How to Configure Windows Sandbox Local Emissary-ingress API Gateway via XML in Windows 11

Modern Kubernetes microservice architectures frequently deploy Emissary-ingress (formerly Ambassador API Gateway) as a cloud-native ingress controller and API gateway built on Envoy Proxy. Emissary provides comprehensive routing, declarative CRD management, automatic TLS termination, rate limiting, and Developer Portal integrations. When designing or debugging declarative mapping configurations or testing upstream proxy rules, developers often want to validate routing definitions without deploying them to a remote Kubernetes cluster or altering local development environments. Windows Sandbox in Windows 11 Pro and Enterprise provides an ephemeral, hardware-isolated guest instance ideal for disposable API gateway testing.

By pairing automated Windows Sandbox configuration files (.wsb) with PowerShell setup scripts, developers can spin up an ephemeral Emissary testing sandbox with a single double-click, validate API mappings thoroughly, and discard the environment cleanly upon exit.

Windows Sandbox Architecture and Setup Primitives

Windows Sandbox provides a pristine, virtualized Windows 11 environment powered by Microsoft’s Hyper-V hypervisor. A .wsb XML file configures container parameters:

• <Networking>: Must be set to Enable to download the portable Emissary/Envoy standalone tools.
• <MappedFolders>: Maps a host directory into the container to supply bootstrap scripts, mapping YAML files, and test payloads.
• <LogonCommand>: Automatically executes PowerShell setup scripts when the sandbox desktop loads.

Creating the Emissary Automated Setup Script

Create a directory on your host machine (e.g., C:\Sandbox\Emissary) and save the following script as bootstrap-emissary.ps1:

# bootstrap-emissary.ps1 - Automated Emissary Setup for Windows Sandbox
$ErrorActionPreference = "Stop"

Write-Host "Configuring Emissary Sandbox Environment..." -ForegroundColor Cyan

# Install Envoy / Emissary standalone binary via winget
Write-Host "Installing Envoy Core for Emissary testing..." -ForegroundColor Yellow
winget install EnvoyProxy.Envoy --silent --accept-package-agreements --accept-source-agreements

# Refresh environment variables
$env:Path = [System.Environment]::GetEnvironmentVariable("Path","Machine") + ";" + [System.Environment]::GetEnvironmentVariable("Path","User")

# Define Emissary working directory
$emissaryDir = "C:\EmissaryApp"
New-Item -ItemType Directory -Path $emissaryDir -Force
Set-Location $emissaryDir

# Author declarative mapping config (emissary-config.yaml)
$emissaryYaml = @"
static_resources:
  listeners:
  - name: emissary_listener
    address:
      socket_address:
        address: 0.0.0.0
        port_value: 8080
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: emissary_ingress
          route_config:
            name: ingress_route
            virtual_hosts:
            - name: api_service
              domains: ["*"]
              routes:
              - match:
                  prefix: "/quote/"
                route:
                  host_rewrite_literal: httpbin.org
                  cluster: quote_service
          http_filters:
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
  clusters:
  - name: quote_service
    type: LOGICAL_DNS
    dns_lookup_family: V4_ONLY
    load_assignment:
      cluster_name: quote_service
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: httpbin.org
                port_value: 80
"@
$emissaryYaml | Out-File -FilePath "$emissaryDir\emissary-config.yaml" -Encoding utf8

# Launch Emissary engine in background
Write-Host "Starting Emissary gateway on port 8080..." -ForegroundColor Green
Start-Process "envoy.exe" -ArgumentList "-c C:/EmissaryApp/emissary-config.yaml" -WorkingDirectory $emissaryDir

# Open Edge to test mapped endpoint
Start-Sleep -Seconds 4
Start-Process "msedge.exe" -ArgumentList "http://localhost:8080/quote/get"

Authoring the Windows Sandbox WSB File

In the same folder, author the configuration file named EmissarySandbox.wsb:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Enable</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\Sandbox\Emissary</HostFolder>
      <SandboxFolder>C:\EmissarySetup</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\EmissarySetup\bootstrap-emissary.ps1</Command>
  </LogonCommand>
</Configuration>

Running and Testing Emissary Inside the Sandbox

1. Double-click EmissarySandbox.wsb on your Windows 11 host.
2. Windows Sandbox initializes, maps the configuration folder, and executes the PowerShell setup script.
3. Emissary is configured with the declarative mapping file and started on port 8080.
4. Microsoft Edge launches automatically displaying the proxied response from upstream.
5. When finished, close the Sandbox window; all temporary gateway configurations and logs are instantly purged.

This automated workflow provides an efficient, clean environment for testing Emissary API Gateway configurations on Windows 11 without impacting your host development system.