News › security
By The Linux Camp News, October 11, 2026
MXC puts workload permissions outside an agent's control and maps them to platform sandboxes. Linux defaults to Bubblewrap, but a shared interface does not mean identical isolation across backends.
Microsoft announced Microsoft Execution Containers, or MXC, on October 7, 2026, as a containment system for untrusted code on Windows, Linux and macOS. Its scope includes model output, plugins and tools, with options ranging from operating-system process sandboxes to virtual machines. For Linux engineers integrating agents into development workflows, this is an application-facing execution layer rather than a single new container backend. 1 2
MXC embeds in the calling application through an SDK, a software development kit. The application supplies a container type, containment rules and a command; MXC validates that request, selects the backend and launches the workload. The important separation is between the code being run and the policy governing it. Microsoft says the policy stays outside the workload's control, so generated code cannot authorize its own additional access. Enforcement belongs to the selected containment environment, not to the agent's willingness to follow instructions. 2 1
The operational difference is resource-scoped execution instead of automatically delegating the signed-in user's authority. Filesystem policies distinguish read-only, writable and denied paths; networking controls include proxies and outbound restrictions. This lets an integrator separate resources a task may inspect from those it may change. Host filtering is explicitly backend-dependent, however. A reasonable operational inference is that policy portability must be checked control by control, rather than assumed from the common interface. 1 2
In the repository documentation retrieved October 11, 2026, Bubblewrap is the default Linux backend on x64 and ARM64, with LXC, MicroVM and Hyperlight listed as alternatives. Microsoft's announcement labels MicroVM support on Linux and Windows 11 experimental and says backend security properties differ. Choosing a backend therefore requires evaluating its isolation boundary against the workload, not treating general availability as a guarantee that every option offers equivalent protection. 2 1
Integration can use packaged Rust, .NET or Node SDKs without cloning the repository. Node and .NET packages include native runtime assets; Rust builds the engine and selected backends into the consuming application. Plan to test legitimate workload access before deployment: Microsoft warns that initial policies may block required capabilities. Reviewing those denials provides a reason to add a specific permission, rather than broadly expanding access just to make a tool run. 2 1
Do not assume the documented policy-authoring diagnostics are Linux features. The announcement restricts agent activity reports to Windows process containers. Separately, the repository warns that audit mode turns off all sandbox security and must never run untrusted code. That makes audit a trusted-tool policy-authoring facility, not a safe way to investigate an unfamiliar agent workload while retaining containment. 1 2
The verified release milestone is general availability, not a dated 1.0.0 changelog. A Windows issue reporter identifies SDK 1.0.0 in their environment, but that establishes neither its publication date nor its changes from earlier packages. The supplied material therefore does not support assigning every documented capability to that exact release. 1 3