smolmachines / smolvm emerges as a secure sandbox for untrusted Python & JavaScript

smolvm, or smolmachines, is a new system built to safely isolate untrusted Python and JavaScript code. It’s especially useful for handling user-provided data jobs. This tool uses hardware-isolated virtual machines for security that’s tougher than standard containers. It sets firm boundaries on resources, network use, and filesystem permissions. The project’s features were recently evaluated, which needed a smart move to GitHub Actions after the first test setting posed a problem.

Key takeaways

• smolvm is a secure sandbox for running untrusted Python and JavaScript code.
• It uses hardware-isolated VMs for stronger security than container-based approaches.
• Key features include no network access, strict CPU/RAM limits, and controlled storage mounts.
• Testing revealed cold starts of 0.6-1.5 seconds and warm executions around 50ms.
• Initial testing failed due to a lack of nested virtualization, but succeeded using GitHub Actions runners.

Core Capabilities and Security Architecture

smolvm is built specifically to isolate untrusted Python and JavaScript code. It focuses on running user-provided data transformation jobs. It does this by using hardware-isolated virtual machines, which offer stronger security separation than shared-kernel container methods.

Key Security Features

The system applies a firm security model. Execution happens with no network access and uses offline local images. The sandbox sets strict CPU and RAM limits to control resource use, plus guest-enforced timeouts for extra control.

Storage access is tightly managed through quotas, read-only input mounts for specific files, and writable output mounts. The design also supports an –unprivileged mode for running with lower privileges. Testing of smolvm 1.8.3 verified these features, including CPU/RAM limits and storage controls, worked correctly.

Performance and Practical Testing

Tests with smolvm version 1.8.3 showed cold start times of about 0.6 to 1.5 seconds. Warm executions were much quicker at roughly 50 milliseconds. The research goal was to assess smolvm’s fit for running user-provided Python and JavaScript code with firm resource and access limits. These included CPU and RAM constraints, no network access, and filesystem access only to specific input and output mounts.

Overcoming Environmental Hurdles

First attempts to test in the Claude Code for web environment didn’t work. The container, which was itself a Firecracker guest, had no nested virtualization support. Missing the /dev/kvm device and vmx/svm CPU flags caused smolvm execution to stop. The fix was to move testing to GitHub Actions’ Ubuntu runners, which do provide /dev/kvm. This let the full set of tests run.

Overcoming Environmental Constraints with GitHub Actions

When asked to test smolvm in the Claude Code for web environment, the Claude Fable 5 agent hit a major obstacle. It found the Claude Code container, also a Firecracker guest, lacked the required /dev/kvm device and CPU virtualization flags. This stopped the nested virtualization needed to run smolvm machines.

Devising a ‘Plan B’

The agent created a different strategy. It saw that GitHub Actions’ Ubuntu runners do grant access to /dev/kvm, enabling hardware virtualization. To use this, the agent ran the practical test suite by making a short-term GitHub Actions workflow on a repository branch.

This forward-thinking solution required installing smolvm and executing the complete test group directly inside the GitHub Actions runner on that branch. After gathering the required logs, the agent deleted the temporary workflow in the final commit. This approach effectively bypassed the environmental restrictions, letting the agent finish its assessment of smolvm’s isolation features.