@namzu/sandbox 15.0.0 → 17.0.0

package/src/backends/kubernetes/per-sandbox-policy.ts

@@ -87,6 +87,7 @@ import {
 	type KubernetesTranslatedEgressPolicy,
 	PER_SANDBOX_NARROWING_REFUSAL,
 	assertHostsFitNarrowing,
+	assertUsableHost,
 	buildCiliumEgressManifest,
 	perSandboxEgressLabelKey,
 	verifyEgressPolicyApplied,
@@ -214,18 +215,15 @@ export class KubernetesAdmissionFenceMissingError extends Error {
  * Raised for an `allowedHosts` entry this backend will not translate —
  * re-exported rather than defined here.
  *
- * It lives in `egress-policy.ts` beside {@link assertHostsFitNarrowing},
- * because the config-level `ciliumNarrowing` translation raises the same
- * class for the same entry, and this module imports that one: defining it
- * here would make the two modules import each other. The identifier is
- * re-exported so every existing import path — including the package index —
- * keeps resolving.
+ * It lives in `egress-policy.ts` beside {@link assertHostsFitNarrowing} and
+ * {@link assertUsableHost}, because the config-level translation raises the
+ * same class for the same entry and this module imports both checks from
+ * there: defining it here would make the two modules import each other. The
+ * identifier is re-exported so every existing import path — including the
+ * package index — keeps resolving.
  */
 export { KubernetesNetworkPolicyHostError }
 
-/** A DNS name, lowercase, no scheme, no port, no wildcard. */
-const DNS_NAME = /^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$/
-
 /**
  * One `allowedHosts` entry, validated and canonicalised to the bytes a
  * `CiliumNetworkPolicy` should carry.
@@ -235,6 +233,13 @@ const DNS_NAME = /^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?
  * `matchName` is compared against what the DNS proxy saw — lowercase. The
  * docker backend accepts either case, and a list that worked there and threw
  * here would be a portability trap with no boundary behind it.
+ *
+ * The grammar itself is {@link assertUsableHost}'s, in `egress-policy.ts`
+ * beside the error it throws, because it is no longer only this writer's: the
+ * shared translation calls it too, so a config-level allowlist is refused the
+ * same entries this path refuses. What is HERE is the part that is this
+ * writer's alone — the canonicalisation, applied before the fence is read and
+ * before anything is queued behind a previous call.
  */
 function normalizeHost(entry: string): string {
 	if (typeof entry !== 'string') {
@@ -245,55 +250,6 @@ function normalizeHost(entry: string): string {
 	return canonical
 }
 
-function assertUsableHost(entry: string): void {
-	if (typeof entry !== 'string' || entry === '') {
-		throw new KubernetesNetworkPolicyHostError(String(entry), 'is empty')
-	}
-	const bare = entry.startsWith('.') ? entry.slice(1) : entry
-	if (bare === '') {
-		throw new KubernetesNetworkPolicyHostError(entry, 'names no domain after its leading dot')
-	}
-	if (entry.includes('*')) {
-		throw new KubernetesNetworkPolicyHostError(
-			entry,
-			"contains a glob; a domain and its subdomains are written with a leading dot ('.example.com'), which becomes matchName plus matchPattern",
-		)
-	}
-	if (!DNS_NAME.test(bare)) {
-		throw new KubernetesNetworkPolicyHostError(
-			entry,
-			'is not a DNS name (a scheme, a path, a port suffix and an IP address all land here; letter case is canonicalised before this check, so it is never the cause)',
-		)
-	}
-	if (bare.length > 253) {
-		throw new KubernetesNetworkPolicyHostError(entry, 'is longer than a DNS name may be')
-	}
-	// A leading-dot entry becomes `matchPattern: '*.<domain>'`, and a
-	// single-label domain there is a whole public suffix — `.com`, `.org`.
-	// That is not an allowlist entry, and the shipped admission fence refuses
-	// the pattern it would produce, so refusing it HERE is what turns an
-	// opaque 403 from the API server into an error naming the entry.
-	if (entry.startsWith('.') && !bare.includes('.')) {
-		throw new KubernetesNetworkPolicyHostError(
-			entry,
-			"names a whole top-level domain ('.com' means every name under it); a domain entry needs at least two labels, as in '.example.com', and the shipped admission policy refuses the '*.com' pattern this would emit",
-		)
-	}
-	// An IPv4 literal passes the grammar above — every label is digits, and
-	// digits are legal in a DNS label. It is still not a hostname: a DNS
-	// top-level label is never all-numeric, and Cilium's `matchName` is
-	// compared against names the DNS proxy SAW, which an address never is. A
-	// policy carrying one is admitted and matches nothing, which reads from
-	// outside exactly like a policy that is working.
-	const lastLabel = bare.slice(bare.lastIndexOf('.') + 1)
-	if (/^[0-9]+$/.test(lastLabel)) {
-		throw new KubernetesNetworkPolicyHostError(
-			entry,
-			'ends in an all-numeric label, so it is an address rather than a hostname; toFQDNs matches names a DNS lookup returned, and an address is never one of them (use config.egress.policy for address-based egress)',
-		)
-	}
-}
-
 /**
  * Raised when the object an acquire created reported no `metadata.uid`.
  *
@@ -434,7 +390,7 @@ export function buildPerSandboxPolicySetter(
 			policyKind: 'static',
 			...(perSandbox.narrowing !== undefined ? { narrowing: perSandbox.narrowing } : {}),
 			ownerReferences: [perSandboxPolicyOwnerReference(owner)],
-			expandDomains: true,
+			refusalContext: PER_SANDBOX_NARROWING_REFUSAL,
 		})
 
