microsoft/mxc

What it claims

MXC is a library, not a service. The SDK and the selected containment backend run in process inside your application. Your app supplies three things: the container type, the containment rules, and the workload command. MXC validates the request, picks the backend, and launches the workload. Container-creation requests and security policies are versioned JSON with a stable schema. Execution can be one-shot, or state-aware with a provision → start → execute → stop → deprovision lifecycle for persistent containers.

How to use it

You install through a package manager and do not need to clone the repo. The Node and .NET packages ship the native runtime assets. The Rust crate compiles the SDK, engine and selected backends directly into your binary.

The Node API shape, from the README:

import { spawn, type ContainerRequest } from '@microsoft/mxc-sdk/v1';
const request: ContainerRequest = {
  command: 'node -e "console.log(\'hello from container\')"',
  network: { egress: { default: 'deny' } },
  timeoutMs: 30_000,
};
const child = await spawn(request);

The SDK is imported from a versioned path (/v1). Egress is expressed as a default-deny rule.

If you cannot embed the SDK, platform executor binaries such as wxc-exec.exe accept the same JSON requests. The README positions these for testing. Native executors reserve stdin, stdout and stderr for the workload, so diagnostics are opt-in:

wxc-exec.exe --debug config.json

Policy authoring. The README expects you to hit access-denied failures until your rules are tuned. On supported Windows releases, audit mode records the accesses a trusted tool actually makes and reconstructs a ProcessContainer policy from them:

wxc-exec.exe --audit policy.json

Building from source is only needed when you are changing MXC or its native runtime, or when you want the standalone executors. It requires:

• Rust pinned to 1.93 via src/rust-toolchain.toml
• Node.js 24+ and npm
• each backend's own platform toolchain

build.bat --all             # Windows
./build.sh --all            # Linux
./build-mac.sh --all        # macOS, native arch

Limits

• --audit disables all sandbox security for the workload. Never use it on untrusted code. Use it only to profile a trusted tool and derive its policy.
• Audit-based policy generation is described only for Windows and only for ProcessContainer.
• Network host filtering is backend-dependent. A policy that filters hosts on one backend may not be enforced the same way on another. Check this for your target backend.
• The page marks some backends as experimental, but the fetched text does not say which ones. Check the backend table before choosing.
• Telemetry: official Microsoft builds can send diagnostic telemetry. It is sent only when all of these hold:
• the individual run opts in,
• the Windows user has consented,
• admin policy permits collection,
• your app enables the option in the request.

Admins can block telemetry but cannot consent on the user's behalf. Local open-source builds don't route telemetry to Microsoft, and telemetry is a no-op on non-Windows platforms.

• The licence is referenced only as LICENSE.md. The fetched text does not name it, so check it before adopting.