Skip to content

README.md

Latest commit

 

History

History
209 lines (159 loc) · 10.3 KB

README.md

File metadata and controls

209 lines (159 loc) · 10.3 KB
Raw

Test Scripts

Audience: MXC developers

This directory contains convenience scripts for running MXC end-to-end tests locally and in CI. The primary Rust executor E2E path is cargo test -p wxc_e2e_tests, which invokes the MXC binaries directly instead of shelling through these scripts.

Arguments and build-profile defaults vary by suite. Use the script's help or header comment for its supported parameters.

Prerequisites

Shared:

  • Rust toolchain installed (rustup, cargo)
  • Built binaries (cargo build from src/)

Windows (.ps1):

  • Windows 11
  • PowerShell 7+ (pwsh)

Linux / macOS (.sh):

  • Bash, plus the per-backend prerequisites listed in the backend's doc (for example bwrap for Bubblewrap, the LXC stack for LXC)

Scripts

Script Description Extra prerequisites
run_basicprocess_test.ps1 Basic process container test wxc-exec.exe
run_lpacac_test.ps1 LPAC container test wxc-exec.exe
run_pwsh_test.ps1 PowerShell Set-Location test wxc-exec.exe
run_filesystem_bfs_test.ps1 BFS filesystem test wxc-exec.exe
run_filesystem_bfsreadonly_test.ps1 BFS read-only filesystem test wxc-exec.exe
run_filesystem_bfs_spaces_test.ps1 BFS path-with-spaces test wxc-exec.exe
run_test_configs.ps1 All test configs via wxc-test-driver wxc-test-driver.exe
run_examples.ps1 All examples via wxc-test-driver wxc-test-driver.exe
run_microvm_basic_test.ps1 MicroVM smoke test wxc-exec.exe, NanVix binaries
run_microvm_tests.ps1 Full MicroVM E2E suite WHP enabled, NanVix binaries
run_windows_sandbox_one_shot_tests.ps1 Windows Sandbox one-shot E2E suite (fresh disposable VM per test) Windows Sandbox enabled
run_windows_sandbox_state_aware_tests.ps1 Windows Sandbox state-aware lifecycle E2E (single VM held across provision/start/exec*/stop/deprovision) Windows Sandbox enabled
run_isolation_session_tests.ps1 IsolationSession one-shot E2E suite Interactive local session; OS-side IsolationSession service
run_isolation_session_state_aware_tests.ps1 IsolationSession provision/start/exec/stop/deprovision E2E suite Interactive local session; OS-side IsolationSession service
run_wslc_all_tests.ps1 All WSLC one-shot and state-aware E2E tests WSL2, WSLC SDK, staged daemon, and registry access for the image preflight (-SkipSetup skips it and needs an already-warm cache, because the state-aware fixtures deny egress)
run_processcontainer_all_tests.ps1 Process container (AppContainer / BaseContainer) primitives suite — tier probes, rw/ro/denied matrix, enumeration-only grants, UI mitigations, DACL restore, crash recovery, directional networking. Dispatches to the per-area run_processcontainer_*_test.ps1 scripts wxc-exec.exe, wxc-ui-probe.exe, plm.exe and winhttp-proxy-shim.exe beside wxc-exec.exe
T3-Workloads.ps1 Real workloads (pwsh, git, node, python, cmd) on top of the T3 primitives. A missing interpreter is reported as a skip, not a failure wxc-exec.exe; pwsh / git / node / python each optional, gating their own cases
run_telemetry_consent_smoke_test.ps1 Consent maintenance, presentation, policy, and exit-code smoke tests Debug wxc-exec.exe built with test-support
run_telemetry_etw_smoke_test.ps1 Isolated consent flow plus public-provider ETW capture Debug wxc-exec.exe built with test-support; ETW tooling; Administrator, otherwise the test skips
run_telemetry_consent_release_test.ps1 Consent path in a release executor, where the debug store/policy overrides are compiled out. Mutates the real consent store and HKLM policy, so it requires -AcceptRealMachineMutation and an ephemeral machine Release wxc-exec.exe; Administrator for the HKLM policy section, otherwise that section skips unless -RequirePolicyCeiling is passed
run_on_repeat.ps1 Stress test (loops core tests) wxc-exec.exe

Each run_processcontainer_<area>_test.ps1 also runs standalone against a built tree, which is the fastest way to iterate on one area:

tests\scripts\run_processcontainer_network_proxy_test.ps1 -RequireTier base-container

When the host probe reports baseContainerSupportsIdentitylessLoopbackProxy, the proxy area requires workload launch and a successful proxied fetch on both PSEC 1.0-only hosts and hosts with PSEC 1.1 ingress support. A clean policy rejection is a failure on these hosts. Older binaries that omit this probe fact do not enable the capability-specific assertions; the existing proxy assertions still apply.

Shared helpers live in tests/scripts/lib/WinProcessContainer.Common.ps1. It must be dot-sourced, not imported as a module — Initialize-WpcContext publishes the suite context into the calling script's scope, which only works because dot-sourcing merges scopes.

