NVX Phase 1: Minimal Signed MicroVM integration

.azure-pipelines/templates/Rust.Build.Job.yml

@@ -210,6 +210,18 @@ jobs:
           contents: wslcsdk.dll
           targetFolder: $(outputDirectory)/$(targetTriple)
 
+      # The NVX release is already signed and hash-pinned; copy it without re-signing.
+      - pwsh: |
+          $ErrorActionPreference = 'Stop'
+          $bundle = Join-Path '$(targetTripleDir)' 'aci-edge-sandboxes'
+          if (-not (Test-Path -LiteralPath (Join-Path $bundle 'SOURCE-MANIFEST.json') -PathType Leaf)) {
+              throw "The Windows x64 build is missing the signed NVX bundle: $bundle"
+          }
+          $artifact = Join-Path '$(outputDirectory)' '$(targetTriple)'
+          Copy-Item -LiteralPath $bundle -Destination $artifact -Recurse
+        displayName: Copy signed NVX runtime bundle
+        condition: and(succeeded(), eq('${{ item.os }}', 'windows'), eq('${{ item.arch }}', 'x64'))
+
       # Copy symbol files into a sibling `symbols/` subdir, NOT alongside the
       # binaries. Workaround for BinSkim BA2007: when the pdb is co-located,
       # BinSkim reads its S_COMPILE3 records and flags `-wd4146` in the

.github/workflows/Build.Windows.Job.yml

@@ -91,6 +91,38 @@ jobs:
              --no-default-features
              --features "${{ matrix.features }}"
 
+      - name: Test NVX host-only executor matrix
+        if: matrix.target == 'x86_64-pc-windows-msvc'
+        run: cargo test --locked --release --target ${{ matrix.target }}
+             -p mxc-sdk --no-default-features --features microvm
+             --test nvx_e2e windows_x64::host_only_executor_request_matrix
+             -- --ignored --exact
+
+      - name: Test MicroVM validation infrastructure
+        if: matrix.target == 'x86_64-pc-windows-msvc'
+        working-directory: ${{ github.workspace }}
+        run: node --test scripts/tests/microvm-validation.test.js
+
+      - name: Verify packaged MicroVM tests
+        if: matrix.target == 'x86_64-pc-windows-msvc'
+        working-directory: ${{ github.workspace }}
+        shell: pwsh
+        env:
+          ACI_EDGE_SANDBOXES_AGENT_BUNDLE_DIR: ${{ github.workspace }}\src\target\${{ matrix.target }}\release\aci-edge-sandboxes
+        run: |
+          & ./scripts/ci/Invoke-CratePackage.ps1 `
+            -OutDir (Join-Path $env:RUNNER_TEMP 'microvm-crate') `
+            -VerifyMicrovmTests
+
+      - name: Stage SDK MicroVM tests for scheduled validation
+        if: matrix.target == 'x86_64-pc-windows-msvc'
+        working-directory: ${{ github.workspace }}
+        shell: pwsh
+        run: |
+          & ./scripts/ci/stage-nvx-validation-tests.ps1 `
+            -BinaryDirectory 'src/target/${{ matrix.target }}/release' `
+            -Features '${{ matrix.features }}'
+
       - name: Build debug executor for isolated telemetry smoke tests
         run: cargo build --locked -p wxc --features test-support
 
@@ -130,5 +162,7 @@ jobs:
             src/target/${{ matrix.target }}/release/wslcsdk.dll
             src/target/${{ matrix.target }}/release/wxc-ui-probe.exe
             src/target/${{ matrix.target }}/release/wxc-test-driver.exe
+            src/target/${{ matrix.target }}/release/nvx-e2e-tests.exe
+            src/target/${{ matrix.target }}/release/aci-edge-sandboxes/
           if-no-files-found: error
           retention-days: 1

.github/workflows/Versioning.Checks.Job.yml

@@ -79,6 +79,10 @@ jobs:
         shell: pwsh
         run: ./scripts/ci/Invoke-CratePackage.ps1 -ValidateOnly
 
+      - name: Smoke-test mxc-sdk crate packaging
+        shell: pwsh
+        run: ./scripts/ci/Invoke-CratePackage.ps1 -OutDir (Join-Path $env:RUNNER_TEMP 'crates')
+
       - name: Check dotnet ErrorCode parity (C# enum == native MXC_STATUS_*)
         run: node scripts/check-dotnet-errorcode-parity.js
 

