0.3.46 — Native Linux and experimental Windows backends

What's new

• Add Bubblewrap and NsJail backends for local Linux execution without container images or a container daemon, with private workspaces, configurable seccomp policies, resource limits, and networking disabled by default.
• Add experimental Windows MXC and WSL2 Bubblewrap adapters. MXC runs native Windows Python and JavaScript through a trusted helper; WSL2 runs Linux tools in an explicitly selected distribution.
• Add backend registration and capability discovery, plus configuration guides, security-boundary documentation, and examples.
• Strengthen regression coverage for filesystem confinement, subprocess lifecycle, output limits, Windows artifact handling, and wheel packaging.
• Update development dependencies and require wheels for SDK dependency installs.

Main feature: #233. SDK CI fix: #232.

Upgrade and prerequisites

python -m pip install --upgrade 'llm-sandbox==0.3.46'

Preserve your existing extras when upgrading, for example llm-sandbox[docker]==0.3.46. Python 3.10+ remains required, and Docker remains the default backend.

The new backends require explicit selection and host prerequisites:

• Bubblewrap: Linux user namespaces, Bubblewrap 0.8.0+, system libseccomp, and the desired host language runtime.
• NsJail: Kafel support and the new mount API, available in NsJail 3.6, with a host that permits the required mount operations.
• Windows MXC (experimental): a PSEC-capable Windows host and a trusted native helper. This release's PyPI workflow publishes a generic Python wheel and source distribution; it does not publish the Windows platform wheels built in CI. Build the helper separately and select it with an absolute mxc_path.
• WSL2 Bubblewrap (experimental): an explicit WSL2 distribution with Bubblewrap prerequisites and a matching llm-sandbox package version and implementation.

See the backend requirements and native helper instructions.

Validation

All 19 GitHub checks passed at 2e87226, including Python 3.10–3.13 tests/type checks, quality and documentation checks, native Linux integration tests, and Windows helper/wheel builds for AMD64 and ARM64. Windows build success is not evidence that PSEC or WSL2 enforcement was exercised on every runner.

Full changelog: 0.3.45...0.3.46