MXC SDK v0.8.0

MXC v0.8.0

MXC v0.8.0 is focused on a more consistent, fail-closed sandboxing experience across Windows, Linux, and macOS.

NPM release: https://www.npmjs.com/package/@microsoft/mxc-sdk/v/0.8.0

See assets section for the mxc-release-binaries.zip file which contains all signed production binaries + pdbs for the MXC project.

What's New in v0.8.0

Schema 0.8 is now stable

0.8.0-alpha is now the current immutable stable policy schema and the recommended version for new policies. Existing 0.6 and 0.7 policies remain supported.

Stronger cross-platform networking

The new directional network policy separates:

• Outbound traffic with IP/CIDR, protocol, and port rules
• Inbound and host-loopback access
• Container HTTP/S proxy configuration

Network permissions remain deny-by-default. ProcessContainer, Bubblewrap, LXC, and Seatbelt now validate the shared 0.8 contract and reject policies they cannot safely enforce instead of silently weakening them.

Safer proxy-only egress

Windows Process Container, Bubblewrap, LXC, and Seatbelt support schema 0.8 proxy-only egress on their enforcing paths. When platform prerequisites are met, MXC blocks direct network access and permits only the configured loopback HTTP/S proxy endpoint. Unsupported policy combinations are rejected rather than silently weakened.

Windows ProcessContainer proxy configurations have additional platform-specific requirements. See the ProcessContainer schema 0.8 proxy example for configuration and support details.

Windows ProcessContainer diagnostics

On Windows, ProcessContainer adds Learning Mode-powered denial capture. Applications can record resources blocked by a policy, use those results to refine the policy, and receive more actionable platform error details through the SDK. See the Learning Mode and denial-capture documentation.

Windows ProcessContainer availability

Important

To use the latest Windows ProcessContainer features today, use Windows Insider Preview Build 26340.9212 or higher.

Windows 11 24H2 and 25H2 machines do not yet include all of the required OS-side changes, so ProcessContainer will not be fully featured on those builds. Updates bringing these changes to 24H2 and 25H2 are expected in the coming weeks.

Experimental backend progress

WSLc, IsolationSession, and Windows Sandbox gain major state-aware lifecycle improvements. These backends still require explicit experimental opt-in and are not part of the stable schema surface.