README.md

@@ -12,7 +12,8 @@ behind a unified containment model and typed SDKs.
 - **JSON-based configuration**: Versioned container-creation requests and
   security policies
 - **Multiple containment backends**: ProcessContainer, Windows Sandbox, LXC,
-  Bubblewrap, Seatbelt, MicroVM (Nanvix), Hyperlight, IsolationSession, and WSLC
+  Bubblewrap, Seatbelt, MicroVM (NVX on Windows x64), Hyperlight,
+  IsolationSession, and WSLC
 - **Policy-driven sandboxing**:
   - **Filesystem policy**: Read-only, read-write, and denied path lists
   - **Network policy**: Proxy support, outbound controls, and backend-dependent
@@ -52,10 +53,10 @@ Linux, and macOS.
 | Runtime platform | Default backend | Other backends | Minimum host OS |
 |---|---|---|---|
 | Windows 11 x64 / ARM64 | `processcontainer` | `windows_sandbox`\*, `wslc`, `microvm`\*, `hyperlight`\*, `isolation_session` | [Windows OS-version support](docs/backends/process-container/os-version-support.md)|
-| Linux x64 / ARM64 | `bubblewrap` | `lxc`, `microvm`, `hyperlight` | - |
+| Linux x64 / ARM64 | `bubblewrap` | `lxc`, `hyperlight` | - |
 | macOS ARM64 / x64 | `seatbelt` | - | - |
 
-\* These backends are **experimental**.
+\* These backends are **experimental**. MicroVM is currently available on Windows x64 only.
 
 ## How do I use MXC?
 

build.bat

@@ -5,7 +5,7 @@ setlocal enabledelayedexpansion
 set "BUILD_CONFIG=release"
 set "BUILD_ARCH="
 set "BUILD_ALL=0"
-set "WITH_NANVIX=0"
+set "WITH_MICROVM=0"
 set "WITH_WSLC=0"
 set "WITH_ISOLATION_SESSION=0"
 set "WITH_HYPERLIGHT=0"
@@ -18,7 +18,7 @@ if /i "%~1"=="--release" ( set "BUILD_CONFIG=release"  & shift & goto :parse_arg
 if /i "%~1"=="--x64"     ( set "BUILD_ARCH=x86_64-pc-windows-msvc"   & shift & goto :parse_args )
 if /i "%~1"=="--arm64"   ( set "BUILD_ARCH=aarch64-pc-windows-msvc"  & shift & goto :parse_args )
 if /i "%~1"=="--all"     ( set "BUILD_ALL=1"           & shift & goto :parse_args )
-if /i "%~1"=="--with-microvm" ( set "WITH_NANVIX=1"    & shift & goto :parse_args )
+if /i "%~1"=="--with-microvm" ( set "WITH_MICROVM=1"    & shift & goto :parse_args )
 if /i "%~1"=="--with-wslc"    ( set "WITH_WSLC=1"      & shift & goto :parse_args )
 if /i "%~1"=="--with-isolation-session" ( set "WITH_ISOLATION_SESSION=1" & shift & goto :parse_args )
 if /i "%~1"=="--with-hyperlight" ( set "WITH_HYPERLIGHT=1" & shift & goto :parse_args )
@@ -40,7 +40,7 @@ if "%BUILD_ALL%"=="0" if "%BUILD_ARCH%"=="" (
 :: Build flags
 set "CARGO_FLAGS=--target"
 if "%BUILD_CONFIG%"=="release" set "CARGO_FLAGS=--release --target"
-if "%WITH_NANVIX%"=="1" set "CARGO_FLAGS=--features microvm %CARGO_FLAGS%"
+if "%WITH_MICROVM%"=="1" set "CARGO_FLAGS=--features microvm %CARGO_FLAGS%"
 if "%WITH_WSLC%"=="1" set "CARGO_FLAGS=--features wslc %CARGO_FLAGS%"
 if "%WITH_ISOLATION_SESSION%"=="1" set "CARGO_FLAGS=--features isolation_session %CARGO_FLAGS%"
 if "%WITH_HYPERLIGHT%"=="1" set "CARGO_FLAGS=--features hyperlight %CARGO_FLAGS%"
@@ -113,25 +113,15 @@ for %%T in (x86_64-pc-windows-msvc aarch64-pc-windows-msvc) do (
             copy /Y "!BIN_DIR!\mxc_ffi.dll" "sdk\node\bin\!SDK_ARCH!\" >nul
             echo   Copied !SDK_ARCH!\mxc_ffi.dll
         )
-        if "%WITH_NANVIX%"=="1" (
-            for %%B in (nanvixd.exe nanvix_rootfs.img python3.initrd) do (
-                if exist "!BIN_DIR!\%%B" (
-                    copy /Y "!BIN_DIR!\%%B" "sdk\node\bin\!SDK_ARCH!\" >nul
-                    echo   Copied !SDK_ARCH!\%%B
-                )
-            )
-            if exist "!BIN_DIR!\bin\kernel.elf" (
-                if not exist "sdk\node\bin\!SDK_ARCH!\bin" mkdir "sdk\node\bin\!SDK_ARCH!\bin"
-                copy /Y "!BIN_DIR!\bin\kernel.elf" "sdk\node\bin\!SDK_ARCH!\bin\" >nul
-                echo   Copied !SDK_ARCH!\bin\kernel.elf
-            )
-            for %%S in (kernel.vmem kernel.whp.cbor) do (
-                if exist "!BIN_DIR!\snapshots\%%S" (
-                    if not exist "sdk\node\bin\!SDK_ARCH!\snapshots" mkdir "sdk\node\bin\!SDK_ARCH!\snapshots"
-                    copy /Y "!BIN_DIR!\snapshots\%%S" "sdk\node\bin\!SDK_ARCH!\snapshots\" >nul
-                    echo   Copied !SDK_ARCH!\snapshots\%%S
-                )
+        if "%WITH_MICROVM%"=="1" if /i "!SDK_ARCH!"=="x64" (
+            if not exist "!BIN_DIR!\aci-edge-sandboxes\bundle-manifest.json" (
+                echo ERROR: MicroVM build is missing the signed agent bundle
+                exit /b 1
             )
+            if exist "sdk\node\bin\!SDK_ARCH!\aci-edge-sandboxes" rmdir /S /Q "sdk\node\bin\!SDK_ARCH!\aci-edge-sandboxes"
+            xcopy /E /I /Y "!BIN_DIR!\aci-edge-sandboxes" "sdk\node\bin\!SDK_ARCH!\aci-edge-sandboxes" >nul
+            if errorlevel 1 exit /b 1
+            echo   Copied !SDK_ARCH!\aci-edge-sandboxes signed agent runtime
         )
         if "!COPY_WSLC_RUNTIME!"=="1" (
             if "%WITH_WSLC%"=="1" (
@@ -288,7 +278,7 @@ echo   --release   Build release configuration
 echo   --x64       Build for x64 only
 echo   --arm64     Build for ARM64 only
 echo   --all             Build both Windows architectures and create the .NET NuGet package
-echo   --with-microvm    Download and include NanVix micro-VM binaries
+echo   --with-microvm    Enable signed bundled NVX MicroVM support (x64)
 echo   --with-wslc       Build with WSL Container (WSLC SDK) support
 echo   --with-isolation-session   Build with IsolationSession backend (IsoEnvBroker)
 echo   --with-hyperlight         Build with Hyperlight (micro-VM) backend (x86_64 only)