T2 (appcontainer-bfs) is out of scope: it is off by default behind the tier2_bfs Cargo feature and is not in use, so the suite records no assertions about it. The remaining bfscfg checks are guards, not coverage — invoking bfscfg.exe hard-locks the bfs.sys minifilter on 25H2, so a run that detects one raises MXC-FATAL and stops the whole suite (child exit code 78).

Unix suites

Script Description Extra prerequisites
run_bwrap_all_tests.sh All Bubblewrap tests lxc-exec, bwrap
run_lxc_all_tests.sh All LXC tests lxc-exec, LXC stack, root
run_seatbelt_all_tests.sh All Seatbelt tests; missing prerequisites are failures rather than skips macOS, mxc-exec-mac, unprivileged user, backend prerequisites

Individual run_bwrap_*.sh, run_lxc_*.sh, and run_seatbelt_*.sh scripts run focused backend suites.

Manual smoke tests

Manual smokes are visual-inspection scripts for rendering and event-propagation behavior that has no automated pass/fail oracle. They must run on a real cmd.exe console on the test host (not via PowerShell, not via PSSession), and the operator observes the output to confirm healthy behavior.

Script Description Prerequisites
run_isolation_session_resize_smoke.ps1 Ruler-line loop inside an isolation session; resize the window and verify cols= / rows= track the resize and the trailing ` ` stays at the actual right edge. Ctrl-C to exit.

Invoke from cmd.exe:

powershell -ExecutionPolicy Bypass -File tests\scripts\run_isolation_session_resize_smoke.ps1

Deployment helpers

These scripts copy build artifacts onto a remote test VM. The TShell-based scripts must be sourced from inside an active TShell session (Open-Device -vm <vm>); the PowerShell Remoting script handles the session itself and takes a -ComputerName / -VMName plus -Credential.

Script Copies Transport
push_exes_to_vm.ps1 Native Rust binaries (Debug + Release) TShell (active Open-Device session)
push_batch_and_config_files_to_vm.ps1 tests\configs\, examples\, runner batch files, helper scripts TShell (active Open-Device session)
push_sdk_integration_tests_to_vm.ps1 SDK integration test artifacts (sdk\bin\x64, compiled tests, node_modules, package.json, run-tests.js) PowerShell Remoting (-ComputerName/-VMName + -Credential)

Test ownership

Use npm for SDK tests and Cargo for Rust executor tests. Avoid routing npm tests through Cargo.

cd sdk\node
npm test                    # SDK unit tests
npm run test:integration    # SDK integration tests
cd src
cargo test --workspace       # Rust unit tests

Unix PTY SDK integration tests

The caller-controlled PTY contract is directly runnable on a matching host:

# Linux with Bubblewrap installed
cd src
cargo test -p mxc-sdk --test streaming_bubblewrap bubblewrap_pty -- --nocapture

# Linux with LXC installed; run as root
sudo --preserve-env=PATH,HOME "$(command -v cargo)" \
  test -p mxc-sdk --test streaming_lxc lxc_pty -- --nocapture

# macOS
cd src
cargo test -p mxc-sdk --test streaming seatbelt_pty -- --nocapture

The local Bubblewrap and LXC tests report a prerequisite skip when their backend is unavailable. Provisioned CI hosts run the same tests in backend-specific lanes; strict mode turns a missing prerequisite into a failure.

Running executor E2E via Cargo

The wxc_e2e_tests crate runs executor E2E tests directly against wxc-exec.exe and wxc-test-driver.exe:

cd src
cargo test -p wxc_e2e_tests              # Executor E2E tests (skips if prereqs missing)
cargo test -p wxc_e2e_tests -- --ignored # Include BFS, networking, and stress tests

Ignored tests

The following tests are marked #[ignore] because they require velocity key 61714527 (BFS deadlock fix) enabled on the machine. AppContainer process isolation with brokered filesystem or networking depends on this fix. Run them explicitly on capable machines with cargo test -p wxc_e2e_tests -- --ignored:

Test Reason
test_appcontainer_basic Requires velocity key 61714527 (BFS deadlock fix)
test_appcontainer_lpac Requires velocity key 61714527 (BFS deadlock fix)
test_filesystem_bfs Requires velocity key 61714527 (BFS deadlock fix)
test_filesystem_bfs_readonly Requires velocity key 61714527 (BFS deadlock fix)
test_filesystem_bfs_spaces Requires velocity key 61714527 (BFS deadlock fix)
test_pwsh_setlocation Requires velocity key 61714527 (BFS deadlock fix)
test_tests\configs Requires velocity key 61714527 (BFS deadlock fix)
test_examples Requires velocity key 61714527 (BFS deadlock fix)
test_processcontainer_proxy Requires velocity key 61714527 (BFS deadlock fix) and elevation
test_on_repeat Stress test (loops BFS tests)

MicroVM E2E

Build

cd src
cargo build --features microvm --target x86_64-pc-windows-msvc

Run

cd src
cargo test -p wxc_e2e_tests --target x86_64-pc-windows-msvc test_microvm_suite -- --nocapture

The MicroVM suite runs 6 functional tests + 1 timeout behavior test. It generates microvm-perf-results.json with per-test timing and status data (uploaded as CI artifact).