# What Are the Security Implications of Using Microsandbox? A Deep Dive into Security Profiles

> Explore microsandbox security implications with configurable profiles. Learn how micro-VMs provide defense-in-depth isolation for your workloads.

- Repository: [Super Rad Company/microsandbox](https://github.com/superradcompany/microsandbox)
- Tags: deep-dive
- Published: 2026-08-20

---

**Microsandbox provides defense-in-depth isolation through micro-VM architecture with configurable security profiles that harden or relax capability restrictions based on workload requirements.**

Microsandbox runs each workload inside a lightweight micro-VM that is **isolated from the host** by the kernel and hypervisor. This architecture provides strong baseline security, but the project's security model goes further with **configurable security profiles** that control privilege escalation, capability sets, and filesystem mount behavior. Understanding these security implications is essential for deploying workloads safely.

## Micro-VM Isolation Architecture

Microsandbox leverages hardware virtualization to create isolated execution environments. Unlike traditional containers that share the host kernel, each micro-VM runs with its own kernel instance, providing stronger isolation boundaries against:

- **Kernel exploits** – A compromised workload cannot directly attack the host kernel
- **Resource exhaustion** – CPU and memory are isolated per VM, preventing noisy neighbor problems
- **Side-channel attacks** – Cross-sandbox leakage is reduced through separate address spaces

This isolation layer is controlled through the runtime in [[`sdk/rust/lib/runtime/spawn.rs`](https://github.com/superradcompany/microsandbox/blob/main/sdk/rust/lib/runtime/spawn.rs)](https://github.com/superradcompany/microsandbox/blob/main/sdk/rust/lib/runtime/spawn.rs), where VM parameters are applied during sandbox creation.

## Security Profiles: Default vs. Restricted

Microsandbox implements two distinct security profiles that trade capability for hardening. The profile is defined in [`sdk/rust/lib/sandbox/config.rs#L1432`](https://github.com/superradcompany/microsandbox/blob/main/sdk/rust/lib/sandbox/config.rs#L1432) as the `SecurityProfile` enum.

### Default Profile: Full Capabilities

The **Default** profile maintains standard Linux privileges inside the guest, matching traditional container behavior.

**Capabilities retained:**
- `CAP_SYS_ADMIN` – Full administrative privileges
- Mount operations – Can create privileged mounts including `tmpfs`
- Privilege escalation – Can use `sudo` or similar mechanisms

**When to use:** Development environments, Docker-in-Docker scenarios, workloads requiring custom filesystem mounts, or legacy applications needing elevated permissions.

**Risk assessment:** A compromised process can acquire `CAP_SYS_ADMIN` and potentially manipulate kernel namespaces to escape isolation boundaries.

### Restricted Profile: Hardened Execution

The **Restricted** profile applies three hardening measures at spawn time, enforced in [`sdk/rust/lib/runtime/spawn.rs#L2514`](https://github.com/superradcompany/microsandbox/blob/main/sdk/rust/lib/runtime/spawn.rs#L2514):

| Hardening Measure | Implementation | Security Benefit |
|-------------------|----------------|----------------|
| `no_new_privs` | Kernel flag enabled | Prevents privilege escalation through `setuid` binaries |
| `CAP_SYS_ADMIN` dropped | Capability removed | Blocks privileged syscalls and namespace manipulation |
| `nosuid,nodev` mount flags | Applied to all mounts | Prevents execution of set-uid binaries and device node creation |

**Verification through testing:** The integration test suite in [[`sdk/rust/tests/security_profile.rs`](https://github.com/superradcompany/microsandbox/blob/main/sdk/rust/tests/security_profile.rs)](https://github.com/superradcompany/microsandbox/blob/main/sdk/rust/tests/security_profile.rs) validates these behaviors with explicit assertions:

```rust
assert_no_new_privs(&restricted, "1");         // no_new_privs active
assert_cap_sys_admin(&restricted, false);      // CAP_SYS_ADMIN dropped
assert_mount_has_flags(..., &["nosuid", "nodev"]);  // mount restrictions applied

```

**When to use:** Production workloads, untrusted code execution, multi-tenant environments, or any scenario requiring minimal attack surface.

## Profile Configuration Across Entry Points

Microsandbox ensures **consistent security policy enforcement** by parsing profiles identically across all interfaces.

### CLI Parsing (`msb` command)

Profile parsing occurs in [`crates/cli/lib/commands/common.rs#L2644`](https://github.com/superradcompany/microsandbox/blob/main/crates/cli/lib/commands/common.rs#L2644):

```bash

# Default profile (privileged)

msb sandbox create my-default --image alpine --cpus 1 --memory 256

# Restricted profile (hardened)

msb sandbox create my-restricted --image alpine --cpus 1 --memory 256 \
    --security-profile restricted

```

### Agent Daemon Configuration

The `agentd` component reads the `MSB_SECURITY_PROFILE` environment variable in [`crates/agentd/lib/config.rs#L575`](https://github.com/superradcompany/microsandbox/blob/main/crates/agentd/lib/config.rs#L575):

```rust
read_env(ENV_SECURITY_PROFILE)  // MSB_SECURITY_PROFILE

```

Both paths use the same `parse_security_profile` function, ensuring identical validation and defaults regardless of entry point.

