# Microsandbox Isolation: How Microsandbox Ensures Sandbox Isolation Using Linux Namespaces

> Discover how Microsandbox ensures robust sandbox isolation using Linux namespaces, cgroups, seccomp, and more. Secure your applications with deterministic runtime environments.

- Repository: [Super Rad Company/microsandbox](https://github.com/superradcompany/microsandbox)
- Tags: internals
- Published: 2026-08-20

---

**Microsandbox guarantees isolation between sandboxes by constructing a deterministic runtime namespace for each instance, combining PID, mount, network, UTS, and IPC namespaces with cgroup limits, seccomp filters, and per-sandbox socket namespaces.**

Microsandbox is a lightweight container runtime that provides strong isolation guarantees without the overhead of traditional virtual machines. Understanding **how Microsandbox ensures isolation between sandboxes** requires examining its multi-layered approach to namespace construction and resource confinement.

## The Core Isolation Architecture

Every Microsandbox instance receives its own **deterministic runtime namespace** orchestrated by the runtime VM implementation in [`crates/runtime/lib/vm.rs`](https://github.com/superradcompany/microsandbox/blob/main/crates/runtime/lib/vm.rs). This architecture prevents any shared state that one sandbox could use to affect another—even when running identical images.

### Linux Namespaces as the Foundation

Microsandbox leverages five critical Linux namespaces, all created during VM initialization:

- **PID namespace** – Each sandbox runs an independent process tree, completely invisible to host or sibling processes
- **Mount namespace** – A private filesystem view backed by overlay/dual-fs stacks
- **Network namespace** – Dedicated networking stack with isolated interfaces, routing tables, and firewall rules
- **UTS namespace** – Independent hostname and domain name per sandbox
- **IPC namespace** – Separate System V IPC objects and POSIX message queues

These namespaces are instantiated together in [`crates/runtime/lib/vm.rs`](https://github.com/superradcompany/microsandbox/blob/main/crates/runtime/lib/vm.rs) when the runtime spawns a new sandbox.

## Filesystem Isolation via Dual-FS Stack

The mount namespace implementation ensures sandboxes cannot access host filesystem paths. In [`sdk/rust/lib/sandbox/flat_rootfs.rs`](https://github.com/superradcompany/microsandbox/blob/main/sdk/rust/lib/sandbox/flat_rootfs.rs) and `crates/filesystem/lib/backends/dualfs/*.rs`, the runtime constructs a sandbox-only mount tree using overlay filesystem techniques.

Each sandbox resolves paths exclusively within its own mount namespace. The dual-fs backend guarantees that guest filesystem operations remain strictly isolated from both the host and other sandboxes.

## Network Isolation and Policy Enforcement

Network isolation operates at two levels. First, [`crates/network/lib/lib.rs`](https://github.com/superradcompany/microsandbox/blob/main/crates/network/lib/lib.rs) defines the sandbox network policy. Second, [`crates/runtime/lib/vm.rs`](https://github.com/superradcompany/microsandbox/blob/main/crates/runtime/lib/vm.rs) creates the dedicated network namespace (`netns`) for each sandbox.

The network namespace provides:
- Independent loopback and interface configuration
- Isolated routing tables
- Custom firewall rules per sandbox

You can constrain network access through the SDK's `NetworkPolicy`:

```rust
use microsandbox::{Sandbox, SandboxBuilder, NetworkPolicy};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let sb = Sandbox::builder("restricted-net")
        .image("docker.io/library/alpine:latest")
        .network_policy(NetworkPolicy::allow_outbound_tcp(80))
        .create()
        .await?;
    Ok(())
}

```

## Resource Isolation with Cgroups

Beyond namespace isolation, Microsandbox enforces **hard resource limits** through cgroups. The [`crates/runtime/lib/launch.rs`](https://github.com/superradcompany/microsandbox/blob/main/crates/runtime/lib/launch.rs) file attaches each sandbox to a cgroup defined by its isolation profile (`SandboxDefaults` in [`sdk/rust/lib/config/mod.rs`](https://github.com/superradcompany/microsandbox/blob/main/sdk/rust/lib/config/mod.rs)).

Configurable limits include:
- **CPU quotas** – Maximum processor utilization
- **Memory limits** – Physical and swap memory boundaries
- **PID counts** – Maximum number of processes

These limits prevent a single sandbox from exhausting host resources or impacting other sandboxes through denial-of-service patterns.

## System Call Confinement with Seccomp

The **seccomp profile** provides syscall-level isolation. Each `SandboxConfig` (defined in [`sdk/rust/lib/sandbox/config.rs`](https://github.com/superradcompany/microsandbox/blob/main/sdk/rust/lib/sandbox/config.rs)) can embed a `SecurityProfile` that the runtime loads when spawning the guest.

The default seccomp profile implements a whitelist approach—only explicitly permitted system calls are allowed. This reduces the attack surface dramatically compared to standard container runtimes.

```rust
use microsandbox::{Sandbox, SandboxBuilder, SecurityProfile};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let sb = Sandbox::builder("syscall-restricted")
        .image("docker.io/library/alpine:latest")
        .security_profile(SecurityProfile::default()) // Minimal syscall set
        .create()
        .await?;
    Ok(())
}

```

## Per-Sandbox IPC Socket Namespaces

Microsandbox creates **deterministic socket namespaces** for host-guest communication. The [`crates/runtime/lib/ipc.rs`](https://github.com/superradcompany/microsandbox/blob/main/crates/runtime/lib/ipc.rs) module manages `SandboxSocketPaths`—unique Unix-domain socket directories per sandbox.

