sandboxing

MXC is Microsoft's MIT-licensed SDK for running untrusted code, including model output, plugins and tools, under one deny-by-default policy that it maps to Seatbelt on macOS, bubblewrap on Linux and ProcessContainer on Windows. Here is what MXC SDK 1.0.1 and schema 1.0.0 actually define, how Copilot CLI hands it a policy per process, and what stays outside the box.

Turn on the local sandbox for everyday Copilot CLI work, move to a cloud sandbox when the code or the task should never touch your laptop, and use a dev container when the team needs the same reproducible toolchain. Compared on Copilot CLI 1.0.104: what each boundary isolates, what it leaks, what it costs, and how to stack them.

Run /sandbox policy <command> to see what the sandbox blocked, then grant the path or host it needs, update Copilot CLI to 1.0.103 for the localhost, proxy and Linux fixes, and only bypass a command on purpose.

Enable GitHub Copilot local sandboxing in Copilot CLI 1.0.95 and the Copilot app, then lock down filesystem paths, outbound hosts, git/gh tokens and masked environment variables. Covers the settings.json keys, /sandbox policy, the bypass escape hatch, enterprise enforcement, and the gotchas on macOS, Linux and Windows.

Dev containers, Docker Sandboxes microVMs, Lima VMs, and hosted cloud sandboxes all move Claude Code, Codex, or Copilot CLI off your host. What each one actually isolates, the exact commands to make it throwaway, and the two things none of them protect: your writable workspace and your git hooks.