microsoft/mxc

View on GitHub

Policy-driven, layered isolation and containment

Stars: 1.3k
Forks: 79
Open beginner issues: 0
Indexed issues: 58
Avg merge: 2d 7h
Merged PRs (30d): 117

Dominant language: Rust
License: MIT
Last GitHub push: Sep 18, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Open All

58 open issues indexed

README: add a "Community Integrations" section for third-party deployment repos Open

Issue-Docs Issue-Feature

microsoft/mxc#478 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 19, 2026
feat(bwrap): readable preflight errors when a path isn't in the deny-by-default baseline Open

Issue-Feature

microsoft/mxc#507 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 19, 2026
Unify executor binary names to mxc-exec* across platforms Open

Area-Build-Rust Area-Build-TypeScript Area-SDK-Api Issue-Feature Issue-Task OS-Linux OS-MacOS OS-Windows

microsoft/mxc#546 · 1 comment · 0 reactions · 2 assignees · Indexed Sep 19, 2026
Windows Credential Manager support Open

Area-SDK-Policy Container-Process Issue-Feature OS-Windows

microsoft/mxc#607 · 1 comment · 0 reactions · 2 assignees · Indexed Sep 19, 2026
Rename base container to process container in docs and code Open

Container-Process Issue-Feature Issue-Task

microsoft/mxc#610 · 1 comment · 1 reaction · 1 assignee · Indexed Sep 19, 2026
Emit wxc executor errors and warnings as structured ScriptResponse JSON Open

Area-Executor-WXC Container-Process Issue-Feature OS-Windows

microsoft/mxc#612 · 1 comment · 1 reaction · 2 assignees · Indexed Sep 19, 2026
Evaluate flatc/FlatBuffers-driven codegen vs hand-rolled schema/type conformance oracles Open

Area-Build-Rust Area-Build-TypeScript Area-Executor-Schema Area-SDK-Configuration Area-Test-SDK Issue-Feature Issue-Task

microsoft/mxc#613 · 5 comments · 1 reaction · 1 assignee · Indexed Sep 19, 2026
Allow additional Process Container capabilities in the Rust SDK just like in the TypeScript SDK Open

Area-SDK-Api Container-Process OS-Windows Priority1

microsoft/mxc#637 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 19, 2026
Add WASIX / WebAssembly sandbox backend support Open

Area-Build-Rust Area-Executor-Schema Area-SDK-Api Issue-Feature

microsoft/mxc#668 · 2 comments · 0 reactions · 2 assignees · Indexed Sep 19, 2026
Share the telemetry-consent test harness between wxc_common and mxc_ffi Open

Area-Build-Rust Issue-Feature Issue-Task

microsoft/mxc#690 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 19, 2026
Telemetry consent path has no automated coverage in release builds Open

Area-Test-Executor Issue-Feature Issue-Task OS-Windows

microsoft/mxc#691 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 19, 2026
Verify whether newer-SDK/older-executor version skew occurs (justifies permissive experimental block) Open

Area-Executor-Schema Area-SDK-Configuration Issue-Feature Issue-Task

microsoft/mxc#702 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 19, 2026
Unify one-shot and state-aware config parsing Open

Area-Build-Rust Area-SDK-Configuration Issue-Feature Issue-Task

microsoft/mxc#703 · 2 comments · 0 reactions · 1 assignee · Indexed Sep 19, 2026
Harden the default sandbox working directory against DLL/executable planting Open

Area-Executor-Schema Container-Process Issue-Feature Issue-Task OS-Windows

microsoft/mxc#757 · 1 comment · 0 reactions · 2 assignees · Indexed Sep 19, 2026
Make the Windows ProcessContainer tier deterministically selectable for e2e coverage Open

Area-Executor-LXC Area-Test-Executor Container-Process Issue-Feature Issue-Task OS-Windows

microsoft/mxc#758 · 1 comment · 0 reactions · 2 assignees · Indexed Sep 19, 2026
Backend probe: CI gate ensuring every tier/backend stays probe-covered Open