 	const write = async (translated: KubernetesTranslatedEgressPolicy): Promise<void> => {
@@ -497,13 +453,12 @@ export function buildPerSandboxPolicySetter(
 			perSandbox.narrowing,
 			// The per-sandbox context, from `egress-policy.ts` rather than
 			// rebuilt here: it is the SAME value `buildCiliumEgressManifest`
-			// refuses by on this path (`expandDomains: true`), so the earlier
-			// check and the translation's own cannot name different fields —
-			// and the sentence it carries is the true one here, where the entry
-			// really does become a name plus a `*.domain` pattern. The
-			// config-level wording, where nothing is expanded, would be a lie
-			// on this path: leaving the option off here does allow the domain
-			// and its subdomains.
+			// refuses by on this path (`refusalContext`), so the earlier check
+			// and the translation's own cannot name different fields — and the
+			// sentence it carries is the true one here, where the entry really
+			// does become a name plus a `*.domain` pattern. Sending this caller
+			// to `config.egress.ciliumNarrowing` would name a field a
+			// `perSandbox` host never set.
 			PER_SANDBOX_NARROWING_REFUSAL,
 		)
 		// A previous call's failure belongs to that caller; this one still runs,

package/src/backends/kubernetes/transport.ts

@@ -530,6 +530,13 @@ export interface KubernetesTransportOptions
 	 * Fires once per completed `exec()` call (success or failure) with
 	 * the four phase durations above. The payload is exactly those four
 	 * numbers — never the token, never a command, argv, or output.
+	 *
+	 * THIS is the timing hook for this tier. The base options also carry
+	 * `VsockTransportOptions.onExecTiming`, which is inherited here and is
+	 * INERT: it belongs to the firecracker tier, whose `exec()` reports into
+	 * it, while this transport drives the shared wire through
+	 * `executeStreamed` and never calls that `exec()`. Setting it on a
+	 * Kubernetes transport starts nothing.
 	 */
 	readonly onTiming?: (timing: KubernetesTransportTiming) => void
 	/**

package/src/egress/proxy.ts

@@ -71,13 +71,46 @@ export interface EgressProxyOptions {
 	 * reach — which is the hole this screen exists to close.
 	 */
 	readonly allowInwardFor?: readonly string[]
+	/**
+	 * Address this proxy listens on. Default `127.0.0.1`.
+	 *
+	 * The default is loopback because a proxy holding real credentials and
+	 * bound to every interface is reachable by anything on the network, which
+	 * is the opposite of what it exists for. There is exactly one deployment
+	 * where that reasoning flips, and it is the whole reason this is
+	 * configurable: the docker tier runs the proxy as a container of its own
+	 * (`egress-proxy/server.mjs`), the sandbox is attached to an `--internal`
+	 * network with no route out, and this container is the only way its traffic
+	 * reaches the internet. There, `0.0.0.0` inside the proxy container is not
+	 * "every interface on the host" — the container IS the boundary — and what
+	 * else the sandbox can reach on that network is whatever other containers a
+	 * host attached to it, which `docs/sdk/sandbox-egress.md` states.
+	 */
+	readonly bindHost?: string
+	/**
+	 * Names that denote THIS proxy, for the loop guard in `listen`.
+	 *
+	 * `isSelf` refuses a request whose target is the proxy itself, because
+	 * forwarding it makes the proxy call itself until the process runs out of
+	 * sockets — a failure that arrives as a hang rather than as an error. On
+	 * loopback the target is one of `127.0.0.1`, `localhost`, `::1` and the
+	 * check is closed by construction. Bound to another address it is not:
+	 * anything that names this proxy by a name it answers to — its container
+	 * name or network alias, say — would walk straight into that loop. So
+	 * every such name is listed here by whoever knows it.
+	 */
+	readonly selfNames?: readonly string[]
 	/** Injected in tests. Defaults to the platform resolver. */
 	readonly resolveAddresses?: ScreeningLookupOptions['resolve']
 }
 
