Do not run privileged LXC containers. by dhoehna · Pull Request #1688 · microsoft/mxc

Darren Hoehna (dhoehna) · 2026-11-05T22:20:45Z

📖 Description

MXC will not run privileged LXC containers. After startup and before applying network rules, MXC reads the container's live UID mappings from the host. MXC stops the container if it cannot verify that container root maps to a nonroot host user. lxc-ls can incorrectly report an unprivileged container when lxc.namespace.keep = user retains the host user namespace.

build_lxc_capability_helper.rs builds a static helper embedded in MXC for network-filtered workloads. Entering the container can restore capabilities dropped on the host. The helper removes CAP_NET_ADMIN and CAP_NET_RAW after entry and before the workload starts. It restricts the requested command without changing the container's configuration or depending on container-provided libraries.

One consequence of this change is the minimum Linux version went up to 3.12. Version 3.12 is the minimum supported version to unprivileged containers.

Gudge (@MGudgin) for FYI on the minimum Linux kernel version change.

🔗 References

N/A

🔍 Validation

Ran the full LXC E2E suite

✅ Checklist

Signed the Contributor License Agreement
Linked to an issue
For features or changes requiring a spec: linked the issue with maintainer-applied feature-accepted
For implementation: linked the required approved and merged design/API spec, or explained why no spec is required
Feature issue remains open unless this PR completes all agreed implementation, validation, and documentation
Updated documentation (if applicable)
Updated Copilot instructions (if build, architecture, or conventions changed)
If this PR changes Cargo.lock, the dependency-feed-check check passes (see pull request builds)

📋 Issue Type

Bug fix
Feature
Task

Microsoft Reviewers: Open in CodeFlow

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

LXC's reported classification replaces MXC-specific ID-map requirements. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Remove the helper-specific tests instead of keeping a helper solely for testing. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Configured status can report an unprivileged container even when it retains the host user namespace. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Use complete command output instead of the bounded helper; inspection now waits for lxc-attach to finish. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

A readable shifted-root range is sufficient; unreadable or nonmatching rows do not veto admission. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

azure-pipelines · 2026-11-05T22:20:55Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Copilot

🟡 Changes recommended

The LXC admission check trusts forgeable guest output, exposes host environment variables, and breaks existing SDK and CI flows without the required unprivileged provisioning and migration support.

5 open issues

Clear the host environment before admission checks · New
Verify the live container UID map from the host · New
Provision UID/GID mappings for V1 SDK compatibility · New
Bound UID-map inspection time and output · New
Assert the admission-specific rejection message · New

What changed in this PR

This PR adds an unprivileged-container admission check to MXC’s LXC backend, intended to reject privileged containers before executing the requested workload.

Changes:

Inspect the live UID mapping after startup and stop containers that fail validation.
Add a regression scenario for misleading LXC privilege metadata and include it in the LXC suite.
Document unprivileged-container requirements and raise the minimum Linux kernel version to 3.12.

File	Description
`tests/scripts/run_lxc_unprivileged_test.sh`	Tests rejection, workload prevention, and cleanup for an identity-mapped container.
`tests/scripts/run_lxc_all_tests.sh`	Adds the admission regression to the LXC suite.
`src/mxc-sdk/src/backends/lxc/common/lxc_bindings.rs`	Adds UID-map validation and routes command execution through validated startup.
`docs/backends/lxc/lxc-backend.md`	Updates prerequisites and describes the admission check.

_{Review effort: Balanced}

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Copilot

🔵 Needs a closer look

The admission check trusts guest-controlled output and can expose host credentials, while the V1 compatibility break lacks the required security-servicing documentation and migration guidance.

5 open issues

1 previously missed issue

In code that hasn't changed since last review

Configure shifted UID/GID mappings in all CI hosts

.github/workflows/lxc-e2e.yml:51

[P1] Scheduled LXC validation (scripts/ci/prepare-linux-host.sh) and Azure SDK integration (.azure-pipelines/templates/SDK.Integration.Test.Job.yml) still install LXC without configuring shifted mappings or root subordinate UID/GID ranges. On clean hosts with default LXC configuration, the new admission check rejects their normal success-path scenarios. Provision the mappings and required mapping tools in those entry points too, preferably through shared host setup with appropriate cleanup.