Area-Build-Rust Area-Executor-Schema Area-Test-Executor Container-Process Issue-Feature Issue-Task OS-Windows

microsoft/mxc#769 · 2 comments · 0 reactions · 3 assignees · Indexed Sep 19, 2026
feat: Add Quicksand (QEMU-based VM) backend support for MXC Open

Area-Executor-Schema Area-SDK-Api Container-VM Issue-Feature OS-Linux OS-MacOS OS-Windows

microsoft/mxc#781 · 2 comments · 0 reactions · 2 assignees · Indexed Sep 19, 2026
Hyperlight blockedHosts overrides defaultPolicy=block Open

Container-Hyperlight Issue-Bug OS-Windows Priority2

microsoft/mxc#786 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 19, 2026
NanVix blockedHosts overrides defaultPolicy=block Open

Area-SDK-Policy Container-MicroVM Issue-Bug OS-Windows Priority2

microsoft/mxc#787 · 3 comments · 0 reactions · 1 assignee · Indexed Sep 19, 2026
Networking not available with windows sandbox isolation (containment is windows_sandbox) Open

Area-Executor-Schema Container-VM Issue-Feature OS-Windows

microsoft/mxc#793 · 2 comments · 0 reactions · 1 assignee · Indexed Sep 19, 2026
[WSLC] One-shot vs state-aware network-policy parity: fail-open redundant host lists and dropped portMappings Open

Area-Executor-Schema Area-SDK-Api Area-SDK-Configuration Container-WSLC Issue-Bug OS-Windows Priority2

microsoft/mxc#824 · 2 comments · 0 reactions · 1 assignee · Indexed Sep 19, 2026
Remove ETL files from captureDenials Open

Container-Process Issue-Feature Issue-Task OS-Windows

microsoft/mxc#826 · 1 comment · 0 reactions · 2 assignees · Indexed Sep 19, 2026
note: something to update in the future PRs: We can technically pass in `--audit --dry-run` and we'd start the elevated host-wide WPR session before the runner reaches its dry-run short-circuit. In this case if someone passes in --dry-run we probably don't want to startup a wpr session. Open

Container-Process OS-Windows Priority2

microsoft/mxc#831 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 19, 2026
note: something the bot found which I thought I would at least bring up for your next PR. A stale marker makes later audit starts fail closed, but this error provides neither its path nor a safe recovery procedure, so auditing can remain unavailable indefinitely. Open

Container-Process Issue-Bug OS-Windows Priority2

microsoft/mxc#832 · 1 comment · 0 reactions · 2 assignees · Indexed Sep 19, 2026
State-aware exec streaming + typed-error contract gaps (FFI in-process + CLI executor framing) Open

Area-Executor-Schema Area-SDK-Api Container-WSLC Issue-Task OS-Windows Priority2

microsoft/mxc#843 · 3 comments · 0 reactions · 2 assignees · Indexed Sep 19, 2026
Unify duplicate sha2 versions in the Rust workspace Open

Area-Build-Rust Issue-Feature Issue-Task

microsoft/mxc#844 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 19, 2026
Expose backend-specific configuration in the Rust SDK Open

Area-SDK-Configuration Issue-Feature

microsoft/mxc#887 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 19, 2026
[LXC/Bubblewrap] Network policy: egress enforcement, hook scoping, and proxy pinning Open

Area-Build-Rust Area-Executor-LXC Container-Process Issue-Bug OS-Linux Priority2

microsoft/mxc#896 · 10 comments · 0 reactions · 1 assignee · Indexed Sep 19, 2026
[Cross-backend] process.cwd is silently discarded or resolved against host state Open

Area-Executor-Schema Container-WSLC Issue-Bug OS-Linux OS-MacOS OS-Windows Priority1

microsoft/mxc#902 · 4 comments · 0 reactions · 1 assignee · Indexed Sep 19, 2026
New containment backend: macOS hardware isolation via Apple Virtualization.framework (VZ Linux microVM) Open

Area-Executor-Schema Container-MicroVM Issue-Feature OS-MacOS

microsoft/mxc#927 · 1 comment · 0 reactions · 2 assignees · Indexed Sep 19, 2026
[Bubblewrap] Proxy-only egress: slirp4netns dying mid-run leaves the sandbox with a broken network and no error Open

