Skip to content

Add comprehensive gVisor firewall comparison workflow#5236

Merged
lpcox merged 2 commits into
mainfrom
test/gvisor-firewall-comparison
Jun 18, 2026
Merged

Add comprehensive gVisor firewall comparison workflow#5236
lpcox merged 2 commits into
mainfrom
test/gvisor-firewall-comparison

Conversation

@lpcox

@lpcox lpcox commented Jun 18, 2026

Copy link
Copy Markdown
Collaborator

Summary

This PR adds a comprehensive test workflow that compares Squid vs Envoy proxy approaches under both runc and gVisor runtimes.

Test Coverage

1. Squid + iptables DNAT (Current AWF Approach)

  • ✅ Test under runc (standard Docker runtime)
  • ✅ Test under gVisor (userspace kernel)
  • ✅ Verify domain ACL filtering (allow github.com, block google.com)
  • ✅ Verify port blocking (SSH port 22)
  • ✅ Check if DNAT actually redirects traffic

2. Envoy + iptables redirect (Alternative Approach)

  • ✅ Test under runc
  • ✅ Test under gVisor
  • ✅ Dynamic forward proxy for transparent proxying
  • ✅ HTTP and HTTPS connectivity tests

3. Performance Comparison

  • ✅ Benchmark average latency for 100 requests through each proxy
  • ✅ Compare Squid vs Envoy performance

Key Questions Answered

  1. Does gVisor's userspace network stack support iptables DNAT?

    • Tests if rules are accepted
    • Tests if traffic is actually redirected
  2. Which approach works better with gVisor?

    • Squid (mature, ACL-focused)
    • Envoy (modern, observability-rich)
  3. Performance implications?

    • Latency comparison under real workload
  4. Can AWF keep its current architecture with gVisor?

    • Or does it need to switch to Envoy or modify the iptables pattern?

Running the Tests

gh workflow run test-gvisor-firewall-comparison.yml

The workflow generates a summary report showing pass/fail status, performance metrics, and recommendations.

Related Issues

Addresses questions raised in #3264 (gVisor compatibility investigation)

Files Changed

  • .github/workflows/test-gvisor-firewall-comparison.yml - New comprehensive test workflow

- Compare Squid vs Envoy proxy approaches
- Test under both runc and gVisor runtimes
- Verify iptables DNAT/redirect compatibility with gVisor
- Benchmark performance (latency comparison)
- Generate summary report with recommendations

Tests answer key questions:
1. Does gVisor support iptables DNAT for traffic redirection?
2. Which proxy approach works better with gVisor?
3. Can AWF keep current Squid architecture or need Envoy?

Related to issue #3264 (gVisor compatibility investigation)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings June 18, 2026 04:44
@github-actions

github-actions Bot commented Jun 18, 2026

Copy link
Copy Markdown
Contributor

✅ Coverage Check Passed

Overall Coverage

Metric Base PR Delta
Lines 97.57% 97.61% 📈 +0.04%
Statements 97.50% 97.54% 📈 +0.04%
Functions 98.84% 98.84% ➡️ +0.00%
Branches 92.95% 92.98% 📈 +0.03%
📁 Per-file Coverage Changes (1 files)
File Lines (Before → After) Statements (Before → After)
src/workdir-setup.ts 92.7% → 94.5% (+1.82%) 92.7% → 94.5% (+1.82%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a new manual GitHub Actions workflow to empirically compare AWF’s current Squid+iptables approach versus an Envoy-based proxy approach under both the default Docker runtime (runc) and gVisor (runsc), including a simple latency benchmark and a final aggregated report.

Changes:

  • Introduces a multi-job workflow that runs Squid+iptables tests under runc and gVisor.
  • Adds Envoy+iptables test jobs under runc and gVisor.
  • Adds a basic “100 requests” latency benchmark and a final summary report job.
Show a summary per file
File Description
.github/workflows/test-gvisor-firewall-comparison.yml New workflow to compare proxy/firewall behaviors (Squid vs Envoy) across runc and gVisor, plus a latency benchmark and summary output.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 1/1 changed files
  • Comments generated: 19

