12 ms·

Windows Sandbox

• iggldiggl 4y ago
  Does it (respectively Hyper-V) still fundamentally break hibernation and/or hybrid sleep? In theory it sounds neat, but not having working suspend-to-disk is a no-go for me…
• ape4 4y ago
  Heavy prerequisites.... At least 4 GB of RAM (8 GB recommended) At least 1 GB of free disk space (SSD recommended) At least two CPU cores (four cores with hyperthreading recommended)
  • piperswe 4y ago
    I don't think any of those are a tall ask for powerusers in 2023
  • daveoc64 4y ago
    Those are all at or below the Windows 11 System Requirements.
  • paxys 4y ago
    How is any of this heavy? Every entry level laptop or desktop sold in the last 5 years (probably longer) will meet these requirements.
  • dragonwriter 4y ago
    1GB of free disk space is trivial, 2 CPU cores and 4GB is the minimum requirement for Windows 11; so its hardly “heavy requirements”, its basically “a relatively recent PC”. Recommended is a bit more onerous, but, 8GB and 4 hyperthreading cores isn’t a lot . I’ve got a two-year-old midrange laptop (other than having a fairly nice dGPU for something not marketed for gaming, but that’s not really really relevant here) and its got 16GB of RAM and 6HT cores.
    • fbdab103 4y ago
      >its basically “a relatively recent PC”. I would challenge recent. For a power user who would engage in these features, that feels like at least baseline specs from 10+ years ago. On a larf, I queried "dell 2012 laptop" and came to this review for a Dell XPS 15[0]. Probably a more performant laptop than the average user, but this thing has a quad-core with 8GB ram. [0] https://www.laptopmag.com/reviews/laptops/dell-xps-15-2012-review https://www.laptopmag.com/reviews/laptops/dell-xps-15-2012-r...
      • dragonwriter 4y ago
        Sure, it’ll work on more powerful older computers; I’m just saying practically any recent windows PC will work.
  • temp12192021 4y ago
    With those pre-reqs, is there anything Windows Sandbox can do that Sandboxie can't? https://github.com/sandboxie-plus/Sandboxie https://github.com/sandboxie-plus/Sandboxie
    • gruez 4y ago
      Hypervisor isolation. Sandboxie works at the kernel level which is a much larger attack surface.
    • throwaway689236 4y ago
      Sandboxie is great, didn't know there was a fork.
  • andix 4y ago
    It’s fine to keep using old hardware, but with lower specs than that, windows 10/11 is completely unusable anyway. With such specs you probably want to use some lightweight Linux distribution, if you don’t enjoy looking at the hourglass-cursor most of your workday…
  • HeavyFeather 4y ago
    Are you from 2010? What computer doesn’t have 4GB of ram? My phone has more than that
• gigel82 4y ago
  It would be much more useful if you could save / restore checkpoints. And because it gets wiped on every reboot it means you can never test software that needs to restart the machine (to install services and whatnot).
  • amluto 4y ago
    > Note, however, that as of Windows 11 Build 22509, your data will persist through a restart initiated from inside the virtualized environment—useful for installing applications that require the OS to reboot.
  • revicon 4y ago
    They specially call out that files are retained during a reboot of the sandbox to allow for the “restart required” condition
• paxys 4y ago
  Running Hyper-V under the hood I imagine? The description makes it seem like this is targeted towards professional use cases (for example excluding it from Windows Home editions), but I'd like to see a future where every application installed on your computer gets such a sandbox by default.
• thomasmarton 4y ago
  This is basically Microsoft's big chance to create Docker for windows. Prebaked images on top of this lightweight layer and shared folders which are already supported. I'd love to see this happen on environments where you need Windows, but you still want the ease of deployment feature of Docker
  • andix 4y ago
    Windows containers for docker exist for a long time already, they are even compatible with k8s. And they are just a mess. Windows is not really a suitable platform for containerized apps. If you want a sandboxed App environment for windows, there are the UWP/Store apps, which are also not that great. I have the feeling that Microsoft kind of gave up on windows and is trying to move everything into the cloud and the browser.
