How to Configure Windows Sandbox Automated Winget Package Installation via XML in Windows 11

Windows Sandbox provides a pristine, isolated Hyper-V desktop for evaluating untrusted applications, testing software installations, and reproducing clean-room bugs. However, because Windows Sandbox resets to a bare Windows 11 image on every launch, developers frequently spend valuable minutes repeatedly downloading essential utilities—such as Git, Visual Studio Code, 7-Zip, or Node.js. While the Windows Package Manager (winget) is not installed by default in the sandbox’s lightweight OS image, it can be automatically bootstrapped upon startup via a .wsb XML configuration file and PowerShell logon script. This guide details how to automate package provisioning in Windows Sandbox.

The Architecture of Winget Bootstrapping in Windows Sandbox

Windows Sandbox boots from a specialized stripped-down system image that excludes the Microsoft Store and pre-packaged AppX bundles. To run winget inside the sandbox, the provisioning script downloads the Microsoft.UI.Xaml dependency, the VCLibs desktop framework, and the latest Microsoft.DesktopAppInstaller bundle from GitHub releases, registering them silently via Add-AppxPackage. Once registered, standard winget install commands execute silently to install desired toolchains.

Structuring Host Folders and Assets

Create a dedicated automation folder on your Windows 11 host (for example, C:\SandboxWinget):

C:\SandboxWinget\
├── Install-WingetAndApps.ps1
└── Winget_Sandbox.wsb

Authoring the Winget Provisioning Script

Save the following PowerShell script as C:\SandboxWinget\Install-WingetAndApps.ps1. This script bootstraps the AppInstaller framework and installs developer utilities:

# Install-WingetAndApps.ps1 - Automated Winget Provisioning
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Write-Host "Bootstrapping Windows Package Manager (winget)..." -ForegroundColor Cyan

# 1. Download and install prerequisites
$WorkDir = "C:\SandboxBootstrap"
New-Item -ItemType Directory -Path $WorkDir -Force | Out-Null

$VCLibsUrl = "https://aka.ms/Microsoft.VCLibs.x64.14.00.Desktop.appx"
$XamlUrl = "https://github.com/microsoft/microsoft-ui-xaml/releases/download/v2.8.6/Microsoft.UI.Xaml.2.8.x64.appx"
$WingetUrl = "https://github.com/microsoft/winget-cli/releases/latest/download/Microsoft.DesktopAppInstaller_8wekyb3d8bbwe.msixbundle"

Invoke-WebRequest -Uri $VCLibsUrl -OutFile "$WorkDir\VCLibs.appx"
Invoke-WebRequest -Uri $XamlUrl -OutFile "$WorkDir\Xaml.appx"
Invoke-WebRequest -Uri $WingetUrl -OutFile "$WorkDir\AppInstaller.msixbundle"

Add-AppxPackage "$WorkDir\VCLibs.appx"
Add-AppxPackage "$WorkDir\Xaml.appx"
Add-AppxPackage "$WorkDir\AppInstaller.msixbundle"

# 2. Add winget to session PATH
$env:PATH = "$env:LOCALAPPDATA\Microsoft\WindowsApps;" + $env:PATH

Write-Host "Winget registered successfully!" -ForegroundColor Green

# 3. Silently install requested development packages
$Packages = @(
    "Git.Git",
    "7zip.7zip",
    "Microsoft.VisualStudioCode"
)

foreach ($Pkg in $Packages) {
    Write-Host "Installing $Pkg via winget..." -ForegroundColor Yellow
    winget install --id $Pkg --exact --silent --accept-package-agreements --accept-source-agreements
}

Write-Host "Environment provisioning complete. Ready for development!" -ForegroundColor Green

Creating the WSB Configuration File

Create Winget_Sandbox.wsb with mapped folder access and automated script execution:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\SandboxWinget</HostFolder>
      <SandboxFolder>C:\SandboxScripts</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\SandboxScripts\Install-WingetAndApps.ps1</Command>
  </LogonCommand>
</Configuration>

Running and Auditing Automated Tooling Provisioning

1. Double-click Winget_Sandbox.wsb on your Windows 11 workstation.
2. Windows Sandbox spins up in seconds, launches PowerShell, and executes the bootstrapping script.
3. The script registers the AppInstaller framework and silently installs Git, 7-Zip, and VS Code.
4. All applications appear in the sandbox Start Menu and are immediately accessible from the command line.
5. When you close the sandbox, all installed software, cache files, and registry entries are purged completely, leaving your host machine unmodified.