James Stringer
5674a4c66d
### Added - **Windows on ARM (ARM64).** App Sandbox now runs on ARM64 Windows PCs and can create **ARM Windows 11 VMs with GPU-PV** — paravirtualized GPU acceleration in the guest. ### Fixed - **Hardware OpenGL in Windows VMs.** OpenGL apps in the guest were stuck on Windows' GDI Generic software renderer (OpenGL 1.1) — apps needing OpenGL 4.3+ (e.g. Blender) refused to start. The old approach selected Microsoft's OpenGLOn12 driver via an AppInit DLL, but Windows disables AppInit DLLs when Secure Boot is on — and App Sandbox runs guests with Secure Boot on by default — so it never engaged (and even when it did, Windows' opengl32 dropped the GPU driver across the virtual GPU's render/display split). App Sandbox now installs the Mesa OpenGL driver directly into the guest, taking Windows' broken opengl32 out of the path, so apps get real GPU-accelerated OpenGL 4.6 (or software 4.6 with no GPU) — with Secure Boot left on. - **New VMs could fail to start with an odd memory size.** HCS (Windows' Host Compute Service) requires VM memory to be a multiple of 2 MB; the suggested default (half the host RAM) or a manually entered value could be odd (e.g. 7991 MB) and fail to start. RAM is now rounded to an even value in the suggested default, the create form, and inline edits. - **New Sandbox dialog no longer closes by accident.** Selecting text in a field and releasing the mouse outside the dialog no longer dismisses it. - Various stability and bug fixes across the Windows, macOS, and Linux components. ### Known issues - **x64 (emulated) apps in ARM Windows VMs don't get the OpenGL fix.** The Mesa driver shipped on ARM is ARM64-only, so emulated x64 apps fall back to the old renderer; native ARM64 apps get full GPU OpenGL. - **ARM Linux (Ubuntu 26.04 LTS) guests do not work in this release — on ARM, Windows is the only guest that works.** Ubuntu 26.04's arm64 kernel constantly churns BPF JIT memory, which makes the kernel boot extremely slowly and never reach the Ubuntu desktop. On a Qualcomm Snapdragon X1-Plus (ASUS A14) using 25H2, the guest never came up and the App Sandbox agent never came online.
App Sandbox
App Sandbox is a virtual machine app for Windows and macOS that's focused on performance and ease of use.
Windows features:
- Works on Windows 11 Home or Pro, without Hyper-V
- Windows 11 or Ubuntu 26.04 LTS VM Support
- Zero touch install
- Copy and Paste
- 2 Channel Audio
- GPU Acceleration via Paravirtualization (GPU-PV) with support for DirectX 12 (Windows only), OpenGL, Vulkan, CUDA, OpenCL
- GPU Hardware Video Decoder/Encoder support
- SSH via Hyper-V socket proxy (no network required)
- Snapshots
- Fixed 1080P60 display
- Host to client hot-key support
- Provision and boot with / without internet
- Supports running Claude Cowork and Docker inside the VM thanks to Nested Virtualization Support
Mac features:
- macOS VM support
- Skips most of the install setup process
- Copy and Paste
- 2 Channel Audio
- GPU Acceleration via Paravirtualization with support for Metal
- SSH via virtio-vsock (no network required)
- Dynamic display sizing
- Provision and boot with / without internet
Requirements: Windows 11 with an x64 Processor or macOS Tahoe (M Series)
About App Sandbox
App Sandbox creates and runs full desktop virtual machines — Windows 11, Ubuntu, and macOS. It is free, open-source (MIT), and distributed as prebuilt, signed releases on its Releases page. It is operated from a graphical UI: pick an OS, point it at an installer image, and App Sandbox provisions the disk, runs an unattended install, and boots the guest. You supply a Windows or Ubuntu ISO; macOS guests download their restore image automatically. It runs on a Windows 11 (x64) PC or an Apple Silicon Mac, including laptops.
