GitHub - microsoft/mxc: Policy-driven, layered isolation and containment — Blankdot