Repository navigation
ci: escape suite for firecracker on hosted runners, on every change - #57
Merged
chxmxii merged 1 commit intoOct 23, 2026
Merged
Conversation
…change GitHub's hosted Ubuntu runners expose /dev/kvm, and the firecracker backend needs nothing more than KVM, vsock, podman and crun. escape.yml runs the escape suite there under strict and standard isolation, on every pull request and push to main as well as nightly; each job takes about a minute. Until now the suite ran only on the self-hosted kvm runner, nightly, and that runner has not picked up a job in days. The podman and krun backends need crun built with libkrun, which those runners lack, so security.yml keeps running them on the self-hosted runner. Until chxperiments#56 lands, box up needs krun on PATH whatever the backend, so the job symlinks krun to crun; the step says to remove that once it does.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #31.
GitHub's hosted Ubuntu runners expose
/dev/kvm, and the firecracker backend needs nothing beyond KVM, vsock, podman and crun. This adds.github/workflows/escape.yml, which runssecurity/escape-test.shfor firecracker under strict and standard isolation on every pull request and push tomain, plus nightly and on demand.Why
security.yml, which needs a self-hostedkvmrunner, and none is registered (A self-hosted KVM runner for the nightly escape suite #31). Every nightly Security run queues for 24 h and is cancelled, so the suite has only ever run by hand. Recent changes, including the per-sandbox UID (strict: a UID of its own for every sandbox (#27) #47) and the/datacap (data_size: cap /data, so an agent cannot fill the disk (#10) #54), merged without it in CI.What it does
/dev/kvmusable for the runner user (udev rule), loadsvhost_vsock, and adds a subordinate UID range large enough for strict mode (box doctor's suggestion).box.security/escape-test.sh ./box <isolation> firecracker.It needs no secrets, so PRs from forks run it too.
What it doesn't change
security.ymlstays as it is for the podman and krun backends. They need crun built with libkrun, which stock Ubuntu's crun lacks, so they still need the self-hosted runner #31 asks for. This PR does not close #31: of the backends × isolation matrix there, it covers firecracker × both modes.Only
security.yml's header comment changes. SECURITY.md's "Tests" section now says which backends run where; it previously said the suite "does not run in the hosted CI".The krun symlink
Until #56 lands,
box uprequireskrunon PATH whatever the backend, so the job symlinkskruntocrun. The step's comment says to remove that line once #56 merges, so the job then stands for a firecracker-only host. The same job without the symlink and with #56 applied also found no escapes: https://github.com/KoLDXr00T/bluebox/actions/runs/39483949749Checked on the fork