MXC: A Framework for Secure, Sandboxed Code Execution

The Microsoft eXecution Container (MXC) is a sophisticated system engineered to run unsafe untrusted code—such as tool outputs, plugins, or LLM-generated code—within a secure, isolated environment. It supports Windows, Linux, and macOS, providing a unified containment model and strongly typed SDKs that abstract away the complexity of various isolation backends.

🚀 Core Capabilities

MXC offers a layered approach to containment, ensuring that workloads are restricted based on strict security policies.

• Cross-Platform Versatility: Native support for the three major OS families using the most appropriate local isolation technology.
• JSON-Centric Configuration: Utilizes versioned schemas for defining security policies and container requests.
• Diverse Containment Backends: Supports a wide array of isolation levels, including:
  • ProcessContainer, Windows Sandbox, LXC, Bubblewrap, Seatbelt, MicroVM (Nanvix), Hyperlight, IsolationSession, and WSLC.
• Granular Policy Control:
  • Filesystem: Define paths as read-only, read-write, or denied.
  • Networking: Manage outbound traffic, utilize proxies, and apply host filtering (depending on the backend).
  • User Interface: Control access to the display, GUI elements, and the system clipboard.
• Managed Lifecycle: Containers follow a state-aware progression: $\text{Provision} \rightarrow \text{Start} \rightarrow \text{Execute} \rightarrow \text{Stop} \rightarrow \text{Deprovision}$
• Developer Tooling: Comprehensive SDKs for Rust, .NET, and Node.js, along with diagnostic tools to troubleshoot "access denied" errors.

---

🛠️ How MXC Operates

The system acts as a bridge between your high-level application logic and the low-level OS isolation primitives.

The Workflow:

1. The application defines the container type, the security rules, and the command to run.
2. MXC validates these parameters.
3. The appropriate backend is selected to launch the workload in total isolation.

Backend Compatibility Matrix

* Denotes experimental backends.

---

📦 Integration and Consumption

SDK Availability

Depending on your language preference, you can integrate MXC via the following packages:

Non-SDK Usage

For scenarios where embedding an SDK isn't feasible (e.g., testing), you can use platform-specific binaries like wxc-exec.exe. These tools accept a JSON request based on the stable schema.

---

💻 Execution Example

Below is a brief example of how to spawn a contained process using the Node.js SDK:

import { spawn, type ContainerRequest } from '@microsoft/mxc-sdk/v1';

const request: ContainerRequest = {
  command: 'node -e "console.log(\'hello from container\')"',
  network: { 
    egress: { default: 'deny' } 
  },
  timeoutMs: 30_000,
};

const child = await spawn(request);

---

🔍 Diagnostics and Policy Tuning

Because sandboxes are restrictive by nature, you will likely encounter access errors during development. MXC provides two primary modes to resolve this:

1. Debug Console Mode

Standard I/O is usually reserved for the workload. To see MXC's internal diagnostic logs, use the --debug flag: wxc-exec.exe --debug config.json

2. Audit Mode

[!WARNING] Security Risk: The --audit flag disables all sandbox security for the workload. Use this only for analysis.

Audit mode allows policy authors to observe exactly what files and capabilities a tool attempts to access. This data is used to build a precise ProcessContainer policy.

• Execution: wxc-exec.exe --audit policy.json (Supported on specific Windows releases).
• Result: MXC generates artifacts detailing observed accesses to help refine the "deny-and-record" workflow.

---

📊 Telemetry and Privacy

Official Microsoft distributions may collect diagnostic telemetry, subject to the following strict conditions:

• Individual run must opt-in.
• Windows user must provide explicit consent.
• Administrative policies must permit collection.
• The application must enable the telemetry option in the request.

Key Privacy Notes:

• Administrators can block telemetry but cannot force consent on behalf of a user.
• Open-source builds do not route telemetry to Microsoft.
• Telemetry is a no-op (non-functional) on non-Windows platforms.

---

🛠️ Getting Started Checklist

• Select the appropriate SDK for your project.
• Define your workload's filesystem and network requirements.
• Test the workload using --audit mode to refine policies.
• Deploy using the platform-specific default backend.