What Are the Security Implications of Using Microsandbox? A Deep Dive into Security Profiles

Microsandbox provides defense-in-depth isolation through micro-VM architecture with configurable security profiles that harden or relax capability restrictions based on workload requirements.

Microsandbox runs each workload inside a lightweight micro-VM that is isolated from the host by the kernel and hypervisor. This architecture provides strong baseline security, but the project's security model goes further with configurable security profiles that control privilege escalation, capability sets, and filesystem mount behavior. Understanding these security implications is essential for deploying workloads safely.

Micro-VM Isolation Architecture

Microsandbox leverages hardware virtualization to create isolated execution environments. Unlike traditional containers that share the host kernel, each micro-VM runs with its own kernel instance, providing stronger isolation boundaries against:

• Kernel exploits – A compromised workload cannot directly attack the host kernel
• Resource exhaustion – CPU and memory are isolated per VM, preventing noisy neighbor problems
• Side-channel attacks – Cross-sandbox leakage is reduced through separate address spaces

This isolation layer is controlled through the runtime in [sdk/rust/lib/runtime/spawn.rs](https://github.com/superradcompany/microsandbox/blob/main/sdk/rust/lib/runtime/spawn.rs), where VM parameters are applied during sandbox creation.

Security Profiles: Default vs. Restricted

Microsandbox implements two distinct security profiles that trade capability for hardening. The profile is defined in sdk/rust/lib/sandbox/config.rs#L1432 as the SecurityProfile enum.

Default Profile: Full Capabilities

The Default profile maintains standard Linux privileges inside the guest, matching traditional container behavior.

Capabilities retained:

• CAP_SYS_ADMIN – Full administrative privileges
• Mount operations – Can create privileged mounts including tmpfs
• Privilege escalation – Can use sudo or similar mechanisms

When to use: Development environments, Docker-in-Docker scenarios, workloads requiring custom filesystem mounts, or legacy applications needing elevated permissions.

Risk assessment: A compromised process can acquire CAP_SYS_ADMIN and potentially manipulate kernel namespaces to escape isolation boundaries.

Restricted Profile: Hardened Execution

The Restricted profile applies three hardening measures at spawn time, enforced in sdk/rust/lib/runtime/spawn.rs#L2514:

Hardening Measure	Implementation	Security Benefit
no_new_privs	Kernel flag enabled	Prevents privilege escalation through setuid binaries
CAP_SYS_ADMIN dropped	Capability removed	Blocks privileged syscalls and namespace manipulation
nosuid,nodev mount flags	Applied to all mounts	Prevents execution of set-uid binaries and device node creation

Verification through testing: The integration test suite in [sdk/rust/tests/security_profile.rs](https://github.com/superradcompany/microsandbox/blob/main/sdk/rust/tests/security_profile.rs) validates these behaviors with explicit assertions:

assert_no_new_privs(&restricted, "1");         // no_new_privs active
assert_cap_sys_admin(&restricted, false);      // CAP_SYS_ADMIN dropped
assert_mount_has_flags(..., &["nosuid", "nodev"]);  // mount restrictions applied

When to use: Production workloads, untrusted code execution, multi-tenant environments, or any scenario requiring minimal attack surface.

Profile Configuration Across Entry Points

Microsandbox ensures consistent security policy enforcement by parsing profiles identically across all interfaces.

CLI Parsing (msb command)

Profile parsing occurs in crates/cli/lib/commands/common.rs#L2644:

# Default profile (privileged)

msb sandbox create my-default --image alpine --cpus 1 --memory 256

# Restricted profile (hardened)

msb sandbox create my-restricted --image alpine --cpus 1 --memory 256 \
    --security-profile restricted

Agent Daemon Configuration

The agentd component reads the MSB_SECURITY_PROFILE environment variable in crates/agentd/lib/config.rs#L575:

read_env(ENV_SECURITY_PROFILE)  // MSB_SECURITY_PROFILE

Both paths use the same parse_security_profile function, ensuring identical validation and defaults regardless of entry point.

