Table of all backends and links to per-backend guides — click to expand.
-`SandboxPolicy` is cross-platform. The backend is selected by the second argument to `createConfigFromPolicy(policy, containment)`. Pass an **abstract intent** (`"process"`, `"vm"`, `"microvm"`) whenever possible — the SDK and native binary resolve it to the right concrete backend for the host. Pass a **concrete backend name** when you need a specific runner. +`SandboxPolicy` is cross-platform. The backend is selected by the second argument to `createConfigFromPolicy(policy, containment)`. Pass an **abstract intent** (`"process"`, `"vm"`, or the compatibility-preserved `"microvm"` public identity) whenever possible — the SDK and native binary resolve it to the right concrete backend for the host. Pass a **concrete backend name** when you need a specific runner. | Backend | Intent | Platforms | Minimum schema | Stable? | Guide | | --- | --- | --- | --- | --- | --- | @@ -302,14 +308,15 @@ console.log(result.stdout); | `lxc` | (concrete only) | Linux | `0.6.0-alpha` | ✅ | [`docs/lxc-support/lxc-backend.md`](https://github.com/microsoft/mxc/blob/main/docs/lxc-support/lxc-backend.md) | | `seatbelt` | `process` | macOS | `0.7.0-alpha` | ✅ | [`docs/seatbelt/seatbelt-backend.md`](https://github.com/microsoft/mxc/blob/main/docs/seatbelt/seatbelt-backend.md) | | `windows_sandbox` | `vm` | Windows | `0.10.0-alpha` | Experimental | [`docs/windows-sandbox/windows-sandbox.md`](https://github.com/microsoft/mxc/blob/main/docs/windows-sandbox/windows-sandbox.md) | -| `microvm` | `microvm` | Windows | `0.10.0-alpha` | Experimental | [`docs/nanvix-microvm/nanvix.md`](https://github.com/microsoft/mxc/blob/main/docs/nanvix-microvm/nanvix.md) — MicroVM via NanVix on Windows Hypervisor Platform | +| `microvm` | `microvm` | Windows x64 | `0.9.0-alpha` | Experimental | [`docs/nvx-backend-gaps.md`](https://github.com/microsoft/mxc/blob/main/docs/nvx-backend-gaps.md) — public MicroVM identity implemented internally by NVX; structural foundation only; runtime unavailable in Phase 1 | | `hyperlight` | (concrete only) | Windows x64 / Linux x64 | `0.10.0-alpha` | Experimental | No dedicated guide | | `wslc` | (concrete only) | Windows | `0.9.0-alpha` | Stable | [`docs/wsl/wsl-container-getting-started.md`](https://github.com/microsoft/mxc/blob/main/docs/wsl/wsl-container-getting-started.md) | | `isolation_session` | (concrete only) | Windows | `0.9.0-alpha` | Stable | [`docs/isolation-session/oneshot.md`](https://github.com/microsoft/mxc/blob/main/docs/isolation-session/oneshot.md) | The abstract `process` intent therefore requires `0.7.0-alpha` on macOS, where it resolves to Seatbelt, but retains the `0.6.0-alpha` floor on Windows -and Linux. The abstract `vm` intent requires `0.10.0-alpha`. +and Linux. The compatibility-preserved `microvm` identity requires +`0.9.0-alpha`; the abstract `vm` intent requires `0.10.0-alpha`. Experimental backends require `{ experimental: true }` in `SandboxSpawnOptions`: @@ -546,14 +553,14 @@ granting file content reads. It requires a BaseContainer host with PSEC 1.1 | --- | --- | --- | | `MXC is not supported on this platform` | `getPlatformSupport()` returned `isSupported: false`. On Linux, neither LXC nor a usable Bubblewrap 0.5.0+ installation is available. On macOS, the Seatbelt platform probe could not find `/usr/bin/sandbox-exec`. | Inspect `support.reason`. On Linux, also inspect `support.unavailableReasons` and install LXC or Bubblewrap 0.5.0+. On macOS, verify that `/usr/bin/sandbox-exec` exists; its absence indicates an incomplete or unsupported macOS installation. | | `wxc-exec.exe not found` / `lxc-exec not found` | The SDK couldn't locate the native binary. | Set `MXC_BIN_DIR=Scenario
@@ -450,7 +449,7 @@Containment Types
- 🛡️ Base Process Container — Uses the Windows process security environment API.