_{Review effort: Balanced}

The streaming and PTY cases need no host files; sharing /tmp can prevent mapped-container startup on hosts with nested mounts. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Namespace entry restored capabilities dropped on the host, allowing raw-socket traffic through the ICMP allowance. Reading UID mappings on the host avoids trusting guest code during admission. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Soham Das (SohamDas2021) · 2026-11-09T19:22:57Z

+                        self.name
+                    )
+                })?;
+            let root_is_shifted = mapping.lines().any(|line| {


This only requires one uid_map line that shifts root, so it admits g 0 0 65536 (host GID 0) and u 1 0 1 (container UID 1 = host root); on LXC 5.0.3 both let the workload read host root-only files.
Do we need to check gid_map, and refuse any range in either map that covers host ID 0 or any line that doesn't parse?

Soham Das (SohamDas2021) · 2026-11-09T19:24:08Z

        cmd.args(network.to_start_args(self.configured_interface_count()));
-        Self::run_tool(cmd)
+        Self::run_tool(cmd)?;
+        self.validate_unprivileged()


The check runs after lxc-start, so a privileged container's init has already run as host root when it's refused; also, on a nested host, a container sharing MXC's user namespace passes because its map reads like a shifted one.

Shall we refuse a config without lxc.idmap or with lxc.namespace.keep = user before starting and refuse when /proc/<pid>/ns/user equals /proc/self/ns/user?

Soham Das (SohamDas2021) · 2026-11-09T19:25:26Z

        out
    }

+    fn validate_unprivileged(&self) -> Result<(), String> {


Only the identity-map e2e case is tested now: no init PID, an unreadable or malformed map, and a failed lxc-stop?

Please move the map parsing into a pure function with table-driven unit tests, and bring back the fake-tool tests for those failure paths.

Soham Das (SohamDas2021) · 2026-11-09T19:26:03Z

+- Linux kernel >= 3.12.
+- LXC >= 5.0 installed (`liblxc-dev` for building, `lxc-utils` for runtime).
+- A GCC-compatible C11 compiler and target Linux userspace API headers for source builds.
+- Root access to run MXC and to configure LXC.


This contradicts "Running without root" (line 57), and this PR also dropped its chmod o+x ~ step, which is still needed on 0750 Ubuntu homes (run_lxc_rootless_no_network_test.sh:31-32 still does it).
Please say root is needed to configure LXC and filter network traffic and restore the chmod o+x ~ step?

Soham Das (SohamDas2021) · 2026-11-09T19:26:38Z

+            });
+            if !root_is_shifted {
+                return Err(format!(
+                    "Container '{}' has no unprivileged root UID mapping.  MXC will not run the requested command.",


Every root-run host with a stock /etc/lxc/default.conf hits this after upgrading, and nothing tells them to add root ranges to /etc/subuid//etc/subgid, add lxc.idmap, and recreate existing containers.
Please name those steps in the error or link the doc section that lists them?

Soham Das (SohamDas2021) · 2026-11-09T20:15:25Z

+        ++length;
+    }
+    linux_syscall(__NR_write, 2, (long)message, length, 0, 0);
+    linux_syscall(__NR_exit, 126, 0, 0, 0, 0);


Every helper failure exits 126, and MXC returns that as the workload's normal exit code with no error, so "MXC couldn't confine the workload" looks the same as a script that exited 126; before this commit a failed drop was an MXC error.

Soham Das (SohamDas2021) · 2026-11-09T20:16:28Z

+}
+
+__attribute__((noreturn, used))
+void drop_network_capabilities_and_exec(unsigned long* initial_stack)


Nothing runs this helper directly: its failure exits are untested, and the aarch64 syscall path never executes in CI either?
Please add a Linux test that runs the embedded helper in a user namespace (caps dropped on success, exit 126 on bad args or a failed exec); it would also run natively on the arm64 build job.

Retain guest networking capabilities and enforce policy outside the container. Cross-container UDP reply theft remains unresolved. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8d35d189-89d3-400f-aaef-a33c8ce5860c

Copilot

🟡 Changes recommended

Unresolved issues include a V1 networking compatibility break, a cross-container reply isolation bypass, and cleanup that can leave active workloads running without network restrictions.

