Implement bubblewrap for lightweight process container on Linux by shschaefer · Pull Request #314 · microsoft/mxc

shschaefer · 2026-05-14T18:25:00Z

Implement bubblewrap for lightweight process container on Linux.

📖 Description

This adds support for the Bubblewrap based process container on Linux.

🔍 Validation

The full PR will have complete validation tests.

✅ Checklist

Signed the Contributor License Agreement
Linked to an issue
Updated documentation (if applicable)
Updated Copilot instructions (if build, architecture, or conventions changed)

📋 Issue Type

Bug fix
Feature
Task

Microsoft Reviewers: Open in CodeFlow

…Linux.

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a feasibility/implementation plan document for introducing a Bubblewrap (bwrap) backend as a lightweight Linux process container for MXC.

Changes:

Adds a new design/feasibility evaluation document describing a Bubblewrap backend architecture
Outlines planned schema/model/parser updates, a new bwrap_common crate, and SDK/platform detection changes
Documents intended policy mappings (filesystem/network) and proposed test additions

Show a summary per file

File	Description
docs/bwrap-support/bubblewrap-backend-plan.md	New planning document describing approach, integration points, and test/docs follow-ups for a Bubblewrap backend

Copilot's findings

Files reviewed: 1/1 changed files
Comments generated: 7

+| Aspect | LXC | Bubblewrap |
+|--------|-----|------------|
+| Privileges | Root required | Unprivileged (user namespaces) |
+| Rootfs | Downloads distro rootfs | Bind-mounts host filesystem |
+| Startup | Create → Start → Attach | Single `bwrap` exec |
+| Network isolation | iptables + veth | `--unshare-net` (no network stack) |
+| Network filtering | Per-host allow/block via iptables | `--unshare-net` for full block; iptables (reuses `NetworkIptablesManager`) for per-host filtering |
+| Filesystem policy | LXC mount entries | `--ro-bind`, `--bind`, `--tmpfs` |
+| Signal cleanup | Kill container on SIGTERM | Process dies with parent |
+| Dependencies | `lxc-*` tools, rootfs templates | Single `bwrap` binary |


+No backend-specific config block for now. Bubblewrap will use only the shared
+cross-backend fields (`filesystem`, `network`, `process`, `lifecycle`, `ui`). Backend-specific
+knobs (e.g., namespace sharing, device bindings) can be added later under `experimental.bubblewrap`
+if needed.


+No `BubblewrapConfig` struct needed for now — the runner uses only the shared
+`ContainerPolicy` fields on `CodexRequest` (filesystem paths, network policy, env, etc.).
+A backend-specific config can be added later under `ExperimentalConfig` if needed.


+- `src/wxc_common/src/models.rs` — add `Bubblewrap` variant, `BubblewrapConfig` struct, wire into `ExperimentalConfig` and `CodexRequest`
+- `src/wxc_common/src/config_parser.rs` — add `RawBubblewrap`, parsing, containment match arm
+
+### Schema (modify)
+- `schemas/dev/mxc-config.schema.0.6.0-dev.json` — add `"bubblewrap"` to enum, add config block


+- `src/wxc_common/src/models.rs` — add `Bubblewrap` variant, `BubblewrapConfig` struct, wire into `ExperimentalConfig` and `CodexRequest`
+- `src/wxc_common/src/config_parser.rs` — add `RawBubblewrap`, parsing, containment match arm
+
+### Schema (modify)
+- `schemas/dev/mxc-config.schema.0.6.0-dev.json` — add `"bubblewrap"` to enum, add config block


@@ -0,0 +1,358 @@
+# Bubblewrap (bwrap) Backend for MXC — Feasibility Evaluation


+| Network isolation | iptables + veth | `--unshare-net` (no network stack) |
+| Network filtering | Per-host allow/block via iptables | `--unshare-net` for full block; iptables (reuses `NetworkIptablesManager`) for per-host filtering |
+| Filesystem policy | LXC mount entries | `--ro-bind`, `--bind`, `--tmpfs` |
+| Signal cleanup | Kill container on SIGTERM | Process dies with parent |


jsidewhite · 2026-05-15T22:39:00Z

+//!   spawns the `bwrap` binary.
+
+pub mod bwrap_command;
+pub mod bwrap_runner;


bwrap_runner

does this need conditional compilation? "#[cfg(target_os = "linux")]"

Yes — I gated bwrap_runner at the module export with #[cfg(target_os = "linux")] in src/bwrap_common/src/lib.rs so only Linux builds include it. Addressed in bed4be3.

jsidewhite

huzaifa-d · 2026-05-18T18:25:00Z

@copilot resolve the merge conflicts in this pull request

Agent-Logs-Url: https://github.com/microsoft/mxc/sessions/31b3d621-4b94-4cb1-ba58-07be3d1b1d88 Co-authored-by: huzaifa-d <16077119+huzaifa-d@users.noreply.github.com>

Copilot · 2026-05-18T18:32:22Z

@copilot resolve the merge conflicts in this pull request

Merge conflicts are resolved by merging origin/main into this branch and fixing the workspace conflict in src/Cargo.toml. Addressed in bed4be3.

