> ## Documentation Index
> Fetch the complete documentation index at: https://docs.microsandbox.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Run isolated PR checks

> Stream a commit into a bounded microVM and run its tests there

Boot a clean worker, transfer only committed files into it, and run the pull request's install and test commands inside the microVM. The host never executes code from the checkout.

This example uses Node.js. The same `create → copy → exec` shape works for other toolchains.

## Run the checks

<Steps>
  <Step title="Create the worker">
    <Tooltip tip="This worker works on microsandbox cloud after omitting replace-on-create from the command."><span className="msb-badge-limited">Limited on cloud <Icon icon="circle-info" size={11} /></span></Tooltip>

    <CodeGroup>
      ```sh macOS & Linux theme={null}
      msb run -d --name pr-check --replace \
        --cpus 2 --memory 1G --root-disk 3G --max-duration 10m \
        --net-default deny \
        --net-rule 'allow@registry.npmjs.org:tcp:443' \
        --security restricted \
        node:24.18.1-bookworm-slim -- sh -lc \
          'install -d -o node -g node /workspace; exec sleep 600'
      ```

      ```powershell Windows theme={null}
      msb run -d --name pr-check --replace `
        --cpus 2 --memory 1G --root-disk 3G --max-duration 10m `
        --net-default deny `
        --net-rule 'allow@registry.npmjs.org:tcp:443' `
        --security restricted `
        node:24.18.1-bookworm-slim -- sh -lc `
          'install -d -o node -g node /workspace; exec sleep 600'
      ```
    </CodeGroup>

    Only the npm registry is reachable. Do not pass CI secrets or mount the host checkout into this worker.
  </Step>

  <Step title="Copy the commit">
    <CodeGroup>
      ```sh macOS & Linux theme={null}
      git archive HEAD | \
        msb exec --stream --user node pr-check -- tar -x -C /workspace
      ```

      ```powershell Windows theme={null}
      git archive --format=tar --output=pr-check.tar HEAD
      msb cp ./pr-check.tar pr-check:/tmp/pr-check.tar
      msb exec --user node pr-check -- tar -x -f /tmp/pr-check.tar -C /workspace
      Remove-Item ./pr-check.tar
      ```
    </CodeGroup>

    `git archive` excludes `.git`, checkout credentials, and uncommitted host files. In CI, make sure `HEAD` is the exact pull-request commit you intend to test.
  </Step>

  <Step title="Install and test">
    <CodeGroup>
      ```sh macOS & Linux theme={null}
      msb exec --timeout 8m \
        --user node --workdir /workspace \
        --rlimit nproc=256 --rlimit nofile=1024 \
        pr-check -- sh -lc 'npm ci && npm test'
      ```

      ```powershell Windows theme={null}
      msb exec --timeout 8m `
        --user node --workdir /workspace `
        --rlimit nproc=256 --rlimit nofile=1024 `
        pr-check -- sh -lc 'npm ci && npm test'
      ```
    </CodeGroup>

    Package lifecycle scripts and tests execute inside the microVM. Their exit code becomes the `msb exec` exit code, so the same command works in CI.

    If the project installs from another registry, add the smallest required network rule. For fully offline checks, install reviewed dependencies once, create a snapshot, and launch each worker with `--no-net`; see [Warm workers](/examples/sandboxing/warm-workers).

    <Note>
      A hosted CI runner must expose KVM on Linux or run on Apple Silicon macOS. Many managed runners do not allow nested virtualization.
    </Note>
  </Step>

  <Step title="Clean up">
    ```sh theme={null}
    msb rm -f pr-check
    ```
  </Step>
</Steps>