Register nvx as an opt-in preview runtime - #8924
Conversation
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Multiple critical runtime correctness and security issues must be resolved before approval.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 6
Open (12)
What changed in this PR
Registers NVX/OpenVMM as an opt-in preview microVM runtime with CLI/configuration support, validation, backend integration, tests, schemas, and documentation.
Changes:
- Adds NVX runtime registration and preview gating.
- Integrates
NvxManagerthrough an external runtime backend. - Adds compatibility checks, configuration options, tests, and documentation.
| File | Review |
|---|---|
src/types/runtime-options.ts |
Defines NVX options and defaults. |
src/types/index.ts |
Exports NVX types and constants. |
src/nvx/runtime-validation.ts |
Adds compatibility and host checks. Must reject custom network subnets before resources are created. |
src/nvx/runtime-validation.test.ts |
Tests NVX validation behavior. |
src/nvx/runtime-lifecycle.test.ts |
Updates runtime registration coverage. |
src/nvx/runtime-backend.ts |
Adds the NVX backend adapter. Critical issues include broken multi-word commands, mismatched scratch ownership, missing workspace/cwd support, unsafe PATH-based tool discovery, shutdown races, and stale infrastructure use. It also mishandles scratch-size normalization, discards the guest environment, omits topology peers, misses post-probe compatibility validation, mishandles custom subnets, and does not quiesce preserved executions. |
src/nvx/runtime-backend.test.ts |
Tests backend lifecycle and mapping. |
src/external-runtime-backend.test.ts |
Tests NVX backend resolution and gating. |
src/external-runtime-backend-resolver.ts |
Registers the NVX backend factory. |
src/container-runtime.ts |
Registers NVX microVM capabilities. |
src/container-runtime.test.ts |
Tests NVX capability behavior. |
src/config-mapper.ts |
Maps NVX configuration to CLI options. |
src/config-file.ts |
Adds NVX configuration-file fields. |
src/commands/validators/config-assembly.ts |
Applies NVX validation, but security-mode normalization can erase incompatible option intent before validation. |
src/commands/build-config.ts |
Builds NVX runtime configuration. |
src/cli-options.ts |
Adds NVX CLI flags and help text. |
src/awf-config-schema.json |
Adds NVX schema definitions. |
README.md |
Links to NVX preview documentation. |
docs/nvx-security-design.md |
Documents registration and troubleshooting, but uses the wrong runtime-selection key and incorrectly describes the signer workflow as required. |
docs/awf-config.schema.json |
Updates the published configuration schema. |
docs/awf-config-spec.md |
Documents NVX configuration mappings. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| resolveInfrastructure: (enableApiProxy, ipPath) => | ||
| resolveMicrovmInfrastructure(enableApiProxy, undefined, ipPath), |
| this.infrastructure = await this.dependencies.resolveInfrastructure( | ||
| Boolean(this.config.enableApiProxy), | ||
| ); | ||
| this.identity = this.dependencies.identity(); |
| const nvx = requireNvxConfig(this.config); | ||
| const infrastructure = this.infrastructure; | ||
| const identity = this.identity; | ||
| if (!infrastructure || !identity) { | ||
| throw new Error('NVX microVM infrastructure is not ready'); | ||
| } |
| }, | ||
| filesystem: { | ||
| workDir: this.config.workDir ?? '/run/awf-nvx', | ||
| layers: [{ role: 'distro', sourcePath: nvx.layerPath! }], |
| filesystem: { | ||
| workDir: this.config.workDir ?? '/run/awf-nvx', | ||
| layers: [{ role: 'distro', sourcePath: nvx.layerPath! }], | ||
| scratchBytes: nvx.scratchBytes, |
| this.infrastructure = await this.dependencies.resolveInfrastructure( | ||
| Boolean(this.config.enableApiProxy), | ||
| ); |
| ? undefined | ||
| : agentTimeoutMinutes * 60_000; | ||
|
|
||
| const manager = this.dependencies.createManager({ |
| scratchBytes: nvx.scratchBytes, | ||
| maxScratchBytes: nvx.scratchBytes, |
| if (!config.networkIsolation || config.legacySecurity) { | ||
| throw new Error('NVX preview requires strict --network-isolation security'); | ||
| } | ||
| if (!config.enableApiProxy) { |
| (`src/nvx/artifact-manifest.ts`, `src/nvx/preflight.ts`). All are required; | ||
| any missing value fails validation before launch. |
|
@copilot address the review feedback |
Addressed in 4dc4311:
All existing and new unit tests pass, plus a full typecheck. |
|
✅ Copilot review passed with no inline comments. @copilot Add the |
Documentation PreviewDocumentation has been built for this PR. To view locally:
Built from commit b8dfcba |
|
❌ Smoke Gemini reports failed. Facets need polishing...
|
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.
|
|
🚀 Security Guard has started processing this pull request |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
✅ Smoke Claude passed Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
Smoke Cloud Hypervisor completed. Cloud Hypervisor + Copilot passed. Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"
- "github.com"See Network Configuration for more information.
|
|
✅ Build Test Suite completed successfully! Warning Firewall blocked 7 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "bun.sh"
- "dc.services.visualstudio.com"
- "deno.land"
- "dl.deno.land"
- "github.com"
- "releaseassets.githubusercontent.com"
- "repo.maven.apache.org"See Network Configuration for more information.
|
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅ Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "o205451.ingest.us.sentry.io"See Network Configuration for more information.
|
|
❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...
