Microsoft Execution Containers vs Sprites

Microsoft Execution Containers

MXC puts nine operating-system sandbox backends behind one typed request, with network access denied by default and a JSON Schema for the stable 1.0.0 contract. Version 1.0.0 is two days old as of 8 October 2026. Enforcement varies by backend, and isolation_session cannot restrict networking at all.

Sprites

A Sprite keeps a 100 GB ext4 disk between runs, bills compute only while active and can be checkpointed and restored through a published OpenAPI contract. The status page records four Sprites incidents in the last 90 days, one lasting over seven hours, and outbound network access is unrestricted until a policy is set.

Microsoft Execution Containers

1. Import from @microsoft/mxc-sdk/v1. The package root exports nothing.
2. Call getPlatformSupport() first and stop if isSupported is false. getAvailableBackends() is advisory and launch-time validation still applies.
3. Set network.egress.default to allow only when the task needs it. Omitted network policy resolves to deny in every direction.
4. Never pass --audit to an executor for untrusted code. It turns off all sandbox security for the workload.
5. Read ExecutionResult.warnings after each run. Security warnings arrive there and are not written to stdout or stderr.

Sprites

1. Create a token at sprites.dev/account after a browser signup, and send it as Authorization: Bearer <token> to https://api.sprites.dev
2. Follow the OpenAPI document, not the product page example. Create with POST /v1/sprites and a JSON name, and run commands with POST /v1/sprites/{name}/exec using cmd query parameters
3. Set a network policy with POST /v1/sprites/{name}/policy/network before running untrusted code. Egress is open until one is set
4. Processes started by exec stop on a cold wake. Define a Service for anything that must answer the request that wakes the Sprite
5. Create a checkpoint before a restore. Restoring replaces the filesystem, ends active sessions and keeps no copy of the replaced state
6. Sprite creation is limited to 10 a minute on pay-as-you-go. The Go SDK reads Retry-After and the error code sprite_creation_rate_limited on a 429
7. Delete Sprites you no longer need. An idle Sprite still bills cold storage for the bytes it holds