# MXC Schema Version Differences: Comparing 0.5.0-alpha, 0.6.0-alpha, and 0.7.0-dev

> Explore MXC schema version differences from 0.5.0-alpha to 0.7.0-dev. Understand changes in process abstraction, network defaults, and experimental backend support.

- Repository: [Microsoft/mxc](https://github.com/microsoft/mxc)
- Tags: api-reference
- Published: 2026-06-07

---

**The MXC configuration schema evolved from 0.5.0-alpha's introduction of process abstraction through 0.6.0-alpha's security-hardened network defaults to 0.7.0-dev's experimental backend support, with each release introducing structural changes to containment models, fallback controls, and extensibility mechanisms.**

The microsoft/mxc repository defines a JSON-based configuration format that orchestrates container-execution backends across heterogeneous platforms. Understanding MXC schema version differences is critical for migrating configurations between releases and leveraging platform-specific containment capabilities as the SDK matures from alpha stability toward production-ready orchestration.

## Version 0.5.0-alpha: Process Abstraction Foundation

Released as a transitional milestone, schema 0.5.0-alpha introduces the abstract `process` containment intent that decouples configuration authors from platform-specific backend implementations. According to [`schemas/stable/mxc-config.schema.0.5.0-alpha.json`](https://github.com/microsoft/mxc/blob/main/schemas/stable/mxc-config.schema.0.5.0-alpha.json), this version adds the `processContainer` block as the canonical replacement for the legacy `appContainer` section while maintaining backward compatibility aliases.

### Key Architectural Changes

**Abstract Process Containment**: The schema introduces the `"containment": "process"` value, which the SDK resolves at runtime to concrete backends via [`sdk/src/platform.ts`](https://github.com/microsoft/mxc/blob/main/sdk/src/platform.ts), rather than requiring explicit backend selection as in earlier versions.

**ProcessContainer Alias**: Windows-specific UI and privilege settings migrate from `appContainer` to `processContainer`, establishing the pattern where platform-specific containers nest under their respective backend names while sharing common `process` configuration.

## Version 0.6.0-alpha: Security-First Stable Release

Schema 0.6.0-alpha represents a hardening release defined in [`schemas/stable/mxc-config.schema.0.6.0-alpha.json`](https://github.com/microsoft/mxc/blob/main/schemas/stable/mxc-config.schema.0.6.0-alpha.json), flipping the default security posture from permissive to restrictive and introducing explicit fallback controls.

### Network Security Posture

The `network.defaultPolicy` field changes its default from `"allow"` to `"block"`, enforcing deny-by-default networking that aligns with modern zero-trust principles. Configuration authors must now explicitly whitelist hosts via `allowedHosts` arrays rather than relying on implicit outbound access.

### Fallback Control Mechanism

The new `fallback` top-level block provides opt-out controls for host-modifying fallback behaviors. Specifically, `fallback.allowDaclMutation` controls Tier-3 fallbacks that mutate host ACLs, which were previously implicit and uncontrollable in earlier schemas.

### UI Policy Separation

A dedicated top-level `ui` block decouples interface constraints from backend-specific configuration, enabling cross-platform UI policies. While `processContainer.ui` retains Windows-specific settings, the abstract `ui` object provides portable clipboard, display, and input controls.

## Version 0.7.0-dev: Experimental Backend Expansion

The development schema [`schemas/dev/mxc-config.schema.0.7.0-dev.json`](https://github.com/microsoft/mxc/blob/main/schemas/dev/mxc-config.schema.0.7.0-dev.json) introduces a namespaced mechanism for unstable backend support, isolating experimental features from the stable configuration surface.

### Experimental Namespace

The `experimental` top-level block contains backend-specific settings for platforms still in development. This includes `windows_sandbox`, `wslc`, `microvm`, `macos_sandbox`, `isolation_session`, and `hyperlight` backends, each with their own typed configuration objects that remain invisible to stable schema validation.

### Extended Backend Support

Beyond stable backends (`processcontainer`, `bubblewrap`, `lxc`), 0.7.0-dev recognizes experimental containment mechanisms. For example, the `wslc` backend accepts `cpuCount`, `memoryMb`, and `gpu` parameters within its experimental namespace, allowing resource tuning for WSL-Container workloads without polluting the stable schema.

## Configuration Examples by Version

### 0.5.0-alpha Configuration

The following example demonstrates the transition to process abstraction and the new processContainer block:

```json
{
  "version": "0.5.0-alpha",
  "containment": "process",
  "process": { "commandLine": "python script.py" },
  "processContainer": {
    "leastPrivilege": true,
    "capabilities": ["internetClient"]
  },
  "filesystem": { "readwritePaths": ["/tmp"] },
  "network": { "defaultPolicy": "allow" }
}

```

Notice the abstract `containment` value and the migration from `appContainer` to `processContainer`.