    • riffic 4y ago
      they should give up on windows too.
      • andix 4y ago
        I think that’s what they are doing. Most new sever side products they release have first class Linux support. And most new desktop applications are web based. Also Edge is supported on Linux.
        • pjmlp 4y ago
          Azure runs on Windows. https://techcommunity.microsoft.com/t5/windows-os-platform-blog/azure-host-os-cloud-host/ba-p/3709528 https://techcommunity.microsoft.com/t5/windows-os-platform-b...
          • andix 4y ago
            Those are probably hyper-v hosts. Yes it is Windows, but it’s mostly a virtualization platform for running VMs.
• vodou 4y ago
  Windows Sandbox, together with WSL, have liberated me from VirtualBox/VMware Workstation. So thankful for that. Now I only wait for native USB support in WSL.
  • eidorb 4y ago
    This is useful on the USB support front: https://learn.microsoft.com/en-us/windows/wsl/connect-usb https://learn.microsoft.com/en-us/windows/wsl/connect-usb
  • lhoff 4y ago
    In case you don’t know about it, there is good workaround based on USB over IP that is officially recommended by MS. I used it a while ago to flash a ESP32 and to connect a Zigbee Adapter to a Linux container. Had no issues with it. https://learn.microsoft.com/en-us/windows/wsl/connect-usb https://learn.microsoft.com/en-us/windows/wsl/connect-usb
• coconut08 4y ago
  It would be nice if there was a way to persist this. There are instances where you want to have either a clean environment to work in or you want to isolate something from your primary machine but you also don't want it to just get destroyed when you are done. Maybe this is a feature of this and I'm just not understanding it properly.
  • jmkni 4y ago
    Isn't that just a virtual machine?
    • Dalewyn 4y ago
      In fairness, setting up and maintaining a virtual machine might as well be too much upkeep for the common user. On the other hand, if a user knows what a "sandbox" is (no, not the playground box of sand) they aren't a common user.
    • coconut08 4y ago
      This seems to run more seamlessly than a virtual machine. Plus I think this supports hardware acceleration and stuff natively.
    • petra 4y ago
      It uses hardware-isolation which i think is more secure.
      • Operyl 4y ago
        That’s what most VM Hypervisor technology already does.
    • kritr 4y ago
      It is a Hyper-V backed VA backed VM. It shared memory with the host in the same fashion that WSL does, as opposed to carving out physical memory. We have some additional optimizations to make it snappier than running a full vm.
  • 4y ago
• zrg 4y ago
  This has been a feature since windows 10 https://www.howtogeek.com/399290/how-to-use-windows-10s-new-sandbox-to-safely-test-apps/ https://www.howtogeek.com/399290/how-to-use-windows-10s-new-...
  • majkinetor 4y ago
    In Windows 11 you can restart it without losing data, though, which is nice, since its so fast that it starts almost instantly. Because of that speed, I test all the funky software in it first, and some I run in it exclusivelly as you can create "run in Windows Sandbox" fairly easyly and customize what runs on startup via pwsh script. I would love the option for it to survive the closure though, that would open entire new world of possibilities. It doesn't have to compete with full HyperV setup if you open just a few more options.
    • smileybarry 4y ago
      Yeah, I don't 100% trust the new CurseForge app for updating World of Warcraft addons, but it's kind of necessary when you have 10+ addons. But with some poking and a Windows Sandbox configuration file, I can just launch it in a sandbox now and mount the addons directory, update/install, and wipe the sandbox. It's a neat Sandboxie replacement once you start playing with mounts and startup scripts.
    • stinos 4y ago
      In Windows 11 you can restart it without losing data, So did they also fix the rather annoying issue that if you shutdown the OS in sandbox it displays a 'The connection to the sandbox was lost.' dialog instead of quitting the process? We use it to run automated tests, for which it is actually pretty great with the .wsb files makeing it easy to get data into it and run script, but it's a bit silly one needs to workaround detection of whether the thing exited by using files for signalling the script is done with a timeout then killing all involved processes.
