Run isolated PR checks - Microsandbox

Boot a clean worker, transfer only committed files into it, and run the pull request's install and test commands inside the microVM. The host never executes code from the checkout.

This example uses Node.js. The same create → copy → exec shape works for other toolchains.

Run the checks

<Tooltip tip="This worker works on microsandbox cloud after omitting replace-on-create from the command."><span className="msb-badge-limited">Limited on cloud <Icon icon="circle-info" size={11} /></span></Tooltip>

<CodeGroup> ```sh macOS & Linux msb run -d --name pr-check --replace \ --cpus 2 --memory 1G --root-disk 3G --max-duration 10m \ --net-default deny \ --net-rule '[email protected]:tcp:443' \ --security restricted \ node:24.18.1-bookworm-slim -- sh -lc \ 'install -d -o node -g node /workspace; exec sleep 600' ```

powershell

msb run -d --name pr-check --replace `
  --cpus 2 --memory 1G --root-disk 3G --max-duration 10m `
  --net-default deny `
  --net-rule '[email protected]:tcp:443' `
  --security restricted `
  node:24.18.1-bookworm-slim -- sh -lc `
    'install -d -o node -g node /workspace; exec sleep 600'

</CodeGroup>

Only the npm registry is reachable. Do not pass CI secrets or mount the host checkout into this worker.

</Step> <Step title="Copy the commit"> <CodeGroup> ```sh macOS & Linux git archive HEAD | \ msb exec --stream --user node pr-check -- tar -x -C /workspace ```

powershell

git archive --format=tar --output=pr-check.tar HEAD
msb cp ./pr-check.tar pr-check:/tmp/pr-check.tar
msb exec --user node pr-check -- tar -x -f /tmp/pr-check.tar -C /workspace
Remove-Item ./pr-check.tar

</CodeGroup>

git archive excludes .git, checkout credentials, and uncommitted host files. In CI, make sure HEAD is the exact pull-request commit you intend to test.

</Step> <Step title="Install and test"> <CodeGroup> ```sh macOS & Linux msb exec --timeout 8m \ --user node --workdir /workspace \ --rlimit nproc=256 --rlimit nofile=1024 \ pr-check -- sh -lc 'npm ci && npm test' ```

powershell

msb exec --timeout 8m `
  --user node --workdir /workspace `
  --rlimit nproc=256 --rlimit nofile=1024 `
  pr-check -- sh -lc 'npm ci && npm test'

</CodeGroup>

Package lifecycle scripts and tests execute inside the microVM. Their exit code becomes the msb exec exit code, so the same command works in CI.

If the project installs from another registry, add the smallest required network rule. For fully offline checks, install reviewed dependencies once, create a snapshot, and launch each worker with --no-net; see Warm workers.

<Note> A hosted CI runner must expose KVM on Linux or run on Apple Silicon macOS. Many managed runners do not allow nested virtualization. </Note> </Step> <Step title="Clean up">

msb rm -f pr-check

</Step> </Steps>