Deploying Minecraft in a Windows Sandbox for Computer Use Agents

This guide details how to launch a Windows sandbox, install the Java Edition of Minecraft, and enable an agent to control it via the cua-driver MCP server hosted within the guest environment.

Why Minecraft? It serves as a comprehensive stress test for sandbox capabilities. To run successfully, it requires active internet connectivity, a Java runtime environment, a functional GUI driven by click events, and working OpenGL support.

🛠 Version Requirements & Compatibility

To ensure this setup works, you must be on the correct version of the software. The following table outlines the necessary updates:

Hardware Prerequisites

• Local Path: Requires a machine with hardware virtualization. This means an Intel Mac or a Linux x86_64 system with /dev/kvm enabled.
• The CPU Constraint: This guide utilizes -cpu host.
  • Apple Silicon (M1/M2/M3): x86_64 guests on ARM run via TCG emulation, which rejects -cpu host.
  • Solution: Use the Fleet path for Apple Silicon users.

🔄 System Architecture Flow

🚀 Booting the Windows Sandbox

The Image.windows() method defaults to a pinned Windows Server 2022 containerDisk. To make this work for Minecraft, we need three specific modifications:

1. MCP Access: We use .expose(3000) to make the cua-driver MCP server reachable by the agent.
2. Internet Access: The bare-metal runtime defaults to restrict=on for the NIC. While sb.shell.run() still functions, the guest OS is isolated. We must add a second, unrestricted NIC.
3. Graphics Support: The default qemu64 CPU model is insufficient for software-based OpenGL. Without -cpu host, Minecraft will launch its window and then crash silently without logs.

Implementation Code

import asyncio 
from cua import Image, QEMURuntime, Sandbox 

# Configuration for network and CPU
EXTRA_ARGS = [ 
    # Adding a second unrestricted user-mode NIC to bypass restrict=on
    '-netdev', 'user,id=net1,net=10.0.3.0/24,host=10.0.3.2,dns=10.0.3.3', 
    '-device', 'virtio-net-pci,netdev=net1,mac=52:55:00:d1:55:02', 
    # Required for the software OpenGL driver to function
    '-cpu', 'host', 
] 

async def main(): 
    sb = await Sandbox.create( 
        Image.windows().expose(3000), 
        name = 'mc-win', 
        local = True, 
        runtime = QEMURuntime( 
            mode = 'bare-metal', 
            cpu_count = 12, 
            memory_mb = 16384, 
            extra_args = EXTRA_ARGS, 
        ), 
    ) 
    
    # Retrieve the host port mapped to guest port 3000
    mcp_port = sb.exposed_ports[3000] 
    print(f'cua-driver MCP available at http://127.0.0.1:{mcp_port}/mcp') 
    
    await sb.disconnect() # Sandbox continues running in background

asyncio.run(main())

⚠️ Key Technical Nuances

• Boot Time: Expect a "warm boot" to take roughly 30 seconds.
• Port Mapping:
  • sb.exposed_ports is used for local runs because the runtime assigns a random free host port.
  • sb.tunnel.forward(3000) is used for Fleet, as it publishes services rather than mapping local ports.
• Network Collision: Since both user-mode networks might default to 10.0.2.0/24, Windows may assign a link-local address ($169.254.x.x$) to one interface.

Verification Task:

• Confirm internet connectivity before proceeding.

async with Sandbox.connect('mc-win', local = True) as sb: 
    # Check if the Mojang manifest is reachable
    check = await sb.shell.run( 
        'powershell -Command (Invoke-WebRequest -UseBasicParsing ' 
        '\'https://piston-meta.mojang.com/mc/game/version_manifest.json\').StatusCode' 
    ) 
    print(check.stdout) # Should output 200

🎮 Installing the Launcher and OpenGL Driver

The sandbox uses the Microsoft Basic Display Adapter, which only supports OpenGL 1.1. However, modern Minecraft requires a higher version:

$\text{Minecraft 1.17+} \implies \text{OpenGL } \ge 3.2$

To bridge this gap, we install Mesa3D's opengl32.dll (llvmpipe) for software rendering. Note that both Mesa and Prism Launcher require the Visual C++ redistributable, which is missing from Windows Server 2022.

Setup Script (PowerShell)

$ErrorActionPreference = 'Stop' 
$ProgressPreference = 'SilentlyContinue' 
New-Item -ItemType Directory -Force -Path C:\mc | Out-Null 

# 1. Install Prism Launcher (Supports MS device auth, no browser needed)
Invoke-WebRequest -UseBasicParsing -OutFile C:\mc\prism.zip `
 'https://github.com/PrismLauncher/PrismLauncher/releases/download/11.0.3/PrismLauncher-Windows-MinGW-w64-Portable-11.0.3.zip'
Expand-Archive C:\mc\prism.zip -DestinationPath C:\mc\prismw -Force 

# 2. Install 7-Zip (Necessary for extracting Mesa .7z files)
Invoke-WebRequest -UseBasicParsing -OutFile C:\mc\7z.msi `
 'https://www.7-zip.org/a/7z2408-x64.msi'
Start-Process msiexec.exe -ArgumentList '/i', 'C:\mc\7z.msi', '/qn' -Wait 

# 3. Install Mesa3D for software OpenGL 3.2+
Invoke-WebRequest -UseBasicParsing -OutFile C:\mc\mesa.7z `
 'https://github.com/pal1000/mesa-dist-win/releases/download/26.1.6/mesa3d-26.1.6-release-mingw.7z'
& 'C:\Program Files\7-Zip\7z.exe' x C:\mc\mesa.7z -oC:\mc\mesamw -y | Out-Null 

Final Step: Authentication

Because the agent cannot easily navigate a full OAuth flow, Minecraft uses Microsoft device authorization.

1. A unique code will be displayed inside the sandbox.
2. You must manually enter this code into your own web browser to authorize the account.