Pimp My IDE / garage dispatchBack to the garage
October 9, 2026 / agent sandboxes / backend identity

One API. Different cages.

A cross-platform sandbox call can select different kernels, policies, and failure modes. Record the backend that ran, not only the request you sent.

Portable syntax is not portable containment.
Unified requestHost-selected backend
Policy
request
Observed
containment
The receipt needs both sides: requested policy and enforced backend.

A common call does not make a common boundary.

Microsoft released MXC as an SDK for running untrusted code across Windows, Linux, and macOS. Its README lists ProcessContainer as the Windows default, Bubblewrap as the Linux default, and Seatbelt as the macOS backend. It also lists other Windows and Linux backends, with several marked experimental.[1]

The common request can name a command, filesystem policy, network policy, UI policy, timeout, and containment choice. The useful abstraction is real. So is the gap underneath it. Each host turns that request into a different native mechanism.

Save the policy you asked for, the backend that answered, and the denial that proved it.

Discovery is not a launch receipt.

The current Node API has separate calls for platform support, available backends, dry-run validation, and execution. The documentation says backend availability is advisory. It also says validation does not guarantee that a later operation will succeed on a changed host.[2]

Keep those states separate. Discovery says what this host reports now. Validation says a typed request passes a preflight. Execution says a workload started and returned a result. A negative test says the boundary stopped the access you expected it to stop.

The policy builder owns the sharp edge.

Bubblewrap's own README says it builds sandbox environments. It is not a ready-made sandbox with one fixed security policy. The protection depends on the arguments supplied by the program that invokes it. The document calls out mounted resources, D-Bus sockets, terminal isolation, and seccomp choices as places where the caller can weaken the result.[3]

A wrapper can make policy easier to express. It cannot erase the backend's operating model. Test filesystem, network, process, UI, and cleanup behavior on every supported host class. Do not infer one platform's result from another platform's matching JSON.

Audit mode changes the test.

MXC documents a Windows audit path that records ungranted checks while allowing them. Its deny-and-record path keeps failed accesses blocked. These are different experiments. A permissive policy-authoring run cannot prove deny-by-default containment because the run disabled that enforcement.[1]

Put the mode in the receipt. Mark permissive output as policy-authoring evidence. Then rerun the finished policy with enforcement on and force denied file, network, process, and UI actions. The proof is the blocked action and its independent witness.

The package is inspectable. This run did not execute it.

The npm registry served @microsoft/mxc-sdk version 1.0.0. We downloaded its package archive, confirmed its published metadata, and inspected its JavaScript declarations and bundled native assets. The archive SHA-256 was 39e59ffd9d0832334889b0cd583d0beb43b1bbbe9f783dd7c6980203d23e9602.[4]

We did not install dependencies or launch a contained workload. That would execute native host code and change this inspection from read-only intake into a sandbox trial. The transfer case below drafts a test matrix. It does not report that MXC or any backend passed it.

Interactive makeover / generic sandbox badge replaced

Build a backend test card.

This browser-local transfer case joins host selection, required negative tests, a physical route, and a copyable receipt. It defines a test. It does not inspect your host or execute a sandbox.

Select hostProbe backendRun denialsClose receipt

Host transfer case

Choose the host class the real fixture will use. The backend shown is the documented default, not a live probe.

Choose host and documented default backend

Required negative tests

Select required negative tests
Test card / structure only

Transfer route

WINDOWS
PROCESSCONTAINER
0 OF 4
TESTS SELECTED
Test matrix openSelect the negative tests the real host run must perform.
Sources read / October 9, 2026

Source log

Open the evidence boundary
  1. Microsoft, MXC repository at revision 3c2d57f, read October 9, 2026. We read the README, API reference, diagnostics guide, and access-denial documentation. These are the sources for architecture, default backends, request fields, lifecycle, validation, and audit-mode behavior.
  2. Microsoft, MXC Node V1 operation signatures, read October 9, 2026. This is the source for discovery, validation, execution, advisory-availability language, and the warning that validation does not guarantee a later launch.
  3. Bubblewrap README, read October 9, 2026. This is the source for Bubblewrap's policy-builder boundary, namespace mechanisms, and the security effect of caller-selected arguments.
  4. @microsoft/mxc-sdk 1.0.0 on npm, archive fetched October 9, 2026. We inspected the package metadata, public declarations, and file inventory. We did not install dependencies or execute its native assets.
  5. Hacker News discussion, "MXC - a sandboxed code execution system", item 50016489, read October 9, 2026. The exact item URL came from the Hacker News API. The discussion was a discovery source and does not verify repository claims.

Artifact boundary: the npm archive was fetched and inspected read-only. No dependency install, native backend probe, workload launch, denial test, or cleanup test was performed. Every state produced by the transfer case is a test-plan state.