microsoft / microsoft/mxc

Networking not available with windows sandbox isolation (containment is windows_sandbox)

Open
#793 2 comments 0 reactions 1 assignee Claimed by @huzaifa-d View on GitHub
Area-Executor-Schema Container-VM Issue-Feature OS-Windows
Dominant language
Rust
Stars
1.3k
Forks
79
Avg merge
2d 7h
Merged PRs (30d)
117

Description

### Relevant area(s)

Linux, Windows

### Brief description of your issue

When using sandbox for containment networking doesn't work.

I am trying to run 10_windows_sandbox_network_isolated.json sample.

### Isolations tried

1. using direct ip address - 1.1.1.1 instead of example.com
2. adding network policy to allow `"network": {
"defaultPolicy": "allow"
}`

3. Firewall of the system is disabled. Also when sandbox prompt runs the firewall access for public and private networks both is allowed
4. Tried increasing network timeout in the script to 60 seconds
5. Sandbox feature on the OS is enabled
6. Running wxc-exec.exe with --experimental flag
7. Running with processcontainer containment everything works as expected - when network is blocked, the access is prevented, and when it is enabled the access is allowed
8. `Get-NetAdapter -Name "*Windows Sandbox*"` returns nothing
9. Enable Hyper V feature in the host

### LOGS

```
PS C:\Users\k> C:\mxc-kit\bin\wxc-exec.exe --debug --experimental "C:\Users\k\Downloads\mxc-main\mxc-main\tests\examples\10_windows_sandbox_network_isolated.json"
SECTION: Request simplified
Container ID: CLI-WindowsSandbox-Network-Isolated
Script code length: 90
Working directory:
Script timeout: 30000
Container name: CLI-WindowsSandbox-Network-Isolated
SECTION: Full ExecutionRequest configuration (redacted)
{
"schema_version": "0.6.0-alpha",
"container_id": "CLI-WindowsSandbox-Network-Isolated",
"env": [],
"script_code": "powershell -NoProfile -Command \"Invoke-WebRequest -Uri 'http://example.com' -TimeoutSec 5\"",
"working_directory": "",
"script_timeout": 30000,
"containment": "windowssandbox",
"lifecycle": {
"destroy_on_exit": true,
"preserve_policy": false
},
"policy": {
"least_privilege_mode": false,
"capabilities": [],
"readwrite_paths": [],
"readonly_paths": [],
"denied_paths": [],
"fallback": {
"allow_dacl_mutation": true
},
"default_network_policy": "block",
"network_enforcement_mode": "capabilities",
"allow_local_network": false,
"allowed_hosts": [],
"blocked_hosts": [],
"ui": {
"disable": true,
"clipboard": "none",
"injection": false
},
"base_process_ui": {
"isolation": "container",
"desktopSystemControl": false,
"systemSettings": "none",
"ime": false
}
},
"lxc_config": {
"distribution": "",
"release": ""
},
"seatbelt": null,
"experimental_enabled": true,
"experimental": {
"test": null,
"windows_sandbox": null,
"wslc": null,
"isolation_session": null
},
"dry_run": false
}
[network_proxy: disabled]
Runner completed in 14573ms
Exit code: 1 (0x00000001)
Error: Invoke-WebRequest : The remote name could not be resolved: 'example.com'
At line:1 char:1
+ Invoke-WebRequest -Uri 'http://example.com' -TimeoutSec 5
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:Htt
pWebRequest) [Invoke-WebRequest], WebException
+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShe
ll.Commands.InvokeWebRequestCommand

Invoke-WebRequest : The remote name could not be resolved: 'example.com'
At line:1 char:1
+ Invoke-WebRequest -Uri 'http://example.com' -TimeoutSec 5
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:Htt
pWebRequest) [Invoke-WebRequest], WebException
+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShe
ll.Commands.InvokeWebRequestCommand

{"error":{"code":"backend_error","message":"Invoke-WebRequest : The remote name could not be resolved: 'example.com'\r\nAt line:1 char:1\r\n+ Invoke-WebRequest -Uri 'http://example.com' -TimeoutSec 5\r\n+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:Htt \r\n pWebRequest) [Invoke-WebRequest], WebException\r\n + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShe \r\n ll.Commands.InvokeWebRequestCommand\r\n \r\n"}}
PS C:\Users\k>
```

### Steps to reproduce

1. Download MXC release package
2. enable sandbox feature - `Enable-WindowsOptionalFeature -Online -FeatureName "Containers-DisposableClientVM" -NoRestart`
3. Reboot
4. Run sample '10_windows_sandbox_network_isolated.json'
5. Try with granting allow access in config - `"network": { "defaultPolicy": "allow" }`
6. When containment is changed to `processcontainer` things work as expected

### Expected behavior

1. When network policy is set to allow, networking should work
2. When networking policy is set to block, networking should not work

### Actual behavior

Network connection fails to be established

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.