- May 16, 2018
- 1,363
Microsoft is introducing a new sandboxing feature. It's similar to the sandbox that makes Google Chrome (and therefore the new version of Microsoft Edge) so hard to hack, but this one will be capable of protecting your entire Windows operating system -- not just one app.
The Windows Sandbox is a "lightweight virtual environment." You can think of it as the computer equivalent of Las Vegas: what happens in the sandbox stays in the sandbox. Changes that occur there don't impact your actual Windows installation in any way.
Taken together, Windows Sandbox combines elements of virtual machines and containers. The security boundary between the sandbox and the host operating system is a hardware-enforced boundary, as is the case with virtual machines, and the sandbox has virtualized hardware much like a VM. At the same time, other aspects—such as sharing executables both on-disk and in-memory with the host as well as running an identical operating system version as the host—use technology from Windows Containers.
At least for now, the Sandbox appears to be entirely ephemeral. It gets destroyed and reset whenever it's closed, so no changes can persist between runs. The Edge virtual machines worked similarly in their first incarnation; in subsequent releases, Microsoft added support for transferring files from the virtual machine to the host so that they could be stored persistently. We'd expect a similar kind of evolution for the Sandbox.
