microsoft / Windows-Sandbox

Disposable, secure and lightweight Windows Desktop Environment
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview
MIT License
364 stars 49 forks source link

[FeatureRequest]: Mapped Environment Variables #46

Open bevanweiss opened 5 months ago

bevanweiss commented 5 months ago

Windows Sandbox version

10.0.22621.3527

Windows build number

10.0.22621.3593

Other software

No response

Steps to reproduce the bug

It would be great if it were possible to 'inject' Environment Variables from the Host into the Sandbox environment. My thought is that this would only occur at initial startup for the Sandbox, and would only be for a subset of the Environment Variables (strictly enumerated in the Sandbox Configuration).

My thought for the schema would be something like

<Configuration>
...
  <MappedEnvVars>
    <!-- Simple passthrough environment mapping -->
    <MappedEnvVar>VSTEST_DEBUG</MappedEnvVar>

    <!-- Remapped environment mapping, for things like system Env Vars that already exist in the Sandbox -->
    <MappedEnvVar>
      <HostEnvVar>ComputerName</HostEnvVar>
      <SandboxEnvVar>HostComputerName</SandboxEnvVar>
    </MappedEnvVar>

    <!-- Glob format mapping for multiple variables at once -->
    <MappedEnvVar>VSTEST_*</MappedEnvVar>

  </MappedEnvVars>
...
</Configuration>

My thoughts are that once the Sandbox is running, if it modifies the mapped environment variables, then that's just within the Sandbox that they are changed. I don't think there needs to be any reason to allow the environment variables to escape back into the Host machine (i.e. no need for a ReadOnly vs ReadWrite option... it's only ever a copy taken at startup).

I don't think the Glob * alone should be allowed to work, i.e. it shouldn't be possible to configure the system to map ALL Environment Variables by default, since there's no good reason for that... (the person doing the configuration should have some consideration of what environment variables they need to add mapping for).

This would make it easier to use the Sandbox environment for automated test regression suites, without needing to have a full virtualised environment configuration (docker has limitations around automated testing of firewall rules, and lots of other aspects of Windows deployments).

Expected result

I'd like to be able to 'inject' in VSTEST environment variables into the Sandbox environment without having to hardcode them within a batch file.

Actual result

Currently it is very difficult to have such an environment variable within the Sandbox environment aligned with the Host. It would require to have a file which is exchanged from the Host to the Sandbox, and then the Sandbox running a script to parse and populate the environment variables.

Included System Information

No response