Microsoft Execution Container (MXC) Overview

Microsoft Execution Container (MXC) provides a unified abstraction for sandboxing untrusted code

Microsoft Execution Container (MXC) is a sandboxed code execution system designed to run untrusted workloads—specifically model outputs, plugins, and tools—on Windows, Linux, and macOS. It functions as an SDK dependency that integrates directly into an application, allowing developers to launch workloads within isolated environments using a unified containment model and typed SDKs for Rust, .NET, and Node.js.

Policy-Driven Containment Model

MXC uses JSON-based configurations to define security policies and container-creation requests. This allows developers to specify the container type, containment rules, and the workload command without needing to manage the underlying platform-specific sandbox implementation.

Security Policy Controls

MXC provides granular control over the following areas:

  • Filesystem Policy: Defines read-only, read-write, and denied path lists.
  • Network Policy: Includes proxy support, outbound controls, and host filtering (though capabilities vary by backend).
  • UI Policy: Controls access to the clipboard, display, and GUI elements.

Lifecycle Management

MXC supports a state-aware lifecycle for containers, enabling the provisioning, starting, execution, stopping, and deprovisioning of persistent containers.

Cross-Platform Backend Support

MXC abstracts multiple containment backends, selecting the most appropriate one based on the host operating system.

Runtime Platform Default Backend Other Backends
Windows 11 processcontainer windows_sandbox, wslc, microvm, hyperlight, isolation_session
Linux bubblewrap lxc, microvm, hyperlight
macOS seatbelt None

Note: windows_sandbox, microvm, and hyperlight are currently marked as experimental.

Developer Tooling and Diagnostics

To facilitate the creation of restrictive policies, MXC includes tools to identify and resolve access-denied failures:

  • Debug Console Mode: Using the --debug flag with native executors provides diagnostic output for troubleshooting.
  • Audit Mode: The --audit flag (available on supported Windows releases) allows developers to record observed accesses to reconstruct a ProcessContainer policy that grants only the necessary permissions for a trusted tool. Warning: Audit mode disables all sandbox security and must never be used to run untrusted code.

Community Insights and Technical Critiques

Following the release of MXC, technical discussions on Hacker News highlighted several strengths and weaknesses of the system.

Perceived Utility

Some developers noted that while MXC acts as a frontend for existing tools like Bubblewrap and Seatbelt, the value lies in the consistent SDK and the "learning" mode for policy authoring. One user mentioned that Codex already utilizes MXC on Windows.

Technical Concerns

Critics raised several points regarding the implementation and security:

  • Platform Parity: macOS support is notably limited; specifically, fine-grained networking (hostname/IP/CIDR filtering) is missing for the macOS backend.
  • Codebase Complexity: Some users pointed to the high volume of Rust source lines of code (approximately 350,000 SLOC) and the fact that upstream sandboxes are not vendored, expressing concern over the auditability of the system.
  • Security Implementation: Some contributors claimed to have found sandbox escapes and argued that capability dropping and setuid handling in the Bubblewrap integration were implemented incorrectly.
  • Build System: Critiques were made regarding the build scripts, noting that they perform Windows-exclusive work on all platforms and are heavily dependent on specific binaries.

Alternative Approaches

Discussion participants suggested that WebAssembly (Wasm) runtimes, such as Wasmtime with WASI P3, might be more efficient for sandboxed plugins due to their inherent platform independence and stronger isolation properties compared to OS-level sandboxing.

Sources

Related

  • Dispatch
    Building a safe, effective sandbox to enable Codex on Windows

    OpenAI has implemented a custom sandbox for Codex on Windows to provide secure, restricted execution of coding agents without requiring constant user approval for every command.

  • Project
    apify/mcpc

    mcpc is a universal command‑line client for the Model Context Protocol (MCP). It maps every MCP operation—tools, prompts, resources, tasks, skills, OAuth authentication, and even experimental x402 payments—into intuitive shell commands. Designed for AI agents and developers, it lets you inspect, debug, and script MCP workflows using standard Unix tools (e.g., jq, xargs). Features include persistent named sessions, progressive tool discovery via `grep`, JSON‑only output mode, secure OAuth 2.1 storage (OS keychain or protected file), AI sandboxing, and lightweight cross‑platform support.

  • Project
    superradcompany/microsandbox

    A tool for running untrusted workloads in fast, local microVMs with hardware-level isolation, specifically designed for AI agents and automated code execution.

  • Dispatch
    Meta Muse filesystem export reveals 6.8 GB of internal runtime files

    A Mouse researcher prompted Meta’s Muse agent to archive its visible filesystem, receiving a 6.8 GB zip that exposed internal docs, integration code, container scripts, memory stores, and experimental Home Link hardware guides, prompting a bug‑bounty report that Meta marked “Not Applicable.”

  • Project
    lablup/mlxcel

    A high-performance native Rust runtime for LLM, VLM, and audio inference on Apple Silicon, CUDA, and ROCm, removing Python from the production request path.