Programmatic Security Profile Selection

The Rust SDK exposes profile control through the builder pattern in [packages/microsandbox-types/rust/lib/domain.rs](https://github.com/superradcompany/microsandbox/blob/main/packages/microsandbox-types/rust/lib/domain.rs):

Default Profile (Privileged)

use microsandbox::{Sandbox, sandbox::SecurityProfile};

let sb = Sandbox::builder("my-default")
    .image("docker.io/library/alpine")
    .cpus(1)
    .memory(256)
    .replace()
    .create()
    .await
    .expect("create sandbox");

// Runs with CAP_SYS_ADMIN, full mount capabilities, privilege escalation possible

Restricted Profile (Hardened)

let sb = Sandbox::builder("my-restricted")
    .image("docker.io/library/alpine")
    .cpus(1)
    .memory(256)
    .replace()
    .security(SecurityProfile::Restricted)   // Enable hardening
    .create()
    .await
    .expect("create sandbox");

// Inside: no_new_privs, no CAP_SYS_ADMIN, nosuid/nodev mounts

Threat Model Analysis

Understanding the security implications of each profile requires analyzing specific attack vectors.

Privilege Escalation Attacks

Default profile vulnerability: A compromised process with CAP_SYS_ADMIN can create new user namespaces, mount filesystems, or manipulate cgroups to escape sandbox boundaries.

Restricted profile mitigation: no_new_privs prevents setuid exploitation, while CAP_SYS_ADMIN removal blocks namespace operations entirely. The test suite verifies assert_cap_sys_admin(&restricted, false) to confirm this protection.

Filesystem-Based Exploitation

Default profile risk: Writable mounts without restrictions allow creating set-uid root binaries or device nodes that could compromise the host when accessed outside the sandbox.

Restricted profile hardening: The nosuid mount flag prevents set-uid execution, and nodev blocks device file creation. The integration test validates this with assert_mount_has_flags(..., &["nosuid", "nodev"]).

Network and Side-Channel Considerations

While security profiles control capability-based hardening, network isolation is configured separately through Microsandbox's networking module. The micro-VM architecture inherently provides:

• Independent network namespaces
• Optional firewall rule application
• CPU/memory isolation reducing cross-VM side-channel leakage

Security Best Practices

Based on the Microsandbox source code analysis, follow these recommendations:

• Always use Restricted profile for production workloads – The capability reduction eliminates major escape vectors with minimal functionality loss for most applications.

• Audit Default profile usage – Document any workload requiring Default profile and implement additional monitoring for privilege escalation attempts.

• Validate through integration tests – Mirror the test patterns in sdk/rust/tests/security_profile.rs to verify security boundaries in your deployment pipeline.

• Centralize profile configuration – Use the MSB_SECURITY_PROFILE environment variable in agentd deployments for consistent policy enforcement.

Summary

• Microsandbox combines micro-VM isolation with configurable security profiles for defense-in-depth security
• The Default profile maintains CAP_SYS_ADMIN and full mount capabilities, suitable only for trusted development environments
• The Restricted profile enables no_new_privs, drops CAP_SYS_ADMIN, and applies nosuid/nodev mount flags—verified by integration tests in security_profile.rs
• Profile configuration is parsed identically across CLI (common.rs) and daemon (agentd/config.rs) entry points
• Security boundaries are enforced at runtime spawn in runtime/spawn.rs with testable guarantees
• Production deployments should default to Restricted profile, with explicit exceptions documented for Default profile workloads

Frequently Asked Questions

Can a restricted Microsandbox still run containerized applications?

Yes, most containerized applications function normally in Restricted profile. The removed capabilities (CAP_SYS_ADMIN, privilege escalation) primarily affect operations like Docker-in-Docker, custom filesystem mounts, or modifying kernel parameters. Standard network services, compute workloads, and applications using normal POSIX APIs operate without restriction.

How does Microsandbox security compare to traditional Linux containers?

Microsandbox's micro-VM architecture provides stronger isolation than containers because each workload runs an independent kernel instance. The security profile system adds capability-based hardening that complements this isolation. While containers rely on namespace and cgroup restrictions sharing one kernel, Microsandbox combines hardware virtualization with fine-grained capability control, making escape significantly more difficult.

Is there performance overhead when using the Restricted security profile?

The Restricted profile imposes negligible performance overhead. The no_new_privs flag and capability dropping occur once at process startup through prctl and capset syscalls. Mount flags are applied at filesystem setup time. These are one-time initialization costs with no runtime impact on workload execution, as confirmed by the standard test suite timing measurements in the codebase.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}