Skip to content

MXC SDK v0.9.0

Pre-release
Pre-release

Choose a tag to compare

View all tags
@bbonaby bbonaby released this 29 Sep 00:44
· 65 commits to release/v0.0.0-smoketest since this release
v0.9.0
86fb3d2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

MXC v0.9.0 expands the stable sandbox surface with IsolationSession and WSL Container support, telemetry consent APIs, and new Windows ProcessContainer policy capabilities.

NPM release: https://www.npmjs.com/package/@microsoft/mxc-sdk/v/0.9.0

See the Assets section for mxc-release-binaries.zip, which contains the signed production binaries and PDBs for the MXC project.

What's New in v0.9.0

Schema 0.9 is now stable

0.9.0-alpha is the current stable policy schema and the recommended version for new policies. Existing policies using schema 0.6, 0.7, or 0.8 remain supported. Schema 0.10.0-alpha is available for features that are still under development.

Schema 0.9 completes the directional networking transition. New 0.9 policies use network.egress, network.ingress, and, where applicable, runtimeConfig.networkProxy. Policies using earlier schema versions continue to use their existing network fields.

ProcessContainer is available on serviced Windows 11 builds

Windows 11 version 24H2 and 25H2 added Process Isolation for Microsoft Execution Containers in the August 2026 update KB5120998.

The September 2026 update KB5124010 adds the OS support MXC uses for:

  • Container-to-host loopback networking, represented by network.ingress.hostLoopback.
  • Enumerate-only filesystem access, represented by processContainer.filesystem.enumeratePaths. This permits directory queries and listing under the caller's existing access without granting file-content reads.

Install KB5124010 or a later cumulative update on Windows 11 24H2 and 25H2 to use these capabilities. On Windows 11 26H1, install the September 2026 update KB5124006 or a later cumulative update.

IsolationSession and WSL Container join the stable surface

Schema 0.9 is the first stable schema release to include IsolationSession and WSL Container (wslc). Their one-shot and state-aware lifecycle APIs are included in the stable 0.9.0-alpha schema and no longer require experimental opt-in.

IsolationSession requires Windows build 26340.9212 or later with the IsolationSession OS feature enabled.

Both backends support provision, start, exec, stop, and deprovision through the shared lifecycle model.

Windows Sandbox, MicroVM, and Hyperlight remain experimental and use the development 0.10.0-alpha contract.

Explicit environment inheritance

Schema 0.9 adds process.inheritDefaultEnv. Callers can now choose whether a supplied environment replaces the backend default or is layered over it.

Telemetry consent APIs

The Node.js SDK adds APIs to query, request, and withdraw MXC telemetry consent. Applications provide the consent presentation experience; MXC stores its own user decision and applies administrative policy only as an additional restriction.

Telemetry remains Windows-only, requires explicit user consent, and fails
closed.

Cross-platform enforcement and reliability

  • LXC directional networking now handles CIDR carve-outs more safely, waits for container addressing before execution, and fails closed when network initialization is incomplete.
  • Bubblewrap strengthens proxy and firewall enforcement, IPv6 handling, descendant cleanup, and network-provider failure detection.
  • Seatbelt enforces host-loopback policy, improves IPv6 loopback behavior, and fixes working-directory and listener behavior.
  • Learning Mode and denial capture add more actionable diagnostics and more robust stale-session recovery.
  • ProcessContainer selection and capability probing now avoid selecting an OS path that cannot enforce the complete requested policy.

Breaking Changes and Migration Notes

Node.js SDK

  • The minimum supported Node.js version is now 24.
  • Windows requires Node.js 24.21.0 or later within the Node.js 24 release line, or 26.8.0 or later. Node.js 26.8.0 or later is recommended.

Change log

New Contributors

Full Changelog: v0.8.0...v0.9.0

Contributors

caarlos0, shschaefer, and 15 other contributors
Assets 3
Loading