### 0.6.0-alpha Security Configuration

This example illustrates the hardened defaults and new control blocks:

```json
{
  "version": "0.6.0-alpha",
  "containment": "process",
  "process": { "commandLine": "node -e \"console.log('secure')\"" },
  "filesystem": { "readwritePaths": ["/tmp"] },
  "network": {
    "defaultPolicy": "block",
    "allowedHosts": ["api.example.com"]
  },
  "ui": { "disable": true, "clipboard": "none" },
  "fallback": { "allowDaclMutation": false }
}

```

The network default is now `"block"`, and the `fallback` object explicitly prevents host ACL modification.

### 0.7.0-dev Experimental Backend

This configuration leverages the WSL-Container experimental backend:

```json
{
  "version": "0.7.0-dev",
  "containment": "wslc",
  "process": { "commandLine": "/bin/sh -c 'echo experimental'" },
  "experimental": {
    "wslc": {
      "cpuCount": 2,
      "memoryMb": 1024,
      "gpu": true
    }
  },
  "network": {
    "defaultPolicy": "block",
    "allowedHosts": ["dev.local"]
  }
}

```

The `experimental.wslc` block provides backend-specific tuning parameters unavailable in stable releases.

## Implementation Files

The schema evolution is enforced by specific runtime components:

- **[`schemas/stable/mxc-config.schema.0.5.0-alpha.json`](https://github.com/microsoft/mxc/blob/main/schemas/stable/mxc-config.schema.0.5.0-alpha.json)**: Defines process abstraction and processContainer introduction
- **[`schemas/stable/mxc-config.schema.0.6.0-alpha.json`](https://github.com/microsoft/mxc/blob/main/schemas/stable/mxc-config.schema.0.6.0-alpha.json)**: Implements fallback controls and network security defaults
- **[`schemas/dev/mxc-config.schema.0.7.0-dev.json`](https://github.com/microsoft/mxc/blob/main/schemas/dev/mxc-config.schema.0.7.0-dev.json)**: Provides experimental namespace validation
- **[`sdk/src/sandbox.ts`](https://github.com/microsoft/mxc/blob/main/sdk/src/sandbox.ts)**: Runtime helper that inspects the `version` field and selects appropriate backend implementations
- **[`sdk/src/platform.ts`](https://github.com/microsoft/mxc/blob/main/sdk/src/platform.ts)**: Contains platform-specific logic that resolves abstract `process` containment to concrete OS-specific backends

## Summary

- **0.5.0-alpha** introduces abstract `process` containment and the `processContainer` block, establishing the foundation for cross-platform configuration
- **0.6.0-alpha** hardens security with `network.defaultPolicy` set to `"block"`, adds explicit `fallback` controls for host mutations, and separates UI policies into a top-level block
- **0.7.0-dev** expands backend support through the `experimental` namespace, enabling configuration of bleeding-edge containment mechanisms like `wslc` and `windows_sandbox` without breaking stable schema contracts
- Runtime resolution of these schemas occurs in [`sdk/src/sandbox.ts`](https://github.com/microsoft/mxc/blob/main/sdk/src/sandbox.ts) and [`sdk/src/platform.ts`](https://github.com/microsoft/mxc/blob/main/sdk/src/platform.ts), which validate the `version` field and instantiate appropriate backend drivers

## Frequently Asked Questions

### How do I migrate from 0.5.0-alpha to 0.6.0-alpha?

Update your schema identifier to reference [`schemas/stable/mxc-config.schema.0.6.0-alpha.json`](https://github.com/microsoft/mxc/blob/main/schemas/stable/mxc-config.schema.0.6.0-alpha.json), change `network.defaultPolicy` from `"allow"` to `"block"` while adding explicit `allowedHosts`, and introduce a `fallback` object to control host mutation behaviors. If you previously relied on implicit ACL modifications, set `fallback.allowDaclMutation` to `true` temporarily, then refactor to remove the dependency.

### What is the difference between `process` and `processContainer` containment?

In the MXC schema, `process` is an abstract containment intent specified in the `containment` field that the SDK resolves at runtime to appropriate backends via [`sdk/src/platform.ts`](https://github.com/microsoft/mxc/blob/main/sdk/src/platform.ts). The `processContainer` block is a concrete configuration section containing Windows-specific settings like capabilities and UI policies, replacing the legacy `appContainer` structure while maintaining compatibility aliases.

### Can I use experimental backends like `wslc` in production environments?

Experimental backends defined in [`schemas/dev/mxc-config.schema.0.7.0-dev.json`](https://github.com/microsoft/mxc/blob/main/schemas/dev/mxc-config.schema.0.7.0-dev.json) are not recommended for production workloads. The `experimental` namespace explicitly isolates unstable features that may change without backward compatibility guarantees. For production use, select stable backends (`processcontainer`, `bubblewrap`, `lxc`) using the 0.6.0-alpha schema.

### Why did the default network policy change to block in 0.6.0-alpha?

The change from `"allow"` to `"block"` aligns with zero-trust security principles and defense-in-depth strategies. This breaking change prevents accidental data exfiltration by requiring explicit host whitelisting through `allowedHosts` arrays, ensuring developers consciously define network boundaries rather than inheriting permissive defaults.