Highly experimental windows sandbox for Fabric. The sandbox aims to act as protection not prevention, thus any exploits / security issues should be made publicly to this repo.

This sandbox should have little to no performance overhead as it runs the game within a Windows App Container.

To validate that the game is running within a sandbox use Process Monitor and enable the "Integrity" column and check for "AppContainer"

File access should be limited as follows:

• Read+Write working directory
• Read .minecraft
• Read Java home (of the JDK being used)
• No registry access

Network access is enabled, but may have restricted access to localhost as per the UWP defaults. For debugging purposes use CheckNetIsolation.exe LoopbackExempt -is -p=<CONTAINER_SID> from an elevated command prompt. See here for more info.

• Less Privileged AppContainer (LPAC), allows for fine grain control to almost all aspects of a machine.
• Access token protection
• MacOS and possibly Linux support

• Requires ARM64 or x64 Windows 10 or 11
• Swift for windows either official or from github.com/thebrowsercompany/swift-build
• Wix installer tools dotnet tool install --global wix --version 5.0.0 (Used to extract the swift redistributables)

• Why swift?
  • Writing new security software in C++ does not seem like a good idea
• Why Windows only?
  • The vast majority of players and malicious code is on Windows.
• Where is the swift source code
  • Its in windows/Sources

This repository does not have an official license yet as I do not want people using this in production. You may learn from the code and improve it but please don't distribute this, as it's far from battle tested. I would strongly recommend opening an issue before thinking about creating a PR. Thanks for understanding.