How to Configure Windows Sandbox Local OpenBao Secrets Vault via XML in Windows 11

OpenBao—the community-driven open-source fork of HashiCorp Vault managed under the Linux Foundation—provides enterprise-grade secrets management, dynamic credential leasing, and encryption as a service. When testing infrastructure-as-code automation, developer API token rotation, or zero-trust authentication workflows, running a persistent secrets vault directly on a developer workstation risks leaving unencrypted encryption keys and sensitive token artifacts on host disks. In Windows 11, Windows Sandbox provides a pristine, isolated testing platform. By authoring custom Windows Sandbox XML (.wsb) configuration files, you can deploy a disposable OpenBao development server in seconds.

Architecture of the Disposable OpenBao Sandbox

Windows Sandbox provides a disposable, hypervisor-isolated guest environment that resets completely upon termination. To provision an automated OpenBao instance, the architecture requires:

• A mapped host folder: A directory containing the standalone bao.exe binary and a minimal development server configuration.
• A WSB configuration file: An XML blueprint that mounts the mapped directory and initiates the vault agent automatically via LogonCommand.

Authoring the Windows Sandbox WSB Blueprint

Create a working directory on your host machine, such as C:\SandboxOpenBao. Place the standalone bao.exe binary into this folder, then create RunOpenBao.wsb with the following XML code:

<Configuration>
  <VGpu>Default</VGpu>
  <Networking>Default</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\SandboxOpenBao</HostFolder>
      <SandboxFolder>C:\BaoFiles</SandboxFolder>
      <ReadOnly>false</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\BaoFiles\Start-OpenBao.ps1</Command>
  </LogonCommand>
</Configuration>

Authoring OpenBao Startup Script

Inside the mapped host folder (C:\SandboxOpenBao), create the PowerShell initialization script named Start-OpenBao.ps1:

Write-Host "=============================================" -ForegroundColor Cyan
Write-Host " Starting OpenBao Secrets Vault in Sandbox.. " -ForegroundColor Green
Write-Host " API Endpoint: http://127.0.0.1:8200         " -ForegroundColor Yellow
Write-Host " Root Token:   root                          " -ForegroundColor Yellow
Write-Host "=============================================" -ForegroundColor Cyan

# Set environment variables for local CLI tools
$env:BAO_ADDR = "http://127.0.0.1:8200"
$env:BAO_TOKEN = "root"

# Launch OpenBao in dev mode with pre-configured root token
& "C:\BaoFiles\bao.exe" server -dev -dev-root-token-id="root" -dev-listen-address="0.0.0.0:8200"

Running and Validating Secrets in the Sandbox

Double-click RunOpenBao.wsb on your Windows 11 host. Windows Sandbox boots up, mounts the mapped folder, and immediately launches OpenBao inside an interactive PowerShell window.

The vault begins listening on port 8200 with an unsealed in-memory transit engine. Open Microsoft Edge inside the sandbox and navigate to http://127.0.0.1:8200/ui to access the OpenBao web console, logging in with root token root.

You can write test secrets, configure AppRole authentication, issue dynamic database credentials, and test PKI certificate authorities in total isolation. When testing concludes, closing the sandbox window instantly eliminates all encryption keys, unsealed memory pages, and server processes, leaving your host workstation completely clean and unburdened.