test(runtime): cover MicroSandbox TCP egress parity

[skevetter]

Add four shared MicroSandbox egress scenarios: default public TCP access and explicit denial for both the built-in driver and published external provider v0.1.7. Each repeats after stop/start and recreation while checking active network policy, creation time and boot identity.

A test-owned Linux dummy interface hosts the controlled destination. Successful host and default-policy VM probes bracket each denied request. Denial requires a healthy SSH session, an available client, explicit connection refusal/reset and zero matching endpoint receipts; a timeout or broken endpoint cannot satisfy the assertion. Interface, listener, workspaces and providers have independent cleanup. CI requires Linux/KVM and fixture privileges; the change adds no production networking behavior.

Local validation: focused uncached race tests, vet, strict lint and module verification passed. The dry run selects four cases only. All 13 repository hooks passed. Fresh full committed local CodeRabbit review completed with zero findings across all three PR files. Current-head implementation CI passed all 78 jobs. Full logs confirm all 46 selected MicroSandbox scenarios passed, including all four new TCP egress cases with the actual built-in and published external drivers. Fresh Greptile completed on this head with confidence 5/5 and no actionable findings. A full remote CodeRabbit review has been requested and remains pending.

This slice covers TCP egress to a controlled destination. UDP, DNS, TLS, ingress, live policy changes and later driver migration are outside its claims. Existing invalid-recreation preservation remains a separate pre-cutover correctness gate.

Summary by CodeRabbit

• Tests
  • Added end-to-end coverage for MicroSandbox egress policies across both providers, checking public TCP access and explicit denial when workspaces are created, restarted, and recreated.
  • Added the scenario to CI, with required environment checks and a defined test timeout.
• Documentation
  • Documented the scenario’s prerequisites and clarified which network behaviors it covers—and does not cover.

[netlify]

✅ Deploy Preview for devsydev ready!

Name	Link
🔨 Latest commit	1b3e1c1
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6acb897e41956e0008ae5948
😎 Deploy Preview	https://deploy-preview-1461--devsydev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 09bc8947-8725-4d6a-93a5-9b864e2ef930

---

---

---

📥 Commits

Reviewing files that changed from the base of the PR and between 2a72a4c and 1b3e1c1.

---

---

---

📒 Files selected for processing (3)

• .github/workflows/pr-ci.yml
• e2e/tests/up/provider_microsandbox_egress.go
• sites/docs-devsy-sh/content/docs/developing-providers/runtime-protocol.mdx

---

---

---

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

---

---

---

---

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

Walkthrough

Adds MicroSandbox egress tests for builtin and external providers. The tests check public TCP access and explicit egress denial at workspace creation, after stop/start, and after recreation. CI runs the scenario, and the provider runtime protocol documentation describes its scope and requirements.

Changes

MicroSandbox egress E2E

Layer / File(s)	Summary
Egress test fixture e2e/tests/up/provider_microsandbox_egress.go	Adds a controlled HTTP endpoint, host networking setup, receipt checks, and host and guest probes for allowed and blocked egress.
Provider policy and lifecycle checks e2e/tests/up/provider_microsandbox_egress.go	Tests builtin and external providers with default access and explicit denial. Checks policy and connectivity at creation, after stop/start, and after recreation, including workspace creation time and storage boot ID.
CI and scenario documentation .github/workflows/pr-ci.yml, sites/docs-devsy-sh/content/docs/developing-providers/runtime-protocol.mdx	Adds the scenario to the CI matrix and documents its prerequisites and coverage limits.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Other

---

---

---

---

Merge Risk: ⚪ Minimal · up to 1b3e1

No actionable merge-blocking risk is established for this test and documentation change.

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 1 files. (2 skipped: 2…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: adding runtime tests for MicroSandbox TCP egress parity.

---

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 1 files. (2 skipped: 2 unsupported.)

---

• Fix all pre-merge checks with AI

✨ Finishing Touches

✨ Simplify code

• Commit to this branch
• Create a new PR

---

---

---

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	1b3e1c1
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6acb897e817d3600075721bb

[skevetter]

@greptileai review

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issue was found.

Summary

Adds four shared TCP-egress cases for the built-in MicroSandbox driver and external provider.

• MicroSandbox tests check public TCP access and egress denial across VM lifecycles.

No actionable issues were found. Actual VM behavior was not run during this review.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Create controlled TCP endpoint] --> B[Create target VM]
  B --> C[Check active policy and VM identity]
  C --> D[Successful host probe]
  D --> E{Egress blocked?}
  E -->|No| F[Target request succeeds]
  E -->|Yes| G[Control VM request succeeds]
  G --> H[Target reports refusal or reset]
  H --> I[Control VM request succeeds again]
  I --> J[Confirm zero target receipts]
  F --> K[Successful host probe]
  J --> K
  K --> L[Repeat after stop/start and recreation]

Loading

_{Reviews (1) · Last reviewed commit: "test(runtime): cover MicroSandbox TCP eg..." · Reviewed by Greptile}

[skevetter]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[skevetter]

Reviewed the complete full CodeRabbit run 09bc8947 on 1b3e1c1, including merge-risk assessment. No actionable findings or review threads remain. The generic docstring-percentage warning concerns private E2E fixture helpers; existing descriptive names and comments explain the non-obvious network ownership and denial invariants. Adding comments that repeat every helper name would not improve these tests, so no code change is warranted. All 78 implementation CI jobs and all 46 actual MicroSandbox scenarios passed on this head; Greptile confidence is 5/5.