- 🛡️ AppContainer — Default for 0.4.0-alpha. Standard Windows AppContainer isolation. -
- 🧪 Windows Sandbox / MicroVM / WSLC — Experimental. Select from the Containment dropdown — these only support MXC JSON Config mode (paste your own config). +
- 🧪 Windows Sandbox / Hyperlight / WSLC — Experimental. Select from the Containment dropdown — these only support MXC JSON Config mode (paste your own config).
diff --git a/tests/scripts/README.md b/tests/scripts/README.md
index 0b8b9edf1..7fd3544ab 100644
--- a/tests/scripts/README.md
+++ b/tests/scripts/README.md
@@ -37,8 +37,6 @@ Linux / macOS (`.sh`):
| `run_filesystem_bfs_spaces_test.ps1` | BFS path-with-spaces test | `wxc-exec.exe` |
| `run_test_configs.ps1` | All test configs via wxc-test-driver | `wxc-test-driver.exe` |
| `run_examples.ps1` | All examples via wxc-test-driver | `wxc-test-driver.exe` |
-| `run_microvm_basic_test.ps1` | MicroVM smoke test | `wxc-exec.exe`, NanVix binaries |
-| `run_microvm_tests.ps1` | Full MicroVM E2E suite | WHP enabled, NanVix binaries |
| `run_windows_sandbox_one_shot_tests.ps1` | Windows Sandbox one-shot E2E suite (fresh disposable VM per test) | Windows Sandbox enabled |
| `run_windows_sandbox_state_aware_tests.ps1` | Windows Sandbox state-aware lifecycle E2E (single VM held across provision/start/exec*/stop/deprovision) | Windows Sandbox enabled |
| `run_isolation_session_tests.ps1` | IsolationSession one-shot E2E suite | Interactive local session; OS-side IsolationSession service |
@@ -95,8 +93,8 @@ these dispatchers, which map a matrix backend id to the suites above:
| Dispatcher | Platforms | Backend ids |
|------------|-----------|-------------|
-| `scripts/ci/run_backend_validation_tests.ps1` | Windows | `process-t1`, `process-t3`, `isolation-session`, `windows-sandbox`, `wslc`, `microvm`, `hyperlight` |
-| `scripts/ci/run_backend_validation_tests.sh` | Linux, macOS | `bubblewrap`, `lxc`, `seatbelt`, `microvm`, `hyperlight` |
+| `scripts/ci/run_backend_validation_tests.ps1` | Windows | `process-t1`, `process-t3`, `isolation-session`, `windows-sandbox`, `wslc`, `hyperlight` |
+| `scripts/ci/run_backend_validation_tests.sh` | Linux, macOS | `bubblewrap`, `lxc`, `seatbelt`, `hyperlight` |
Pass the backend id exactly as it appears in the catalog — there is no separate
handler name. Ids that share a suite have their own case in the dispatcher:
@@ -220,22 +218,3 @@ Run them explicitly on capable machines with
| `test_examples` | Requires velocity key 61714527 (BFS deadlock fix) |
| `test_processcontainer_proxy` | Requires velocity key 61714527 (BFS deadlock fix) and elevation |
| `test_on_repeat` | Stress test (loops BFS tests) |
-
-## MicroVM E2E
-
-### Build
-
-```powershell
-cd src
-cargo build --features microvm --target x86_64-pc-windows-msvc
-```
-
-### Run
-
-```powershell
-cd src
-cargo test -p wxc_e2e_tests --target x86_64-pc-windows-msvc test_microvm_suite -- --nocapture
-```
-
-The MicroVM suite runs 6 functional tests + 1 timeout behavior test.
