InstaVM vs Microsoft Execution Containers

InstaVM 35

Closed service lines. The latest dated change found is Python SDK 0.26.1 on 15 July 2026, 114 days before the check, and the site changelog's only entry is 11 July (10). No SDK release in the 90 days to 6 November (0). A public changelog, support email and Discord, with no reply times seen (8 of 15). Official Python and JavaScript SDKs, last released in July and May 2026 (12 of 15). Package health of the SDK repositories was not read (5 of 10). Total 35.

Microsoft Execution Containers 92

v1.0.1 on npm and crates.io on 17 October 2026, 15 days before the check, still the newest release on 1 November (30). Four npm releases in the 90 days from 3 August, 0.8.0 on 22 August, 0.9.0 on 28 September, 1.0.0 on 6 October and 1.0.1 on 17 October (the npm dates per the 17 October check, crates.io and the tags re-read on 1 November) (20). 261 issues closed against 38 open, with issue forms, triage labels and fixes that land within days, and three outside bug reports filed between 24 September and 2 October with no comment, per the 8 October check, not re-read on 1 November (19 of 25). Official SDKs for Node.js, .NET and Rust, all at 1.0.1 (15). A package-lock check, CodeQL and Dependabot in CI, with 47 commits on main from 17 to 30 October. The npm package has no repository field and no provenance attestation, per the 17 October check (8 of 10). 30+20+19+15+8 = 92.

InstaVM 20

No x402, MPP or L402 (0 of 40). Per-second vCPU, memory and storage prices are published without a login (20). The free plan's $50 credit needs a card on file (0). Signup and key minting are in a browser dashboard (0). Total 20.

Microsoft Execution Containers 60

Read with the self-hosted rule. No x402, MPP or L402 (0 of 40). MIT software with nothing to buy and no hosted option, so 20 for pricing, 20 for free use with no card and 20 because an agent can install it from npm with no account. 0+20+20+20 = 60.

InstaVM 41

Plain API keys in a header, with API endpoints to create, list and delete them and no scopes found (20 of 30). Egress policies per session or VM can block all outbound traffic or allow named domains and CIDRs, but llms.txt describes full network access as the default (8 of 20). No guidance on untrusted output from executed code or browser sessions (3 of 15). An Audit Logs endpoint group exists in the API reference (10 of 15). No security.txt, disclosure policy, bug bounty or certification found; the privacy policy names none (0 of 20). Total 41.

Microsoft Execution Containers 69

No credentials to issue or leak, because the library runs in the caller's process, so the middle band (20 of 30). Least privilege is the product's job. Egress, ingress and host loopback default to deny, filesystem access is limited to listed paths, UI access is denied when omitted, and validation rejects a policy the chosen backend can't enforce. The limits are documented. isolation_session cannot restrict networking, proxy routing is cooperative on Seatbelt and WSLC, the Windows DACL fallback that edits host file permissions is allowed by default, and --audit turns the sandbox off (17 of 20). The workload's output is untrusted content. The SDK keeps warnings and denial metadata out of stdout and stderr, but we found no guidance for an agent reading that output (8 of 15). Local JSON audit records for process exits, tier fallbacks, teardown and rejected configs through --log-file on the executors, and the deny-and-record capture. We found no equivalent switch documented for the in-process SDKs (10 of 15). SECURITY.md sends reports to MSRC, CodeQL runs in CI and the repository has a fuzzing pipeline. OSV lists no advisories for the npm, crates.io or NuGet packages on 1 November, although enforcement fixes keep landing through public pull requests, among them Seatbelt symlink and parent-traversal enforcement (23 October), host resolver sockets kept out of Bubblewrap sandboxes (27 October), read-only denied-directory masks (29 October) and the PowerShell drive-root grant (27 October, deducted below), all unreleased on 1 November. The security.txt on microsoft.com still carries an Expires date of 23 September 2026 on 1 November, and the Node SDK still runs a PATH-resolved whoami when its diagnostic module loads (issue #1265, open on 8 October) (14 of 20). 20+17+8+10+14 = 69.

