From a1265586ab85ab9f4b3aa1df16dfe3b9f8161205 Mon Sep 17 00:00:00 2001 From: Pedro Henrique Penna Date: Sat, 26 Sep 2026 21:52:28 -0700 Subject: [PATCH 1/2] docs: document run network policy options Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- doc/usage.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/doc/usage.md b/doc/usage.md index 35c1300f6..0c554139b 100644 --- a/doc/usage.md +++ b/doc/usage.md @@ -298,6 +298,13 @@ python3 scripts/nvx.py run [--mount GUEST_TARGET,HOST_PATH[,ro|rw]] [--net IPV4/PREFIX] [--network-profile {portable}] + [--network-egress {allow,deny}] + [--network-ingress {allow,deny}] + [--network-egress-allow CIDR[:PROTOCOL:PORT]]... + [--network-egress-deny CIDR[:PROTOCOL:PORT]]... + [--host-loopback {allow,deny}] + [--network-proxy IPV4:TCP-PORT] + [--host-loopback-forward PROTOCOL:HOST_PORT:GUEST_PORT]... [--cmdline TEXT] [--restore-snapshot PATH] [--restore-processors {1,2,4,8}] @@ -317,6 +324,13 @@ python3 scripts/nvx.py run | `--mount GUEST_TARGET,HOST_PATH[,ro\|rw]` | none | Expose one host directory to the absolute guest target. Active snapshot restore requires the same canonical path, target, and mode; a dormant-slot restore may attach a new mapping that the resumed guest mounts explicitly. | | `--net IPV4/PREFIX` | none | Enable virtio-net with the static guest IPv4 address and prefix. | | `--network-profile {portable}` | none | Select the required cross-platform network behavior contract; must be specified with `--net`. | +| `--network-egress {allow,deny}` | `allow` | Set the default guest egress policy. | +| `--network-ingress {allow,deny}` | `deny` | Set the default host ingress policy. | +| `--network-egress-allow CIDR[:PROTOCOL:PORT]` | none | Allow matching guest egress; repeat to add rules. | +| `--network-egress-deny CIDR[:PROTOCOL:PORT]` | none | Deny matching guest egress; repeat to add rules. Deny rules take precedence. | +| `--host-loopback {allow,deny}` | existing mapping | Control guest access to host loopback services. | +| `--network-proxy IPV4:TCP-PORT` | none | Allow one explicit host TCP proxy endpoint. | +| `--host-loopback-forward PROTOCOL:HOST_PORT:GUEST_PORT` | none | Publish one TCP or UDP localhost port to the guest; repeat to add forwards. | | `--cmdline TEXT` | empty | Append kernel parameters; `nvx_*` and `tsc=` tokens are reserved. | | `--restore-snapshot PATH` | none | Restore the immutable machine contract and saved state from a snapshot directory. | | `--restore-processors {1,2,4,8}` | none | Bring this contiguous processor prefix online before restore readiness. Requires an opt-in microVM snapshot and cannot exceed `--processors` capacity. | From 4ca1a68b5fb7e6cc7a63b010291eb7d9869a198f Mon Sep 17 00:00:00 2001 From: Pedro Henrique Penna Date: Sun, 27 Sep 2026 08:32:37 -0700 Subject: [PATCH 2/2] Update --network-ingress option description Clarify the behavior of the --network-ingress option in the portable profile. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- doc/usage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/usage.md b/doc/usage.md index 0c554139b..c620ea0bb 100644 --- a/doc/usage.md +++ b/doc/usage.md @@ -325,7 +325,7 @@ python3 scripts/nvx.py run | `--net IPV4/PREFIX` | none | Enable virtio-net with the static guest IPv4 address and prefix. | | `--network-profile {portable}` | none | Select the required cross-platform network behavior contract; must be specified with `--net`. | | `--network-egress {allow,deny}` | `allow` | Set the default guest egress policy. | -| `--network-ingress {allow,deny}` | `deny` | Set the default host ingress policy. | +| `--network-ingress {allow,deny}` | `deny` | Set the default host ingress policy. The portable profile currently supports only `deny`; `allow` is rejected before launch. | | `--network-egress-allow CIDR[:PROTOCOL:PORT]` | none | Allow matching guest egress; repeat to add rules. | | `--network-egress-deny CIDR[:PROTOCOL:PORT]` | none | Deny matching guest egress; repeat to add rules. Deny rules take precedence. | | `--host-loopback {allow,deny}` | existing mapping | Control guest access to host loopback services. |