Hello,
I am exploring cross-platform sandboxing with AppContainters on Windows 11 (x64) for a project in which I will basically create a type of Docker engine but for native applications (Windows, Linux, MacOS)
I came across your project and was able to compile and run it with most of the examples but in the comprehensive demo it looked like it wanted to start "notepad" but that did not work at all and also there seem to be some errors in the networking Demo 4 from what I can tell.
As an update I also tried
acrun.exe launch cmd C:\\Windows\\System32\\cmd.exe
Error: Win32("CreateAppContainerProfile failed: 0x80070057")
Any help would be greatly appreciated.
Thanks and have a great day
.\comprehensive_demo.exe
╔════════════════════════════════════════════════════════════════╗
║ ║
║ rappct - Windows AppContainer Toolkit ║
║ Comprehensive Demo Suite ║
║ ║
╚════════════════════════════════════════════════════════════════╝
This demo suite showcases all major capabilities of rappct:
• Profile Management • Token Introspection
• Container Launching • Network Capabilities
• File System ACLs • LPAC Mode
• Resource Limits • I/O Redirection
• Comprehensive Example
Ready to start demos?
Press Enter to continue...
Expected: Profile ensure/derive/delete should succeed.
╔════════════════════════════════════════════════╗
║ DEMO 1: AppContainer Profile Management ║
╚════════════════════════════════════════════════╝
→ Creating AppContainer profile: 'rappct.demo.profile'
✓ Profile created/opened successfully
• Name: rappct.demo.profile
• SID: S-1-15-2-1307649430-1689579145-787119888-1901034244-280070270-3805486061-1082648574
→ Deriving SID from profile name...
✓ Derived SID: S-1-15-2-1307649430-1689579145-787119888-1901034244-280070270-3805486061-1082648574
• Matches original: true
Profile will be deleted after viewing
Press Enter to continue...
✓ Profile deleted successfully
✓ Profile Management completed successfully
Expected: Shows current token; outside container typically not in AppContainer.
╔════════════════════════════════════════════════╗
║ DEMO 2: Token Introspection ║
╚════════════════════════════════════════════════╝
→ Querying current process token...
✓ Current Process Security Context:
• Running in AppContainer: false
• Running in LPAC: false
• Package SID: None (not in container)
• Capabilities: None
✓ Token Introspection completed successfully
Expected: Isolated cmd.exe runs with no network/file/registry access.
╔════════════════════════════════════════════════╗
║ DEMO 3: Basic Container Launch ║
╚════════════════════════════════════════════════╝
→ Building security capabilities (no special permissions)...
→ Launching isolated cmd.exe in AppContainer...
✗ Basic Container Launch failed: Process launch failed at CreateProcessW: launch
Continuing with next demo...
Expected: InternetClient => HTTP works, DNS may fail; Client/Server => can listen; PrivateNetwork => LAN allowed.
╔════════════════════════════════════════════════╗
║ DEMO 4: Network Capabilities ║
╚════════════════════════════════════════════════╝
→ Example 1: Internet Client capability
Allows: Outbound internet connections
Denies: Server operations, LAN access
✓ Launched with PID: 25884
[NET-CLIENT] Testing Internet Client
Attempting to perform the InitializeDefaultDrives operation on the 'FileSystem' provider failed.
200
→ Example 2: Internet Client/Server capability
Allows: Internet connections + listening on ports
✓ Launched with PID: 25172
[NET-SERVER] Can act as both client and server
Attempting to perform the InitializeDefaultDrives operation on the 'FileSystem' provider failed.
200
→ Example 3: Private Network Client/Server
Allows: LAN/domain network access
✓ Launched with PID: 2052
[NET-PRIVATE] Access to private networks
Attempting to perform the InitializeDefaultDrives operation on the 'FileSystem' provider failed.
HTTP failed
✓ Network Capabilities completed successfully
Expected: Allowed file readable; denied file fails from AppContainer.
