# Microsoft eXecution Container (MXC) Microsoft eXecution Container (MXC) is an open-source ([[MIT License]]) sandboxed code execution system from Microsoft for running untrusted code (model outputs, plugins, tools) safely on Windows, Linux, and macOS. Instead of shipping one isolation technology, it puts multiple containment backends, from OS-native process sandboxes to full VMs, behind a unified JSON configuration schema and a TypeScript SDK. It is the engine behind [[GitHub Copilot Sandboxing|local sandboxing in GitHub Copilot CLI]]. ## Architecture - **Policy-driven**: JSON configs (versioned schemas) define execution parameters and security policy across three layers: filesystem (read-only/read-write path whitelists), network (allow/block outbound, proxy support), and UI (clipboard, display, GUI access) - **Lifecycle**: one-shot execution or a stateful provision → start → exec → stop → deprovision flow - **Implementation**: Rust native binaries and shared library crates, wrapped by the `@microsoft/mxc-sdk` npm package ## Per-OS backends | OS | Default backend | Alternatives | |----|-----------------|--------------| | Windows | ProcessContainer (Windows 11 24H2+, AppContainer-based) | [[Windows Sandbox]], WSLC, MicroVM (NanVix), Hyperlight, IsolationSession | | Linux | Bubblewrap (namespaces + seccomp) | LXC, MicroVM, Hyperlight | | macOS | Seatbelt (`sandbox-exec` profiles) | | ## Caveats Early preview. From the README: "no MXC profiles should be treated as security boundaries currently" and the default policies generated by the SDK are "overly permissive". Denied paths are not yet supported on Windows, and network proxying is cooperative (not enforced) on Linux/macOS. Treat it as a guardrail against accidents, not as a boundary against a determined attacker, at least for now. ## References - Repository: https://github.com/microsoft/mxc - TypeScript SDK: https://www.npmjs.com/package/@microsoft/mxc-sdk - Used by Copilot CLI local sandboxing: https://docs.github.com/en/copilot/concepts/agents/copilot-cli/understanding-local-sandboxing ## Related - [[GitHub Copilot Sandboxing]] - [[GitHub Copilot CLI]] - [[Windows Sandbox]] - [[Docker Sandboxes]] - [[OpenSandbox]] - [[AI Agents]] - [[AI Agent Permissions]] - [[microVM]]