Is there a more convenient, yet safe, way to run DOSBox-X than I'm currently doing it?

Question

I recently learned about DOSBox-X. It's basically a somewhat less awful version of the basically-abandoned DOSBox.

I currently have it installed inside a Windows 10 VM inside of my Windows 10 bare metal PC. It's the only computer I have. If I could afford it and had the physical space, I would set up a real classic PC and not bother with any emulators.

Every time I want to play around in my "nostalgia box", I have to first fire up the Windows 10 VM. Then wait for it to fully start. Then switch to it, run DOSBox-X inside of it, and then finally start using it. Fullscreen and "Alt-tabbing" between it and programs on my hos OS is either highly impractical, or impossible. It's basically a damn chore.

It would of course be quite technically possible to install DOSBox-X on the host OS instead. Then it would (probably) allow me to "Alt-tab" between it running something in fullscreen and my host OS's programs. Great.

Only one problem with that: security. Just trusting DOSBox-X to begin with is a major deal for me, but then you explicitly read this on their own website:

DOSBox-X cannot claim to be a "secure" application. It contains a lot of code designed for performance, not security. There may be vulnerabilities, bugs, and flaws in the emulation that could permit malicious DOS executables within to cause problems or exploit bugs in the emulator to cause harm. There is no guarantee of complete containment by DOSBox-X of the guest operating system or application.

If security is a priority, then:

Do not use DOSBox-X on a secure system.

Source: https://github.com/joncampbell123/dosbox-x/blob/master/README.md#software-security-comments

This, while honest, does not make me more likely to trust it on my main OS.

You probably don't realize how big of a deal this is to me. Actually, while I'm specifically asking about DOSBox-X in this case, this question could also be made much more generic. Every single program I run on my host OS is a total security nightmare waiting to happen. A ticking bomb. Yet all the programs I do run on it are ones which logically have to run there; they cannot run in a VM for logical reasons.

How does one reasonably handle things like this? I know of "Sandboxie", but it was never able to instill any confidence with me. I wonder why this feature isn't part of Windows itself. It should be possible to "isolate" individual programs while still running them on the actual OS and not have to fiddle about with these slow and cumbersome VMs. Ironically, I don't trust Sandboxie!

I'm afraid that the answer is going to be: "you have to trust people in life or you will be unable to function whatsoever". While true, it doesn't help me feel any safer. I have a lot of personal and valuable data which I truly don't want leaked or stolen.

Answer 1

You should use Windows Sandbox. "I wonder why this feature isn't part of Windows itself.". Indeed, it has been for some years now, and is called Windows Sandbox. I run DOSBox-X from inside Windows Sandbox and it works very well.

To install Sandbox

• 1. Confirm Virtualization UEFI/BIOS for the motherboard. Check for this by opening Task Manager, go to Performance tab, then at lower right, look for "Virtualization: Enabled".
• 2. Enable Windows Sandbox from an Admin PowerShell console: Enable-WindowsOptionalFeature –FeatureName "Containers-DisposableClientVM" -All -Online -NoRestart

You will need to reboot. The Sandbox is completely secure, and opens in seconds. You can optionally use a .wsb file to customise the Sandbox (adjust the D:\0\MySandbox address that I use to suit your needs) and a startup script, put anything you want in there.

You have a couple options for installing DOSBox-X. Note in my .wsb that I keep a shared folder as read-write (written as <ReadOnly>false</ReadOnly>). This is the folder that my .wsb is in. I install my DOSBox-X into that read-write area, i.e. I install to C:\Users\WDAGUtilityAccount\Desktop\MySandbox\MyPrograms which is a folder on the host beside my Sandbox setup scripts. This way, my DOSBox-X (or other applications) and their settings persist between reboots of the Sandbox.

Alternatively, you can use Chocolatey to get DOSBox-X inside the Sandbox (you could put these lines into your startup script):

Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))

choco install DOSBox-X -y

MySandbox.wsb (you must change the D:\0\MySandbox path to suit yourself or it will complain, once set, you can just double-click on MySandbox.wsb to start the Sandbox:

<Configuration>
    <VGpu>Enable</VGpu>
    <Networking>Enable</Networking>
    <ClipboardRedirection>Enable</ClipboardRedirection>
    <ProtectedClient>Enable</ProtectedClient>
    <PrinterRedirection>Enable</PrinterRedirection>
    <MemoryInMB>0</MemoryInMB>
    <MappedFolders>
        <MappedFolder>
              <HostFolder>D:\0\MySandbox</HostFolder>
              <ReadOnly>false</ReadOnly>
        </MappedFolder>
        <MappedFolder>
              <HostFolder>C:\Users</HostFolder>
              <ReadOnly>true</ReadOnly>
        </MappedFolder>
    </MappedFolders>
    <LogonCommand>
        <Command>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -sta -WindowStyle Hidden -noprofile -executionpolicy unrestricted -file "C:\Users\WDAGUtilityAccount\Desktop\MySandbox\MySandboxStartup.ps1" </Command>
    </LogonCommand>
</Configuration>