MXC SDK v1.0.1

MXC SDK v1.0.1 is the first patch for MXC. The stable schema version remains 1.0.0.

• Crates.io: https://crates.io/crates/mxc-sdk/1.0.1
• NPM: https://www.npmjs.com/package/@microsoft/mxc-sdk/v/1.0.1
• Nuget: NuGet Gallery | Microsoft.Mxc.Sdk 1.0.1

See the Assets section for mxc-release-binaries.zip, which contains signed binaries that can be useful for testing.

What's Changed

Behavior changes

• ProcessContainer: BaseContainer can reach host services over loopback on PSEC 1.0 hosts when hostLoopback: "allow" and the egress policy permit it.
• ProcessContainer: captureDenials uses option-aware Learning Mode traces where available, and verbose diagnostics include COM activation details.
• WSLC: a create-and-run request that combines wslc.portMappings with an omitted or all-deny network block is now rejected during validation. These requests previously failed at container creation.
• WSLC: The lifecycle daemon runs executions for up to eight containers concurrently. A second execution against a busy container is refused as busy.

Bug fixes

• ProcessContainer: captureDenials now reports WFP network denials that were previously dropped because of an outdated provider GUID.
• WSLC: Create-and-run execution no longer fails with HRESULT 0x80070020 while a lifecycle container is provisioned.
• WSLC: Create-and-run requests that omit containerId no longer fail with WSLC_E_INVALID_SESSION_NAME.
• WSLC: Lifecycle operations on one container no longer wait behind an execution running in another container.
• WSLC: a lifecycle daemon still running from an older install is rejected instead of silently ignoring new fields.
• Bubblewrap: DNS resolution works on hosts that use a loopback stub resolver, such as systemd-resolved, dnsmasq, or Pi-hole.
• Bubblewrap: Fixed an intermittent loopback setup failure at sandbox startup.
• Seatbelt: Paths in deniedPaths no longer expose file metadata.
• IsolationSession: Fixed a race in the console Ctrl handler that could signal a closed handle.
• PTY: Fixed PTY deadlocks on macOS and a file-descriptor race on Linux.
• Telemetry: Fixed intermittent consent-store lock failures under concurrent access on Windows.

Changelog

• [ProcessContainer] Report identity-less loopback proxy support by Carlos Alexandro Becker (@caarlos0) in #1406
• [Core] Remove pre-0.9 runtime compatibility code by Gudge (@MGudgin) in #1397
• [Build] Fix Windows test compilation by Branden Bonaby (@bbonaby) in #1433
• [WSLC] Support port mappings for lifecycle containers in the development contract by Soham Das (@SohamDas2021) in #1369
• [Docs] Update the landing README by Jeff Whiteside (@jsidewhite) in #1437
• [Docs] Add OS version support information by Jeff Whiteside (@jsidewhite) in #1438
• [Deps] Update GitHub Actions dependencies by Dependabot (@dependabot)[bot] in #1434
• [ProcessContainer] Fix environment block sort lint by Gudge (@MGudgin) in #1387
• [Tests] Close backend validation coverage gaps by Elliot (@theelliotm) in #1431
• [Seatbelt] Deny metadata reads for denied paths by Elliot (@theelliotm) in #1439
• [Learning Mode] Prefer option-aware trace startup by Richie Gomez (@richiemsft) in #1417
• [Learning Mode] Add COM diagnostics by Jacob Dereje (@jacobdereje-msft) in #1395
• [WSLC] Run lifecycle daemon executions off the worker thread by Soham Das (@SohamDas2021) in #1407
• [WSLC] Run concurrent executions and refuse busy containers by Soham Das (@SohamDas2021) in #1428
• [Learning Mode] Scope verbose diagnostics to Learning Mode events by Jacob Dereje (@jacobdereje-msft) in #1396
• [Bubblewrap] Warn about unmatched resolver mounts by Gudge (@MGudgin) in #1441
• [Bubblewrap] Warn about unmatched working directory mounts by Gudge (@MGudgin) in #1442
• [IsolationSession] Fix test bundle BinSkim failure by Dan Legg (@danlegg) in #1456
• [Learning Mode] Decode WFP network events by Richie Gomez (@richiemsft) in #1418
• [Docs] Add a glossary and simplify terminology by Jeff Whiteside (@jsidewhite) in #1454
• [Bubblewrap] Resolve DNS on hosts with a loopback stub resolver by Soham Das (@SohamDas2021) in #1453
• [Build] Publish only the SPDX 2.2 manifest in the VPack by Dan Legg (@danlegg) in #1472
• [Docs] Add versioned containment policy references by Gudge (@MGudgin) in #1471
• [Telemetry] Fix consent store lock contention by RamonArjona4 in #1474
• [Node] Align V1 conformance tests with the published 1.0 contract by Gudge (@MGudgin) in #1479
• [ProcessContainer] Route captured network decisions through Tessera by Richie Gomez (@richiemsft) in #1419
• [Contract] Reject unknown ProcessContainer UI system settings in the development contract by Gudge (@MGudgin) in #1478
• [Bubblewrap] Stabilize the loopback resolver DNS test by Elliot (@theelliotm) in #1488
• [Build] Migrate release pipelines to 1ES and ESRP by Branden Bonaby (@bbonaby) in #1493
• [PTY] Fix macOS deadlocks and run PTY tests in CI by Elliot (@theelliotm) in #1476
• [Docs] Describe WFP denial capture by Richie Gomez (@richiemsft) in #1420
• [Bubblewrap] Wait for loopback before starting slirp by Carlos Alexandro Becker (@caarlos0) in #1497
• [WSLC] Give the lifecycle daemon its own image store by Soham Das (@SohamDas2021) in #1475
• [Tests] Enforce probe coverage for every backend and isolation tier by Elliot (@theelliotm) in #1491
• [Learning Mode] Update the network provider GUID by Richie Gomez (@richiemsft) in #1509
• [Seatbelt] Remove the spawn-open launch method and update the host probe by Elliot (@theelliotm) in #1511
• [ProcessContainer] Fix host loopback on PSEC 1.0 by Branden Bonaby (@bbonaby) in #1490
• [IsolationSession] Fix a closed-handle race in the Ctrl handler by Dom Giandinoto (@daamenik) in #1504
• [WSLC] Generate session names when containerId is omitted by Soham Das (@SohamDas2021) in #1514
• [SDK] Update package versions to 1.0.1 by Elliot (@theelliotm) in #1518

New Contributors

• Jacob Dereje (@jacobdereje-msft) made their first contribution in #1395

Full Changelog: v1.0.0...v1.0.1