      • majkinetor 4y ago
        I just kill the process on Win 10.
• doubleorseven 4y ago
  It's a great tool. We've been using it as a windows replacment for Linux live. I have 2 wishes from this feature. 1. Use more than one screen. 2. Have the ability to extend the dockerfile so i can preinstall software.
  • nabilhat 4y ago
    For (2.) I've been using wsb configs to script installs, or better yet map to storage that's preloaded with software that can be installed to an arbitrary location or is otherwise portable. https://techcommunity.microsoft.com/t5/itops-talk-blog/customize-windows-sandbox/ba-p/2301354 https://techcommunity.microsoft.com/t5/itops-talk-blog/custo...
  • jimbob45 4y ago
    It’s a great tool but it’s becoming clear that this is another IE6 in 2002 situation. That is, MS has a killer feature but can’t recognize that and will let it fester until a competitor comes along in a decade. Real shame because even a small team could add some desperately needed updates.
• SeriousM 4y ago
  Windows sandbox combined with winget used in setup script has a lot of usecases
• discreditable 4y ago
  One of my favorite uses for this is creating .wsb files that would launch a script and install zoom/WebEx/etc so I would not have to install them on my PC. The video and audio worked just well enough for me to get away with and it was easier to screen share what I was doing within the container and avoid sharing anything extra (ex: notifications).
  • foolfoolz 4y ago
    this seems like overkill to avoid installing a critical piece of work software like video chat
    • giancarlostoro 4y ago
      It's not necessarily that critical if your company doesn't directly use it, and it's only used by third party vendors you sometimes interface with.
    • NikolaNovak 4y ago
      Not the op, but... The video chat my company uses is indeed a critical work software. The 27 other obscure video chats that people around the world use, though, are not. And they all want to dig their claws into your registry and drive and startup. And then flash incomprehensible error messages on reboot. And constantly run in background and uodate and ask for ever more permissions.
      • discreditable 4y ago
        100% this. We used Google Meet. I had no interest in installing any apps for meetings with external parties.
    • zbrozek 4y ago
      I don't think it's overkill. I have a whole VM that I use for the sole purpose of not installing my label printer software on my host machine.
    • ysleepy 4y ago
• deleted 4y ago
  [deleted]
• windows_sandbox 4y ago
  There are some pretty neat things about Windows Sandbox, it starts in about 3 or 4 seconds on my machine, and is integrated with file copy and paste. One unconventional use I found for it was in troubleshooting the networking speeds of my desktop being lower than expected, and it turned out that network tuning was broken in some terrible way that went away with a simple reset command. https://learn.microsoft.com/en-us/answers/questions/361238/slow-internet-speed-on-windows-10-but-windows-sand https://learn.microsoft.com/en-us/answers/questions/361238/s...
• apatheticonion 4y ago
  Would be cool if video games could be run inside containers or sandboxes where they ship with the dependencies they need. Don't know how many times Steam has reinstalled my C++ library or whatever else it does when it prepares a game for launch. Not to mention games have unrestricted access to my filesystem, which isn't ideal
  • waboremo 4y ago
    This is technically a thing already on Windows. Games can run within UWP containers and they have everything they need to go and have far less universal access. But from what I've heard it's not fun to deal with and Steam will never support it.
• TowerTall 4y ago
  First time I started Windows Sandbox was to test install some software program I didn't trust and want to see if Windows Defender would detect virus, adware, etc before installing it for real. Turns out that Windows Defender is disabled in Windows Sandbox and you get an access denied when you try to enable it. Installing it in the sandbox first does not help you determine if a script or software is malicious and that removes my primary use case for this feature. I sometimes wonder what exactly the Windows Sandbox if for if anti-virus wont run inside of it.
