How to Configure Windows Sandbox Local HashiCorp Vault Server via XML in Windows 11

When engineering secure cloud-native architectures, developing microservices, or building automated infrastructure pipelines, validating secret injection workflows (such as dynamic database credentials, encryption-as-a-service, or PKI certificate issuance) against a production HashiCorp Vault cluster introduces security and auditing risks. Running a local Vault dev server directly on a primary developer workstation leaves sensitive test secrets, tokens, and storage files lingering in user directories. Windows Sandbox offers an ephemeral, isolated Hyper-V environment that boots pristine and self-destructs upon closure. This guide demonstrates how to configure an automated Vault development server inside Windows Sandbox via WSB XML.

The Architecture of an Ephemeral Vault Sandbox

Windows Sandbox operates in a lightweight virtual machine attached to the host via Hyper-V NAT. By mapping a host folder containing the portable Vault Windows binary (vault.exe) and an automated provisioning PowerShell script via <MappedFolders>, the sandbox launches Vault in development mode (vault server -dev). This initializes an in-memory secret engine, outputs an unseal key and root token, and exposes the Vault Web UI on port 8200.

Structuring Host Folders and Assets

Create a dedicated configuration directory on your Windows 11 host (for example, C:\SandboxVault):

C:\SandboxVault\
├── vault.exe
├── Start-Vault.ps1
└── Vault_Sandbox.wsb

Authoring the Automated Vault Provisioning Script

Save the following PowerShell script as C:\SandboxVault\Start-Vault.ps1. This script launches Vault dev mode and opens the Web UI:

# Start-Vault.ps1 - Automated HashiCorp Vault Development Server
param (
    [string]$VaultDir = "C:\SandboxAssets"
)

Write-Host "Initialising HashiCorp Vault inside Windows Sandbox..." -ForegroundColor Cyan

$VaultExe = Join-Path $VaultDir "vault.exe"
if (-not (Test-Path $VaultExe)) {
    Write-Warning "vault.exe not found at: $VaultExe"
    Exit 1
}

# 1. Add Vault to session PATH
$env:PATH = "$VaultDir;" + $env:PATH
$env:VAULT_ADDR = "http://127.0.0.1:8200"

# 2. Start Vault Dev Server in background
$DevRootToken = "sandbox-root-token-dev"
$VaultProcess = Start-Process $VaultExe -ArgumentList "server", "-dev", "-dev-root-token-id=$DevRootToken", "-dev-listen-address=0.0.0.0:8200" -PassThru -NoNewWindow

Start-Sleep -Seconds 3

# 3. Enable Key-Value Version 2 Secrets Engine
& $VaultExe secrets enable -path=secret kv-v2 | Out-Null
& $VaultExe kv put secret/app/config environment="sandbox" api_key="secret-key-12345" | Out-Null

Write-Host "==========================================" -ForegroundColor Green
Write-Host "Vault Server is LIVE at http://127.0.0.1:8200" -ForegroundColor Green
Write-Host "Root Token: $DevRootToken" -ForegroundColor Yellow
Write-Host "Sample Secret written to: secret/app/config" -ForegroundColor Cyan
Write-Host "==========================================" -ForegroundColor Green

# 4. Launch Edge to open Vault Web UI
Start-Process "msedge.exe" "http://127.0.0.1:8200/ui"

# Keep server alive
Wait-Process -Id $VaultProcess.Id

Creating the WSB XML Configuration

Create Vault_Sandbox.wsb to mount the assets folder and execute the setup script upon launch:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\SandboxVault</HostFolder>
      <SandboxFolder>C:\SandboxAssets</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\SandboxAssets\Start-Vault.ps1 -VaultDir C:\SandboxAssets</Command>
  </LogonCommand>
</Configuration>

Running and Auditing Ephemeral Secrets Management

1. Double-click Vault_Sandbox.wsb on your Windows 11 host.
2. Windows Sandbox spins up in seconds, launches PowerShell, starts Vault in in-memory dev mode, and mounts the KV-v2 engine.
3. Microsoft Edge opens automatically at http://127.0.0.1:8200/ui.
4. Log in with the root token (sandbox-root-token-dev) to inspect and test secret engines, transit encryption, and authentication methods.
5. When testing is finished, close the sandbox window. All memory-stored tokens, encryption keys, and secrets are instantly purged without touching host storage.