Issues

New issue

Process container: backend policy rejections exit -1 with a generic backend_error code
#1247 · theelliotm opened on Sep 23, 2026

Allow mapping a host file source to a different destination path in the sandbox
microsoft/mxc#1366 · opened on Oct 1, 2026
1
concurrent_grant_revoke_never_corrupts_the_store is flaky
Bug
microsoft/mxc#1365 · opened on Oct 1, 2026
[LXC] Halve the launch time of networked containers with optional removal of a duplicate ARP check
Feature
microsoft/mxc#1357 · opened on Sep 30, 2026
Add the Rust SDK crates.io release pipeline
Task
microsoft/mxc#1306 · opened on Sep 28, 2026
1
[Cross-backend] Relative process.cwd is resolved against the host process's working directory
Bug
microsoft/mxc#1299 · opened on Sep 27, 2026
Add network into capture denials
Task
microsoft/mxc#1286 · opened on Sep 25, 2026
SDK samples needed for each supported SDK.
Task
microsoft/mxc#1281 · opened on Sep 25, 2026
Cross SDK public API surface alignment for creating containers
Task
microsoft/mxc#1280 · opened on Sep 25, 2026
4
Seatbelt: support native name and Unix-socket path exclusions without filesystem scans
Feature
microsoft/mxc#1277 · opened on Sep 25, 2026
mxc-sdk: diagnostic.js runs a PATH-resolved whoami at import time, even with diagnostics off
Bug
microsoft/mxc#1265 · opened on Sep 24, 2026
Support container-scoped CA roots for BaseContainer proxy workloads
Feature
microsoft/mxc#1262 · opened on Sep 24, 2026
processcontainer: egress deny + hostLoopback deny hangs asyncio servers — intra-container loopback (socketpair) is blocked
Bug
microsoft/mxc#1261 · opened on Sep 24, 2026
processcontainer: support device-class capabilities (e.g. webcam) — capability strings are always hashed via DeriveCapabilitySidsFromName
Feature
microsoft/mxc#1260 · opened on Sep 24, 2026
Integration surface for checkpoint/resume across hosts
Bug
microsoft/mxc#1172 · opened on Sep 15, 2026
1
Support of smolvm backend
Feature
microsoft/mxc#1117 · opened on Sep 5, 2026
ProcessContainer: MSYS2/Cygwin runtimes (git-bash) cannot initialize — NtCreateDirectoryObject(\BaseNamedObjects\...) denied
Feature
microsoft/mxc#1061 · opened on Aug 28, 2026
4
LXC: protocol: any combined with a port lowers only TCP and UDP, narrowing deny rules
Bug
microsoft/mxc#1000 · opened on Aug 22, 2026
3
apple-containers support
Feature
microsoft/mxc#958 · opened on Aug 19, 2026
1
New containment backend: macOS hardware isolation via Apple Virtualization.framework (VZ Linux microVM)
Feature
microsoft/mxc#927 · opened on Aug 17, 2026
1
WSLc one-shot silently ignores process.cwd when it is not a Windows drive path
Bug
microsoft/mxc#872 · opened on Aug 14, 2026
2
Remove ETL files from captureDenials
Feature
microsoft/mxc#826 · opened on Aug 12, 2026
1
[WSLC] One-shot vs state-aware network-policy parity: fail-open redundant host lists and dropped portMappings
Bug
microsoft/mxc#824 · opened on Aug 12, 2026
2
Networking not available with windows sandbox isolation (containment is windows_sandbox)
Bug
microsoft/mxc#793 · opened on Aug 9, 2026
2
Hyperlight blockedHosts overrides defaultPolicy=block
Bug
microsoft/mxc#786 · opened on Aug 8, 2026
1
feat: Add Quicksand (QEMU-based VM) backend support for MXC
Feature
microsoft/mxc#781 · opened on Aug 8, 2026
2

Navigation Menu

Issues

Issues

Allow mapping a host file source to a different destination path in the sandbox

concurrent_grant_revoke_never_corrupts_the_store is flaky

[LXC] Halve the launch time of networked containers with optional removal of a duplicate ARP check

Add the Rust SDK crates.io release pipeline

[Cross-backend] Relative process.cwd is resolved against the host process's working directory

Add network into capture denials

SDK samples needed for each supported SDK.

Cross SDK public API surface alignment for creating containers

Seatbelt: support native name and Unix-socket path exclusions without filesystem scans

mxc-sdk: diagnostic.js runs a PATH-resolved `whoami` at import time, even with diagnostics off

Support container-scoped CA roots for BaseContainer proxy workloads

processcontainer: egress deny + hostLoopback deny hangs asyncio servers — intra-container loopback (socketpair) is blocked

processcontainer: support device-class capabilities (e.g. webcam) — capability strings are always hashed via DeriveCapabilitySidsFromName

Integration surface for checkpoint/resume across hosts

Support of smolvm backend

ProcessContainer: MSYS2/Cygwin runtimes (git-bash) cannot initialize — NtCreateDirectoryObject(\BaseNamedObjects\...) denied

LXC: `protocol: any` combined with a port lowers only TCP and UDP, narrowing deny rules

apple-containers support

New containment backend: macOS hardware isolation via Apple Virtualization.framework (VZ Linux microVM)

WSLc one-shot silently ignores process.cwd when it is not a Windows drive path

Remove ETL files from captureDenials

[WSLC] One-shot vs state-aware network-policy parity: fail-open redundant host lists and dropped portMappings

Networking not available with windows sandbox isolation (containment is windows_sandbox)

Hyperlight blockedHosts overrides defaultPolicy=block

feat: Add Quicksand (QEMU-based VM) backend support for MXC