-It generates `microvm-perf-results.json` with per-test timing and status data (uploaded as CI artifact).
diff --git a/tests/scripts/run_microvm_basic_test.ps1 b/tests/scripts/run_microvm_basic_test.ps1
deleted file mode 100644
index 5dffe2214..000000000
--- a/tests/scripts/run_microvm_basic_test.ps1
+++ /dev/null
@@ -1,44 +0,0 @@
-# Copyright (c) Microsoft Corporation.
-# Licensed under the MIT License.
-
-# MicroVM basic smoke test runner.
-#
-# Usage:
-# .\run_microvm_basic_test.ps1 # debug build
-# .\run_microvm_basic_test.ps1 -Release # release build
-
-param(
- [switch]$Release,
- [string]$BinDir
-)
-
-$ErrorActionPreference = "Stop"
-$RepoRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
-
-if (-not $BinDir) {
- if ($Release) {
- $BinDir = Join-Path $RepoRoot "src\target\release"
- } else {
- $BinDir = Join-Path $RepoRoot "src\target\debug"
- }
-}
-
-$WxcExec = Join-Path $BinDir "wxc-exec.exe"
-$TestConfig = Join-Path $RepoRoot "tests\configs\microvm_hello.json"
-
-if (-not (Test-Path $WxcExec)) {
- Write-Host "ERROR: wxc-exec.exe not found at $WxcExec" -ForegroundColor Red
- Write-Host "Run 'cargo build$(if ($Release) { ' --release' })' first." -ForegroundColor Yellow
- exit 1
-}
-
-Write-Host "Running MicroVM basic smoke test..." -ForegroundColor Cyan
-& $WxcExec --debug --experimental $TestConfig
-$exitCode = $LASTEXITCODE
-
-if ($exitCode -ne 0) {
- Write-Host "FAILED: wxc-exec exited with code $exitCode" -ForegroundColor Red
- exit $exitCode
-}
-
-Write-Host "PASSED: MicroVM basic smoke test" -ForegroundColor Green
diff --git a/tests/scripts/run_microvm_tests.ps1 b/tests/scripts/run_microvm_tests.ps1
deleted file mode 100644
index dcf6002b5..000000000
--- a/tests/scripts/run_microvm_tests.ps1
+++ /dev/null
@@ -1,235 +0,0 @@
-# Copyright (c) Microsoft Corporation.
-# Licensed under the MIT License.
-
-<#
-.SYNOPSIS
- Runs MicroVM E2E tests. Requires WHP and Nanvix binaries next to wxc-exec.exe.
-
-.DESCRIPTION
- - Locates wxc-exec.exe (built with --features microvm)
- - Verifies Nanvix binaries are present
- - Runs each test config via wxc-exec, validates exit codes and stdout content
- - Reports pass/fail summary with per-test performance timing
- - Writes microvm-perf-results.json for CI artifact consumption
-
-.PARAMETER Release
- Use release build (default: debug)
-
-.PARAMETER BinDir
- Explicit binary directory. Overrides -Release logic when provided.
-
-.PARAMETER ConfigDir
- Path to test configs directory. Defaults to \tests\configs
-
-.EXAMPLE
- .\run_microvm_tests.ps1
- .\run_microvm_tests.ps1 -Release
- .\run_microvm_tests.ps1 -BinDir C:\build\output
-#>
-
-param(
- [switch]$Release,
- [string]$BinDir,
- [string]$ConfigDir
-)
-
-$ErrorActionPreference = "Stop"
-$RepoRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
-
-if (-not $BinDir) {
- if ($Release) {
- $BinDir = Join-Path $RepoRoot "src\target\release"
- } else {
- $BinDir = Join-Path $RepoRoot "src\target\debug"
- }
-}
-
-if (-not $ConfigDir) {
- $ConfigDir = Join-Path $RepoRoot "tests\configs"
-}
-
-$WxcExePath = Join-Path $BinDir "wxc-exec.exe"
-
-# -- WHP check (local runs only) ---------------------------------------------
-# In CI, the workflow checks WHP and fails before reaching this script.
-# For local runs, check here and skip gracefully if WHP is unavailable.