 export interface RunningEgressProxy {
 	readonly port: number
-	/** `http://127.0.0.1:<port>` — what a sandbox sets `HTTP_PROXY` to. */
+	/**
+	 * `http://<the address this proxy bound>:<port>` — what a sandbox sets
+	 * `HTTP_PROXY` to. Loopback by default; the address is whatever
+	 * {@link EgressProxyOptions.bindHost} said.
+	 */
 	readonly url: string
 	/** Swap the allowlist on a live proxy. See `setNetworkPolicy`. */
 	setAllowedHosts(resolve: () => Promise<readonly string[]>): void
@@ -86,6 +119,12 @@ export interface RunningEgressProxy {
 
 const DENIED_STATUS = 403
 
+/** The default bind address. See {@link EgressProxyOptions.bindHost}. */
+const LOOPBACK_BIND_HOST = '127.0.0.1'
+
+/** Names that mean "this proxy" on loopback, whatever it bound to. */
+const LOOPBACK_SELF_NAMES: readonly string[] = ['127.0.0.1', 'localhost', '::1']
+
 export class EgressProxy {
 	private resolveAllowed: () => Promise<readonly string[]>
 	private readonly credentials: readonly BrokeredCredential[]
@@ -101,6 +140,8 @@ export class EgressProxy {
 	 */
 	private readonly lookup: ReturnType<typeof createScreeningLookup>
 	private readonly inwardAllowed: readonly string[]
+	private readonly bindHost: string
+	private readonly selfNames: readonly string[]
 
 	constructor(options: EgressProxyOptions) {
 		this.resolveAllowed = options.allowedHosts
@@ -108,6 +149,8 @@ export class EgressProxy {
 		this.upgradeToHttps = options.upgradeToHttps ?? true
 		this.onDenied = options.onDenied
 		this.inwardAllowed = options.allowInwardFor ?? []
+		this.bindHost = options.bindHost ?? LOOPBACK_BIND_HOST
+		this.selfNames = options.selfNames ?? []
 		this.lookup = createScreeningLookup(
 			{
 				...(options.allowInwardFor ? { allowInwardFor: options.allowInwardFor } : {}),
@@ -131,10 +174,12 @@ export class EgressProxy {
 		})
 		await new Promise<void>((resolve, reject) => {
 			server.once('error', reject)
-			// Loopback only. A proxy that holds real credentials and binds
-			// every interface is reachable by anything on the network, which
-			// is the opposite of what it exists for.
-			server.listen(port, '127.0.0.1', () => {
+			// Loopback by default. A proxy that holds real credentials and binds
+			// every interface is reachable by anything on the network, which is
+			// the opposite of what it exists for — see
+			// {@link EgressProxyOptions.bindHost} for the one deployment where
+			// the container itself is the boundary and this is not that.
+			server.listen(port, this.bindHost, () => {
 				server.off('error', reject)
 				resolve()
 			})
@@ -153,7 +198,7 @@ export class EgressProxy {
 
 		return {
 			port: boundPort,
-			url: `http://127.0.0.1:${boundPort}`,
+			url: `http://${this.bindHost}:${boundPort}`,
 			setAllowedHosts: (resolve) => {
 				this.resolveAllowed = resolve
 			},
@@ -363,10 +408,22 @@ export class EgressProxy {
 		})
 	}
 