InstaVM 57

Closed service with clear terms (15). The terms and privacy policy agree on keeping code and execution logs up to one year and US storage, and the policy names Stripe, PostHog and Resend, but allows training on anonymised, aggregated data derived from user content with opt-out by email and mentions no DPA (18 of 30). No deprecation policy or notices found (0 of 20). US data location stated and three subprocessors named, cloud providers unnamed (12 of 20). Total 45.

Microsoft Execution Containers 84

MIT for the repository and for the published npm package, whose LICENSE.md we compared with the repository's (30). Local software with no service behind it. The telemetry docs list what the optional Windows events contain (version, backend, bounded outcomes, policy fingerprints) and what they omit (commands, file paths, credentials, free-form error text), and the consent prompt links Microsoft's privacy statement. No retention period for those events is stated (24 of 30). The release notes name V1 as the compatibility boundary for 1.x under semver 2.0, breaking changes need a new versioned surface, and the schema docs mark retired contracts. No notice period with dates was found (12 of 20). Telemetry is disclosed in the README, off by default, opt-in for each run, subject to user consent and an administrative block, and absent on Linux and macOS (20). 30+24+12+20 = 86.

InstaVM 51

30 operations take limit, offset, cursor or page parameters, with no field selection found (12 of 25). Listing endpoints page, with little filtering (10 of 20). The SDK maps failures to typed exceptions such as AuthenticationError, QuotaExceededError and RateLimitError, but the HTTP error bodies are undocumented (8 of 20). One operation takes an idempotency parameter, and snapshots and clones make work repeatable, with no safe-retry guidance (6 of 20). client.execute(code=..., language=...) needs two arguments, with Python and JavaScript SDKs (15). Total 51.

Microsoft Execution Containers 74

One request type with command as the only required field, and run returns stdout, stderr, the exit code, a timeout flag and warnings. We found no documented cap on captured output, and the npm package is a 37.7 MB tarball (18 of 25). spawn streams output and timeoutMs bounds a run, but there is no truncation or size control on captured output (10 of 20). MxcError carries one of 12 codes with optional operation, native code and remediation, and a deny-and-record mode lists blocked accesses on ProcessContainer (18 of 20). validate* calls dry-run every lifecycle step, and lifecycle state errors are typed (already_started, stale_id). Issue #1429, open since 6 October, reports a second deprovision returning success, per the 8 October check, not re-read on 17 October. Not an MCP server, so no tool annotations apply (13 of 20). Network, filesystem and UI policy default to deny, and official SDKs exist for Node.js, .NET and Rust (15). 18+10+18+13+15 = 74.

InstaVM 66

A public OpenAPI 3.1 spec with 229 operations (25). llms.txt at instavm.io (10). Only 93 of 229 operations have a description, and those read as short summaries without when-not-to-use guidance (8 of 20). FastAPI-generated request schemas with typed fields and required lists (10 of 15). Docs carry code examples for each SDK area, but only 422 validation errors appear in the spec and no error-code reference was found (6 of 15). Paths sit under /v1 and an SDK changelog exists, but the site changelog has one entry, of 11 July 2026 (7 of 15). Total 66.

Microsoft Execution Containers 81

Read as an SDK with a published request contract. A draft-07 JSON Schema for the stable 1.0.0 request sits in the repository, and the Node SDK ships TypeScript declarations (25). No llms.txt. The docs are Markdown files in the repository (5 of 10). The API reference states what each operation does and has a table for choosing between captured, piped and terminal execution, and the backend guides say which policies each backend enforces and which are cooperative (15 of 20). Containment is a closed union, network actions and clipboard levels are enums, the schema has 33 enums and 39 objects closed to extra properties, and 135 of 150 properties carry a description. command is one free string (13 of 15). Ten sample scenarios, each in Rust, .NET and Node. The 12 error codes are a closed type, but we found no page that explains each one (11 of 15). A versioned /v1 entry point, a schema version table with retired contracts, a changelog for each SDK and GitHub release notes. The Node changelog still has no 1.0.0 or 1.0.1 entry on 1 November (12 of 15). 25+5+15+13+11+12 = 81.