-
-if (-not $env:CI) {
- function Test-WhpAvailable {
- if (-not (Test-Path "$env:SystemRoot\System32\WinHvPlatform.dll")) {
- return $false
- }
- try {
- $cs = Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction SilentlyContinue
- return ($cs -and $cs.HypervisorPresent)
- } catch {
- return $false
- }
- }
-
- if (-not (Test-WhpAvailable)) {
- Write-Host "SKIP: Windows Hypervisor Platform (WHP) is not available." -ForegroundColor Yellow
- Write-Host " Enable it with: Enable-WindowsOptionalFeature -Online -FeatureName HypervisorPlatform"
- exit 0
- }
-}
-
-Write-Host "`n=== MicroVM E2E Tests ===" -ForegroundColor Cyan
-
-# -- Locate wxc-exec.exe -----------------------------------------------------
-
-if (-not (Test-Path $WxcExePath)) {
- Write-Host "ERROR: wxc-exec.exe not found at: $WxcExePath" -ForegroundColor Red
- Write-Host " Build with: cd src && cargo build --features microvm"
- exit 1
-}
-
-$wxcExe = Resolve-Path $WxcExePath
-
-# -- Verify MicroVM binaries --------------------------------------------------
-
-$requiredBinaries = @(
- "nanvixd.exe",
- "nanvix_rootfs.img",
- "python3.initrd",
- "bin\kernel.elf",
- "snapshots\kernel.vmem",
- "snapshots\kernel.whp.cbor"
-)
-$binDir = Split-Path $wxcExe
-$missing = $requiredBinaries | Where-Object { -not (Test-Path (Join-Path $binDir $_)) }
-
-if ($missing) {
- Write-Host "ERROR: Missing MicroVM binaries in ${binDir}:" -ForegroundColor Red
- $missing | ForEach-Object { Write-Host " - $_" }
- Write-Host " Build with: cd src && cargo build --features microvm"
- exit 1
-}
-
-Write-Host "wxc-exec: $wxcExe"
-Write-Host "binaries: $binDir"
-
-# -- Test definitions ---------------------------------------------------------
-
-$tests = @(
- @{ Config = "microvm_hello.json"; ExpectedExit = 0; Description = "Hello world"; OutputContains = "sum=100" },
- @{ Config = "microvm_exit_code.json"; ExpectedExit = 42; Description = "Exit code propagation" },
- @{ Config = "microvm_multiline.json"; ExpectedExit = 0; Description = "Multi-line script (fibonacci)"; OutputContains = "fib(" },
- @{ Config = "microvm_stdlib.json"; ExpectedExit = 0; Description = "Stdlib (json, math, hashlib)"; OutputContains = "pi" },
- @{ Config = "microvm_large_output.json"; ExpectedExit = 0; Description = "Large stdout (1000 lines)"; OutputContains = "line 999" },
- @{ Config = "microvm_error.json"; ExpectedExit = 1; Description = "Python exception"; OutputContains = "ValueError" },
- @{ Config = "microvm_timeout.json"; ExpectedExit = -1; Description = "Timeout kills VM" }
-)
-
-# -- Run tests ----------------------------------------------------------------
-
-$passed = 0
-$failed = 0
-$results = @()
-
-foreach ($test in $tests) {
- $configPath = Join-Path $ConfigDir $test.Config
- if (-not (Test-Path $configPath)) {
- Write-Host " SKIP $($test.Config) (file not found)" -ForegroundColor Yellow
- continue
- }
-
- Write-Host "`n--- $($test.Description) ($($test.Config)) ---" -ForegroundColor White
-
- $sw = [System.Diagnostics.Stopwatch]::StartNew()
- $stdoutFile = [System.IO.Path]::GetTempFileName()
- $stderrFile = [System.IO.Path]::GetTempFileName()
- $process = Start-Process -FilePath $wxcExe `
- -ArgumentList "--debug", "--experimental", $configPath `
- -PassThru -Wait `
- -RedirectStandardOutput $stdoutFile `
- -RedirectStandardError $stderrFile
- $sw.Stop()
-
- $actualExit = $process.ExitCode
- $expectedExit = $test.ExpectedExit
- $elapsedMs = $sw.ElapsedMilliseconds
- $stdout = Get-Content $stdoutFile -Raw -ErrorAction SilentlyContinue
- $stderr = Get-Content $stderrFile -Raw -ErrorAction SilentlyContinue
- Remove-Item $stdoutFile, $stderrFile -ErrorAction SilentlyContinue
-
- $pass = ($actualExit -eq $expectedExit)
- $reason = ""
-
- if (-not $pass) {
- $reason = "expected exit=$expectedExit, got exit=$actualExit"
- }
-
- # Check stdout content if OutputContains is specified. Not every test
- # defines the key, and StrictMode makes a missing hashtable key throw, so
- # test for its presence rather than accessing it directly.