-	/** Whether a target names this proxy. See the loop guard in `listen`. */
+	/**
+	 * Whether a target names this proxy. See the loop guard in `listen`.
+	 *
+	 * The loopback spellings are always this proxy — a client inside the same
+	 * network namespace reaches it at one of them whatever it bound to, and
+	 * the bound address when that address is a literal is one more. Anything
+	 * else has to be named by the caller, through
+	 * {@link EgressProxyOptions.selfNames}: this process cannot know which
+	 * names resolve to it on the network it is attached to, and a guard that
+	 * guessed would either miss the loop or refuse a legitimate target.
+	 */
 	private isSelf(host: string, port?: number): boolean {
 		if (port === undefined || port !== this.selfPort) return false
-		return host === '127.0.0.1' || host === 'localhost' || host === '::1'
+		if (host === this.bindHost) return true
+		if (LOOPBACK_SELF_NAMES.includes(host)) return true
+		return this.selfNames.includes(host)
 	}
 
 	private credentialFor(host: string): BrokeredCredential | undefined {

package/src/index.ts

@@ -9,11 +9,29 @@
  *
  * Two tiers, each a trust boundary:
  *
- *  • `container` — one OCI container per task, seccomp on, tmpfs
- *    workdir, no network unless asked. The same path on a laptop and
- *    on a Linux replica anywhere. The tier for trusted prompts and
- *    contained workloads. Boundary: kernel namespaces, or a
- *    userspace-kernel runtime where one is installed.
+ *  • `container` — one OCI container per task, with the container itself
+ *    as the boundary: kernel namespaces, or a userspace-kernel runtime
+ *    where one is installed. The same path on a laptop and on a Linux
+ *    replica anywhere. The tier for trusted prompts and contained
+ *    workloads. What confines the workload INSIDE the container is
+ *    applied by each backend and documented where it is applied, not
+ *    promised here: `container:docker` drops every capability, sets
+ *    no-new-privileges, gives the container an IPC namespace nothing else can
+ *    join and mounts its root filesystem read-only over a named writable set
+ *    (see `backends/docker/index.ts`), while the ACI standby pool takes
+ *    its controls from the container-group profile its pool was built
+ *    from. This line used to claim "seccomp on, tmpfs workdir, no
+ *    network unless asked" on both their behalf, and none of the three
+ *    is a property this package establishes: nothing here passes a
+ *    seccomp flag, so what filters a container's syscalls is the daemon's
+ *    own profile rather than a default this package sets; the directory
+ *    the agent works in is the layout's `outputs` bind mount — a host
+ *    directory the run is collected from — rather than a tmpfs that would
+ *    lose it when the container exits; and the network a container is
+ *    attached to is a fact about
+ *    the backend's own configuration — a daemon network whose internals
+ *    the egress policy is checked against, or the container group's
+ *    subnet or public address.
  *
  *  • `microvm` — one hardware-virtualized guest per task. The boundary
  *    to reach for when the prompt itself is adversarial, at the cost
@@ -44,6 +62,7 @@ import type {
 import { buildAciStandbyPoolBackend } from './backends/aci-standby-pool/index.js'
 import { buildDockerBackend, resolveLayout } from './backends/docker/index.js'
 import { buildFirecrackerBackend } from './backends/firecracker/index.js'
+import type { FirecrackerTransportTiming } from './backends/firecracker/transport.js'
 import type { KubernetesEgressConfig } from './backends/kubernetes/egress-policy.js'
 import {
 	type KubernetesAgentAddressMode,
@@ -108,6 +127,7 @@ export {
 	AgentWriteFileTooLargeError,
 	DEFAULT_MAX_WRITE_FILE_BYTES,
 	FIRECRACKER_AGENT_PROTOCOL_VERSION,
+	type FirecrackerTransportTiming,
 	GUEST_FRAME_LIMIT_BYTES,
 	type SandboxAgentHandle,
 	TCP_PREAUTH_FRAME_LIMIT_BYTES,
@@ -641,8 +661,51 @@ export interface ContainerBackendConfig {
 	 *
 	 * Egress from the sandbox is governed separately by `EgressPolicy`,
 	 * which is checked against this network rather than trusted.
+	 *
+	 * An egress policy of `static` or `resolver` — a host allowlist —
+	 * additionally REQUIRES this network to be `--internal`, and requires
+	 * `hostReachability: 'container-network'`. The allowlist is enforced by
+	 * the egress proxy running as a sibling container on this network: the