build.sh

@@ -13,7 +13,6 @@ BUILD_TYPE="release"
 BUILD_SDK=true
 
 WITH_HYPERLIGHT=false
-WITH_MICROVM=false
 
 while [[ $# -gt 0 ]]; do
     case $1 in
@@ -30,8 +29,8 @@ while [[ $# -gt 0 ]]; do
             shift
             ;;
         --with-microvm)
-            WITH_MICROVM=true
-            shift
+            echo "error: --with-microvm is currently supported only by build.bat on Windows x64" >&2
+            exit 1
             ;;
         --help|-h)
             echo "Usage: build.sh [OPTIONS]"
@@ -40,7 +39,6 @@ while [[ $# -gt 0 ]]; do
             echo "  --debug             Build in debug mode (default: release)"
             echo "  --rust-only         Only build Rust binaries, skip SDK"
             echo "  --with-hyperlight   Build with Hyperlight (micro-VM) backend (x86_64 only)"
-            echo "  --with-microvm      Build with NanVix MicroVM backend (KVM required at runtime)"
             echo "  -h, --help          Show this help message"
             exit 0
             ;;
@@ -79,9 +77,6 @@ FEATURES_LIST=()
 if [ "$WITH_HYPERLIGHT" = true ]; then
     FEATURES_LIST+=(hyperlight)
 fi
-if [ "$WITH_MICROVM" = true ]; then
-    FEATURES_LIST+=(microvm)
-fi
 if [ ${#FEATURES_LIST[@]} -gt 0 ]; then
     CARGO_FEATURES=(--features "$(IFS=,; echo "${FEATURES_LIST[*]}")")
 fi