How to Configure Windows Sandbox Local Envoy Gateway via XML in Windows 11

Modern microservice networks and cloud-native service meshes rely heavily on Envoy Proxy as a high-performance, L7 edge proxy and service gateway. Envoy provides rich telemetry, dynamic configuration discovery (xDS APIs), advanced load balancing, and fine-grained HTTP routing. However, testing Envoy YAML filter chains, header manipulation rules, or rate-limiting clusters on a developer’s primary machine can be challenging without Docker or complex virtualization setups. Windows Sandbox in Windows 11 Pro and Enterprise offers an ephemeral, hardware-isolated guest instance ideal for disposable proxy testing.

By pairing automated Windows Sandbox configuration files (.wsb) with PowerShell setup scripts, developers can deploy an ephemeral Envoy proxy testing instance with a single double-click, test routing behavior thoroughly, and discard the sandbox cleanly upon exit.

Windows Sandbox Architecture and Setup Primitives

Windows Sandbox provides a pristine, virtualized Windows 11 environment powered by Microsoft’s Hyper-V hypervisor. A .wsb XML file defines container startup parameters:

• <Networking>: Must be set to Enable to download the Envoy Windows binary from official distribution channels.
• <MappedFolders>: Maps a host directory into the container to pass bootstrap scripts, YAML configuration files, and test HTML pages.
• <LogonCommand>: Automatically executes PowerShell setup scripts when the sandbox desktop loads.

Creating the Envoy Setup Script

Create a directory on your host machine (e.g., C:\Sandbox\Envoy) and save the following script as bootstrap-envoy.ps1:

# bootstrap-envoy.ps1 - Automated Envoy Proxy Setup for Windows Sandbox
$ErrorActionPreference = "Stop"

Write-Host "Configuring Envoy Sandbox Environment..." -ForegroundColor Cyan

# Install Envoy binary via winget or official release
Write-Host "Installing Envoy Proxy..." -ForegroundColor Yellow
winget install EnvoyProxy.Envoy --silent --accept-package-agreements --accept-source-agreements

# Refresh environment variables
$env:Path = [System.Environment]::GetEnvironmentVariable("Path","Machine") + ";" + [System.Environment]::GetEnvironmentVariable("Path","User")

# Define Envoy working directory
$envoyDir = "C:\EnvoyApp"
New-Item -ItemType Directory -Path $envoyDir -Force
Set-Location $envoyDir

# Author basic Envoy configuration (envoy.yaml)
$envoyYaml = @"
static_resources:
  listeners:
  - name: listener_0
    address:
      socket_address:
        address: 0.0.0.0
        port_value: 10000
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: ingress_http
          route_config:
            name: local_route
            virtual_hosts:
            - name: local_service
              domains: ["*"]
              routes:
              - match:
                  prefix: "/"
                route:
                  host_rewrite_literal: httpbin.org
                  cluster: service_httpbin
          http_filters:
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
  clusters:
  - name: service_httpbin
    type: LOGICAL_DNS
    dns_lookup_family: V4_ONLY
    load_assignment:
      cluster_name: service_httpbin
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: httpbin.org
                port_value: 80
"@
$envoyYaml | Out-File -FilePath "$envoyDir\envoy.yaml" -Encoding utf8

# Launch Envoy in background
Write-Host "Starting Envoy proxy on port 10000..." -ForegroundColor Green
Start-Process "envoy.exe" -ArgumentList "-c C:/EnvoyApp/envoy.yaml" -WorkingDirectory $envoyDir

# Open Edge to verify endpoint
Start-Sleep -Seconds 3
Start-Process "msedge.exe" -ArgumentList "http://localhost:10000/get"

Authoring the Windows Sandbox WSB File

In the same folder, author the configuration file named EnvoySandbox.wsb:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Enable</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\Sandbox\Envoy</HostFolder>
      <SandboxFolder>C:\EnvoySetup</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\EnvoySetup\bootstrap-envoy.ps1</Command>
  </LogonCommand>
</Configuration>

Running and Testing Envoy Inside the Sandbox

1. Double-click EnvoySandbox.wsb on your Windows 11 host.
2. Windows Sandbox initializes, maps the configuration folder, and executes the PowerShell setup script.
3. Envoy is installed silently, configured with the YAML routing file, and started on port 10000.
4. Microsoft Edge launches automatically displaying the proxied JSON response from upstream.
5. When finished, close the Sandbox window; all temporary proxy configurations and logs are instantly purged.

This automated workflow provides an efficient, clean environment for testing Envoy proxy configurations on Windows 11 without impacting your host development system.