Area-Executor-LXC Container-Process Issue-Bug OS-Linux Priority2

microsoft/mxc#935 · 2 comments · 0 reactions · 1 assignee · Indexed Sep 19, 2026
[Bubblewrap/SDK] Schema-0.8 network gate: an absent version disables it, and the Node SDK trips it on a field callers never set Open

Area-Executor-Schema Area-SDK-Api Area-SDK-Configuration Issue-Bug OS-Linux Priority3

microsoft/mxc#945 · 2 comments · 0 reactions · 1 assignee · Indexed Sep 19, 2026
Adopt RAII telemetry provider registrations Open

Container-Process Issue-Task OS-Windows

microsoft/mxc#952 · 1 comment · 0 reactions · 2 assignees · Indexed Sep 19, 2026
apple-containers support Open

Container-Process Issue-Feature OS-MacOS

microsoft/mxc#958 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 19, 2026
LXC: `protocol: any` combined with a port lowers only TCP and UDP, narrowing deny rules Open

Area-Executor-LXC Issue-Bug OS-Linux Priority2

microsoft/mxc#1000 · 2 comments · 0 reactions · 1 assignee · Indexed Sep 19, 2026
LXC: live E2E for schema 0.8 directional egress covers only IPv4 Open

Area-Test-Executor Container-Process Issue-Task OS-Linux Priority2

microsoft/mxc#1001 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 19, 2026
[Schema 0.8] Contradictory spec and parser semantics for an omitted network.ingress.hostLoopback Open

Area-Executor-Schema Area-SDK-Policy Issue-Bug OS-Linux OS-MacOS OS-Windows Priority1

microsoft/mxc#1032 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 19, 2026
[WSLC] Promote WSLC, move it out of experimental Open

Container-WSLC Issue-Task OS-Windows Priority2

microsoft/mxc#1049 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 19, 2026
ProcessContainer: MSYS2/Cygwin runtimes (git-bash) cannot initialize — NtCreateDirectoryObject(\BaseNamedObjects\...) denied Open

Container-Process Issue-Feature OS-Linux OS-Windows

microsoft/mxc#1061 · 3 comments · 0 reactions · 2 assignees · Indexed Sep 19, 2026
[SDK] Node SDK rejects network.proxy on LXC, which the backend has supported since #798 Open

Area-SDK-Api Issue-Bug OS-Linux Priority2

microsoft/mxc#1074 · 1 comment · 0 reactions · 1 assignee · Indexed Sep 19, 2026
Centralize state-aware telemetry version handling in native execution boundary Open

Issue-Bug OS-Windows Priority1

microsoft/mxc#1085 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 19, 2026
Reuse shared native policy parsing in mxc_ffi Open

Issue-Task Needs-Triage

microsoft/mxc#1090 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 19, 2026
Flaky PLM inherited-output test can miss PID file after 30 seconds Open

Issue-Bug Needs-Triage OS-Windows

microsoft/mxc#1098 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 19, 2026
[WSLC] Decide whether the shipped C# NuGet enables WSLc, and document wslcsdk.dll for Rust SDK consumers Open

Issue-Bug Priority2

microsoft/mxc#1106 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 19, 2026
Support of smolvm backend Open

Container-VM Issue-Feature

microsoft/mxc#1117 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 19, 2026
Remove legacy CreateProcessInSandbox fallback after PSEC adoption Open

Issue-Task

microsoft/mxc#1129 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 19, 2026
Pin logger output in corpus diagnostic-divergence expectations Open

Issue-Task Needs-Triage

microsoft/mxc#1142 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 19, 2026
Default PATH behavior is inconsistent across Linux and macOS backends Open

Issue-Bug OS-Linux OS-MacOS Priority1

microsoft/mxc#1153 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 19, 2026
inheritDefaultEnv is not honored on IsolationSession or WSLc Open

Issue-Bug OS-Windows

microsoft/mxc#1165 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 19, 2026
[WSLC] State-aware daemon protocol flattens every backend failure to `backend_error`, discarding its typed classification Open

Area-SDK-Api Container-WSLC Issue-Bug Needs-Triage OS-Windows Priority2

microsoft/mxc#1167 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 19, 2026

microsoft/mxc

Get new issues in your inbox