SohamDas2021 · 2026-05-18T18:57:26Z

Found the following while manually testing the runtime end-to-end. build_args in bwrap_command.rs emits arguments in this order:

--ro-bind / / (base)
policy mounts: --bind / --ro-bind / --tmpfs for the user's readwritePaths / readonlyPaths / deniedPaths
--dev /dev, --proc /proc, --tmpfs /tmp

Because bwrap applies mounts in order with later mounts overriding at the same path, step 3's hard-coded --tmpfs /tmp obscures all the subdirs; in every policy mount in step 2 whose target lives under /tmp - /tmp/, /tmp/, /tmp/ all disappear inside the sandbox.

Repro

mkdir -p /tmp/bwrap-rw /tmp/bwrap-ro /tmp/bwrap-denied
echo "from host" > /tmp/bwrap-ro/test.txt
echo "secret" > /tmp/bwrap-denied/secret.txt

cat > /tmp/repro.json <<'JSON'
{
"version": "0.6.0-alpha",
"containment": "bubblewrap",
"platform": "linux",
"process": {
"commandLine": "cat /tmp/bwrap-ro/test.txt; echo X > /tmp/bwrap-rw/output.txt"
},
"filesystem": {
"readonlyPaths": ["/tmp/bwrap-ro"],
"readwritePaths": ["/tmp/bwrap-rw"],
"deniedPaths": ["/tmp/bwrap-denied"]
}
}
JSON

src/target/release/lxc-exec --experimental /tmp/repro.json

Observed:

cat: /tmp/bwrap-ro/test.txt: No such file or directory
sh: 1: cannot create /tmp/bwrap-rw/output.txt: Directory nonexistent

Expected: the RO bind serves the file; the RW write succeeds and lands on the host.

I will push out the fix.

shschaefer · 2026-05-20T17:36:41Z

@copilot resolve the merge conflicts in this pull request

revoking review

Begin bubblewrap implementation for lightweight process container on …

5987697

…Linux.

Copilot AI review requested due to automatic review settings May 14, 2026 18:25

Copilot AI reviewed May 14, 2026

View reviewed changes

shschaefer requested review from MGudgin, SohamDas2021, bbonaby and jsidewhite May 14, 2026 18:33

Copilot started reviewing on behalf of shschaefer May 14, 2026 18:52 View session

Basic bubblewrap implementation. Needs test pass.

8f65b9d

jsidewhite reviewed May 15, 2026

View reviewed changes

jsidewhite previously approved these changes May 15, 2026

View reviewed changes

Copilot started work on behalf of huzaifa-d May 18, 2026 18:25 View session

Merge origin/main and gate bwrap runner module to Linux

bed4be3

Agent-Logs-Url: https://github.com/microsoft/mxc/sessions/31b3d621-4b94-4cb1-ba58-07be3d1b1d88 Co-authored-by: huzaifa-d <16077119+huzaifa-d@users.noreply.github.com>

Copilot finished work on behalf of huzaifa-d May 18, 2026 18:32

Copilot AI requested a review from huzaifa-d May 18, 2026 18:32

emit standard mounts before policy mounts

c144182

SohamDas2021 approved these changes May 20, 2026

View reviewed changes

shschaefer marked this pull request as ready for review May 20, 2026 17:36

Copilot started work on behalf of shschaefer May 20, 2026 17:36 View session

Copilot stopped work on behalf of shschaefer due to an error May 20, 2026 17:38
Execution failed: Error: External tool "lsp" conflicts with a built-in tool of the same name. Set overridesBuiltInTool: true to explicitly override it.

Resolve merge conflicts.

066132d

SohamDas2021 approved these changes May 20, 2026

View reviewed changes

Build pipeline fix

74f8385

shschaefer requested review from SohamDas2021 and jsidewhite May 20, 2026 20:41

kanismohammed approved these changes May 21, 2026

View reviewed changes

kanismohammed merged commit ad67607 into main May 21, 2026
18 checks passed

kanismohammed deleted the user/shschaefer/bubblewrap branch May 21, 2026 00:30

SohamDas2021 mentioned this pull request May 21, 2026

[Bubblewrap] Make Bubblewrap the default Linux backend #368

Merged

7 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Implement bubblewrap for lightweight process container on Linux#314

Implement bubblewrap for lightweight process container on Linux#314
kanismohammed merged 6 commits into
mainfrom
user/shschaefer/bubblewrap

shschaefer commented May 14, 2026 •

edited by microsoft-github-policy-service Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

jsidewhite May 15, 2026

Uh oh!

Copilot AI May 18, 2026

Uh oh!

jsidewhite left a comment

Uh oh!

huzaifa-d commented May 18, 2026

Uh oh!

Copilot AI commented May 18, 2026

Uh oh!

SohamDas2021 commented May 18, 2026

Uh oh!

shschaefer commented May 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

		@@ -0,0 +1,358 @@
		# Bubblewrap (bwrap) Backend for MXC — Feasibility Evaluation

Uh oh!

Conversation

shschaefer commented May 14, 2026 • edited by microsoft-github-policy-service Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📖 Description

🔍 Validation

✅ Checklist

📋 Issue Type

Microsoft Reviewers: Open in CodeFlow

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

jsidewhite May 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 18, 2026

Choose a reason for hiding this comment

Uh oh!

jsidewhite left a comment

Choose a reason for hiding this comment

Uh oh!

huzaifa-d commented May 18, 2026

Uh oh!

Copilot AI commented May 18, 2026

Uh oh!

SohamDas2021 commented May 18, 2026

Uh oh!

shschaefer commented May 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

shschaefer commented May 14, 2026 •

edited by microsoft-github-policy-service Bot

Loading