feat: migrate gVisor smoke tests to strict security mode (no sudo, network-isolation)#6195
Closed
lpcox wants to merge 1 commit into
Closed
feat: migrate gVisor smoke tests to strict security mode (no sudo, network-isolation)#6195lpcox wants to merge 1 commit into
lpcox wants to merge 1 commit into
Conversation
Contributor
|
🚀 Security Guard has started processing this pull request |
Contributor
|
🦎 Smoke gVisor reports failed. gVisor compatibility issue detected. |
Contributor
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
Switch all 4 gVisor smoke test workflows from the legacy iptables-based configuration (sudo + --enable-host-access) to the network-isolation topology mode (no sudo, no iptables, Docker network enforcement): AWF invocation: - Remove sudo - Replace --enable-host-access --allow-host-ports 80,443,8080 with --network-isolation --topology-attach awmg-mcpg MCP Gateway launch: - Switch from --network host to --network bridge with published port - Set MCP_GATEWAY_DOMAIN to 'awmg-mcpg' (container name on awf-net) - Use --add-host host.docker.internal:host-gateway (bridge standard) These changes match the pattern already used by network-isolation-test.lock.yml. The gVisor static DNS workaround (runtimeNeedsStaticDns → patchComposeWithTopologyHosts) handles hostname resolution for topology peers on gVisor's isolated netstack. Validates gVisor compatibility with the proposed --security-mode strict bundle from #6193. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
lpcox
force-pushed
the
gvisor-strict-mode-compat
branch
from
July 13, 2026 18:00
294679b to
e934d1e
Compare
Contributor
|
🚀 Security Guard has started processing this pull request |
Contributor
|
🦎 Smoke gVisor completed. gVisor smoke test passed. ✅ |
Contributor
|
🦎 gVisor runtime: unconfirmed (runc detected — non-blocking) Overall: PASS Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"
- "example.com"See Network Configuration for more information.
|
This was referenced Jul 13, 2026
This was referenced Jul 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates all 4 gVisor smoke test workflows from the legacy iptables-based configuration to the network-isolation topology mode, validating gVisor compatibility with the proposed
--security-mode strictbundle (#6193).Changes per workflow
sudo -E awfawf(no sudo)--enable-host-access --allow-host-ports 80,443,8080--network-isolation --topology-attach awmg-mcpg --topology-attach awmg-cli-proxyinternal: true)What stays the same
enabled: trueinawf-config.json— credential isolation unchangedrunscOCI runtimeWhy this should work
gVisor's DNS incompatibility with Docker's embedded DNS (
127.0.0.11) is already handled:runtimeNeedsStaticDns()returnstruefor gVisorcli-workflow.tsinjects/etc/hostsentries for topology peers and compose-internal services viapatchComposeWithTopologyHosts()Affected workflows
smoke-gvisor.lock.ymlsmoke-gvisor-claude.lock.ymlsmoke-gvisor-codex.lock.ymlsmoke-gvisor-build-test.lock.ymlTesting
This PR itself is the test — if the gVisor smoke tests pass in CI with these changes, gVisor is confirmed compatible with strict mode.
Relates to #6193