Microsoft Execution Containers vs Morph Cloud

Microsoft Execution Containers

MXC puts nine operating-system sandbox backends behind one typed request, with network access denied by default and a JSON Schema for the stable 1.0.0 contract. Version 1.0.0 is two days old as of 8 October 2026. Enforcement varies by backend, and isolation_session cannot restrict networking at all.

Morph Cloud

Pause and snapshot keep memory and running processes, and one call branches an instance into several copies. A public OpenAPI file covers 69 operations. No terms of service, privacy policy or security page was found, the free plan includes no compute credit, and the changelog holds one entry from November 2024.

Microsoft Execution Containers

1. Import from @microsoft/mxc-sdk/v1. The package root exports nothing.
2. Call getPlatformSupport() first and stop if isSupported is false. getAvailableBackends() is advisory and launch-time validation still applies.
3. Set network.egress.default to allow only when the task needs it. Omitted network policy resolves to deny in every direction.
4. Never pass --audit to an executor for untrusted code. It turns off all sandbox security for the workload.
5. Read ExecutionResult.warnings after each run. Security warnings arrive there and are not written to stdout or stderr.

Morph Cloud

1. Set ttl_seconds and ttl_action when starting an instance. Nothing in the docs stops an instance with no TTL from billing MCUs
2. Pass auth_mode: api_key when exposing an HTTP service. The default is none, which makes the URL public
3. Enable wake_on_ssh before calling exec on an instance that may be paused. There is no separate exec wake setting
4. Use /api/instance/list and /api/snapshot/list with page and limit (default 50, maximum 1,000). The plain list routes return everything
5. On a 503 from snapshot, branch, pause or reboot, wait for the Retry-After value before repeating the call