← Back to feed

Microsoft published MXC — Microsoft Execution Containers — as an open-source repository on GitHub this week, following an early preview shown at Build on June 2, 2026. The project gives developers a declarative API for running untrusted code in sandboxed containers across Windows, Linux, and macOS, with a unified policy model for filesystem, network, and UI access.

The core problem MXC addresses is practical: AI agents generate code and invoke tools. Those workloads need to run, and running them without containment means a model-generated command can read arbitrary files, make arbitrary network requests, or modify system state. Existing solutions — Docker, cloud VMs, language-level sandboxes — each have significant operational friction and do not share a common policy model. MXC is an SDK, not a daemon, which means it builds into an application directly rather than requiring a separate infrastructure component.

Eight Backends, One API

MXC selects the appropriate containment backend based on runtime platform and developer preference:

• Windows: ProcessContainer, Windows Sandbox, IsolationSession, WSLC
• Linux: LXC, Bubblewrap
• macOS: Seatbelt
• Cross-platform: MicroVM (Nanvix), Hyperlight

The backends range from lightweight OS-level process isolation to full microVM environments. A developer specifies which container type they want in a versioned JSON configuration; MXC validates the request, selects the backend, and launches the workload.

Policy Model

Three policy domains control what the sandboxed workload can reach:

Filesystem: Read-only, read-write, and explicitly denied path lists. An agent given read-only access to a project directory cannot write to it or follow symlinks outside the declared scope.

Network: Proxy configuration, outbound filtering, and backend-dependent host filtering. A workload that should only reach one API endpoint can be constrained to that endpoint without firewall rule changes at the host level.

UI: Clipboard access, display access, and GUI controls. Relevant for computer-use agents that render visual output or read from the user’s clipboard.

SDK Targets

MXC ships SDKs for Rust, .NET, and Node.js. The lifecycle is explicit: provision, start, execute, stop, deprovision. Persistent containers maintain state across multiple execute calls; one-shot containers clean up after a single run. A diagnostics tool surfaces access-denied failures so developers can tighten or loosen policy without guesswork.

Context

The release comes as agent sandboxing has become a recurring engineering problem rather than a theoretical one. Models are being deployed in production agentic workflows that read codebases, write files, call external APIs, and interact with desktop environments. Each of those action types creates a surface for unintended side effects — either from model errors or adversarial prompts that manipulate the agent into acting outside its intended scope.

Microsoft’s approach is infrastructure-level: declare what the workload is allowed to reach before it runs, enforce at the OS, and make the policy readable and versionable. That is a different posture from post-hoc auditing or prompt-level guardrails, which operate on what the model says rather than what the workload does.

The repository is at github.com/microsoft/mxc under an open-source license. The HN thread surfacing it this week suggests early developer interest in the cross-platform story specifically — the combination of Bubblewrap on Linux, Seatbelt on macOS, and Windows Sandbox on Windows under a single JSON configuration is the part that does not currently have a clean alternative.