fix(microsandbox): synchronize workspace permissions by skevetter · Pull Request #1240 · devsy-org/devsy

skevetter · 2026-09-19T00:06:14Z

Summary

propagate the resolved devcontainer containerUser to msb run --user
apply explicit workspace stat-virt and host-perms policies while preserving additional bind-mount defaults
add provider options, validation, runtime version gating, tests, E2E coverage, and documentation

Validation

coderabbit review --uncommitted --agent — clean, zero findings
go test ./pkg/driver/microsandbox ./pkg/options ./pkg/provider
go test ./e2e/tests/up -run '^$'
targeted golangci-lint for the MicroSandbox package
provider YAML parse and git diff --check

The live MicroSandbox E2E requires the installed runtime and Apple Silicon/macOS integration environment; it was not run in this pass.

Summary by CodeRabbit

New Features
- Added configurable workspace permission mirroring and metadata virtualization for MicroSandbox workspaces.
- Added support for propagating the configured container user and workspace mount policies.
- Added runtime version validation, requiring MicroSandbox v0.6.15 or newer.
Bug Fixes
- Improved synchronization of file ownership and permissions between guest workspaces and the host.
Documentation
- Documented workspace policies, supported runtime versions, user propagation, defaults, and configuration guidance.

netlify · 2026-09-19T00:06:20Z

✅ Deploy Preview for devsydev ready!

Name	Link
🔨 Latest commit	`b6fee01`
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6aae1969edef4d00083f14b6
😎 Deploy Preview	https://deploy-preview-1240--devsydev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

coderabbitai · 2026-09-19T00:06:21Z

Warning

Review limit reached

Next included review available in 21 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 8972a891-3bf5-4fa4-86b1-c833855e17b9

📥 Commits

Reviewing files that changed from the base of the PR and between 35af9b6 and b6fee01.

📒 Files selected for processing (3)

pkg/driver/microsandbox/microsandbox.go
pkg/driver/microsandbox/preflight_test.go
sites/docs-devsy-sh/content/docs/developing-providers/driver.mdx

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 51792b38-0eeb-4be2-b259-94b0c4cb7fda

📥 Commits

Reviewing files that changed from the base of the PR and between 1c65d31 and 35af9b6.

📒 Files selected for processing (14)

e2e/tests/up/provider_microsandbox.go
e2e/tests/up/testdata/microsandbox/.devcontainer.json
pkg/driver/microsandbox/cliclient.go
pkg/driver/microsandbox/cliclient_test.go
pkg/driver/microsandbox/client.go
pkg/driver/microsandbox/microsandbox.go
pkg/driver/microsandbox/microsandbox_test.go
pkg/driver/microsandbox/mounts.go
pkg/driver/microsandbox/preflight_test.go
pkg/options/resolve.go
pkg/options/resolve_test.go
pkg/provider/provider.go
providers/microsandbox/provider.yaml
sites/docs-devsy-sh/content/docs/developing-providers/driver.mdx

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

The Microsandbox driver now supports workspace permission and stat virtualization policies, propagates the configured container user, validates the runtime version, serializes mount policies, and verifies bidirectional ownership and mode behavior in end-to-end tests.

Changes

Microsandbox workspace policy

Layer / File(s)	Summary
Workspace policy configuration `pkg/provider/provider.go`, `providers/microsandbox/provider.yaml`, `pkg/options/resolve.go`, `pkg/options/resolve_test.go`, `sites/docs-devsy-sh/content/docs/developing-providers/driver.mdx`	Adds host-permission and stat-virtualization configuration, resolves both values, and documents their defaults and compatibility rules.
Mount policy implementation `pkg/driver/microsandbox/mounts.go`, `pkg/driver/microsandbox/client.go`, `pkg/driver/microsandbox/microsandbox.go`, `pkg/driver/microsandbox/cliclient.go`, `pkg/driver/microsandbox/cliclient_test.go`, `pkg/driver/microsandbox/microsandbox_test.go`	Parses mount policies, serializes policy options, applies them to the workspace mount, and includes the configured user in the sandbox specification.
Runtime identity and version validation `pkg/driver/microsandbox/cliclient.go`, `pkg/driver/microsandbox/microsandbox.go`, `pkg/driver/microsandbox/client.go`, `pkg/driver/microsandbox/*_test.go`	Adds runtime version retrieval and parsing, rejects versions older than `v0.6.15`, and tests version and user argument handling.
Identity and permission validation `e2e/tests/up/provider_microsandbox.go`, `e2e/tests/up/testdata/microsandbox/.devcontainer.json`	Runs the environment as `vscode` and verifies guest-created file modes on the host and host-created file ownership and modes in the guest.

