Skip to main content
Host sockets let a process inside a local sandbox talk to a service on the host. The host service can listen on a Unix socket or a Windows named pipe. Microsandbox connects it to the guest over virtio-vsock, so you do not need to open a TCP port.

​
Connect a socket

Pass the host path and the port that the guest will use:
Inside the sandbox, connect to host CID 2 on port 5000 with an AF_VSOCK socket. On Windows, pass a local named pipe instead:
Stream sockets are the default. On macOS and Linux, add /dgram when you need datagram semantics:
Datagrams are best effort and limited to 64 KiB. They require the kernel bundled with Microsandbox and are not available on Windows.

​
SDKs

Use vsock_dgram, vsockDgram, or a datagram VsockRoute when you need datagrams.

​
Limits and security

  • Host sockets work only with the local backend. Cloud and multi-tenant deployments reject them.
  • Unix socket paths must be absolute. Windows paths must point to a local named pipe.
  • Each route supports up to 256 active stream connections or datagram peers.
  • Port 123 is reserved. Port 0 and u32::MAX are not valid.
A route gives sandbox processes access to whatever the host service allows. Avoid exposing powerful services such as the Docker socket or an SSH agent unless the service has its own authentication and narrow permissions.