╔════════════════════════════════════════════════╗
║ DEMO 5: File System ACLs ║
╚════════════════════════════════════════════════╝
→ Created test structure:
• C:\Users\lonni\AppData\Local\Temp\rappct_acl_demo
├── allowed/
│ └── readable.txt (will grant access)
└── denied/
└── secret.txt (no access)
→ First, testing normal (non-AppContainer) file access:
⚠ Normal process: Unexpected file access behavior
→ Now comparing with AppContainer restrictions:
→ Granting AppContainer access to allowed directory...
This modifies Windows ACLs to allow the AppContainer SID to access specific files
✓ ACLs applied - AppContainer can now access the allowed directory
→ Testing file access from AppContainer...
Expected: Can read allowed file, cannot read denied file
✗ File System ACLs failed: Process launch failed at CreateProcessW: launch
Continuing with next demo...
Expected: Notepad launches under LPAC; limited registry/COM access.
╔════════════════════════════════════════════════╗
║ DEMO 6: Low Privilege AppContainer (LPAC) ║
╚════════════════════════════════════════════════╝
✓ LPAC is supported on this system
→ Building LPAC capabilities...
LPAC provides limited access to:
• Registry (read-only)
• COM objects (lpacCom)
• Some system resources
→ Launching Notepad in LPAC mode...
✓ LPAC process launched with PID: 10072
• Has limited registry read access
• Can use certain COM objects
• Still isolated from most system resources
Close Notepad when ready
Press Enter to continue...
✓ LPAC Mode completed successfully
Expected: Process launches with memory/CPU constraints enforced by job object.
╔════════════════════════════════════════════════╗
║ DEMO 7: Job Objects & Resource Limits ║
╚════════════════════════════════════════════════╝
→ Configuring resource limits:
• Memory limit: 50 MB
• CPU limit: 25% (1/4 of one core)
• Kill on job close: Yes
✗ Job Objects & Resource Limits failed: Process launch failed at CreateProcessW: launch
Continuing with next demo...
Expected: Captures child stdout/stderr via pipes.
╔════════════════════════════════════════════════╗
║ DEMO 8: Process I/O Redirection ║
╚════════════════════════════════════════════════╝
→ Launching process with piped I/O...
✗ Process I/O Redirection failed: Process launch failed at CreateProcessW: launch
Continuing with next demo...
Expected: Sandboxed PowerShell can fetch HTTP, write file within granted directory, respect job limits.
╔════════════════════════════════════════════════╗
║ DEMO 9: Comprehensive Example ║
║ (Secure Web Scraper Sandbox) ║
╚════════════════════════════════════════════════╝
Scenario: Sandboxed PowerShell script that:
• Downloads content from the internet
• Saves to a specific allowed directory
• Has memory and CPU limits
• Runs in LPAC mode for enhanced but limited access
→ Setting up sandbox environment...
• Work directory: C:\Users\lonni\AppData\Local\Temp\rappct_scraper_sandbox
✓ File system ACLs configured
✓ LPAC mode enabled
✓ Capabilities configured
→ Launching sandboxed PowerShell scraper...
Resource limits:
• Memory: 100 MB max
• CPU: 50% max
✓ Sandboxed process launched with PID: 4368
→ Waiting for completion...
→ Cleaning up...
✓ Sandbox environment cleaned
✓ Comprehensive Example completed successfully
╔════════════════════════════════════════════════════════════════╗
║ All Demos Complete! ║
╚════════════════════════════════════════════════════════════════╝
You've seen rappct's full capabilities for:
✓ Creating secure sandboxes with AppContainer
✓ Managing granular permissions and capabilities
✓ Enforcing resource limits
✓ Controlling file system access
✓ Running processes in LPAC mode
✓ Capturing process I/O
For production use, consider:
• Run with administrative privileges for full functionality
• Test on Windows 10 1703+ for LPAC support
• Review Windows Firewall settings for network features
• Use appropriate error handling for all operations
Hello,
I am exploring cross-platform sandboxing with AppContainters on Windows 11 (x64) for a project in which I will basically create a type of Docker engine but for native applications (Windows, Linux, MacOS)
I came across your project and was able to compile and run it with most of the examples but in the comprehensive demo it looked like it wanted to start "notepad" but that did not work at all and also there seem to be some errors in the networking Demo 4 from what I can tell.
As an update I also tried
Any help would be greatly appreciated.
Thanks and have a great day