Runs on Windows 11 Home, without Hyper-V. On Windows, App Sandbox does not use Hyper-V or Hyper-V Manager; it creates and runs VMs through the Windows Host Compute System (HCS) and Host Compute Network (HCN) APIs, which require only the Virtual Machine Platform feature. Hyper-V is limited to Windows 11 Pro and Enterprise, while Virtual Machine Platform is available on Windows 11 Home, so a Windows 11 Pro license is not required. Virtual Machine Platform is the same Windows feature WSL2 uses.
What you can use it for:
- A fresh Windows or Ubuntu VM for building and testing your own software on a clean OS install.
- Running a program in a VM, kept separate from your main OS and files.
- Developing and testing Windows drivers: a built-in Test Mode enables test-signing inside the guest, so the host's Secure Boot and boot configuration are left unchanged.
- Running a computer-use AI agent (such as Claude's computer use model) in its own VM, so it has a desktop to work in without taking over your own. Several agents can run at once, each in its own VM, on a single laptop or desktop.
- Creating GPU-accelerated (GPU-PV) VMs from a native-app GUI.
How it works: this repo also aims to be a working example of creating full desktop VMs
programmatically with the Windows HCS/HCN APIs and Apple's Virtualization.framework. On
Windows, App Sandbox submits a hand-built HCS machine document to computecore.dll /
computenetwork.dll — the HCS/HCN layer that also underlies WSL2 and Windows Sandbox —
rather than going through Hyper-V Manager. GPU acceleration uses GPU paravirtualization
(GPU-PV) to share the host GPU with the guest, with DirectX 12, OpenGL, Vulkan, CUDA, and
OpenCL on Windows and Metal on macOS. A custom IddCx indirect display driver and a
virtual audio device carry the screen and sound, and guest↔host clipboard, audio, input,
and SSH run over Hyper-V sockets. Guest disks are built by an in-repo tool with support
for ext4, squashfs, qcow2, and VHDX. On macOS, App Sandbox uses Apple's
Virtualization.framework (VZVirtualMachine, VZMacOSInstaller) over
virtio-vsock. On Windows, Linux (Ubuntu) guests reach the GPU through a custom DRM/KMS
kernel module (asb_drm), Microsoft's WSL2 dxgkrnl, and a custom Mesa build. The apps
are native C / Objective-C with an HTML/JS UI (WebView2 on Windows, WKWebView on macOS).
Tips:
[Windows] Enable hotkeys or mute the VM audio: connect to the VM and right-click the connection title bar
[Windows] Need a high performance remote desktop to remotely access your VM? Phaze works well
[Windows] You can check if the GPU-PV driver setup is working by running gpu-test.exe inside your App Sandbox Windows VM, gpu-test.exe will show a box with 6 rotating cubes, each using a different rendering engine (D3D9, D3D10, D3D11, D3D12, OpenGL and Vulkan). If one or more fail, they will not correctly show a rotating cube for that rendering API. gpu-test.zip. Note: The rendering API succeeding means that the GPU-PV worked, but sometimes games or apps are coded in such a way that they will not detect the GPU-PV system correctly and still show an error.
License
AppSandbox is licensed under the MIT License — Copyright (c) 2026 James Stringer.
It bundles third-party components that are not covered by the MIT license and
retain their own terms — most notably the Microsoft WSL2 dxgkrnl GPU driver
(GPL-2.0) and the embedded XZ decoder (0BSD). See
THIRD-PARTY-NOTICES.md for the full list. AppSandbox's
own Linux DRM kernel module (tools/linux/asb_drm/) is dual-licensed MIT OR
GPL-2.0 so it can resolve the kernel's GPL-only symbols.
Acknowledgements
Beyond my own experience building Easy-GPU-PV, I found NanaBox to be a really helpful resource for understanding HCS.
Author
James Stringer — author of Easy-GPU-PV.