[Enrique Saurez (esaurez)]

Stacked on #866; this PR retargets when its parent merges.

Stack: #866 → #882 (this PR) → #883 → #876 → #871 → #873 → #874, on dev. #863, #864, #865, #867, #868, #869, #870, #872, #875, and #878 are merged.

Part of #822: PR 10 of 11, the guest's settings.

What changed

• The root configuration gains an optional field, listeners (root::Listeners: published or unpublished), which says whether the sandbox's listeners are published. It is the 17th field, after workload-uid and workload-gid; no other field moves, and the version stays 1. Without it, the listeners are published, as nvx::guest::entry's default has them, which refuses the most to the executions.
• The worker builds the sandbox of its executions through its one seam, worker::executions::Sandbox::new(identity, publication), with the publication that the configuration names; the hostname stays the entry's default. Executions, and the check of the account of the sandbox's workload identity, enter the root with that publication (worker::Entrance::publication). While the listeners are published, the entry refuses CAP_NET_BIND_SERVICE and CAP_NET_RAW at stage 0, with which a workload could forge the announcements of its listeners.
• A layered launch names the publication of its network as OpenVMM publishes listeners: LayeredLaunch::with_network puts the network on the plan, with the listeners published when ingress or host-loopback access is allowed, and unpublished otherwise, or without a network.
• The host gives each execution the URL of a proxy-only network's proxy (SandboxPlan::proxy_url) in the proxy variables of its environment, layered::PROXY_VARIABLES (http_proxy, https_proxy, HTTP_PROXY, and HTTPS_PROXY), after its own entries, with layered::with_proxy; a start that names any of them keeps its own proxy settings. The host program's exec reads the plan that the launch recorded, with LaunchRecord::read_plan. Before it attaches, exec checks that the framing still carries each start with the proxy's variables, and runs none of the executions if one no longer fits.
• The network device, its addresses, and the announcer of the guest's listeners stay with NVX's /init.
• The adapter's README and the module docs describe the field, the publication, and the proxy.

Tests

• src/root.rs: the field's encoding, last, its decoding, and the configurations that the guest refuses for it.
• tests/guest_session.rs, guest-only: an_execution_enters_the_root_with_the_publication_of_listeners_that_its_configuration_names, without the field, and with each publication: the refusals at stage 0 while listeners are published, the capabilities that the entry still allows, and the account check of a workload identity, which enters with the configuration's publication.
• tests/layered_launch.rs, host-only: the publication that a launch names for each element of a policy; an_execution_finds_the_url_of_its_network_s_proxy_in_its_environment, for each scheme and with a start that names its own proxy; and the_record_of_a_launch_gives_back_its_plan.
• tests/vm_layered.rs, on a real hypervisor: executions_take_the_settings_of_a_proxy_only_network, which on Linux also has exec refuse, before it attaches, a batch with a start that the framing carries alone but not with the proxy's URL, none of whose executions runs; and published_listeners_refuse_binding_and_raw_sockets.

Validation

At this head, on #866 at f9b8829a, with OpenVMM built at the pinned a12d9167. The previous head, 23eb4ef9, moved onto #866's new head unchanged: its git range-diff is all =.

• Windows (local), in tests/runtime-adapter: each of this PR's commits with cargo clippy --locked --all-targets -- -D warnings in the protocol-only, host-only, and guest-only (--features guest --target x86_64-unknown-linux-musl) configurations; and cargo test --locked --features host at this head.
• At tests: enforce the runtime adapter's networks in VMs #883's head, the top of this stack, which holds this PR unchanged, in tests/runtime-adapter: on Windows (local), cargo fmt --all --check, and the protocol-only and host-only configurations' cargo clippy --locked --all-targets [--features host] -- -D warnings, cargo build --locked, cargo test --locked, and cargo +1.89 check --locked --all-targets; on Linux (x86_64), the same, plus the guest-only configuration's (--features guest --target x86_64-unknown-linux-musl) Clippy, build, tests, and MSRV check, the guest-only library and guest_session tests as root, and a stress run of guest_session, 10 times as root and 10 times as a user, and of the library's tests, 3 times as root.
• VM tests at tests: enforce the runtime adapter's networks in VMs #883's head: vm_layered (43 scenarios: runtime adapter: run cold sandboxes end to end on KVM, MSHV and WHP #822's and runtime adapter: settle executions through cgroups and run them in a VM #805's 35, this PR's 2, and tests: enforce the runtime adapter's networks in VMs #883's 6), vm_restart (3), and vm_steps (3) on WHP (local) and MSHV (Linux x86_64, as root).
• python scripts/check_markdown_links.py.
• Left to CI: everything, once this PR targets dev, KVM included; a stacked PR runs no NVX CI.

[Copilot]

🟡 Changes recommended

Proxy injection can invalidate a later start after earlier executions have already been sent, so the augmented batch needs validation before submission.

1 open issue

• Validate proxy-augmented starts before sending any batch work · New

What changed in this PR

This PR connects the runtime adapter’s execution settings to its sandbox network policy, advancing #822’s end-to-end sandbox support.

Changes:

• Adds listener-publication configuration and passes it into guest capability checks.
• Supplies proxy environment variables from the recorded launch plan while preserving caller overrides.
• Adds configuration, host, guest, and VM coverage with updated documentation.

File	Description
tests/​runtime-adapter/​tests/​vm_layered.rs	Adds proxy and published-listener VM scenarios.
tests/​runtime-adapter/​tests/​layered_launch.rs	Tests publication, proxy injection, and plan readback.
tests/​runtime-adapter/​tests/​guest_session.rs	Tests publication-dependent capability admission.
tests/​runtime-adapter/​src/​worker/​executions.rs	Carries sandbox publication into execution entry.
tests/​runtime-adapter/​src/​worker.rs	Applies configured publication to entry and account checks.
tests/​runtime-adapter/​src/​root.rs	Defines and validates the optional listeners field.
tests/​runtime-adapter/​src/​lib.rs	Documents execution network settings.
tests/​runtime-adapter/​src/​layered.rs	Derives publication, injects proxies, and reads recorded plans.
tests/​runtime-adapter/​src/​bin/​runtime-adapter-host.rs	Integrates network settings into launch and execution commands.
tests/​runtime-adapter/​README.md	Documents configuration, behavior, and test coverage.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Network-dependent capability permissions warrant human review while backend CI, including KVM validation, remains pending.

No open issues 🎉

1 resolved since last review

• Validate proxy-augmented starts before sending any batch work

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Coordinated changes to guest capability restrictions and host/guest execution framing warrant final human review despite no confirmed blocking defects.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Changes to guest capability enforcement and cross-platform network behavior warrant final human review and exact-head CI validation.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Network-dependent capability enforcement crosses the host–guest boundary and warrants human review with exact-head cross-platform CI, including KVM.

No open issues 🎉

_{Review effort: Balanced}