Proposal: Unified Sandboxed Application Distribution for Windows

[Lubi (Lubi-git)]

Note: English is not my native language, so I used AI assistance to help with the writing and proofreading of this proposal. The ideas and technical direction are my own. I apologize for any inconvenience this may cause, and thank you for taking the time to read and consider the proposal.

Summary

Windows provides several technologies for application packaging, dependency management, runtime sharing, and process isolation, including MSIX, Framework Packages, Dynamic Dependencies, and AppContainer.

This proposal explores whether these capabilities could be combined into a coherent, supported distribution and execution model for sandboxed desktop applications, including Win32 applications.

The objective is not to introduce a new packaging format, package manager, compatibility layer, or virtualization technology. Instead, it is to explore a Windows-native application model that brings existing deployment, dependency, and isolation capabilities together into a consistent application experience.

Motivation

Desktop applications can depend heavily on the state of the host operating system. Shared libraries, runtimes, system-wide components, and broad process privileges can introduce compatibility, maintenance, and security concerns.

Modern application distribution models such as Flatpak demonstrate an alternative approach in which applications can be distributed together with defined runtime dependencies and an explicit isolation boundary.

The relevant concept here is not the Flatpak implementation itself, but the separation between:

• the application and the host system;
• application dependencies and globally installed components;
• application functionality and unnecessary system privileges.

Windows already provides technologies addressing several of these areas. However, these capabilities currently exist as distinct parts of the platform rather than as a single application distribution model.

Proposed Direction

This proposal explores a unified sandboxed application model built around existing Windows infrastructure.

Such a model could provide applications with:

• isolated execution;
• explicitly defined system capabilities;
• versioned and reusable runtime dependencies;
• predictable dependency resolution;
• standard installation, updating, and removal.

Relevant existing Windows technologies include:

• MSIX — application packaging and deployment;
• Framework Packages — shared and versioned runtime components;
• Dynamic Dependencies — runtime dependency resolution;
• AppContainer and the Windows security model — application isolation and restricted resource access.

The focus is therefore on whether these capabilities could be integrated into a coherent application model and developer experience, rather than on creating equivalent infrastructure independently.

Native Windows Execution

A defining characteristic of the proposed model is that applications would remain native Windows applications.

The model would not require:

• a Linux userspace;
• WSL;
• virtual machines;
• a separate operating system environment;
• or another application compatibility layer.

Applications would continue to execute using the Windows kernel and Windows APIs while using the platform's native application deployment and security mechanisms.

This distinguishes the proposal from approaches that provide Linux application sandboxing on Windows by running an additional operating-system environment.

Application Compatibility

The model could serve as an additional deployment option rather than a replacement for traditional Win32 applications.

Applications requiring broad system access, drivers, services, or other privileged functionality could continue using conventional deployment models.

Applications primarily requiring user-level functionality could instead target a sandboxed distribution model with more controlled dependencies and system access.

This would allow different applications to choose an appropriate security and deployment model without requiring a single model for the entire Windows application ecosystem.

Distribution

The proposed model could remain compatible with existing Windows distribution infrastructure rather than requiring a separate ecosystem.

Potential distribution mechanisms include:

• Microsoft Store;
• WinGet;
• enterprise deployment infrastructure;
• direct developer distribution;
• private or organizational package repositories.

The proposal treats application distribution and application execution/isolation as related but distinct concerns. A sandboxed application model could therefore potentially be supported through multiple existing distribution channels.

Relationship to Existing Technologies

This proposal does not seek to replace existing Windows technologies.

Instead, it explores whether their relevant capabilities could form a higher-level application model:

                    Windows Application
                           │
             ┌─────────────┼─────────────┐
             │             │             │
          Package       Runtime       Isolation
             │             │             │
            MSIX      Frameworks    AppContainer
             │             │             │
             └─────────────┼─────────────┘
                           │
                    Windows Platform

The specific APIs, contracts, manifests, capability model, dependency semantics, and implementation details would be determined according to the requirements and architecture of the Windows platform.

Relationship to Flatpak

Flatpak is referenced as an example of an application distribution model that combines application packaging, runtimes, dependency management, and sandboxing.

This proposal does not suggest porting Flatpak to Windows or adopting its implementation.

Instead, it asks whether Windows could provide comparable application-distribution properties using its own native packaging, dependency, deployment, and security infrastructure.

Potential Benefits

If technically and architecturally feasible, such a model could provide:

Security

• Reduced application attack surface.
• Clearer boundaries between applications and the host system.
• Reduced need for unrestricted privileges in ordinary desktop software.

Reliability

• More predictable runtime dependencies.
• Reduced dependency conflicts between applications.
• Less reliance on globally installed application components.

Deployment

• Cleaner application installation and removal.
• More consistent application updates.
• Reusable and versioned runtime components.

Ecosystem

• A standardized security target for desktop application developers.
• An additional deployment option for existing Win32 software.
• A path toward stronger application isolation without requiring virtualization or abandoning native Windows APIs.

Scope

This proposal is intentionally focused on the platform-level concept rather than prescribing a particular implementation.

It does not require:

• a new executable format;
• a new package format;
• a new package manager;
• a new repository system;
• replacement of Win32;
• replacement of MSIX;
• replacement of WinGet;
• replacement of the Microsoft Store;
• or virtualization.

The central question is whether the existing Windows packaging, dependency, deployment, and isolation capabilities could be exposed and integrated as a coherent model for distributing and executing sandboxed desktop applications.

Closing

Windows already provides distinct mechanisms for application packaging, runtime dependencies, deployment, and process isolation.

This proposal explores whether bringing these capabilities together could provide an additional application model for software that benefits from stronger isolation and more predictable dependencies while remaining fully native to Windows.

The purpose of this proposal is to gather feedback on the concept, its technical feasibility, its architectural fit, and whether such a model could provide meaningful value to Windows developers and users.

[Kevin Gallahan (kmgallahan)]

https://xkcd.com/927/

[Lubi (Lubi-git)]

Okay, got me hahaha. But I don't mean a standard like that. It's just about combining technologies that already exist in the Windows ecosystem to create an official solution.