Priority: ⬇️ Low

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant ProviderConfig
  participant MicrosandboxDriver
  participant cliClient
  participant MicroSandbox
  ProviderConfig->>MicrosandboxDriver: workspace policy and user
  MicrosandboxDriver->>MicrosandboxDriver: parse policy and build spec
  MicrosandboxDriver->>cliClient: request version
  cliClient->>MicroSandbox: msb --version
  MicroSandbox-->>cliClient: version output
  MicrosandboxDriver->>cliClient: run with user and mount policy
  cliClient->>MicroSandbox: sandbox command

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 27 functions across 11 files. (3 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: synchronizing MicroSandbox workspace permissions. It matches the PR objectives and changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 27 functions across 11 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Commit to this branch
Create a new PR

✨ Simplify code

Commit to this branch
Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

netlify · 2026-09-19T00:06:53Z

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	`b6fee01`
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6aae19692dde6d0008485928

mergify · 2026-09-19T04:33:16Z

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

Queue this pull request

skevetter · 2026-09-19T04:54:20Z

@greptileai review

greptile-apps · 2026-09-19T04:57:19Z

Confidence Score: 4/5

The PR is not yet safe to merge because an older installed runtime prevents users from stopping, inspecting, or deleting existing MicroSandbox VMs.

Findings

Version Gate Blocks Cleanup ▶

Summary

This PR adds MicroSandbox workspace ownership synchronization by propagating the resolved container user, configuring workspace mount metadata and permission policies, validating the runtime version, and exposing the new behavior through provider options, tests, E2E coverage, and documentation.

Adds --user propagation and explicit workspace stat-virt/host-perms mount options.
Adds configurable workspace policies with validation and provider-option resolution.
Requires MicroSandbox v0.6.15 or newer during preflight.
Extends unit, preflight, and live workspace permission tests.
One lifecycle issue remains: the global version gate also prevents cleanup and inspection of existing VMs created with an older runtime.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Workspace command] --> B[Create runner]
    B --> C[MicroSandbox preflight]
    C --> D[Check msb installation]
    D --> E[Read and validate runtime version]
    E -->|v0.6.15 or newer| F[Execute requested operation]
    E -->|older runtime| G[Return preflight error]
    F --> H[Create with user and mount policies]
    F --> I[Start or stop VM]
    F --> J[Inspect, log, or delete VM]
    G -. currently blocks .-> I
    G -. currently blocks .-> J

_{Reviews (1) · Last reviewed commit: "fix(microsandbox): synchronize workspace..."}

greptile-apps · 2026-09-19T04:57:22Z

+	rawVersion, err := d.client.Version(ctx)
+	if err != nil {
+		return &driver.PreflightError{Provider: provider.MicrosandboxDriver, Err: err}
+	}
+	version, err := parseMicrosandboxVersion(rawVersion)
+	if err != nil {
+		return &driver.PreflightError{Provider: provider.MicrosandboxDriver, Err: err}
+	}
+	if version.LT(minimumMicrosandboxVersion) {


Version gate blocks cleanup

If a user has MicroSandbox v0.6.14 and an existing VM, this shared preflight rejects the runtime before every runner operation. Because stop, delete, status, and logs all construct a runner first, users cannot manage or clean up that VM through Devsy. Apply the version requirement only to operations that need the new mount policies, or allow lifecycle cleanup against older runtimes.

Knowledge Base Used: Supported provider backends

github-actions Bot added the size/l label Sep 19, 2026

skevetter linked an issue Sep 19, 2026 that may be closed by this pull request

How do I sync permissions? #1241

Open

skevetter force-pushed the spooky-octopus branch from b60a08b to 35af9b6 Compare September 19, 2026 00:14

skevetter marked this pull request as ready for review September 19, 2026 04:32

greptile-apps Bot reviewed Sep 19, 2026

View reviewed changes

fix(microsandbox): synchronize workspace permissions

b6fee01

skevetter force-pushed the spooky-octopus branch from 35af9b6 to b6fee01 Compare September 19, 2026 05:11

Navigation Menu

fix(microsandbox): synchronize workspace permissions - #1240

fix(microsandbox): synchronize workspace permissions#1240
skevetter wants to merge 1 commit into
mainfrom
spooky-octopus

skevetter commented Sep 19, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

netlify Bot commented Sep 19, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 19, 2026 •

edited

Loading

Review limit reached

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

netlify Bot commented Sep 19, 2026 •

edited

Loading

Uh oh!

mergify Bot commented Sep 19, 2026

Uh oh!

skevetter commented Sep 19, 2026

Uh oh!

greptile-apps Bot commented Sep 19, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot Sep 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

skevetter commented Sep 19, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Summary by CodeRabbit

Uh oh!

netlify Bot commented Sep 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for devsydev ready!

Uh oh!

coderabbitai Bot commented Sep 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

netlify Bot commented Sep 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for images-devsy-sh canceled.

Uh oh!

mergify Bot commented Sep 19, 2026

Uh oh!

skevetter commented Sep 19, 2026

Uh oh!

greptile-apps Bot commented Sep 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 4/5

Findings

Summary

Uh oh!

greptile-apps Bot Sep 19, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

skevetter commented Sep 19, 2026 •

edited by coderabbitai Bot

Loading

netlify Bot commented Sep 19, 2026 •

edited

Loading

coderabbitai Bot commented Sep 19, 2026 •

edited

Loading

netlify Bot commented Sep 19, 2026 •

edited

Loading

greptile-apps Bot commented Sep 19, 2026 •

edited

Loading