DotBoxD

What is DotBoxD?

A complete plugin system for .NET hosts. Untrusted plugins live in a sidecar process behind IPC (because AssemblyLoadContext is not a security boundary), while plugin-authored logic - filters, projections, batches - runs inside the host as a validated, fuel-metered sandbox that executes restricted IR, never loaded C#/IL. Everything you author is contract-first C# that source generators turn into wiring.

Why DotBoxD? The isolation-vs-latency dilemma, in three diagrams ›

Three interaction modes

Every plugin interaction is one of three shapes - pick per call site:

1 · Call the host - Services (RPC)

The host implements the contract; clients call it through a generated typed proxy. Proxy and implementation come from the same interface, so they cannot drift - and it is all generated at compile time.

Tutorial: your first service ›

2 · React to the host - event pipelines

A plugin subscribes with an ordinary Where/Select chain. The filter runs inside the host as sandboxed IR, so only matching, projected data ever crosses the wire, pushed one way (result terminals can return a reply per match).

Walkthrough: event pipelines ›

3 · Extend the host - Pushdown

A plugin ships its own batch operation that runs server-side over the host’s existing bindings, collapsing N round-trips into one validated submission - without recompiling the host.

Walkthrough: pushdown server extension ›

Modes 2 and 3 are powered by the same engine - the kernel sandbox: validated, capability-gated, fuel-metered IR. Mode 1 is a trusted, hand-written host implementation.

Install

# Full net10.0 stack - Services, the kernel sandbox, and Pushdown:
dotnet add package DotBoxD --prerelease

# Unity / netstandard2.1 service bundle:
dotnet add package DotBoxD.Services.All --prerelease

The Services and channel libraries target netstandard2.1. Unity/IL2CPP consumers must additionally use generated/static MessagePack formatters, root the generated registry, and validate their build. The Kernels and Pushdown stack targets net10.0.

Security in one line

Safe mode is the real boundary

A kernel is restricted IR (intermediate representation) that is validated, capability-gated, fuel/quota-metered, and (for compiled mode) verified before it runs - consumers never supply C#, IL, or arbitrary host calls. Trusted-plugin mode (AssemblyLoadContext) is not a sandbox. Read Sandbox caveats before deploying.

Find your path

Getting started Install, run a complete verified example in about five minutes, and pick your journey.

What is DotBoxD? (choosing a mode) The mental model - three interaction modes, one sandbox - and a decision table.

Tutorials & walkthroughs A from-scratch tutorial plus guided walkthroughs of the maintained sample - call, react, extend.

Example: GameServer An annotated tour of the maintained sample that ties all three modes together.

Security model What is and isn't a boundary - read before deploying untrusted plugins.

API reference Generated from the source of every published package.

---

DotBoxD merges the former standalone ShaRPC (RPC) and Safe-IR (kernel sandbox) projects into one contract-first runtime. It is MIT licensed.