feat: isolate Cloud Hypervisor with per-run VMM identities - #7894
Conversation
lpcox
changed the title
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Cleanup and concurrent allocation paths can leave privileged accounts or device ACLs behind.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review tier: Balanced
Findings: 3
New issues introduced by this change (5)
| Severity | Finding |
|---|---|
 |
src/cloud-hypervisor/vmm-identity.ts — The identity check happens before waiting for the account lock. If two callers invoke allocate()… |
|
src/cloud-hypervisor/vmm-identity.ts — If account validation fails after useradd and userdel/groupdel also fails, this suppresses… |
|
src/cloud-hypervisor/manager-stop.ts — This gates identity cleanup on every prior error, including unrelated failures such as the… |
 |
docs/cloud-hypervisor-foundation.md — The implementation invokes useradd --system --user-group without explicit UID/GID values, so the… |
 |
scripts/ci/cloud-hypervisor-live-smoke.sh — The cancellation smoke check verifies removal only from /dev/kvm, although this change grants and… |
What changed in this PR
Introduces per-run Cloud Hypervisor system accounts to reduce host access and isolate VMM resources.
Changes:
- Adds dedicated VMM identity, ACL, ownership-validation, and locking logic.
- Integrates identity allocation and cleanup into the VMM lifecycle.
- Expands tests, documentation, and live security assertions.
| File | Description |
|---|---|
src/cloud-hypervisor/vmm-identity.ts |
Implements account and ACL lifecycle. |
src/cloud-hypervisor/vmm-identity.test.ts |
Tests identity management. |
src/cloud-hypervisor/preflight.ts |
Requires account and ACL tools. |
src/cloud-hypervisor/preflight.test.ts |
Updates tool assertions. |
src/cloud-hypervisor/manager.ts |
Tracks VMM identity state. |
src/cloud-hypervisor/manager.test.ts |
Tests lifecycle integration. |
src/cloud-hypervisor/manager-types.ts |
Extends manager dependencies. |
src/cloud-hypervisor/manager-stop.ts |
Adds identity cleanup. |
src/cloud-hypervisor/manager-start.ts |
Allocates and validates VMM identity. |
src/cloud-hypervisor/launcher.ts |
Launches with isolated UID/GID. |
src/cloud-hypervisor/launcher.test.ts |
Updates privilege-drop expectations. |
src/cloud-hypervisor-runtime-backend.test.ts |
Updates preflight fixtures. |
scripts/ci/cloud-hypervisor-live-smoke.sh |
Adds live isolation checks. |
docs/cloud-hypervisor-foundation.md |
Documents the identity model. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 93.86% | 93.58% | 📉 -0.28% |
| Statements | 92.67% | 92.31% | 📉 -0.36% |
| Functions | 93.24% | 93.03% | 📉 -0.21% |
| Branches | 86.14% | 85.65% | 📉 -0.49% |
📁 Per-file Coverage Changes (5 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/cloud-hypervisor/manager-stop.ts |
94.6% → 93.8% (-0.77%) | 89.1% → 88.9% (-0.22%) |
src/cloud-hypervisor/manager.ts |
88.9% → 88.4% (-0.49%) | 87.5% → 87.1% (-0.44%) |
src/cloud-hypervisor/launcher.ts |
93.8% → 93.5% (-0.21%) | 92.5% → 92.3% (-0.23%) |
src/cloud-hypervisor/manager-start.ts |
98.2% → 98.5% (+0.29%) | 98.3% → 98.6% (+0.27%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
✨ New Files (1 files)
src/cloud-hypervisor/vmm-identity.ts: 75.5% lines
Coverage comparison generated by scripts/ci/compare-coverage.ts
1d896a3 to
1b1bf12
Compare
|
✅ Copilot review passed with no inline comments. @lpcox Add the |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (6 files)
✨ New Files (1 files)
Coverage comparison generated by |
lpcox
added
the
cloud-hypervisor-kvm
|
🚀 Security Guard has started processing this pull request |
78c1dfb to
e606e29
Compare
lpcox
added
cloud-hypervisor-kvm
|
🚀 Security Guard has started processing this pull request |
lpcox
added
cloud-hypervisor-kvm
|
❌ Security Guard was cancelled. Please review the logs for details.
