Remove legacy CreateProcessInSandbox fallback after PSEC adoption
@bbonaby is already working on this.
Since Sep 10, 2026.
- Dominant language
- Rust
- Stars
- 1.3k
- Forks
- 79
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 117
Description
### Description of the task
After `CreateProcessSecurityEnvironment` (PSEC) reaches critical adoption mass post-9D, remove the transitional `Experimental_CreateProcessInSandbox` (SBOX) execution path from BaseContainer.
The cleanup should:
- remove SBOX export loading, capability probing, request-compatibility checks, FlatBuffer construction, launch handling, diagnostics, and tests;
- make PSEC the sole BaseContainer process-creation contract;
- simplify backend selection and validation so callers no longer need PSEC-to-SBOX fallback handling;
- update ProcessContainer probes and documentation to report only the supported PSEC contract and capabilities;
- preserve AppContainer-tier fallback when PSEC is unavailable or cannot represent a request.
Before removal, confirm the supported Windows population has sufficient PSEC availability and capability coverage for the intended MXC deployment baseline.
### Additional context
PR #1080 retains SBOX as a downlevel compatibility path while adding PSEC 1.1 ingress support. That dual-contract design introduces compatibility checks such as `validate_legacy_sbox_network_contract`; these should be deleted with the rest of the SBOX path once the migration criterion is met.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.