot
committed
adf8e03
Correct the chain-hash work-factor claim

authored and
Darren Hoehna
committed
dbac069

Commits on Aug 5, 2026

Correct MAX_CONTAINER_NAME_LEN comment: chain names are not collision-free

Darren Hoehna (dhoehna)
and
Copilot
committed
bf78432

Commits on Aug 6, 2026

Address review feedback on the state-aware lifecycle

authored and
Darren Hoehna
committed
204bff4
Correct four defects an independent review found in the previous commit

Darren Hoehna (dhoehna)
and
Copilot
committed
d7e3bc9

Commits on Aug 7, 2026

Commits on Aug 12, 2026

Merge upstream/main into the state-aware lifecycle branch

Darren Hoehna (dhoehna)
and
Copilot
committed
51c26e4
Drop the IsolationSessionUserConfig import the merge should not have kept

Darren Hoehna (dhoehna)
and
Copilot
committed
2658d07

Commits on Aug 13, 2026

Commits on Aug 14, 2026

Commits on Aug 15, 2026

Merge remote-tracking branch 'upstream/main' into user/dahoehna/lxc-lifecycle-current
Darren Hoehna (dhoehna)
committed
a551ce2

Commits on Aug 16, 2026

[LXC] Enforce the network mode rule at start instead of in the SDK types

Darren Hoehna (dhoehna)
and
Copilot
committed
7d3e2e0
[LXC] Cover the network presence bit end to end on a real container

Darren Hoehna (dhoehna)
and
Copilot
committed
c4a87aa
[LXC] Pin filesystem_specified with a case that can actually fail

Darren Hoehna (dhoehna)
and
Copilot
committed
1470f15

Commits on Aug 17, 2026

[LXC] Ask liblxc for the interface list instead of parsing the config

authored and
Darren Hoehna
committed
8fecff7
[LXC] Assert the default-deny hook is applied, not just reported

authored and
Darren Hoehna
committed
579d486
[LXC] Drop the lxc.include refusal from the contract

authored and
Darren Hoehna
committed
de90b20
[LXC] Require the physdev hook the bridged veth actually uses

Darren Hoehna (dhoehna)
and
Copilot
committed
79ab7ab
[LXC] Drop the stale lxc.include refusal from the repo guidance

Darren Hoehna (dhoehna)
and
Copilot
committed
bdd8214
[LXC] Pin the netdev type named "empty" against the absence signal

Darren Hoehna (dhoehna)
and
Copilot
committed
b02e731
[LXC] Follow the sole interface's index instead of requiring lxc.net.0

Darren Hoehna (dhoehna)
and
Copilot
committed
825334a
[LXC] Refuse a network config that moved while it was being read

Darren Hoehna (dhoehna)
and
Copilot
committed
1fbc2a9
[LXC] Recheck the located index, not just the interface summary

Darren Hoehna (dhoehna)
and
Copilot
committed
e140496
[LXC] Enforce the network policy without depending on the interface index

Darren Hoehna (dhoehna)
and
Copilot
committed
d6984f1
[LXC] Close three teardown gaps an independent review found

Darren Hoehna (dhoehna)
and
Copilot
committed
56fccba
[LXC] Ask the container which name its interface has, and re-read before flushing

Darren Hoehna (dhoehna)
and
Copilot
committed
ae24c28
[LXC] Cover every start-phase policy field with a roadmap E2E case

Darren Hoehna (dhoehna)
and
Copilot
committed
7c452f4

Commits on Aug 18, 2026

Commits on Aug 19, 2026

Drop enforcementMode from LxcNetworkConfig and fix two stale doc comments

Darren Hoehna (dhoehna)
and
Copilot
committed
f9c9352
Enable bridge netfilter on the SDK integration Linux lanes

Darren Hoehna (dhoehna)
and
Copilot
committed
cfff8cd
Wire experimental.lxc into the generated config schema

Darren Hoehna (dhoehna)
and
Copilot
committed
0ef10b6
Merge upstream/main into lxc-experimental-wire

Darren Hoehna (dhoehna)
and
Copilot
committed
669c80e