|
|
📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤
|
|
✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓
|
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "msfeed25.pkgs.visualstudio.com"
- "registry.npmjs.org"See Network Configuration for more information.
|
|
✅ Build Test Suite completed successfully!
|
|
❌ Smoke Gemini reports failed. Facets need polishing...
|
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
✅ Contribution Check completed successfully! Contribution check complete for PR #7894: no issues found against CONTRIBUTING.md. The PR includes tests, documentation updates, a clear description, and files are placed in the expected directories.
|
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅
|
|
✅ Smoke Claude passed Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
❌ Contribution Check failed. Please review the logs for details.
|
|
📡 Smoke OTel Tracing reports failed. OTel tracing regression detected. OTEL smoke test summary: ✅ Scenario 1 (module loading) - otel.js loads, exports startRequestSpan/setTokenAttributes/setBudgetAttributes/endSpan/endSpanError/shutdown/isEnabled. ✅ Scenario 2 (test suite) - otel.test.js + otel-fanout.test.js: 61/61 tests passed. ✅ Scenario 3 (env var forwarding) - GITHUB_AW_OTEL_TRACE_ID/PARENT_SPAN_ID confirmed forwarded in both env-passthrough.ts and api-proxy-env-config.ts. ✅ Scenario 4 (token tracker integration) - onUsage callback confirmed present in token-tracker-http.js as OTEL hook point.
|
|
✅ Smoke Claude passed Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
|
✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓
|
|
❌ Smoke Gemini reports failed. Facets need polishing...
|
|
📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤
|
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "msfeed25.pkgs.visualstudio.com"
- "registry.npmjs.org"See Network Configuration for more information.
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
✅ Build Test Suite completed successfully!
|
|
Smoke Test: Copilot BYOK (Direct) Mode ✅ PASS
Running in direct BYOK mode (
|
Smoke Test: GitHub Actions Services Connectivity
Overall: FAIL —
|
Smoke Test: Claude Engine Validation
Overall result: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
Smoke Test: Copilot Engine
Overall: PASS cc @lpcox
|
|
PRs: #7891 feat: bind Cloud Hypervisor artifacts to attested release manifests; #7893 feat: reserve microVM network resources atomically Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "msfeed25.pkgs.visualstudio.com"
- "registry.npmjs.org"See Network Configuration for more information.
|
|
Smoke Test: Docker Sbx — @lpcox
Overall: PASS
|
|
feat: reserve microVM network resources atomically GitHub MCP Testing: ❌ Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra Overall: FAIL cc @lpcox
|
|
feat: reserve microVM network resources atomically ❌ Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) Overall FAIL
|
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (github.com) reachable: Overall: PASS cc @lpcox Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
Chroot Version Comparison Results
Overall: FAILED — Node.js version mismatch between host and chroot environments.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS Note: Java tests required overriding the Maven local repository path (
|
Summary
SUDO_UID/SUDO_GIDCAP_NET_ADMIN/dev/kvmand/dev/net/tun, and validate ownership of the TAP, staged files, and required sockets before useSecurity rationale
The VMM parses untrusted guest and device input. Reusing the invoking operator identity gave a VMM escape the operator's ambient host filesystem access. A unique system identity limits a compromised VMM to per-run resources, while serialized uid-specific ACL handling avoids cross-run lost updates and refuses to release a uid while a privileged ACL remains. Random account names and PID start-time/inode validation prevent name, PID, and stale-lock reuse from crossing run boundaries.
Validation
npm test -- --runInBand src/cloud-hypervisor src/cloud-hypervisor-runtime-backend.test.ts scripts/ci/cloud-hypervisor-ci-scripts.test.ts scripts/ci/test-cloud-hypervisor-workflow.test.ts(282 tests)npm run type-check -- --pretty falsenpm run build -- --pretty falsebash -n scripts/ci/cloud-hypervisor-live-smoke.shgit diff --check