Change log

• Add NANVIX_BIN env var for offline nanvix binary prefetching by Huzaifa Danish (@huzaifa-d) in #519
• ci: restore templateContext.rust so 1ES Setup/Restore work on the official build by Branden Bonaby (@bbonaby) in #526
• ci(gha): mirror ADO PR pipeline as split, reusable GHA workflows by Branden Bonaby (@bbonaby) in #510
• ci: split official and unofficial 1ES pipeline entry points by Branden Bonaby (@bbonaby) in #522
• ci: fix versioning Rust toolchain sync check for new template layout by Branden Bonaby (@bbonaby) in #529
• NanVix backend: host networking support by Huzaifa Danish (@huzaifa-d) in #531
• chore: bump hyperlight-unikraft to v0.10.0 by Dan Chiarlone (@danbugs) in #534
• [LXC] Enable LXC integration tests on GHA Linux runners by Soham Das (@SohamDas2021) in #532
• [WSLC] Reject UNC paths in WSLC filesystem policy by Soham Das (@SohamDas2021) in #537
• fix(bwrap): default to deny-by-default filesystem (mirror seatbelt) by Carlos Alexandro Becker (@caarlos0) in #482
• chore: declare MIT license metadata for all crates by Carlos Alexandro Becker (@caarlos0) in #538
• chore(deps-dev): bump tar from 7.5.13 to 7.5.16 in /sdk by Dependabot (@dependabot)[bot] in #536
• chore(deps-dev): bump form-data from 4.0.5 to 4.0.6 in /tests/playground by Dependabot (@dependabot)[bot] in #535
• chore(deps-dev): bump undici from 6.26.0 to 6.27.0 in /tests/playground by Dependabot (@dependabot)[bot] in #548
• test(e2e): characterize executor run-to-completion behavior by Gudge (@MGudgin) in #540
• Prune orphaned-state DACL ACEs whose target no longer exists by Gudge (@MGudgin) in #517
• ci: pin rustup-init version and verify SHA-256 in the public toolchain template by Gudge (@MGudgin) in #502
• Centralize the tempfile dev-dependency in workspace deps by Gudge (@MGudgin) in #516
• Remove GitHub build exclusions by Branden Bonaby (@bbonaby) in #549
• Remove stale TS CLI References by Gudge (@MGudgin) in #539
• [WSLC] Enable portMappings for WSLC (TCP host->container forwarding) by Soham Das (@SohamDas2021) in #530
• Schema codegen: generate the dev schema from the Rust wire model by Gudge (@MGudgin) in #543
• Fix JOB_OBJECT_UILIMIT probe assertions in Win25H2Safe-Tests by Gudge (@MGudgin) in #544
• docs(lxc): replace removed script setting in example config by Gudge (@MGudgin) in #545
• feat(wxc_common): add the sandbox execution interfaces (SandboxBackend / SandboxProcess / Runner) by Carlos Alexandro Becker (@caarlos0) in #554
• refactor(backends): unify the library backends on SandboxBackend + route binaries via Runner by Carlos Alexandro Becker (@caarlos0) in #555
• feat(mxc-sdk): add the importable in-process sandbox library crate by Carlos Alexandro Becker (@caarlos0) in #556
• Make the Windows process-container test harness capability-driven by Gudge (@MGudgin) in #547
• Add dedicated --allow-testing-features gate for builtinTestServer by Gudge (@MGudgin) in #542
• fix(appcontainer): suppress empty console window for piped sandbox children by Carlos Alexandro Becker (@caarlos0) in #569
• Phase 2B: deserialize the parser into the wire model by Gudge (@MGudgin) in #566
• Phase 2B follow-up: use From for wire->domain enum conversions by Gudge (@MGudgin) in #574
• Phase 2C: generate the SDK wire types from a Rust emitter by Gudge (@MGudgin) in #559
• Add filesystem policy path validation (same-path conflict, existence check) by Soham Das (@SohamDas2021) in #551
• Stage isolation_session test collateral into the OS vpack by Branden Bonaby (@bbonaby) in #583
• fix(backends): stop swallowing WinRT/decode failures that corrupt sandbox behavior by Gudge (@MGudgin) in #570
• Sign isolation_session PowerShell scripts staged into the vpack by Branden Bonaby (@bbonaby) in #590
• Phase 2.5: add state-aware SDK wire-type conformance by Gudge (@MGudgin) in #568
• Disable blank issues so all issues get a type set at creation by Demitrius Nelon (@denelon) in #601
• CI: resolve crate dependencies through the public MxcDependencies feed by Branden Bonaby (@bbonaby) in #594
• [Bubblewrap/LXC/WSLC] Add object-based filesystem-policy validation, most restrictive wins by Soham Das (@SohamDas2021) in #593
• ci: bump Lint macOS pool image to macOS-15-arm64 by Richie Gomez (@richiemsft) in #605
• [Bubblewrap/LXC/WSLC] Add filesystem-policy delegation check by Soham Das (@SohamDas2021) in #598
• Add state-aware phase field value conformance by Gudge (@MGudgin) in #595
• CI: add networkisolation featureFlag to onebranch pipeline so it can reachout to ESRP signing by Branden Bonaby (@bbonaby) in #609
• docs: add Windows OS-version policy-support matrix for processcontainer by Gudge (@MGudgin) in #606
• Add gh-aw issue triage workflow with semantic labeling and owner assignment by Huzaifa Danish (@huzaifa-d) with @Copilot in #602
• Plumb deniedPaths to BaseContainer fs_deny, gated on SANDBOX_CAP_FS_DENY by Gudge (@MGudgin) in #603
• chore: bump hyperlight-unikraft to v0.12.1 (crates.io) by Dan Chiarlone (@danbugs) in #591
• feat: add TraceLogging ETW telemetry (experimental) by RamonArjona4 in #493
• .gitignore updates by Gudge (@MGudgin) in #614
• refactor: idiomatic cleanups in wxc_common and the AppContainer/WSLC/LXC backends by Gudge (@MGudgin) in #573
• Fix issue-triage auth: use copilot-requests permission instead of PAT by Huzaifa Danish (@huzaifa-d) in #617
• Triage: reduce failure-report noise, scope repos, and guard against false missing_data by Huzaifa Danish (@huzaifa-d) in #619
• Permissive Learning Mode 1/6 audit skeleton by Lily Barkley (@lilybarkley-msft) in #584
• [Bubblewrap] Resolve bwrap policy mounts by most-specific-path-wins by Soham Das (@SohamDas2021) in #608
• Add CodeQL static analysis workflow for Rust and TypeScript by Huzaifa Danish (@huzaifa-d) in https://github.com/microsoft/mxc/...