Comment on lines +52 to +55
sudo apt-get install -y apt-transport-https gnupg2 curl lsb-release
curl -sL 'https://deb.dl.getenvoy.io/public/gpg.8115BA8E629CC074.key' | sudo gpg --dearmor -o /usr/share/keyrings/getenvoy-keyring.gpg
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/getenvoy-keyring-gpg] https://deb.dl.getenvoy.io/public/deb/ubuntu $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/getenvoy.list
sudo apt-get update -qq
Comment thread .github/workflows/test-gvisor-firewall-comparison.yml
Comment on lines +138 to +142
if [ "$HTTP_CODE" = "403" ] || [ "$HTTP_CODE" = "000" ]; then
echo "✅ PASS: google.com blocked (HTTP $HTTP_CODE)"
else
echo "❌ FAIL: google.com accessible (HTTP $HTTP_CODE)"
fi
Comment thread .github/workflows/test-gvisor-firewall-comparison.yml
Comment on lines +226 to +233
# Test if DNAT actually redirects or just accepts the rule
echo ""
echo "=== Verifying DNAT actually redirects traffic ==="
if curl -v --max-time 5 https://github.com 2>&1 | grep -q "Connected to 172.30.0.10"; then
echo "✅ CONFIRMED: DNAT redirected traffic to proxy"
else
echo "⚠️ DNAT rule exists but may not redirect traffic"
fi
Comment on lines +450 to +453
run: |
set -x
echo "## Performance Test: Squid"

Comment on lines +493 to +496
run: |
set -x
echo "## Performance Test: Envoy"

Comment on lines +17 to +18
- name: Checkout repository
uses: actions/checkout@v4
Comment thread .github/workflows/test-gvisor-firewall-comparison.yml Outdated
Comment on lines +371 to +376
- name: "Test: Envoy under gVisor"
run: |
set -x
echo "## Testing Envoy + iptables under gVisor"
echo ""

Fixes all 19 review comments:

1. Remove ineffective setup job (ran on different runner)
2. Pin actions/checkout by SHA for supply-chain hardening
3. Add set -euo pipefail and EXIT traps to all test steps
4. Make test assertions fail with exit 1 instead of just logging
5. Add DNAT fallback tests with proxy env disabled
6. Fix benchmark outputs to write to $GITHUB_OUTPUT
7. Fix benchmark to use explicit proxy (-x flag)
8. Fix Envoy gVisor config to match runc (add dynamic_forward_proxy)
9. Clarify HTTPS expectations for Envoy (known limitation)
10. Add job outputs for performance comparison
11. Add header note explaining defense-in-depth test approach

Key changes:
- All test jobs now properly propagate failures
- DNAT verification tests actually check enforcement (not just rule acceptance)
- Performance benchmarks capture and output latency correctly
- Cleanup happens reliably via EXIT traps
- Envoy configs consistent between runc and gVisor tests

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@github-actions

Copy link
Copy Markdown
Contributor

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

@lpcox

lpcox commented Jun 18, 2026

Copy link
Copy Markdown
Collaborator Author

✅ All 19 review comments addressed

Thanks for the thorough review! I've addressed all feedback in commit d97caca.

Key fixes:

Architecture changes:

  1. ✅ Removed ineffective setup job (it ran on different runner, didn't help downstream jobs)
  2. ✅ Pinned actions/checkout by SHA (de0fac2e4500dabe0009e67214ff5f5447ce83dd) for supply-chain hardening

Reliability improvements:
3. ✅ Added set -euo pipefail and EXIT traps to all test steps
4. ✅ All test assertions now exit 1 on failure (no more silent failures)
5. ✅ Cleanup always runs via traps, even on failure

DNAT verification:
6. ✅ Added defense-in-depth tests: disable HTTPS_PROXY and verify DNAT causes expected TLS/proxy error (not direct egress)
7. ✅ Tests now validate that iptables DNAT actually enforces proxying, not just accepts rules

Performance benchmarks:
8. ✅ Benchmarks write to $GITHUB_OUTPUT (not container-internal /tmp/results.txt)
9. ✅ Squid benchmark uses explicit proxy: curl -x squid-perf:3128
10. ✅ Added job outputs so summary can display latency values

Envoy configuration:
11. ✅ Fixed Envoy gVisor config: now includes dynamic_forward_proxy filter + cluster config (matches runc test)
12. ✅ Clarified HTTPS expectations: Envoy HTTPS expected to fail without CONNECT support; not a pass/fail criterion

Documentation:
13. ✅ Added header note explaining why proxy env is disabled for DNAT tests

All jobs now reliably report pass/fail, the summary report will show actual performance numbers, and the tests validate actual enforcement (not just configuration acceptance).

@lpcox lpcox merged commit 57a7d49 into main Jun 18, 2026
22 of 23 checks passed
@lpcox lpcox deleted the test/gvisor-firewall-comparison branch June 18, 2026 05:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants