Networking not available with windows sandbox isolation (containment is windows_sandbox)
- Dominant language
- Rust
- Stars
- 1.3k
- Forks
- 79
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 117
Description
### Relevant area(s)
Linux, Windows
### Brief description of your issue
When using sandbox for containment networking doesn't work.
I am trying to run 10_windows_sandbox_network_isolated.json sample.
### Isolations tried
1. using direct ip address - 1.1.1.1 instead of example.com
2. adding network policy to allow `"network": {
"defaultPolicy": "allow"
}`
3. Firewall of the system is disabled. Also when sandbox prompt runs the firewall access for public and private networks both is allowed
4. Tried increasing network timeout in the script to 60 seconds
5. Sandbox feature on the OS is enabled
6. Running wxc-exec.exe with --experimental flag
7. Running with processcontainer containment everything works as expected - when network is blocked, the access is prevented, and when it is enabled the access is allowed
8. `Get-NetAdapter -Name "*Windows Sandbox*"` returns nothing
9. Enable Hyper V feature in the host
### LOGS
```
PS C:\Users\k> C:\mxc-kit\bin\wxc-exec.exe --debug --experimental "C:\Users\k\Downloads\mxc-main\mxc-main\tests\examples\10_windows_sandbox_network_isolated.json"
SECTION: Request simplified
Container ID: CLI-WindowsSandbox-Network-Isolated
Script code length: 90
Working directory:
Script timeout: 30000
Container name: CLI-WindowsSandbox-Network-Isolated
SECTION: Full ExecutionRequest configuration (redacted)
{
"schema_version": "0.6.0-alpha",
"container_id": "CLI-WindowsSandbox-Network-Isolated",
"env": [],
"script_code": "powershell -NoProfile -Command \"Invoke-WebRequest -Uri 'http://example.com' -TimeoutSec 5\"",
"working_directory": "",
"script_timeout": 30000,
"containment": "windowssandbox",
"lifecycle": {
"destroy_on_exit": true,
"preserve_policy": false
},
"policy": {
"least_privilege_mode": false,
"capabilities": [],
"readwrite_paths": [],
"readonly_paths": [],
"denied_paths": [],
"fallback": {
"allow_dacl_mutation": true
},
"default_network_policy": "block",
"network_enforcement_mode": "capabilities",
"allow_local_network": false,
"allowed_hosts": [],
"blocked_hosts": [],
"ui": {
"disable": true,
"clipboard": "none",
"injection": false
},
"base_process_ui": {
"isolation": "container",
"desktopSystemControl": false,
"systemSettings": "none",
"ime": false
}
},
"lxc_config": {
"distribution": "",
"release": ""
},
"seatbelt": null,
"experimental_enabled": true,
"experimental": {
"test": null,
"windows_sandbox": null,
"wslc": null,
"isolation_session": null
},
"dry_run": false
}
[network_proxy: disabled]
Runner completed in 14573ms
Exit code: 1 (0x00000001)
Error: Invoke-WebRequest : The remote name could not be resolved: 'example.com'
At line:1 char:1
+ Invoke-WebRequest -Uri 'http://example.com' -TimeoutSec 5
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:Htt
pWebRequest) [Invoke-WebRequest], WebException
+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShe
ll.Commands.InvokeWebRequestCommand
Invoke-WebRequest : The remote name could not be resolved: 'example.com'
At line:1 char:1
+ Invoke-WebRequest -Uri 'http://example.com' -TimeoutSec 5
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:Htt
pWebRequest) [Invoke-WebRequest], WebException
+ FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShe
ll.Commands.InvokeWebRequestCommand
{"error":{"code":"backend_error","message":"Invoke-WebRequest : The remote name could not be resolved: 'example.com'\r\nAt line:1 char:1\r\n+ Invoke-WebRequest -Uri 'http://example.com' -TimeoutSec 5\r\n+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:Htt \r\n pWebRequest) [Invoke-WebRequest], WebException\r\n + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShe \r\n ll.Commands.InvokeWebRequestCommand\r\n \r\n"}}
PS C:\Users\k>
```
### Steps to reproduce
1. Download MXC release package
2. enable sandbox feature - `Enable-WindowsOptionalFeature -Online -FeatureName "Containers-DisposableClientVM" -NoRestart`
3. Reboot
4. Run sample '10_windows_sandbox_network_isolated.json'
5. Try with granting allow access in config - `"network": { "defaultPolicy": "allow" }`
6. When containment is changed to `processcontainer` things work as expected
### Expected behavior
1. When network policy is set to allow, networking should work
2. When networking policy is set to block, networking should not work
### Actual behavior
Network connection fails to be established
Contributor guide
Assessment
This issue has not been assessed yet.