5 open issues

5 resolved since last review

_{Review effort: Balanced}

+                other => return Err(format!(
+                    "LXC host filtering requires bridge-attached veth interfaces; lxc.net.{index}.type is {other:?}"
+                )),


+    chain ingress {{
+        ether type arp accept
+        ether type != {{ ip, ip6 }} drop
+        ct direction reply ct state established,related accept


+            let result = if active.destroy_on_exit {
+                LxcContainer::new(&name, None).destroy_owned()
+            } else {
+                Ok(())


@@ -36,6 +36,20 @@ jobs:
          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y \
            lxc lxc-templates lxc-utils iptables debootstrap uidmap bridge-utils


+    chain egress {{
+        ether type arp accept
+        ether type != {{ ip, ip6 }} drop
+{egress}    }}


Darren Hoehna (dhoehna) and others added 11 commits November 4, 2026 13:22

Require unprivileged LXC UID and GID mappings

5301d4c

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Check LXC ID mappings directly in the config

401b700

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Use LXC status to require unprivileged containers

3f27f71

LXC's reported classification replaces MXC-specific ID-map requirements. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Read LXC status columns directly

b71e4b7

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Inline LXC unprivileged status validation

87cdb27

Remove the helper-specific tests instead of keeping a helper solely for testing. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Accept mixed-case LXC unprivileged status

007a865

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Add periods to LXC prerequisites

d1eef7d

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Validate live LXC UID mappings before execution

71e7086

Configured status can report an unprivileged container even when it retains the host user namespace. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Simplify live LXC UID-map capture

de1b75a

Use complete command output instead of the bounded helper; inspection now waits for lxc-attach to finish. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Accept positive LXC UID-map matches

fa78781

A readable shifted-root range is sufficient; unreadable or nonmatching rows do not veto admission. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Remove the LXC admission test harness

403e413

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Darren Hoehna (dhoehna) requested a review from a team as a code owner November 5, 2026 22:20

Copilot AI balanced review requested due to automatic review settings November 5, 2026 22:20

Copilot started reviewing on behalf of Darren Hoehna (dhoehna) November 5, 2026 22:21

View session

Copilot AI reviewed Nov 5, 2026

View reviewed changes

Provision unprivileged LXC containers in CI

ff63c4d

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ee956a7c-701c-4e30-ba23-88ed75d298fc

Copilot AI balanced review requested due to automatic review settings November 6, 2026 19:09

Copilot started reviewing on behalf of Darren Hoehna (dhoehna) November 6, 2026 19:09

View session

Copilot AI reviewed Nov 6, 2026

View reviewed changes

Darren Hoehna (dhoehna) and others added 2 commits November 6, 2026 15:09

Soham Das (SohamDas2021) requested changes Nov 9, 2026

View reviewed changes

microsoft-github-policy-service Bot assigned Darren Hoehna (dhoehna) Nov 9, 2026

microsoft-github-policy-service Bot added the Needs-Author-Feedback Waiting for additional information or action from the issue or pull-request author. label Nov 9, 2026

Copilot AI balanced review requested due to automatic review settings November 10, 2026 17:59

Copilot started reviewing on behalf of Darren Hoehna (dhoehna) November 10, 2026 18:00

View session

Copilot AI reviewed Nov 10, 2026

View reviewed changes

		@@ -36,6 +36,20 @@ jobs:
		sudo DEBIAN_FRONTEND=noninteractive apt-get install -y \
		lxc lxc-templates lxc-utils iptables debootstrap uidmap bridge-utils

Conversation

Darren Hoehna (dhoehna) commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📖 Description

🔗 References

🔍 Validation

✅ Checklist

📋 Issue Type

Microsoft Reviewers: Open in CodeFlow

Uh oh!

azure-pipelines Bot commented Nov 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Soham Das (SohamDas2021) Nov 9, 2026

Choose a reason for hiding this comment

Uh oh!

Soham Das (SohamDas2021) Nov 9, 2026

Choose a reason for hiding this comment

Uh oh!

Soham Das (SohamDas2021) Nov 9, 2026

Choose a reason for hiding this comment

Uh oh!

Soham Das (SohamDas2021) Nov 9, 2026

Choose a reason for hiding this comment

Uh oh!

Soham Das (SohamDas2021) Nov 9, 2026

Choose a reason for hiding this comment

Uh oh!

Soham Das (SohamDas2021) Nov 9, 2026

Choose a reason for hiding this comment

Uh oh!

Soham Das (SohamDas2021) Nov 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Darren Hoehna (dhoehna) commented Nov 5, 2026 •

edited

Loading