Critical properties of this isolation layer:
- Socket paths are sandbox-specific and non-discoverable by other sandboxes
- Automatic cleanup on sandbox teardown prevents resource leakage
- No cross-sandbox socket visibility prevents IPC-based attacks

## The Sandbox Lifecycle: Isolation in Action

When you create a sandbox through the SDK, the following isolation sequence executes:

1. **Namespace creation** – Fresh PID, mount, network, UTS, and IPC namespaces instantiated
2. **Filesystem mounting** – Dual-fs/overlayfs stack mounted within the sandbox's mount namespace
3. **Guest VM spawning** – Process started under new namespaces with cgroup attachment
4. **Security profile installation** – Seccomp filter applied to restrict syscalls
5. **Socket directory exposure** – Per-sandbox IPC paths established

```rust
use microsandbox::{Sandbox, SandboxBuilder};

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let sb = Sandbox::builder("my-sandbox")
        .image("docker.io/library/alpine:latest")
        .create()
        .await?;
    // At this point, complete isolation is established:
    // - Separate PID namespace: process IDs start from 1
    // - Private mount namespace: host filesystem invisible
    // - Isolated network namespace: distinct interfaces and routing
    // - Cgroup limits: resource constraints active
    // - Seccomp filter: syscall restrictions enforced
    Ok(())
}

```

## Inspecting Runtime Isolation State

Both SDKs provide introspection capabilities to verify isolation boundaries:

```python
import microsandbox

sb = microsandbox.Sandbox.builder("py-sb") \
        .image("docker.io/library/alpine:latest") \
        .create()

print("PID namespace:", sb.runtime().pid_namespace())
print("Network namespace:", sb.runtime().net_namespace())

```

These values confirm that each sandbox receives unique namespace identifiers that do not overlap with host or sibling sandboxes.

## Key Implementation Files

| File | Isolation Responsibility |
|------|--------------------------|
| [`crates/runtime/lib/vm.rs`](https://github.com/superradcompany/microsandbox/blob/main/crates/runtime/lib/vm.rs) | Core namespace creation (PID, mount, net, UTS, IPC) and cgroup attachment |
| [`crates/runtime/lib/ipc.rs`](https://github.com/superradcompany/microsandbox/blob/main/crates/runtime/lib/ipc.rs) | Per-sandbox Unix-domain socket namespace (`SandboxSocketPaths`) |
| [`crates/runtime/lib/launch.rs`](https://github.com/superradcompany/microsandbox/blob/main/crates/runtime/lib/launch.rs) | Isolation profile application (cgroup limits, seccomp) |
| [`sdk/rust/lib/sandbox/config.rs`](https://github.com/superradcompany/microsandbox/blob/main/sdk/rust/lib/sandbox/config.rs) | `SandboxConfig` with embedded security profile |
| [`sdk/rust/lib/sandbox/flat_rootfs.rs`](https://github.com/superradcompany/microsandbox/blob/main/sdk/rust/lib/sandbox/flat_rootfs.rs) | Overlay/dual-fs mount namespace setup |
| [`crates/network/lib/lib.rs`](https://github.com/superradcompany/microsandbox/blob/main/crates/network/lib/lib.rs) | Sandbox network policies and netns creation |
| [`packages/microsandbox-types/rust/lib/domain.rs`](https://github.com/superradcompany/microsandbox/blob/main/packages/microsandbox-types/rust/lib/domain.rs) | `SandboxPolicy` definition for host-runtime isolation |
| `crates/filesystem/lib/backends/dualfs/*.rs` | Dual-fs implementation for guest-only file views |

## Summary

- **Microsandbox isolation** combines eight distinct Linux kernel mechanisms coordinated by the runtime VM
- **Namespace isolation** (PID, mount, network, UTS, IPC) prevents cross-sandbox visibility of processes, files, and network resources
- **Cgroup limits** enforce hard resource boundaries for CPU, memory, and process count
- **Seccomp profiles** restrict the system call surface available to each sandbox
- **Per-sandbox socket namespaces** ensure IPC channels remain strictly isolated
- All isolation layers are **deterministic and reproducible**—created fresh for every sandbox instance

## Frequently Asked Questions

### How does Microsandbox isolation compare to Docker containers?

Microsandbox provides stronger defaults through deterministic namespace construction and mandatory seccomp profiles. While Docker shares the same Linux namespace primitives, Microsandbox enforces complete isolation stacks by default in [`crates/runtime/lib/vm.rs`](https://github.com/superradcompany/microsandbox/blob/main/crates/runtime/lib/vm.rs), whereas Docker allows more permissive configurations that can weaken boundaries between containers.

### Can Microsandbox sandboxes escape their namespaces?

Namespace escape requires kernel-level vulnerabilities or misconfigured capabilities. Microsandbox minimizes this risk through defense in depth: even if one layer fails (e.g., a seccomp bypass), the mount namespace and PID namespace provide independent barriers. The deterministic construction in [`crates/runtime/lib/vm.rs`](https://github.com/superradcompany/microsandbox/blob/main/crates/runtime/lib/vm.rs) eliminates common misconfiguration vectors.

### What happens to isolated resources when a sandbox terminates?

Resource cleanup is automatic. The [`crates/runtime/lib/ipc.rs`](https://github.com/superradcompany/microsandbox/blob/main/crates/runtime/lib/ipc.rs) module removes socket namespaces, cgroups are destroyed via the lifecycle manager, and all namespace references are released. This prevents resource exhaustion and ensures isolation state does not persist across sandbox instances.

### How can I customize isolation strength for specific sandboxes?

Use the `SandboxBuilder` API to override defaults from [`sdk/rust/lib/config/mod.rs`](https://github.com/superradcompany/microsandbox/blob/main/sdk/rust/lib/config/mod.rs). You can specify custom `NetworkPolicy` constraints, replace `SecurityProfile` definitions, or adjust cgroup parameters through the isolation profile. All customizations are validated before namespace creation begins.