Article · 2026-08-19 · 3 moments

smolmachines / smolvm as a sandbox for untrusted Python & JavaScript

Research: smolmachines / smolvm as a sandbox for untrusted Python & JavaScript I tasked Claude Fable 5 running in Claude Code for web with the following research task: Put https://smolmachines.com through its paces as a fast secure sandbox. Explore what it would take to use this to run untrusted Python and JavaScript code in a way that is limited in what RAM and CPU time it can take up (protection against "while true") with no network access and filesystem access only to designated fil ✦ AI generated

Read original ↗

GUEST Author HOST Simon Willison

Example◆

A creative workaround was to use GitHub Actions runners, which do expose /dev/kvm, to execute the real test battery against the branch.

To overcome the initial environment's limitation, the task was delegated to a GitHub Actions workflow, which has the required virtualization support.

transcript

Author: Plan B: GitHub Actions ubuntu runners DO expose /dev/kvm → run the real test battery via a temporary workflow on this branch, collect logs, remove workflow in final commit. And Plan B is what it did, installing smolvm and running these tests directly in a GitHub Actions runner against that branch. That was a creative solution to the environmental limits posed by Claude Code for web. Another example of Fable being relentlessly proactive.

provides context · 1

Claim◆

smolmachines/smolvm can be used as a fast, secure sandbox for running untrusted Python and JavaScript code, with resource limits (RAM, CPU time) and restricted filesystem and network access.

The research task was to evaluate smolmachines.com as a secure sandbox for executing user-provided, untrusted code with strict resource and access limits.

transcript

Author: Put https://smolmachines.com through its paces as a fast secure sandbox. Explore what it would take to use this to run untrusted Python and JavaScript code in a way that is limited in what RAM and CPU time it can take up (protection against "while true") with no network access and filesystem access only to designated files. Goal is to be able to use this to execute user-provided tasks for things like data transformations.

Fact

The Claude Code for web environment cannot run smolvm because it lacks the necessary hardware virtualization support (KVM, VMX/SVM flags) and is itself a Firecracker guest.

The initial test environment was unable to run smolvm directly due to its lack of nested virtualization capabilities.

transcript

Author: This Claude Code container: Linux 6.18.5-fc-v20 (itself a Firecracker guest), 4 vCPU, 15GB RAM. No /dev/kvm, no vmx/svm CPU flags → no nested virt. smolvm machine run fails as expected: "kvm not available".

provides context · 1rebuts · 1

Highlight slides

smolmachines/smolvm: Secure Code Sandbox✦ from: smolmachines/smolvm can be used as a fast, secure sandbox for running untrusted Python and JavaScript code, with resource limits (RAM, CPU time) and restricted filesystem and network access.GitHub Actions as Test Runner Workaround✦ from: A creative workaround was to use GitHub Actions runners, which do expose /dev/kvm, to execute the real test battery against the branch.Designed for User-Provided Code Execution✦ from: smolmachines/smolvm can be used as a fast, secure sandbox for running untrusted Python and JavaScript code, with resource limits (RAM, CPU time) and restricted filesystem and network access.Execution and Cleanup✦ from: A creative workaround was to use GitHub Actions runners, which do expose /dev/kvm, to execute the real test battery against the branch.

Related episodes

Video · Syntax

Do You Read The Code? ⟡ HTTP Gets a NEW Method ⟡ Codex Gets Sol Ultra ⌁ Syntax Weekly ⌁

→

Article · Lenny's Newsletter

Claude Code for normal people: skills, voice mode, and how to collaborate with AI

→

Video · 20VC

Jensen's Open-Weights Letter | Google Cloud Grows 82% But The Market Tanks

→