MXC SDK v0.7.0

NPM release: https://www.npmjs.com/package/@microsoft/mxc-sdk/v/0.7.0

See assets section for the mxc-release-binaries.zip file which contains all signed production binaries + pdbs for the MXC project.

What's Changed

• Fix RepoRoot path resolution in tests/scripts/*.ps1 by Soham Das (@SohamDas2021) in #475
• Fix fork-PR CI: split Rust build steps into Official / Public templates by Branden Bonaby (@bbonaby) in #481
• Update Linux backend list in README by Dan Chiarlone (@danbugs) in #477
• Fix stale crate paths in .fbs code gen by Gudge (@MGudgin) in #485
• Make .fbs regen script path-robust and simplify README by Gudge (@MGudgin) in #487
• Fix fuzz pipeline: pass --fuzz-dir to cargo-fuzz after crate move by Richie Gomez (@richiemsft) in #491
• Surface portable UI capability facts via --probe by Gudge (@MGudgin) in #490
• Remove stale CLI references from build.sh by Soham Das (@SohamDas2021) in #496
• [build] Fix build failure on non-English Windows by Pedro Henrique Penna (@ppenna) in #499
• ci: add 1ES inventory metadata and TSA options for OS VPack by Branden Bonaby (@bbonaby) in #497
• Stop npm junctioning the integration-test SDK dependency by Gudge (@MGudgin) in #503
• [Bubblewrap/Lxc] Filter resolve_host to IPv4-only addresses by Soham Das (@SohamDas2021) in #505
• versioning phase 0: schema-version sync + config validation CI gates by Gudge (@MGudgin) in #508
• [LXC] Honor process.cwd and process.env in the LXC backend by Soham Das (@SohamDas2021) in #494
• Move to macos-15-arm64 by Gudge (@MGudgin) in #506
• Promote seatbelt from experimental to stable by Richie Gomez (@richiemsft) in #500
• Remove seatbelt from KNOWN_EXPERIMENTAL_BACKENDS by Richie Gomez (@richiemsft) in #514
• Resolve Detail to UIOperation name in diagnostic console by Jeff Whiteside (@jsidewhite) in #513
• Select BaseContainer tier by capability, not symbol presence by Gudge (@MGudgin) in #515
• [WSLC] Add enforcement assertions for WSLC cpuCount/memoryMb; smoke tests for destroyOnExit by Soham Das (@SohamDas2021) in #518
• versioning phase 1: reject unknown top-level config fields by Gudge (@MGudgin) in #509
• schema: freeze 0.7.0-alpha stable, open 0.8.0-dev, bump product to 0.7.0 by Gudge (@MGudgin) in #523
• Add NANVIX_BIN env var for offline nanvix binary prefetching by Huzaifa Danish (@huzaifa-d) in #519
• ci: restore templateContext.rust so 1ES Setup/Restore work on the official build by Branden Bonaby (@bbonaby) in #526

Full Changelog: v0.6.1...v0.7.0-rc1

MXC SDK v0.6.1

NPM release: https://www.npmjs.com/package/@microsoft/mxc-sdk/v/0.6.1

See assets section for the mxc-release-binaries.zip file which contains all signed production binaries + pdbs for the MXC project.

Full Changelog: https://github.com/microsoft/mxc/commits/v0.6.1