## Programmatic Security Profile Selection

The Rust SDK exposes profile control through the builder pattern in [[`packages/microsandbox-types/rust/lib/domain.rs`](https://github.com/superradcompany/microsandbox/blob/main/packages/microsandbox-types/rust/lib/domain.rs)](https://github.com/superradcompany/microsandbox/blob/main/packages/microsandbox-types/rust/lib/domain.rs):

### Default Profile (Privileged)

```rust
use microsandbox::{Sandbox, sandbox::SecurityProfile};

let sb = Sandbox::builder("my-default")
    .image("docker.io/library/alpine")
    .cpus(1)
    .memory(256)
    .replace()
    .create()
    .await
    .expect("create sandbox");

// Runs with CAP_SYS_ADMIN, full mount capabilities, privilege escalation possible

```

### Restricted Profile (Hardened)

```rust
let sb = Sandbox::builder("my-restricted")
    .image("docker.io/library/alpine")
    .cpus(1)
    .memory(256)
    .replace()
    .security(SecurityProfile::Restricted)   // Enable hardening
    .create()
    .await
    .expect("create sandbox");

// Inside: no_new_privs, no CAP_SYS_ADMIN, nosuid/nodev mounts

```

## Threat Model Analysis

Understanding the security implications of each profile requires analyzing specific attack vectors.

### Privilege Escalation Attacks

**Default profile vulnerability:** A compromised process with `CAP_SYS_ADMIN` can create new user namespaces, mount filesystems, or manipulate cgroups to escape sandbox boundaries.

**Restricted profile mitigation:** `no_new_privs` prevents `setuid` exploitation, while `CAP_SYS_ADMIN` removal blocks namespace operations entirely. The test suite verifies `assert_cap_sys_admin(&restricted, false)` to confirm this protection.

### Filesystem-Based Exploitation

**Default profile risk:** Writable mounts without restrictions allow creating set-uid root binaries or device nodes that could compromise the host when accessed outside the sandbox.

**Restricted profile hardening:** The `nosuid` mount flag prevents set-uid execution, and `nodev` blocks device file creation. The integration test validates this with `assert_mount_has_flags(..., &["nosuid", "nodev"])`.

### Network and Side-Channel Considerations

While security profiles control capability-based hardening, **network isolation** is configured separately through Microsandbox's networking module. The micro-VM architecture inherently provides:

- Independent network namespaces
- Optional firewall rule application
- CPU/memory isolation reducing cross-VM side-channel leakage

## Security Best Practices

Based on the Microsandbox source code analysis, follow these recommendations:

- **Always use Restricted profile for production workloads** – The capability reduction eliminates major escape vectors with minimal functionality loss for most applications.

- **Audit Default profile usage** – Document any workload requiring Default profile and implement additional monitoring for privilege escalation attempts.

- **Validate through integration tests** – Mirror the test patterns in [`sdk/rust/tests/security_profile.rs`](https://github.com/superradcompany/microsandbox/blob/main/sdk/rust/tests/security_profile.rs) to verify security boundaries in your deployment pipeline.

- **Centralize profile configuration** – Use the `MSB_SECURITY_PROFILE` environment variable in `agentd` deployments for consistent policy enforcement.

## Summary

- Microsandbox combines **micro-VM isolation** with **configurable security profiles** for defense-in-depth security
- The **Default profile** maintains `CAP_SYS_ADMIN` and full mount capabilities, suitable only for trusted development environments
- The **Restricted profile** enables `no_new_privs`, drops `CAP_SYS_ADMIN`, and applies `nosuid/nodev` mount flags—verified by integration tests in [`security_profile.rs`](https://github.com/superradcompany/microsandbox/blob/main/security_profile.rs)
- Profile configuration is parsed identically across CLI ([`common.rs`](https://github.com/superradcompany/microsandbox/blob/main/common.rs)) and daemon ([`agentd/config.rs`](https://github.com/superradcompany/microsandbox/blob/main/agentd/config.rs)) entry points
- Security boundaries are enforced at runtime spawn in [`runtime/spawn.rs`](https://github.com/superradcompany/microsandbox/blob/main/runtime/spawn.rs) with testable guarantees
- Production deployments should default to Restricted profile, with explicit exceptions documented for Default profile workloads

## Frequently Asked Questions

### Can a restricted Microsandbox still run containerized applications?

Yes, most containerized applications function normally in Restricted profile. The removed capabilities (`CAP_SYS_ADMIN`, privilege escalation) primarily affect operations like Docker-in-Docker, custom filesystem mounts, or modifying kernel parameters. Standard network services, compute workloads, and applications using normal POSIX APIs operate without restriction.

### How does Microsandbox security compare to traditional Linux containers?

Microsandbox's micro-VM architecture provides stronger isolation than containers because each workload runs an independent kernel instance. The security profile system adds capability-based hardening that complements this isolation. While containers rely on namespace and cgroup restrictions sharing one kernel, Microsandbox combines hardware virtualization with fine-grained capability control, making escape significantly more difficult.

### Is there performance overhead when using the Restricted security profile?

The Restricted profile imposes negligible performance overhead. The `no_new_privs` flag and capability dropping occur once at process startup through `prctl` and `capset` syscalls. Mount flags are applied at filesystem setup time. These are one-time initialization costs with no runtime impact on workload execution, as confirmed by the standard test suite timing measurements in the codebase.