mxc

Can MXC JSON be used for configuration of OS-portable sandboxing policies with OpenShell, too? "feat(ai-sandbox): accept MXC policy JSON for protected execution · westurner/sandbox@7538c33" https://github.com/westurner/sandbox/commit/7538c3386af8cb62... "bwrap: Add the option to skip the procfs mount · Pull Request #1508 · microsoft/mxc" https://github.com/microsoft/mxc/pull/1508 "Manage Sandboxes | NVIDIA OpenShell" https://docs.nvidia.com/openshell/latest/how-it-works/sandbo... To sandbox LSP servers in sphinxdocrs with bwrap in rootless containers, we needed to add a --no-procfs-mount CLI arg (and MXC JSON) to sandboxes, because you can't mount /proc in a rootless container.

Microsoft has mxc which I think is neat — not sure if it’s the right level of abstraction for your needs https://github.com/microsoft/mxc

Most of the features are undocumented. I think because most of the behavior is not really defined and varies greatly between the different backends. The backends are also not documented, you need to try out what's working and what isn't working. It doesn't explain the supported and unsupported features of each backend, neither their quirks. A lot of behavior is surprising. For example if you have powershell in path on windows inside MXC it will just silently add the whole C drive with read-only permissions. Circumventing all other policies. https://github.com/microsoft/mxc/issues/1455 A lot of common error cases regularly happen and don't provide reasonable error messages. No documentation how to deal with them. Check the issues on GitHub, there are many things that are expected to just work and they don't. One would at least expect some

> Even if LLMs would produce perfect, high quality code all the time, Microsoft just introduced MXC: "...for running untrusted code (model output ..." https://github.com/microsoft/mxc

This is promising, but there's one feature that's missing that I really care about: fine-grained networking. They have this for Windows and Linux, but it's sadly missing for macOS - see the support table here: https://github.com/microsoft/mxc/blob/main/docs/backends/sea... Things macOS is missing include "Allow/deny by hostname" and "Allow/deny by IP, CIDR, port, or protocol". The rest all looks great, and if you are on Linux or Windows those restrictions don't apply. I guess this is the universal challenge of building an abstraction layer over multiple different technologies.

See Kata containers. https://katacontainers.io/ For ultimate security, containers alone aren't enough. Windows is also having a similar feature on top of WSL, announced at BUILD. https://github.com/microsoft/mxc

Microsoft is working on this with their new execution containers (https://github.com/microsoft/mxc)