+	 * sandbox is attached to this network alone, and an internal network has
+	 * no route off it, so the only way the sandbox's traffic reaches the
+	 * internet is through that container. It is a container on a subnet like
+	 * any other there, so what else a host attaches to this network — a second
+	 * sandbox, and that sandbox's proxy — is reachable from this one too; on a
+	 * network with a route out the allowlist is a proxy environment variable a
+	 * workload may decline to read, and `create()` refuses rather than
+	 * reporting a boundary that is not there.
 	 */
 	readonly network?: 'none' | 'bridge' | string
+	/**
+	 * Image the egress proxy runs as, when the policy needs one.
+	 *
+	 * Required for a `static` or `resolver` policy, refused without it. The
+	 * image is `packages/sandbox/egress-proxy/Dockerfile`:
+	 *
+	 *   pnpm --filter @namzu/sandbox build
+	 *   docker build -f packages/sandbox/egress-proxy/Dockerfile \
+	 *     -t <tag> packages/sandbox
+	 *
+	 * It is a second image rather than the sandbox's own because the
+	 * sandbox image is a string this backend cannot read: there is no way to
+	 * know whether it contains the proxy module, and the bind-mount
+	 * alternative fails on exactly the remote-daemon deployment
+	 * `hostReachability: 'container-network'` exists for. `deny-all` and
+	 * `allow-all` need no image.
+	 */
+	readonly egressProxyImage?: string
+	/**
+	 * Network the egress proxy joins for its route to the internet. Default
+	 * `'bridge'`, docker's own default bridge.
+	 *
+	 * The proxy is dual-homed: it sits on the internal network the sandbox
+	 * is on, and on this one, which is how it reaches the world. Name a
+	 * dedicated network when the daemon is shared, because anything else
+	 * attached to this one can reach the proxy — and this proxy enforces its
+	 * allowlist for whoever asks and stamps brokered credentials on what it
+	 * forwards.
+	 */
+	readonly egressProxyUpstreamNetwork?: string
 	/**
 	 * Maximum time spent waiting for the container worker's `/healthz`
 	 * readiness probe. Must be a positive integer within Node's timer range.
@@ -685,6 +748,46 @@ export interface ContainerBackendConfig {
 	 * collisions with Docker / orchestrator labels.
 	 */
 	readonly labels?: Readonly<Record<string, string>>
+	/**
+	 * CPU cores the container may use, rendered as `--cpus`. Unset by
+	 * default, like `memoryLimitMb` and `maxProcesses`, and for the same
+	 * reason: the value that is right is a property of the host's machine
+	 * and of the workload, and a number chosen here would silently throttle
+	 * runs that finish inside their timeout today.
+	 *
+	 * It is set at provider construction rather than per `create()` call,
+	 * because the documented deployment builds one provider per task — and
+	 * because the ACI and kubernetes backends cannot apply a per-sandbox CPU
+	 * limit, so a per-call field would be a control they would have to
+	 * refuse. See `backends/docker/index.ts` for what it renders.
+	 */
+	readonly cpuLimit?: number
+	/**
+	 * Mount the container's root filesystem read-only. Default `true`.
+	 *
+	 * On by default with the paths that stay writable named in
+	 * `backends/docker/index.ts` (`writableRootfsPaths` extends them). Set it
+	 * to `false` to make the whole container filesystem writable again, which a
+	 * host whose image writes somewhere the writable set cannot describe needs,
+	 * and which is why the switch exists rather than the baseline being
+	 * unconditional. It gives up that one control: the capability drop,
+	 * `no-new-privileges` and `--ipc private` are applied to every container
+	 * whatever this says, so it is not a way back to the previous argv.
+	 */
+	readonly readOnlyRootfs?: boolean
+	/**
+	 * Extra paths to keep writable under `--read-only`, each mounted
+	 * `--tmpfs`.
+	 *
+	 * The default set is the reference image's needs, read off its Dockerfile.
+	 * A host that points `image` at its own build says what that image needs
+	 * here, because the backend cannot read an image's writable set and the
+	 * alternative to asking is guessing. Setting this beside
+	 * `readOnlyRootfs: false` is refused: with a writable root filesystem the
+	 * mounts would add nothing, and accepting a control that is not applied is
+	 * the failure this package refuses everywhere else.
+	 */
+	readonly writableRootfsPaths?: readonly string[]
 }
 