- if ($pass -and $test.ContainsKey('OutputContains')) {
- $combined = "$stdout`n$stderr"
- if ($combined -notmatch [regex]::Escape($test.OutputContains)) {
- $pass = $false
- $reason = "output missing '$($test.OutputContains)'"
- }
- }
-
- if ($pass) {
- Write-Host " PASS (exit=$actualExit, ${elapsedMs}ms)" -ForegroundColor Green
- $passed++
- $results += @{ Test = $test.Config; Status = "PASS"; Exit = $actualExit; WallTimeMs = $elapsedMs; Description = $test.Description }
- } else {
- Write-Host " FAIL ($reason, ${elapsedMs}ms)" -ForegroundColor Red
- $combined = "$stdout`n$stderr"
- $combined -split "`n" | Where-Object { $_.Trim() } | Select-Object -Last 3 | ForEach-Object {
- Write-Host " > $($_.TrimEnd())" -ForegroundColor Gray
- }
- $failed++
- $results += @{ Test = $test.Config; Status = "FAIL"; Exit = $actualExit; WallTimeMs = $elapsedMs; Description = $test.Description }
- }
-}
-
-# -- Performance summary ------------------------------------------------------
-
-Write-Host "`n=== Performance ===" -ForegroundColor Cyan
-Write-Host (" {0,-35} {1,10} {2,8}" -f "Test", "Time (ms)", "Status")
-Write-Host (" {0,-35} {1,10} {2,8}" -f "----", "---------", "------")
-foreach ($r in $results) {
- $color = if ($r.Status -eq "PASS") { "Green" } else { "Red" }
- Write-Host (" {0,-35} {1,10} {2,8}" -f $r.Description, $r.WallTimeMs, $r.Status) -ForegroundColor $color
-}
-
-# Write JSON results for CI artifact consumption
-$perfOutput = @{
- commit = if ($env:GITHUB_SHA) { $env:GITHUB_SHA } else { "local" }
- timestamp = (Get-Date -Format "o")
- results = $results | ForEach-Object {
- @{
- test = $_.Test
- description = $_.Description
- wall_time_ms = $_.WallTimeMs
- exit_code = $_.Exit
- status = $_.Status
- }
- }
-}
-$perfJsonPath = Join-Path $ConfigDir "..\microvm-perf-results.json"
-$perfOutput | ConvertTo-Json -Depth 3 | Set-Content $perfJsonPath -Encoding UTF8
-Write-Host "`n Performance results written to: $perfJsonPath"
-
-# -- Summary ------------------------------------------------------------------
-
-$total = $passed + $failed
-Write-Host "`n=== Results ===" -ForegroundColor Cyan
-if ($total -eq 0) {
- Write-Host " ERROR: No tests were executed. Check -ConfigDir path." -ForegroundColor Red
- exit 1
-}
-Write-Host " Passed: $passed / $total"
-if ($failed -gt 0) {
- Write-Host " Failed: $failed / $total" -ForegroundColor Red
- $results | Where-Object { $_.Status -eq "FAIL" } | ForEach-Object {
- Write-Host " - $($_.Test) (exit=$($_.Exit))" -ForegroundColor Red
- }
- exit 1
-} else {
- Write-Host " All MicroVM E2E tests passed!" -ForegroundColor Green
- exit 0
-}