  • TowerTall 4y ago
    Can anyone elaborate why I am being downvoted? It is a fact that Windows Defender is disabled and that you get zero feedback from the sandbox if you try to install something malicious. You cannot even go into Windows Security settings. It seems like it is all entirely disabled. Isn't that one of the main use cases for running something in a sandbox first instead of trying it out on a live system?
    • kritr 4y ago
      You are correct that this is one of the limitations of Sandbox today, and we are aware of the feedback on this. I believe you should be able to install other anti virus software, but at least today unfortunately Defender isn’t part of Sandbox.
• psyclobe 4y ago
  Windows is nearly unusable after edge and defender have their way with it
  • paulryanrogers 4y ago
    Can you elaborate? Is it slow performance? Taking over defaults with custom schemes?
  • h4ch1 4y ago
    wym "have their way with it"? I run both as my primary browser and AV, turned off all telemetry, any adware type service (News in Edge, Automatic Sample Submission in Defender), and they run alright. Not ideal of course, but what is?
• ComodoHacker 4y ago
  From a linked article[0], sandbox shares both memory pages and binaries with the host system. Which means it's always runs the exact same build as a host. Which means you can't use it to test Windows updates. Am I correct? 0. https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture?source=recommendations https://learn.microsoft.com/en-us/windows/security/threat-pr...
  • kritr 4y ago
    That would be correct! If you need a full windows os to test updates with, I’d recommend a standard vm.
• wizzledonker 4y ago
  Are there any implications with this for software piracy? IE: Can I run my trial software in a new "Sandbox" every time?
  • sourcecodeplz 4y ago
    There is no piracy if there is a trial available.
• nayuki 4y ago
  It's a shame to see Windows Sandbox and also Docker touted as novel features. The operating system was supposed to be the original sandbox. Processes run on time slices of a virtual CPU using memory on a virtual address space and accessing a virtual file system. But there are many complicated APIs that are difficult to secure, and the VFS encourages persistent global state shared by all processes.
  • pjmlp 4y ago
    They aren't novel features, it is still the PC world catching up with mainframes and micro-computers. https://en.wikipedia.org/wiki/VM_(operating_system) https://en.wikipedia.org/wiki/VM_(operating_system) https://en.wikipedia.org/wiki/Burroughs_Large_Systems https://en.wikipedia.org/wiki/Burroughs_Large_Systems https://en.wikipedia.org/wiki/OpenVMS https://en.wikipedia.org/wiki/OpenVMS
  • tjoff 4y ago
    They are novel from a end-users perspective and that they can trivially applied to most stuff that the end-user might be doing otherwise. That the idea and execution existed before doesn't detract at all from that. Something "trivial" can still be a game-changer.
• px1999 4y ago
  I've found Sandbox to be an easy way to circumvent endpoint protection (s/w firewalls and the like). By design, its a sandboxed os without non-microsoft bloat. Itd be handy to easily be able to run a powershell script automatically at boot though...
  • kritr 4y ago
    You can configure this behavior via wsb configuration files as mentioned in other comments on this thread.
    • px1999 4y ago
      Thanks, can't believe I missed this!
• legulere 4y ago
  It’s a bit sad that it’s just an end-user feature. I tried using it for UI automation but hit some roadblocks
  • kritr 4y ago
    Developer on Sandbox here, if you were still interested in using sandbox for this, I’d love to hear more about the scenario you were working on and what roadblocks you hit. Feel free to reach out (krithikrao at microsoft dot com).
• beebmam 4y ago
  Imagine having this on a phone. I wish we still had Microsoft in the mobile space.
• archerx 4y ago
  All I want is to be able to sandbox Windows from all of Microsoft's crap. I don't leave my computers awake while windows is running anymore because the moment it detects inactivity it starts loading up a bunch of unsolicited processes that start scanning drives and stuff for who knows what reasons.
• zspitzer 4y ago
  If you're creating Windows installers, it's really fantastic for testing them out