 /**
@@ -738,6 +841,28 @@ export type MicroVMBackendConfig = {
 	readonly readyTimeoutMs?: number
 	/** Delay between guest-agent health probes. Default 250ms. */
 	readonly readyPollIntervalMs?: number
+	/**
+	 * Fires once per completed `exec()` on this provider's sandboxes with
+	 * that call's wall-time breakdown — the reserve round trip, the execute
+	 * round trip, the dials inside them, the first reply frame, the
+	 * terminator frame and the peer's own close. See
+	 * {@link FirecrackerTransportTiming} for what each number is and is not,
+	 * and {@link VsockTransportOptions.onExecTiming} for why the field is
+	 * named this rather than the kubernetes tier's `onTiming`.
+	 *
+	 * Opt-in and additive, with no default: a host that sets nothing sends,
+	 * receives and waits for exactly what it did before. The intended use is
+	 * attribution — a relay or a guest that adds a fixed cost to every call
+	 * moves a named phase, and one that adds none leaves the numbers at the
+	 * cost of a command's own runtime.
+	 *
+	 * It is an OBSERVER, not a control: it cannot change a command's result,
+	 * it is called after the call has settled, and a listener that throws is
+	 * that listener's problem. The payload is durations only — never the
+	 * agent token, a command, its arguments, or any output — so a host may
+	 * log it without leaking what the sandbox ran.
+	 */
+	readonly onExecTiming?: (timing: FirecrackerTransportTiming) => void
 	/**
 	 * NETWORK-mode mTLS client material (ses_051 P4 client-proxy
 	 * bridge). When present, the orchestrator returns an `mtls` agent
@@ -1259,7 +1384,18 @@ function pickBackend(config: SandboxProviderConfig): SandboxBackend {
 				: {}),
 			...(backend.network !== undefined ? { network: backend.network } : {}),
 			...(backend.allowInwardFor !== undefined ? { allowInwardFor: backend.allowInwardFor } : {}),
+			...(backend.egressProxyImage !== undefined
+				? { egressProxyImage: backend.egressProxyImage }
+				: {}),
+			...(backend.egressProxyUpstreamNetwork !== undefined
+				? { egressProxyUpstreamNetwork: backend.egressProxyUpstreamNetwork }
+				: {}),
 			...(backend.labels !== undefined ? { labels: backend.labels } : {}),
+			...(backend.cpuLimit !== undefined ? { cpuLimit: backend.cpuLimit } : {}),
+			...(backend.readOnlyRootfs !== undefined ? { readOnlyRootfs: backend.readOnlyRootfs } : {}),
+			...(backend.writableRootfsPaths !== undefined
+				? { writableRootfsPaths: backend.writableRootfsPaths }
+				: {}),
 		})
 	}
 	if (backend.tier === 'container' && backend.runtime === 'runsc') {
@@ -1279,7 +1415,18 @@ function pickBackend(config: SandboxProviderConfig): SandboxBackend {
 				: {}),
 			...(backend.network !== undefined ? { network: backend.network } : {}),
 			...(backend.allowInwardFor !== undefined ? { allowInwardFor: backend.allowInwardFor } : {}),
+			...(backend.egressProxyImage !== undefined
+				? { egressProxyImage: backend.egressProxyImage }
+				: {}),
+			...(backend.egressProxyUpstreamNetwork !== undefined
+				? { egressProxyUpstreamNetwork: backend.egressProxyUpstreamNetwork }
+				: {}),
 			...(backend.labels !== undefined ? { labels: backend.labels } : {}),
+			...(backend.cpuLimit !== undefined ? { cpuLimit: backend.cpuLimit } : {}),
+			...(backend.readOnlyRootfs !== undefined ? { readOnlyRootfs: backend.readOnlyRootfs } : {}),
+			...(backend.writableRootfsPaths !== undefined
+				? { writableRootfsPaths: backend.writableRootfsPaths }
+				: {}),
 		})
 	}
 	// `microvm:self-hosted` targeting the OWNED Azure Firecracker
@@ -1304,6 +1451,16 @@ function pickBackend(config: SandboxProviderConfig): SandboxBackend {
 			...(backend.readyPollIntervalMs !== undefined
 				? { readyPollIntervalMs: backend.readyPollIntervalMs }
 				: {}),
+			// Forwarded into the transport's own options rather than onto the
+			// backend's config: the backend reads nothing here, and the phase
+			// numbers are the transport's to report — see
+			// `VsockTransportOptions.onExecTiming`, which is where a host that
+			// builds a `VsockAgentTransport` directly sets it too. Absent ⇒
+			// this spread adds no key at all and the transport is built with
+			// the options it was always built with.
+			...(backend.onExecTiming !== undefined
+				? { transport: { onExecTiming: backend.onExecTiming } }
+				: {}),
 			...(backend.mtls !== undefined ? { mtls: backend.mtls } : {}),
 			...(backend.controlPlaneMtls !== undefined
 				? { controlPlaneMtls: backend.controlPlaneMtls }