|
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 Warning Firewall blocked 13 domainsThe following domains were blocked by the firewall during workflow execution:
[!TIP] tools:
github:
mode: gh-proxySee GitHub Tools for more information on To allow these domains, add them to the network:
allowed:
- defaults
- "ab.chatgpt.com"
- "accounts.google.com"
- "android.clients.google.com"
- "api.github.com"
- "clients2.google.com"
- "collector.github.com"
- "contentautofill.googleapis.com"
- "github.com"
- "github.githubassets.com"
- "msfeed25.pkgs.visualstudio.com"
- "update.googleapis.com"
- "www.google.com"
- "www.gstatic.com"See Network Configuration for more information.
|
Smoke Test: Claude Engine Validation
Overall result: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
Smoke Test: Cloud Hypervisor + Copilot
Overall: PASS (4/4 checks succeeded) Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"
- "github.com"See Network Configuration for more information.
|
|
Smoke Test: Copilot Engine —
Overall: PASS
|
github-actions
Bot
added
the
smoke-copilot-network-isolation
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (github.com) reachable: Overall: PASS cc Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
[!TIP] tools:
github:
mode: gh-proxySee GitHub Tools for more information on To allow these domains, add them to the network:
allowed:
- defaults
- "api.github.com"
- "example.com"See Network Configuration for more information.
|
|
Smoke Test Results
Overall: PASS
|
Smoke Test: Copilot BYOK (Direct) Mode✅ All Tests Pass
Mode: Direct BYOK (
|
Chroot Version Comparison Results
Overall: FAILED — Node.js version mismatch between host and chroot environments.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — ✅ PASS Notes:
Warning Firewall blocked 7 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "bun.sh"
- "dc.services.visualstudio.com"
- "deno.land"
- "dl.deno.land"
- "github.com"
- "releaseassets.githubusercontent.com"
- "repo.maven.apache.org"See Network Configuration for more information.
|
📡 OTel Tracing Smoke Test Results
All scenarios pass or are expected-pending. No regressions detected. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "o205451.ingest.us.sentry.io"See Network Configuration for more information.
|
|
Reviewed merged PRs:
Warning Firewall blocked 13 domainsThe following domains were blocked by the firewall during workflow execution:
[!TIP] tools:
github:
mode: gh-proxySee GitHub Tools for more information on To allow these domains, add them to the network:
allowed:
- defaults
- "ab.chatgpt.com"
- "accounts.google.com"
- "android.clients.google.com"
- "api.github.com"
- "clients2.google.com"
- "collector.github.com"
- "contentautofill.googleapis.com"
- "github.com"
- "github.githubassets.com"
- "msfeed25.pkgs.visualstudio.com"
- "update.googleapis.com"
- "www.google.com"
- "www.gstatic.com"See Network Configuration for more information.
|
NVX (OpenVMM microVM backend) had its Phase 3f security/cleanup contract validated internally, but was reserved and unreachable from the CLI. This registers
nvxas a selectable, explicitly preview-gated runtime without changing the default runtime or ever falling back to another backend on failure.Runtime selection
--container-runtime nvxselects the runtime; execution additionally requires explicit--nvx-preview(ornvx.previewEnabled: truein the config file). Either alone fails closed with an actionable error before any resources are touched.nvxoutright; it is now a fully registeredmicrovmexecution model in the runtime capability registry.process.exit(1)) — unlike Cloud Hypervisor, there is no fallback path to Docker or any other backend.Runtime integration
src/nvx/runtime-backend.ts, anExternalAgentRuntimeBackendadapter bridging the existing, unmodifiedNvxManagerone-shot contract (atomic preflight → launch → execute → cleanup) into the same seam used bysbxand Cloud Hypervisor. Becauseexecute()is atomic,start()only brings up host infra (Squid/API-proxy); the microVM itself is created and torn down insideexec(), andstop()aborts and awaits any in-flight execution.Host eligibility and fail-closed behavior
src/nvx/runtime-validation.ts: Linux x86_64 + KVM eligibility check, and rejection of incompatible combinations (--tty, Docker-in-Docker/split-fs, host access, extra volume mounts, DIFC proxy, DNS-over-HTTPS, enclaves) and incomplete artifact configuration — each with a specific, actionable error.Configuration and CLI
NvxOptionstype, config-file section, JSON schema entries, and 12 CLI flags (--nvx-preview,--nvx-layer,--nvx-artifact-manifest[-bundle],--nvx-signer-workflow,--nvx-openvmm,--nvx-kernel,--nvx-initramfs,--nvx-memory-mib,--nvx-memory-max-bytes,--nvx-pids-max,--nvx-scratch-bytes), wired throughconfig-mapper.tsandbuild-config.ts.awf --container-runtime nvx --nvx-preview \ --nvx-layer ./distro.layer --nvx-openvmm ./openvmm --nvx-kernel ./vmlinux --nvx-initramfs ./initramfs \ --nvx-artifact-manifest ./manifest.json --nvx-artifact-manifest-bundle ./manifest.sigstore.jsonl \ -- echo helloKnown limitation
The one-shot adapter has no per-run env passthrough to the guest (only entrypoint/args/network egress rules). Any environment the agent command needs (including proxy settings) must be pre-baked into the guest layer supplied via
--nvx-layer. This is documented as a deliberate boundary of the validated contract, not an oversight.Documentation
docs/nvx-security-design.md: new "Runtime registration (opt-in preview)" section plus troubleshooting guidance.docs/awf-config-spec.md: config/CLI mapping table entries fornvx.*.README.md: reference entry alongside the Cloud Hypervisor preview link.